TigerRAT's Five-Layer Anti-Analysis Stack Splits Sandbox Verdicts
A TigerRAT sample tied to Silent Chollima has sustained a five-year operational window by stacking a custom high-entropy packer, timing-based sandbox evasion, a falsified 1998 PE timestamp, and a VMware process masquerade. The combination successfully deceived at least one production sandbox while routing C2 traffic over deliberately malformed HTTP to an obscure German autonomous system with no prior Andariel association.
A Packer Named 'UPS' and a Timestamp From 1998: Inside TigerRAT's Anti-Analysis Hardening
A 304-kilobyte Windows executable carrying a PE compile timestamp of October 24, 1998 — a date that predates the x86-64 processor architecture the binary actually requires to run — encapsulates the operational philosophy behind the latest TigerRAT sample tied to Silent Chollima (Andariel). The falsified timestamp is not the most sophisticated trick in the sample's arsenal, but it is the most emblematic: every layer of this implant has been deliberately engineered to mislead, delay, or defeat the analysis tools that defenders rely on. CTX Team's examination of the sample (SHA-256: f78cabf7a0e7ed3ef2d1c976c1486281f56a6503354b87219b466f2f7a0b65c4) and its paired C2 endpoint reveals a five-layer anti-analysis stack that demonstrably succeeded in splitting automated sandbox verdicts — and points toward an operator actively hardening a long-lived implant rather than rotating to new tooling.
The sample carries the threat label trojan.nukesped/tigerrat, with popular names nukesped, tigerrat, and zyji across detection engines. First submitted to public malware repositories on December 21, 2020, it was most recently observed on November 15, 2025 — a five-year operational window during which it accumulated only 12 total submissions from 9 unique sources, a submission density consistent with targeted, operationally disciplined deployment rather than broad commodity distribution. The C2 endpoint, 193.56.28.251, sits in AS200373 (3xK Tech GmbH), a small RIPE-allocated autonomous system that is an unusual infrastructure choice for a DPRK-attributed actor and one that warrants its own analytical attention.
The 'UPS' Section: A Custom Packer Wearing a Familiar Name
The most structurally distinctive feature of this sample is a PE section named UPS — a name that superficially evokes the commodity UPX packer familiar to any malware analyst, but which behaves nothing like it. At 186,880 bytes, the UPS section is the dominant section by raw size in the 304 KB binary, and it registers an entropy of 7.37 — near the theoretical maximum of 8.0 for a uniformly random byte distribution. This is the compressed or encrypted payload stub: the actual TigerRAT code lives inside it, unpacked at runtime.
The tell that distinguishes this from a standard UPX-packed binary is the import table. The sample carries an import count of zero. A UPX-packed executable retains a minimal import table pointing to the loader stubs; this binary resolves every Windows API call dynamically at runtime after the UPS section unpacks itself [T1106]. The imphash 7a9844c5dcf364365fc67da601e8b69c reflects this zeroed import table — it cannot be used to cluster this sample with builder siblings via traditional imphash pivoting, which is itself an analytical inconvenience the operators may have intended. The build provenance dossier records the vhash as 035066651d15555077z50054nz5fz and the ssdeep fuzzy hash as 6144:xdrcJT7fHcr9Bxj07xWnEzEjw3Nn9PztiVeE99Qn00E6m/bpPGuUKqSIq:xdI8mInMEjw3NRztiVe5ERHqSI, providing structural similarity anchors for future sample matching even in the absence of a useful imphash.
The remaining PE sections tell a different story. The .text section — the actual compiled code visible after unpacking — sits at entropy 6.43 across 64,000 bytes, a normal range for compiled x86-64 code. The .rdata section (45,568 bytes, entropy 4.27) and .data section (7,168 bytes, entropy 3.22) are similarly unremarkable. The contrast between the flat, low-entropy legitimate sections and the near-maximum-entropy UPS stub is the structural fingerprint of a runtime-unpacking loader: the packer section is the only part that needs to be opaque to static analysis, and it achieves that opacity comprehensively.
The YARA rule win_tiger_rat_auto (from the Malpedia ruleset authored by Felix Bilstein) fires on this sample, providing a named, community-validated signature tie to the TigerRAT family. This rule hit, combined with the sandbox family attribution to AndarielLoader from the C2AE sandbox, establishes the family identification on two independent detection axes — static signature and dynamic behavioral classification.
Five Evasion Layers and a Split Verdict
The anti-analysis stack does not stop at the packer. Four additional evasion mechanisms are layered into the sample's behavioral profile, and their combined effect is demonstrable: Zenbox returned a CLEAN verdict with confidence 3, while C2AE and DAS-Security Orcas both returned malicious classifications. A production sandbox environment was successfully deceived. That outcome is not incidental — it is the design goal.
Timing and environment checks. The VirusTotal behavioral tags detect-debug-environment, long-sleeps, direct-cpu-clock-access, and idle map directly to MITRE T1497.002 (User Activity Based Checks) and T1497.003 (Time Based Checks). The direct-cpu-clock-access tag indicates the sample is using low-level timing primitives — consistent with GetTickCount or GetSystemTimeAsFileTime-style calls — to measure elapsed time before and after sleep intervals. Sandbox environments that accelerate the system clock to compress analysis windows will produce timing deltas that diverge from what the implant expects on a real host; when that divergence is detected, the implant can suppress its malicious behavior entirely. The long-sleeps tag indicates extended dormancy periods designed to outlast automated analysis windows that terminate after a fixed interval. The idle tag suggests the sample may also monitor for signs of genuine user activity — mouse movement, keystrokes, foreground window changes — before proceeding, consistent with T1497.002's user-activity-based check pattern.
This combination — timing checks plus user-activity checks plus debugger detection — is a three-pronged sandbox evasion stack. Any one of these mechanisms might fool a given sandbox; all three together explain why Zenbox, which apparently did not trigger the sample's activity thresholds, returned a clean verdict while the other two environments did.
Backdated PE timestamp. The compile timestamp embedded in the PE header reads 1998-10-24. The binary is a PE32+ executable targeting the x86-64 architecture — a processor family that did not exist until 2003. The timestamp is therefore physically impossible as a genuine compile date and represents a deliberate falsification [T1562.001]. The operational purpose is forensic disruption: timeline reconstruction tools that sort samples by compile date, or that use compile timestamps to cluster related binaries within a build window, will misplace this sample by more than two decades. Analysts relying on automated timeline correlation without manual timestamp validation will draw incorrect conclusions about when this binary was built relative to other campaign artifacts.
VMware process masquerade. One of the recorded deployment names for this sample is vmware-vmx-gui.exe — the name of a legitimate VMware virtual machine executable process [T1036]. An analyst or EDR alert reviewing a process list on a host running VMware infrastructure would see a plausible, expected process name. The masquerade is not sophisticated in isolation — process name spoofing is a well-documented technique — but in combination with the packer, the zeroed import table, and the behavioral evasion, it forms part of a coherent identity-concealment strategy: the binary looks like a legitimate VMware component at the filesystem level, behaves like an idle process at the sandbox level, and presents no static import signatures at the analysis level.
Zeroed import table. As noted above, the import count of zero means that static analysis tools relying on import-table inspection to identify API usage patterns — a foundational technique for rapid malware triage — return no useful signal from this binary. Every API call is resolved at runtime after the UPS section unpacks, making the pre-execution binary opaque to import-based detection and clustering.
The industry detection ratio of 53 out of 76 engines reflects the partial success of these evasion measures. Engines that miss this sample include SentinelOne, Webroot, ZoneAlarm, Zoner, NANO-Antivirus, and Trapmine, among others. Seventeen engines return undetected, and one timed out — consistent with the long-sleep evasion causing analysis timeouts in dynamic-scan pipelines. The community vote stands at one malicious, zero harmless, with a reputation score of -1.
The C2 Protocol: Breaking HTTP on Purpose
The network behavior of TigerRAT in this sample is as deliberately anomalous as its file-level characteristics. The C2 check-in to 193.56.28.251 triggered four IDS rules simultaneously, and the combination reveals a C2 channel engineered to violate standard HTTP semantics rather than simply tunnel over them.
The high-severity rule ET MALWARE Andariel Backdoor Activity (Checkin) from the Proofpoint Emerging Threats Open ruleset fired — this is the family-specific signature, a direct named identification of the Andariel backdoor check-in pattern. But the three corroborating Suricata and Snort rules are analytically more interesting: (http_inspect) server response before client request, SURICATA HTTP Request line incomplete, and SURICATA Applayer Detect protocol only one direction. These are protocol-decode anomaly rules, not malware-family signatures. They fire when the observed traffic violates the fundamental ordering and structure of the HTTP protocol.
Server response before client request means the C2 server sent data to the implant before the implant sent a well-formed HTTP request — the reverse of normal HTTP interaction. HTTP Request line incomplete means the implant's outbound communication does not conform to the METHOD URI HTTP/VERSION structure that HTTP parsers expect. Applayer Detect protocol only one direction means the protocol decoder could only identify HTTP-like framing in one direction of the conversation, not both — the traffic looks like HTTP from one side and something else from the other.
The operational implication is that TigerRAT's C2 channel is not simply HTTP tunneling with a custom User-Agent header. It is a custom binary protocol that borrows enough HTTP-like framing to traverse firewalls and proxies that perform shallow protocol inspection, while deliberately breaking the request/response semantics that deep packet inspection engines rely on to classify and filter the traffic [T1071.001]. A network security device performing full HTTP protocol validation would flag this traffic immediately; a device performing only port-80/443 allowlisting would pass it without inspection.
The C2 host itself, 193.56.28.251, sits in the 193.56.28.0/24 network block under RIPE allocation, routed through AS200373 (3xK Tech GmbH). The IP carries a detection ratio of 11 out of 91 engines and a reputation score of -1, with one community malicious vote. Using a bare IP directly as C2 with no domain layer leaves no certificate or registration trail, frustrating infrastructure tracking. The RIPE WHOIS record for the broader 193.0.0.0/8 block reflects the standard RIPE NCC allocation entry, providing no operator-specific attribution beyond the AS-level identification.
A German ASN in a DPRK Operation
The choice of AS200373 (3xK Tech GmbH) as C2 infrastructure is the most analytically distinctive infrastructure signal in this dataset, and it warrants explicit attention. Silent Chollima — tracked under aliases including Andariel, Stonefly, Onyx Sleet, and Plutonium — is a DPRK-attributed actor whose C2 infrastructure has historically concentrated in Asian and North American hosting providers. A small RIPE-allocated German autonomous system appearing as the sole C2 host in a confirmed TigerRAT operation is an outlier.
CTX Team's assessment is that this choice is consistent with deliberate geographic and provider diversification to avoid AS-level blocklists built on prior Silent Chollima infrastructure clusters. If network defenders have implemented blocking or alerting rules based on ASNs previously associated with Andariel operations, routing C2 traffic through a small, obscure German provider that has not previously appeared in published Silent Chollima infrastructure reporting provides a clean routing path. The low detection ratio of the IP (11/91) and the absence of prior community malicious votes beyond the single current flag are consistent with a host that has not been burned by prior association with known threat actor infrastructure.
The outlier assessment describes this as "potentially indicative of a bulletproof or rented VPS layer" — a reasonable inference given the provider's size and the absence of any legitimate service association for this specific IP. However, current evidence is too thin to conclude whether this host is part of a broader Silent Chollima infrastructure cluster; nothing in the available artifacts — no shared imphash cohort, no shared certificate serial, no domain co-resolution — bridges this C2 host to other known Andariel infrastructure.
The overall confidence rating for this indicator set is low, driven specifically by the two-IOC isolation: a single file and a single IP, with no bridging artifacts that would allow the kind of multi-axis infrastructure fingerprinting that characterizes higher-confidence campaign assessments. The file evidence is strong — 53 of 76 engines flag, the YARA rule win_tiger_rat_auto fires, the IDS rule ET MALWARE Andariel Backdoor Activity (Checkin) fires, and two of three sandboxes return malicious verdicts. The IP evidence is weaker: 11 of 91 engines flag, and the bare-IP C2 model provides no certificate or domain-resolution surface to pivot from. The actor attribution to Silent Chollima at confidence 85 is grounded in the family and rule-match evidence, not in a broader infrastructure cluster that would allow independent corroboration.
Registry Foothold and the Persistence Question
The MITRE technique T1112 (Modify Registry) appears in the threat metadata for this indicator set, consistent with known TigerRAT behavior of writing configuration or persistence data to the Windows registry. The specific registry keys are not visible in the sandbox behavioral logs — this aspect of the attack chain should be treated as inferred from the technique metadata and the family's documented behavioral profile rather than directly evidenced in this sample's sandbox output.
What the attack chain does establish directly is the execution and defense-evasion sequence. The packed PE32+ binary is deployed on the victim host under the vmware-vmx-gui.exe name [T1036], where the UPS section unpacks the TigerRAT payload at runtime using direct API calls resolved dynamically [T1106]. Before executing its core backdoor functions, the implant runs its layered evasion sequence: debugger detection, timing checks via direct CPU clock access [T1497.003], user-activity monitoring [T1497.002], and extended sleep intervals. The falsified 1998 compile timestamp [T1562.001] is a static artifact rather than a runtime behavior, but it serves the same operational goal — making forensic reconstruction harder for analysts working after the fact.
Once the evasion checks pass, the implant initiates its C2 check-in over the anomalous HTTP channel to 193.56.28.251 [T1071.001]. The C2AE sandbox's family attribution to AndarielLoader rather than a fully-featured TigerRAT variant raises the possibility that this specific sample functions as a loader stage — establishing the C2 channel and receiving a second-stage payload — rather than delivering the full backdoor capability directly. If that assessment is correct, the payload that would be delivered over the C2 channel is not visible in the available evidence. This should be held as an open analytical question rather than a confirmed characterization.
The file is unsigned — no code-signing certificate is present on this sample. This is notable in the context of the VMware masquerade: a vmware-vmx-gui.exe binary without a VMware code-signing certificate is detectable by any security control that validates digital signatures against expected signers for known process names. The absence of a certificate limits the masquerade's effectiveness against signature-aware EDR products, though it does not affect the process-name-based concealment against tools that rely solely on name matching.
Five Years of Deliberate Hardening
The most significant analytical signal in this dataset is not the malware family identification — TigerRAT has been publicly documented since at least late 2020 — but the density and deliberateness of the anti-analysis measures layered into a single sample across a five-year operational window.
Consider what the operators chose to invest in. The custom UPS packer section is not a commodity tool; it requires development effort to build a packer that mimics UPX naming while implementing a different unpacking routine and zeroing the import table. The timing and user-activity evasion stack — three distinct behavioral checks that together successfully deceived Zenbox — reflects knowledge of how specific sandbox environments operate and what thresholds they use. The falsified 1998 timestamp reflects awareness of how analysts use compile timestamps for clustering and timeline reconstruction. The malformed HTTP C2 framing reflects understanding of how network inspection tools parse HTTP at the protocol level. Each of these investments targets a specific detection mechanism, and together they form a coherent picture of an operator who has studied the detection stack they expect to face and engineered countermeasures for each layer.
This pattern — active hardening of an established implant against known detection mechanisms — is operationally distinct from the alternative strategy of rotating to new tooling when an implant family becomes widely detected. TigerRAT at 53 of 76 engine detection is not a stealthy payload by commodity malware standards, but the operators appear to be betting that the behavioral evasion, the packer, and the C2 protocol anomaly will provide sufficient operational cover in targeted deployment contexts where the implant is used sparingly. The submission density supports this reading: 12 total submissions over five years from 9 unique sources is not the profile of a broadly distributed commodity tool. It is the profile of a targeted implant used in specific operations, where each deployment is carefully considered.
The choice of AS200373 (3xK Tech GmbH) as C2 infrastructure fits this operational philosophy. A small, obscure German ASN with no prior public association with Silent Chollima infrastructure is harder to block via threat-feed-driven AS-level filtering than a hosting provider that appears repeatedly in published Andariel campaign reports. The investment in infrastructure diversification mirrors the investment in anti-analysis hardening: both reflect an operator optimizing for longevity and operational security in a targeted espionage posture rather than for scale or speed.
The VMware process masquerade — vmware-vmx-gui.exe — points toward enterprise environments running VMware infrastructure as the intended target context. The espionage motivation attributed to Silent Chollima, combined with the long operational lifespan and the sparse deployment pattern, suggests the organizations most likely to encounter this implant are those in sectors of strategic intelligence value to the DPRK: defense, government, critical infrastructure, and technology. This characterization should be understood as an inference from the actor's documented motivations and the implant's deployment characteristics rather than a direct finding from the available evidence.
What the five-year submission window and the layered anti-analysis stack together suggest is that TigerRAT remains a valued, actively maintained tool in Silent Chollima's operational inventory — not a legacy artifact awaiting replacement, but an implant the operators continue to invest in hardening. The gap between first submission in December 2020 and last observation in November 2025 spans multiple generations of EDR and sandbox technology. The fact that the operators have not abandoned the family in favor of something newer, despite its public documentation and 53-of-76 detection rate, implies they have found the anti-analysis investment sufficient to sustain operational utility. That calculus — maintain and harden rather than rotate — is itself a signal about how this actor manages its tooling lifecycle and how it assesses the detection environment it operates within.