Signed Netease Emulator Files Hide MSSQL Backdoor, Fool All 76 AV Engines

A Database Backdoor Hidden Inside a Gaming Emulator

Two trojanized components of Netease's MuMuPlayer Android emulator — both carrying a currently valid DigiCert code-signing certificate issued to Netease Interactive Entertainment Pte. Ltd. — have been identified embedding Skip-2.0 MSSQL authentication-bypass hooks inside legitimately signed Windows executables, achieving complete evasion across all 76 antivirus engines while routing command-and-control traffic through infrastructure that impersonates Akamai CDN. The combination of a commercially trusted signer, a database-level persistence mechanism, and a pre-positioned domain left dormant for roughly 25 months before activation marks this as a deliberate, operationally mature intrusion campaign targeting the education and research sector.

CTX Team's analysis of the two PE32+ binaries — MuMuNxMain.exe (SHA-256: 4ccf2465d40e5e8678a7332d4c06ab4c3a2342e96eb2842b1f64aa01b35c8913, first seen 2026-04-23) and MuMuNxDevice.exe (SHA-256: 239edb999666525ac5f53b620a512ea3f84abcdc9f2034c62373ccef5b9f3806, first seen 2026-05-23) — confirms that both files co-fire on the YARA rule skip20_sqllang_hook, authored by Mathieu Tartare of ESET and published to the ESET malware-ioc repository. The rule's description is unambiguous: "If $1_0 or $1_1 match, it is probably targeted as it corresponds to the hook responsible for bypassing the authentication" in sqllang.dll. The campaign is attributed in the threat feed to Spring Dragon, a state-aligned actor also tracked under the aliases Lotus Blossom, Billbug, Bronze Elgin, CTG-8171, and Thrip, with an espionage motivation and a recorded focus on education and research sector targets.

The Signing Credential That Silences Every Engine

The operational centrepiece of this campaign is a single DigiCert code-signing certificate issued to Netease Interactive Entertainment Pte. Ltd., serial number 05 CA AB D5 55 EE D7 70 D8 76 FD 20 CA 0B 9A FB, thumbprint B2910DC12D92355FB10109F5989DD7D746BD760C. The certificate was issued on 8 September 2025 and carries a validity window extending to 4 December 2028 — more than three years of remaining shelf life at the time of analysis. It sits within a full DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 chain, a root that Windows trusts unconditionally.

Both binaries carry this certificate with status: Valid and verified: Signed. The practical consequence is stark: 0 of 76 antivirus engines return a malicious or suspicious verdict on either file. For the primary sample, MuMuNxMain.exe, the Zenbox sandbox goes further — it returns a 99%-confidence CLEAN classification, confirming that the valid Netease signing credential suppresses not just static signature matching but also the dynamic behavioural analysis pipeline [T1553.002]. The secondary sample, MuMuNxDevice.exe, had been on VirusTotal for only ten days at the time of analysis, submitted from a single source, and carries no sandbox verdict at all. Behavioural claims about that file beyond the YARA-confirmed hook pattern should be treated with corresponding caution.

The signing dates are themselves informative. MuMuNxMain.exe was signed on 22 April 2026 and first appeared on VirusTotal the following day — a one-day turnaround from signing session to observed deployment. MuMuNxDevice.exe was signed on 22 May 2026 and first appeared on 23 May 2026, again a single day later. The operational tempo is tight: sign, deploy, observe. The certificate was issued in September 2025, meaning the operators had held the signing credential for roughly seven months before the first observed trojanized binary appeared. Whether that gap reflects a preparation period, an earlier unobserved deployment wave, or simply the time required to identify and trojanize appropriate carrier binaries is not directly evidenced in the available data.

What the data does establish is that the same certificate serial binds both files into a single campaign cohort. The shared cert serial is the strongest cross-IOC linkage axis in this dataset: two distinct MuMuPlayer components, compiled at different times (PE timestamps 2026-04-22 and 2026-05-22 respectively), carrying different imphashes (5b4572bc2e114f5ac07291c28cfd3d38 for MuMuNxMain.exe and cd647613c569c4c82cbd3adb08488871 for MuMuNxDevice.exe), but signed under the identical Netease credential. The divergent imphashes indicate the two files were built from different codebases or compilation units — consistent with their different functional roles within the MuMuPlayer installation tree — yet both were processed through the same signing session or signing infrastructure.

Both files also carry the corrupt and overlay tags alongside their valid signatures. This combination is the fingerprint of post-signing modification [T1036.001]: payload data appended to the binary after the Authenticode signature was applied. In practice, Windows does not invalidate a signature because of appended overlay data — the signature covers the PE image up to the point of signing, and overlay bytes are outside that scope. The result is a file that Windows and every tested AV engine treats as legitimately signed Netease software, while carrying additional executable or data content beyond the signed boundary. That the AV engines return 0/76 despite the corrupt flag confirms that the corruption does not trigger signature-validation failures in any tested product — a meaningful operational finding, though the precise mechanism by which the overlay payload is loaded and executed is inferred from the tag combination rather than directly observed in sandbox output.

Skip-2.0 Inside a Gaming Emulator: The Database Hook

The payload concealed within these MuMuPlayer components is not a generic information-stealer or remote-access trojan. The YARA rule skip20_sqllang_hook is a highly specific signature for Skip-2.0, a backdoor-class tool documented in the public ESET malware-ioc repository. Skip-2.0 operates by hooking the sqllang.dll module within Microsoft SQL Server processes, intercepting the authentication logic at a point where it can substitute or bypass credential validation entirely. The practical effect is that an operator with network access to a compromised MSSQL instance can authenticate to any database on that server using any password — or no valid password at all. The database becomes persistently accessible without requiring stolen credentials, without triggering failed-authentication logs, and without any modification to SQL Server configuration that a database administrator would observe through normal monitoring.

The choice of MuMuPlayer as the carrier binary is operationally deliberate. MuMuPlayer is a widely distributed Android emulator used in gaming environments, and its presence on a Windows endpoint — including in university computing labs, research workstations, or environments where staff run personal software alongside professional tools — is unremarkable. Both trojanized files install under standard MuMuPlayer paths: MuMuNxMain.exe appears under C:\Program Files\Netease\MuMuPlayer\nx_main\ and C:\Games\MuMuPlayerGlobal\nx_main\, while MuMuNxDevice.exe installs under C:\Program Files\Netease\MuMuPlayer\nx_device\12.0\shell\. These are the paths a legitimate MuMuPlayer installation would use. An endpoint detection tool that allowlists signed Netease software — a reasonable policy for an organisation that legitimately uses MuMuPlayer — would pass both files without inspection [T1195.002].

Both files are packed with PEiD, and their PE section entropy profiles are consistent with packed content. MuMuNxMain.exe's .text section registers entropy at 5.61 across 19 MB of content, while MuMuNxDevice.exe's .text section reads at 5.59 across 23.6 MB — moderate entropy values that do not immediately flag as strongly packed, but the .pdata sections of both files show elevated entropy (6.43 and 6.56 respectively), a pattern that can indicate compressed exception-handling data or additional embedded content. The overall file sizes — 24,729 KB and 30,434 KB — are large enough that appended overlay data would not produce an obvious size anomaly against a legitimate MuMuPlayer installation.

The process injection mechanism [T1055] implied by the Skip-2.0 hook architecture requires the trojanized MuMuPlayer component to interact with a running SQL Server process — specifically to inject or load code into the sqlservr.exe process space where sqllang.dll is loaded. The precise injection technique is not characterised in the available sandbox data: MuMuNxMain.exe's single Zenbox verdict returns CLEAN, and MuMuNxDevice.exe has no sandbox verdict. The YARA rule confirms the presence of the hooking byte patterns in both binaries, but the execution pathway from MuMuPlayer launch to sqllang.dll hook installation remains unconfirmed in this dataset and should be treated as an open analytical question.

What is confirmed is that both samples co-fire on skip20_sqllang_hook — a rule that is not a generic PE characteristic or broad behavioural heuristic, but a signature for specific byte sequences corresponding to the authentication-bypass hook functions. The ESET repository describes the rule as detecting "if a sqllang.dll version is targeted by skip-2.0", with the matched patterns corresponding directly to the hook responsible for bypassing authentication. The co-firing of this rule on both MuMuPlayer components, combined with their shared signing certificate, establishes them as two deployments of the same Skip-2.0 variant within a single campaign window.

A C2 Layer Built to Disappear Into Legitimate Traffic

The command-and-control infrastructure supporting this campaign is constructed around three structurally distinct fingerprints, each using a different certificate authority, a different autonomous system, and a different geographic jurisdiction. The deliberate avoidance of any shared CA, registrar, or AS across the IP tier is itself a fingerprint of operational planning: a defender who pivots on any single infrastructure attribute will find only one node, not the full network.

The most technically sophisticated element is the Malaysian IP, 202.188.238.219, registered to TM TECHNOLOGY SERVICES SDN. BHD. under ASN 4788, a major Malaysian telecommunications provider. This IP presents a TLS certificate whose subject is a248.e.akamai.net and whose Subject Alternative Names include *.akamaized.net, *.akamaized-staging.net, *.akamaihd.net, and *.akamaihd-staging.net — the certificate infrastructure of Akamai Technologies, issued by DigiCert Global G3 TLS ECC SHA384 2020 CA1. The certificate is legitimate: it was issued to Akamai Technologies, Inc., with a subject address of Cambridge, Massachusetts. What makes its presence on a Malaysian ISP IP anomalous is that 202.188.238.219 is not an Akamai CDN node. It sits within the 202.188.0.0/16 block assigned to TM TECHNOLOGY SERVICES, a residential and commercial ISP range, not Akamai's anycast infrastructure.

The operational implication is that any network monitoring tool that filters TLS traffic by SNI or certificate subject — a common approach in enterprise environments that use TLS inspection proxies — will see connections to 202.188.238.219 presenting as Akamai CDN traffic [T1071.001]. Unless the inspection layer also validates that the IP address is within Akamai's known address space, the traffic blends with the constant background noise of legitimate Akamai CDN connections that any modern network generates. The detection ratio for this IP is 0/91 across all VirusTotal engines, consistent with the effectiveness of the impersonation.

The Dutch IP, 213.174.146.97, operates under ASN 39572, assigned to DataWeb Global Group B.V. and subnetted to Advanced Hosters B.V. — a hosting provider whose infrastructure has appeared in prior operational contexts. This IP presents a GoGetSSL RSA DV CA wildcard certificate for *.ahacdn.me, issued by GoGetSSL, a Latvian domain-validation certificate authority that offers low-cost wildcard certificates with minimal identity verification. The certificate was valid from 29 January 2026 to 28 February 2027, and was observed on this IP on 2 June 2026 — contemporaneous with the MuMuNxDevice.exe activity window. The wildcard coverage of *.ahacdn.me provides the operator flexibility to rotate subdomains without re-issuing the certificate, a useful property for a C2 node that may need to change its DNS-visible identity while maintaining the same TLS fingerprint.

The German IP, 139.45.197.115, is the set's structural outlier. It sits within ASN 9002, assigned to RETN Limited, a transit provider whose WHOIS for this subnet points to networkclaim.com in Amsterdam — an administrative address that does not correspond to a conventional hosting customer. This IP carries no observed TLS certificate, has a reputation score of -53, and received 1 of 91 detections with two malicious community votes on VirusTotal. Its specific role in the campaign's C2 chain is not directly evidenced by the available dossier data: there is no file-to-IP resolution chain, no observed TLS handshake, and no behavioural context linking it to the trojanized MuMuPlayer components. It should be treated as a weaker indicator — present in the threat feed, structurally consistent with the campaign's multi-AS diversification pattern, but analytically unconfirmed as an active C2 node.

The Domain That Waited Two Years to Activate

The DNS tier of the C2 infrastructure centres on the subdomain 27997.2477april2024.com, and its timeline tells a story of deliberate pre-positioning. The parent domain 2477april2024.com was registered on 2 April 2024, through registrar ID 1418 (Danesco Names, WHOIS server whois.danesconames.com), with all registrant fields fully masked through whoisprotectservice.net — a statutory privacy service that replaces every WHOIS field with Statutory Masking for data privacy. The domain was delegated to Cloudflare nameservers (emma.ns.cloudflare.com and stan.ns.cloudflare.com), providing both DNS resolution reliability and an additional layer of infrastructure indirection.

For approximately 25 months after registration, the domain was dormant. No TLS certificate was issued, and there is no evidence of operational use during this period. Then, on 22 May 2026 at 16:51:29 UTC, a Let's Encrypt R12 wildcard certificate was provisioned for *.2477april2024.com, with a 89-day validity window running to 20 August 2026. The following day — 23 May 2026 — MuMuNxDevice.exe first appeared on VirusTotal, submitted from a single source. The one-day gap between certificate issuance and the second trojanized binary's first observed appearance is unlikely to be coincidental: it suggests the domain was activated specifically to support the deployment of the second MuMuPlayer component.

The numeric subdomain pattern — 27997 — is consistent with programmatically generated or operationally assigned subdomain labels, a technique that makes the specific subdomain difficult to predict or enumerate while the wildcard certificate covers the full *.2477april2024.com space. The domain currently resolves to four A-records: 88.208.22.1, 88.208.22.2, 88.208.22.3, and 88.208.22.4 — a load-balanced or round-robin cluster in the 88.208.22.0/24 block that does not appear in the IP dossier set, indicating additional infrastructure beyond what has been enumerated in this analysis.

The domain carries 11 of 91 detections on VirusTotal — the only indicator in this dataset with a meaningful positive detection ratio — and a reputation score of -1 with one malicious community vote. That detection ratio, while modest, is the clearest network-layer signal available in this campaign: the trojanized binaries themselves are invisible to AV, and the C2 IPs are clean across all engines. The domain's 11/91 detection rate makes it the most actionable network indicator in the current evidence set.

The three-CA architecture across the infrastructure layer — Let's Encrypt for the domain, DigiCert for the Malaysian IP's Akamai-impersonating certificate, and GoGetSSL for the Dutch IP's wildcard — means that any detection approach based on certificate authority pivoting will find only one node per CA. A defender who identifies the Let's Encrypt wildcard on 2477april2024.com and pivots to other Let's Encrypt certificates on Cloudflare-delegated domains will not find the GoGetSSL node on ASN 39572. The infrastructure is designed to resist exactly this kind of lateral expansion.

Attack Chain: From Emulator Install to Database Persistence

Walking the campaign's attack mechanism chain from initial access through to command and control reveals a sequence that exploits trust at every layer — trusted software, trusted signer, trusted CDN, trusted DNS provider.

Initial access [T1195.002] is achieved through the delivery of trojanized MuMuPlayer components that present as legitimate Netease software. The installation paths — C:\Program Files\Netease\MuMuPlayer\nx_main\MuMuNxMain.exe and C:\Program Files\Netease\MuMuPlayer\nx_device\12.0\shell\MuMuNxDevice.exe — are the standard paths used by genuine MuMuPlayer installations. The 30 submissions of MuMuNxMain.exe from 27 unique sources between 23 April and 1 June 2026 indicate the file has been encountered across multiple environments, though the submission pattern reflects researcher and automated scanner activity rather than confirmed victim telemetry. MuMuNxDevice.exe's single submission from a single source on 23 May 2026 provides a much thinner evidentiary base; its deployment scope is unknown.

Once a user or system runs the trojanized MuMuPlayer component [T1204.002], the embedded Skip-2.0 code targets any running Microsoft SQL Server process on the host. The hook mechanism [T1055] intercepts sqllang.dll's authentication logic, establishing a persistent, credential-independent backdoor into every MSSQL database on the system. For an education or research institution running SQL Server to manage student records, research databases, or administrative systems, this represents a silent, persistent access pathway that survives password rotations, account audits, and standard database security reviews — because the hook operates below the authentication layer that those controls monitor.

Defense evasion [T1553.002] is achieved entirely through the valid Netease signing certificate. The Zenbox sandbox's 99%-confidence CLEAN verdict for MuMuNxMain.exe confirms that dynamic analysis pipelines are also suppressed — the sandbox sees a legitimately signed Netease binary behaving within expected parameters, and returns clean. The corrupt and overlay tags indicate post-signing modification, but in practice this does not trigger any detection mechanism in the tested pipeline.

Command and control [T1071.001] routes through the three-AS IP layer and the Cloudflare-delegated domain. The Akamai certificate impersonation on 202.188.238.219 is the most sophisticated traffic-blending element: outbound connections from a compromised endpoint to this Malaysian ISP IP will present TLS handshakes with a248.e.akamai.net as the certificate subject and *.akamaized.net in the SAN, making the traffic visually indistinguishable from legitimate Akamai CDN connections in a network monitoring console that displays certificate metadata. Only a monitoring system that cross-references the destination IP against Akamai's published IP ranges would flag the discrepancy.

Spring Dragon's Toolkit and What This Campaign Signals

The threat feed attributes this campaign to Spring Dragon with medium confidence, recording espionage as the motivation and education and research as the targeted sector. The actor carries a substantial alias set — Lotus Blossom, Billbug, Thrip, Bronze Elgin, CTG-8171, Dragonfish, Esile — reflecting contested or evolving attribution across multiple tracking organisations over an extended period. These aliases are recorded as equivalents in the input data and do not represent separate actors in this dataset. The state alignment recorded is China-linked. No historical arc claims or prior named campaign parallels are directly evidenced in the available data for this specific cluster, and none will be invented to fill that gap.

The espionage motivation combined with education and research sector targeting is consistent with intelligence collection against academic institutions — a pattern that suggests interest in research data, intellectual property, or personnel with access to government-adjacent projects. The specific choice of Skip-2.0 as the payload is significant in this context: a database authentication bypass is not a tool for opportunistic credential theft or ransomware staging. It is a persistence mechanism for sustained, quiet access to structured data — the kind of tool an operator deploys when the objective is to read database contents over an extended period without triggering the access-control events that would alert a database administrator.

The wmi_ghost family attribution in the threat feed places this campaign within a known toolset associated with the actor cluster, though the specific relationship between the wmi_ghost family label and the Skip-2.0 YARA-confirmed payload is not further characterised in the available dossier data.

What the dataset establishes with high confidence — supported by the shared certificate serial, the co-firing YARA rule, the contemporaneous signing and deployment dates, and the three-AS C2 diversification — is a single, coordinated campaign that deployed at least two trojanized MuMuPlayer components within a 30-day window, supported by infrastructure that was partially pre-positioned more than two years in advance.

The Operational Maturity Gap This Campaign Exposes

The combination documented here — a commercially issued, currently valid code-signing certificate applied to a widely distributed consumer application, embedding a database authentication bypass that achieves complete AV evasion — is not a novel technique in isolation. Signed-binary abuse is well understood. Skip-2.0 has been documented. CDN impersonation via TLS SAN abuse is a known defense-evasion pattern. What is operationally significant is the integration: each individual element is designed to defeat a specific detection layer, and the layers are stacked so that no single detection mechanism is sufficient.

The skip20_sqllang_hook YARA rule, published by ESET's Mathieu Tartare to the ESET malware-ioc repository at github.com/eset/malware-ioc, is currently the only confirmed detection vector for the payload in this dataset. It fires on both samples. No AV engine flags either binary. No sandbox returns a malicious verdict for the primary sample, and no sandbox verdict exists for the secondary sample. The domain carries an 11/91 detection ratio, making it the most actionable indicator available — but a network-layer detection on the domain fires only if the domain is queried, which requires the implant to have already executed.

The Netease code-signing certificate (serial 05 CA AB D5 55 EE D7 70 D8 76 FD 20 CA 0B 9A FB) remains valid through 4 December 2028. Until that certificate is revoked by DigiCert, any additional MuMuPlayer components signed under the same credential will inherit the same complete AV evasion. The two samples identified in this dataset may not be the full extent of the trojanized binary set: MuMuNxMain.exe accumulated 30 submissions from 27 unique sources over its observation window, suggesting broader distribution than a single targeted deployment, while MuMuNxDevice.exe's single submission leaves its deployment scope entirely open.

The ~25-month domain pre-positioning timeline — registering 2477april2024.com in April 2024, leaving it dormant through Cloudflare nameservers, then activating it with a Let's Encrypt wildcard certificate one day before deploying the second trojanized binary — points toward an operational planning horizon that extends well beyond the immediate campaign window. Infrastructure is acquired and parked long before it is needed, reducing the forensic signal that comes from domain registration activity clustering around deployment dates. The four A-records resolving from 27997.2477april2024.com — 88.208.22.1 through 88.208.22.4 — point to a separate IP block not yet characterised in the available dossier data, suggesting the enumerated infrastructure represents a partial view of the full operational footprint.

For the education and research sector, the operational implication is structural rather than incidental. Institutions that run Microsoft SQL Server alongside environments where consumer software — including gaming tools and Android emulators — may be present on endpoints face a detection gap that signature-based and sandbox-based pipelines cannot currently close against this specific campaign. The YARA rule skip20_sqllang_hook represents the current boundary of confirmed detection capability. The certificate's remaining validity through late 2028 means that boundary is likely to be tested again.