Iron Tiger Malware - PlugX FastProxy

Hunt Hypothesis

The detection identifies potential Iron Tiger Malware activity through PlugX FastProxy, indicating an adversary may be establishing a covert communication channel to exfiltrate data or pivot within the network. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate early-stage malware persistence and lateral movement attempts.

YARA Rule

rule IronTiger_PlugX_FastProxy
{
   
    meta:
        author = "Cyber Safety Solutions, Trend Micro"
        description = "Iron Tiger Malware - PlugX FastProxy"
        reference = "http://goo.gl/T5fSJC"
   
    strings:
        $str1 = "SAFEPROXY HTServerTimer Quit!" nocase wide ascii
        $str2 = "Useage: %s pid" nocase wide ascii
        $str3 = "%s PORT[%d] TO PORT[%d] SUCCESS!" nocase wide ascii
        $str4 = "p0: port for listener" nocase wide ascii
        $str5 = "\\users\\whg\\desktop\\plug\\" nocase wide ascii
        $str6 = "[+Y] cwnd : %3d, fligth:" nocase wide ascii
   
    condition:
        uint16(0) == 0x5a4d and (any of ($str*))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

False Positive Guidance

Scenario: A system administrator is using PowerShell to execute a scheduled job that downloads a legitimate update from a trusted internal repository.
Filter/Exclusion: Exclude PowerShell scripts that originate from known internal update servers (e.g., internal-update-server.example.com) and are signed by a trusted certificate.
Scenario: A database administrator is using SQL Server Agent to run a maintenance job that connects to a remote SQL Server instance for backups.
Filter/Exclusion: Exclude connections to SQL Server instances that are whitelisted in the enterprise’s network security policy (e.g., sql-backup-server.example.com).
Scenario: A DevOps engineer is deploying a containerized application using Docker and Kubernetes, which involves pulling images from a private registry.
Filter/Exclusion: Exclude traffic to private Docker registries (e.g., registry.example.com) that are part of the organization’s CI/CD pipeline.
Scenario: A system administrator is using Windows Task Scheduler to run a script that connects to a remote server for log collection.
Filter/Exclusion: Exclude connections to log collection servers (e.g., log-collector.example.com) that are configured in the enterprise’s monitoring infrastructure.
Scenario: A security analyst is using Wireshark or tcpdump to capture and analyze network traffic for forensic analysis.
Filter/Exclusion: Exclude traffic from known security analysis tools (e.g., wireshark.example.com, tcpdump.example.com) and associated internal IP ranges.