Toneshell Rootkit Inside the Silent Threat

ProtectFun.exe The “Fun” File Hiding a Deadly Rootkit

In the modern threat landscape, stealth is the ultimate weapon. Among the most evasive tools in a cyber-attacker’s arsenal is the Toneshell Rootkit, a sophisticated piece of malware designed to embed itself deep within a system while evading traditional security perimeters.

The HoneyMyte (aka Mustang Panda or Bronze President) APT group has significantly raised the stakes in cyber espionage with the deployment of a sophisticated kernel-mode rootkit for their ToneShell backdoor. By operating within the Windows kernel, this rootkit grants the group deep persistence and the ability to “blind” EDR and antivirus solutions from beneath the OS. This analysis explores how Mustang Panda leverages this kernel-level stealth and modular architecture to target high-value government entities across Southeast Asia with surgical precision.

Understanding how this rootkit operates is the first step in defending your infrastructure. Below, we break down its architecture and provide the critical technical data your SOC team needs to stay ahead.
The Infrastructure of Evasion

The Toneshell rootkit operates through a multi-stage execution flow. By mapping its infrastructure, we see a clear path from initial execution to deep-system persistence. It begins with a seemingly innocuous executable, ProtectFun.exe, which serves as the primary dropper.

The malware utilizes a modified PyInstaller wrapper to bundle its malicious payload, making it difficult for standard signature-based scanners to identify the underlying logic. Once executed, it moves into memory, carving out space for its rootkit components to intercept system calls and hide its presence from the operating system’s task manager and file explorer.

Analysis via PeStudio: The Warning Signs

When examining the Toneshell sample (ProtectFun.exe) through PeStudio, several red flags emerge immediately, signaling high-risk behavior:

High VirusTotal Score: With a detection rate of 57 malicious hits, it is flagged by nearly every major engine.

Malicious Imports: The file contains 37 suspicious imports, specifically functions like VirtualAlloc and WriteFile, which are common indicators of code injection and data manipulation.

Process Manipulation: The presence of OpenProcessToken and GetCurrentProcess suggests the malware is looking to escalate privileges or impersonate system tokens.

Binary Overview

File Type: This is a 64-bit Windows Driver (PE64), typically named ProjectConfiguration.sys.

Role: It functions as a Kernel-Mode Rootkit used by the threat actor Mustang Panda (HoneyMyte).

Status: The DIE output confirms it is a signed binary, but it uses a stolen or leaked digital certificate (often from Guangzhou Kingteller Technology) to bypass Windows Driver Signature Enforcement.

Key Capabilities

Stealth: It operates as a Mini-filter driver, allowing it to intercept and block any attempts to delete or modify its own files.

Payload Injection: Its main job is to inject the ToneShell backdoor into system processes like svchost.exe directly from the kernel.

Evasion: It resolves system functions (APIs) at runtime using custom hashes, making it invisible to standard static analysis tools that look for readable function names.

Persistence: It manipulates the Windows registry to ensure it loads before security software (like Microsoft Defender) can start.

Conclusion

The Toneshell rootkit is a reminder that threat actors like Mustang Panda are moving beyond simple phishing. By leveraging stolen certificates and kernel-level manipulation, they can remain persistent for months or even years. Modern defense requires a shift from simple file scanning to behavioral analysis and EDR (Endpoint Detection and Response) tools that can spot unauthorized kernel calls.

Indicators of Compromise (IOCs)