G0082: APT38

APT38 has used Hermes ransomware to encrypt files with AES256.[2]

APT38 has injected malicious payloads into the `explorer.exe` process.Citation1 - appv

APT38 has identified primary users, currently logged in users, sets of users that commonly use a system, or inactive users.[1]

APT38 uses a tool called CLEANTOAD that has the capability to modify Registry keys.[2]

APT38 installed a port monitoring tool, MAPMAKER, to print the active TCP connections on the local system.[2]

APT38 has used a utility called CLOSESHAVE that can securely delete a file from the system. They have also removed malware, tools, or other non-native files used during the intrusion to reduce their footprint or as part of the post-intrusion cleanup process.[2][1]

APT38 used a Trojan called KEYLIME to capture keystrokes from the victim’s machine.[2]

APT38 has identified security software, configurations, defensive tools, and sensors installed on a compromised system.[1]Citation1 - appv

APT38 has installed a new Windows service to establish persistence.[1]

APT38 has used the legitimate application `ieinstal.exe` to bypass UAC.Citation1 - appv

APT38 has conducted watering holes schemes to gain initial access to victims.[2][1]

APT38 have enumerated files and directories, or searched in specific locations within a compromised host.[1]

APT38 has used a command-line tunneler, NACHOCHEESE, to give them shell access to a victim’s machine.[2] Additionally, APT38 has used batch scripts.Citation1 - appv

APT38 has used the RC4 algorithm to decrypt configuration data. Citation1 - appv

APT38 has used VBScript to execute commands and other operational tasks.[1]Citation1 - appv

APT38 has used a custom MBR wiper named BOOTWRECK, which will initiate a system reboot after wiping the victim's MBR.[2]

APT38 has used links to execute a malicious Visual Basic script.Citation1 - appv

APT38 used a backdoor, QUICKRIDE, to communicate to the C2 server over HTTP and HTTPS.[2]

APT38 used a backdoor, NESTEGG, that has the capability to download and upload files to and from a victim’s machine.[2] Additionally, APT38 has downloaded other payloads onto a victim’s machine.Citation1 - appv

APT38 has unhooked DLLs to disable endpoint detection and response (EDR) or anti-virus (AV) tools.Citation1 - appv

APT38 has used several code packing methods such as Themida, Enigma, VMProtect, and Obsidium, to pack their implants.[2]

APT38 has collected browser bookmark information to learn more about compromised hosts, obtain personal information about users, and acquire details about internal network resources.[1]

APT38 clears Window Event logs and Sysmon logs from the system.[2]

APT38 has used a renamed version of `mshta.exe` to execute malicious HTML files.Citation1 - appv

APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.[1]

APT38 have created firewall exemptions on specific ports, including ports 443, 6443, 8443, and 9443.[1]

APT38 has used a custom secure delete function to make deleted files unrecoverable.[2]

APT38 has used brute force techniques to attempt account access when passwords are unknown or when password hashes are unavailable.[1]

APT38 has enumerated network shares on a compromised host.[1]

APT38 has used ISO and VHD files to deploy malware and to bypass Mark-of-the-Web (MOTW) security measures.Citation1 - appv

APT38 has attempted to get detailed information about a compromised host, including the operating system, version, patches, hotfixes, and service packs.[1]

APT38 has used DYEPACK to manipulate SWIFT messages en route to a printer.[2]

APT38 have created firewall exemptions on specific ports, including ports 443, 6443, 8443, and 9443. [1]

APT38 has used a custom MBR wiper named BOOTWRECK to render systems inoperable.[2]

APT38 has renamed system utilities, such as `rundll32.exe` and `mshta.exe`, to avoid detection.Citation1 - appv

APT38 has prepended a space to all of their terminal commands to operate without leaving traces in the HISTCONTROL environment.[1]

APT38 has used Task Scheduler to run programs at system startup or on a scheduled basis for persistence.[1] Additionally, APT38 has used living-off-the-land scripts to execute a malicious script via a scheduled task.Citation1 - appv

APT38 has obtained and used open-source tools such as Mimikatz.CitationESET Lazarus KillDisk April 2018

APT38 has used web shells for persistence or to ensure redundant access.[1]

APT38 used a Trojan called KEYLIME to collect data from the clipboard.[2]

APT38 has used rundll32.exe to execute binaries, scripts, and Control Panel Item files and to execute code via proxy to avoid triggering security tools.[1]Citation1 - appv

APT38 has used DYEPACK.FOX to manipulate PDF data as it is accessed to remove traces of fraudulent SWIFT transactions from the data displayed to the end user.[2]

APT38 has created fake domains to imitate legitimate venture capital or bank domains.Citation1 - appv

APT38 has used the Windows API to execute code within a victim's system.[1]

APT38 has used CHM files to move concealed payloads.CitationKaspersky Lazarus Under The Hood APR 2017

APT38 has attempted to lure victims into enabling malicious macros within email attachments.[1] Additionally, APT38 has used malicious Word documents and shortcut files.Citation1 - appv

APT38 has used DYEPACK to create, delete, and alter records in databases used for SWIFT transactions.[2]

APT38 has collected data from a compromised host.[1]

APT38 has used PowerShell to execute commands and other operational tasks.[1]

APT38 has used cron to create pre-scheduled and periodic background jobs on a Linux system.[1]

APT38 has conducted spearphishing campaigns using malicious email attachments.[1]

APT38 has used `msiexec.exe` to execute malicious files.Citation1 - appv

APT38 has created new services or modified existing ones to run executables, commands, or scripts.[1]

APT38 has created a mutex to avoid duplicate execution.Citation1 - appv

APT38 leveraged Sysmon to understand the processes, services in the organization.[2]

APT38 has put several spaces before a file extension to avoid detection and suspicion.Citation1 - appv