APT37 executes shellcode and a VBA script to decode Base64 strings.(Citation: Talos Group123)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.003|Steganography|

APT37 uses steganography to send images to users that are embedded with shellcode.(Citation: Talos Group123)(Citation: Securelist ScarCruft May 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1529|System Shutdown/Reboot|

APT37 has used malware that will issue the command

APT37 has a function in the initial dropper to bypass Windows UAC in order to execute the next payload with higher privileges.(Citation: Securelist ScarCruft May 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1120|Peripheral Device Discovery|

APT37 has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices. (Citation: Securelist ScarCruft May 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1106|Native API|

APT37 leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection.(Citation: Talos Group123)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1055|Process Injection|

APT37 injects its malware variant,

ROKRAT, into the cmd.exe process.(Citation: Talos Group123)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|

APT37 identifies the victim username.(Citation: Talos Group123)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

APT37 uses HTTPS to conceal C2 communications.(Citation: Talos Group123)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|