APT3 downloader first establishes a SOCKS5 connection to 192.157.198[.]103 using TCP port 1913; once the server response is verified, it then requests a connection to 192.184.60[.]229 on TCP port 81.(Citation: FireEye Operation Double Tap)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|An

APT3 downloader creates persistence by creating the following scheduled task:

APT3 downloader uses the Windows command

APT3 downloader establishes SOCKS5 connections for its initial C2.(Citation: FireEye Operation Double Tap)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|An

APT3 downloader uses the Windows command

APT3 has used PowerShell on victim systems to download and run payloads after exploitation.(Citation: FireEye Operation Double Tap)|