admin@338 - G0018

Created: 2017-05-31T21:31:53.579Z

Modified: 2020-03-18T19:54:59.120Z

Contributors: Tatsuya Daitoku, Cyber Defense Institute, Inc.

Aliases

admin@338

Description

admin@338 is a China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in financial, economic, and trade policy, typically using publicly available RATs such as PoisonIvy, as well as some non-public backdoors. (Citation: FireEye admin@338)

Techniques Used

admin@338 has sent emails with malicious Microsoft Office documents attached.(Citation: FireEye admin@338)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

admin@338 has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails.(Citation: FireEye admin@338)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

admin@338 has exploited client software vulnerabilities for execution, such as Microsoft Word CVE-2012-0158.(Citation: FireEye admin@338)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1049|System Network Connections Discovery|

admin@338 actors used the following command following exploitation of a machine with

LOWBALL malware to display network connections:

admin@338 actors used the following commands after exploiting a machine with

LOWBALL malware to obtain information about files and directories:

admin@338 actors used the following command after exploiting a machine with

LOWBALL malware to acquire information about local networks:

admin@338 actors used the following commands after exploiting a machine with

LOWBALL malware to obtain information about the OS:

admin@338 actors used the following command to rename one of their tools to a benign file name:

admin@338 actors used the following command following exploitation of a machine with

LOWBALL malware to obtain information about services:

admin@338 actors used the following commands following exploitation of a machine with

LOWBALL malware to enumerate user accounts: