Procedure examples

APT19 used an HTTP malware variant and a Port 22 malware variant to collect the MAC address and IP address from the victim’s machine.

APT19 used Base64 to obfuscate executed commands.

APT19 used Base64 to obfuscate payloads.

APT19 used an HTTP malware variant and a Port 22 malware variant to collect the victim’s username.

APT19 downloaded and launched code within a SCT file.

APT19 used PowerShell commands to execute payloads.

APT19 used HTTP for C2 communications. APT19 also used an HTTP malware variant to communicate over HTTP for C2.

APT19 collected system architecture information. APT19 used an HTTP malware variant and a Port 22 malware variant to gather the hostname and CPU information from the victim’s machine.

APT19 uses a Port 22 malware variant to modify several Registry keys.

An APT19 HTTP malware variant used Base64 to encode communications to the C2 server.

An APT19 HTTP malware variant decrypts strings using single-byte XOR keys.

APT19 performed a watering hole attack on forbes.com in 2014 to compromise targets.

APT19 attempted to get users to launch malicious attachments delivered via spearphishing emails.

APT19 used Regsvr32 to bypass application control techniques.

APT19 configured its payload to inject into the rundll32.exe.

An APT19 Port 22 malware variant registers itself as a service.

An APT19 HTTP malware variant establishes persistence by setting the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows Debug Tools-%LOCALAPPDATA%\.

APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.

APT19 sent spearphishing emails with malicious attachments in RTF and XLSM formats to deliver initial exploits.

APT19 launched an HTTP malware variant and a Port 22 malware variant using a legitimate executable that loaded the malicious DLL.

APT19 has obtained and used publicly-available tools like Empire.