Procedure examples

Mustang Panda has utilized TLS record headers in network packets to impersonate various versions of TLS protocols to blend in with legitimate network traffic. Mustang Panda has used FakeTLS to communicate with its C2 servers.

Mustang Panda utilized “Hdump” to dump credentials from memory.

Mustang Panda has harvested credentials from memory of lssas.exe with Mimikatz.

Mustang Panda has used vssadmin to create a volume shadow copy and retrieve the NTDS.dit file. Mustang Panda has also used reg save on the SYSTEM file Registry location to help extract the NTDS.dit file.

Mustang Panda has leveraged Mimikatz DCSync feature to obtain user credentials.

Mustang Panda has used ipconfig and arp to determine network configuration information. Mustang Panda has also utilized SharpNBTScan to scan the victim environment.

Mustang Panda has queried Active Directory for computers using AdFind. Mustang Panda has also utilized SharpNBTScan to scan the victim environment.

Mustang Panda has delivered initial payloads hidden using archives and encoding measures. Mustang Panda has also utilized opaque predicates in payloads to hinder analysis.

Mustang Panda has leveraged obfuscated Windows API function calls that were concealed as unique names, or hashes of the Windows API.

Mustang Panda has utilized LNK files to hide malicious scripts for execution. Mustang Panda has also leveraged LNK files that were programmed to display a PDF icon to entice the victim to click on the file to execute an office.exe binary.

Mustang Panda has used junk code within their DLL files to hinder analysis.

Mustang Panda has used names like `adobeupdate.dat` and `PotPlayerDB.dat` to disguise PlugX, and a file named `OneDrive.exe` to load a Cobalt Strike payload. Mustang Panda has also masqueraded legitimate browser plugin updates to include AdobePlugins.exe.

Mustang Panda has used an additional filename extension to hide the true file type.

Mustang Panda has masqueraded malicious executables as legitimate files that download PlugX malware.

Mustang Panda has exfiltrated stolen data and files to its C2 server.

Mustang Panda has leveraged NBTscan to scan IP networks.

Mustang Panda has executed PowerShell scripts via WMI.

Mustang Panda has used FTP to exfiltrate archive files.

Mustang Panda has used netstat -ano to determine network connection information.

Mustang Panda has used a customized PlugX variant which could exfiltrate documents from air-gapped networks.

Mustang Panda has created a scheduled task to execute additional malicious software, as well as maintain persistence. Mustang Panda has also created a scheduled task that creates a reverse shell.

Mustang Panda has used tasklist /v to determine active process information. Mustang Panda has also used TONESHELL malware to check the process name and process path to ensure it matches the expected one prior to triggering a custom exception handler.

Mustang Panda has utilized meterpreter shellcode.

Mustang Panda has used malicious PowerShell scripts to enable execution.

Mustang Panda has executed HTA files via cmd.exe, and used batch scripts for collection. Mustang Panda has also utilized cmd.exe to execute commands on an infected host such as `cmd.exe /c ping.exe 8.8.8.8 -n 70&&"%temp%\FontEDL.exe"`.

Mustang Panda has embedded VBScript components in LNK files to download additional files and automate collection. Mustang Panda has also used VBA macros in maldocs to execute malicious DLLs. Mustang Panda also utilized a VBS Script “autorun.vbs” that created persistence through saving the VBS Script in the startup directory which would cause it to run each time the machine was turned on.

Mustang Panda has executed a JavaScript payload utilizing wscript.exe on the endpoint.

Mustang Panda has leveraged AdFind to enumerate domain groups.

Mustang Panda has deleted registry keys that store data and maintained persistence.

Mustang Panda will delete their tools and files, and kill processes after their objectives are reached.

Mustang Panda has modified file timestamps from the export address table (EAT) in malware to make it difficult to identify creation times.

Mustang Panda has communicated with its C2 via HTTP POST requests.

Mustang Panda has leveraged legitimate software tools such as AntiVirus Agents, Security Services, and App Development tools to execute scripts and to side-load dlls.

Mustang Panda has stored collected credential files in c:\windows\temp prior to exfiltration. Mustang Panda has also stored documents for exfiltration in a hidden folder on USB drives.

Mustang Panda has gathered system information using systeminfo.

Mustang Panda has searched the entire target system for DOC, DOCX, PPT, PPTX, XLS, XLSX, and PDF files.

Mustang Panda has utilized AdFind to identify domain users.

Mustang Panda has used a customized PlugX variant which could spread through USB connections.

Mustang Panda has utilized TCP-based reverse shells using cmd.exe.

Mustang Panda has used DropBox URLs to deliver variants of PlugX. Mustang Panda has also used Google Drive to host malicious downloads.

Mustang Panda has downloaded additional executables following the initial infection stage. Mustang Panda has also leveraged Visual Studio Code `code.exe` and Dev Tunnels using `DevTunnel.exe` to propagate additional tools and payloads.

Mustang Panda has used various Windows API calls during execution and defense evasion.

Mustang Panda used custom batch scripts to collect files automatically from a targeted system.

Mustang Panda has leveraged `LoadLibrary` to load DLLs.

Mustang Panda has the ability to decrypt its payload prior to execution. Mustang Panda has also utilized RC4 encryption for malicious payloads.

Mustang Panda has leveraged Visual Studio Code’s (VSCode) embedded reverse shell feature using the command `code.exe tunnel` to execute code and deliver additional payloads.

Mustang Panda has exploited CVE-2017-0199 in Microsoft Word to execute code.

Mustang Panda has sent malicious links including links directing victims to a Google Drive folder. Mustang Panda has also utilized webpages with Javascript code that downloads malicious payloads to the victim device.

Mustang Panda has sent malicious files requiring direct victim interaction to execute. Mustang Panda has also leveraged executable files that display decoy documents to the victim to provide a resemblance of legitimacy with customized themes related to the victim.

Mustang Panda has utilized a magic value in C2 communications and only executes in memory when response packets match specific values of “17 03 03” or “46 77 4d”.