Procedure examples

Mustang Panda has used InstallUtil.exe to execute a malicious Beacon stager.

Mustang Panda has used mshta.exe to launch collection scripts.

Mustang Panda has utilized an established Github account to create a tunnel within the victim environment using Visual Studio Code through the `code.exe tunnel` command.

Mustang Panda has installed TeamViewer on targeted systems.

Mustang Panda has used China Chopper web shells to maintain access to victims’ environments.

Mustang Panda has searched the victim system for the InstallUtil.exe program and its version.

Mustang Panda's custom ORat tool uses a WMI event consumer to maintain persistence.

Mustang Panda has created the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobelmdyU to maintain persistence. Mustang Panda has also established persistence via the registry key `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`.

Mustang Panda has used valid legitimate digital signatures and certificates to evade detection.

Mustang Panda leveraged a captive portal hijack that redirected the victim to a webpage that prompted the victim to download a malicious payload.

Mustang Panda has used RAR to create password-protected archives of collected documents prior to exfiltration. Mustang Panda has used WinRAR “Rar.exe” to archive stolen files before exfiltration. Mustang Panda has also used TONESHELL and post-exploitation tools such as RemCom and Impacket to execute WinRAR `rar.exe` to archive files for exfiltration.

Mustang Panda has encrypted documents with RC4 prior to exfiltration.

Mustang Panda's PlugX variant has created a hidden folder on USB drives named RECYCLE.BIN to store malicious executables and collected data. Mustang Panda has also modified file attributes to `hidden` and `system`.

Mustang Panda has used spearphishing attachments to deliver initial access payloads. Mustang Panda has also delivered archive files such as RAR and ZIP files containing legitimate EXEs and malicious DLLs.

Mustang Panda has delivered malicious links to their intended targets. Mustang Panda has distributed spear-phishing emails with embedded links that direct the victim to a malicious archive hosted on Google or Dropbox.

Mustang Panda has also exfiltrated archived files to cloud services such as Dropbox using `curl`.

Mustang Panda has leveraged OpenSSH (sshd.exe) to execute commands, transfer files and spread across the environment communicating over SMB port 445.

Mustang Panda has encrypted C2 communications with RC4. Mustang Panda has also leveraged encryption and compression algorithms to obfuscate the traffic between the system and C2 server, methods observed included RC4, AES, XOR with 0x5a, and LZO.

Mustang Panda has used a legitimately signed executable to execute a malicious payload within a DLL file. Mustang Panda has abused legitimate executables to side-load malicious DLLs.

Mustang Panda has leveraged legitimate software installer executables such as Setup Factory “IRSetup.exe” to drop and execute their payload.

Mustang Panda has acquired C2 domains prior to operations.

Mustang Panda has set up Dropbox and Google Drive to host malicious downloads.

Mustang Panda has leveraged the legitimate email marketing service SMTP2Go for phishing campaigns. Mustang Panda has also created fake Google accounts to distribute malware via spear-phishing emails. Mustang Panda has also created accounts for spearphishing operations including the use of services such as Proton Mail.

Mustang Panda has compromised legitimate email accounts to use in their spear-phishing operations.

Mustang Panda has developed custom malware for use in their operations.

Mustang Panda has obtained and leveraged publicly-available tools for intrusion activities.

Mustang Panda has used revoked code signing certificates for its malicious payloads.

Mustang Panda has obtained SSL certificates for their C2 domains.

Mustang Panda has used open-source research to identify information about victims to use in targeting to include creating weaponized phishing lures and attachments.

Mustang Panda has delivered web bugs to profile their intended targets.

Mustang Panda has used servers under their control to validate tracking pixels sent to phishing victims.

Mustang Panda has hosted malicious payloads on DropBox including PlugX.

Mustang Panda has embedded debug strings with messages to distract analysts. Mustang Panda has also made calls to Windows API `CheckRemoteDebuggerPresent` and exits if it detects a debugger.

Mustang Panda has used Wevtutil to gather Windows Security Event Logs.

Mustang Panda has delayed the execution of payloads leveraging ping echo requests `cmd /c ping 8.8.8.8 -n 70&&"%temp%\<legitimate executable>"`.