Procedure examples

AppleSeed can collect data on a compromised host.

AppleSeed can use a second channel for C2 when the primary channel is in upload mode.

AppleSeed can identify the IP of a targeted system.

AppleSeed can find and collect data from removable media devices.

AppleSeed has the ability to Base64 encode its payload and custom encrypt API calls.

AppleSeed has used UPX packers for its payload DLL.

AppleSeed has divided files if the size is 0x1000000 bytes or more.

AppleSeed can disguise JavaScript files as PDFs.

AppleSeed has the ability to rename its payload to ESTCommon.dll to masquerade as a DLL belonging to ESTsecurity.

AppleSeed can exfiltrate files via the C2 channel.

AppleSeed can use GetKeyState and GetKeyboardState to capture keystrokes on the victim’s machine.

AppleSeed can enumerate the current process on a compromised host.

AppleSeed has the ability to execute its payload via PowerShell.

AppleSeed has the ability to use JavaScript to execute PowerShell.

AppleSeed can delete files from a compromised host after they are exfiltrated.

AppleSeed has the ability to communicate with C2 over HTTP.

AppleSeed can stage files in a central location prior to exfiltration.

AppleSeed can identify the OS version of a targeted system.

AppleSeed has the ability to search for .txt, .ppt, .hwp, .pdf, and .doc files in specified directories.

AppleSeed has the ability to use multiple dynamically resolved API calls.

AppleSeed can take screenshots on a compromised host by calling a series of APIs.

AppleSeed has automatically collected data from USB drives, keystrokes, and screen images before exfiltration.

AppleSeed can pull a timestamp from the victim's machine.

AppleSeed can gain system level privilege by passing SeDebugPrivilege to the AdjustTokenPrivilege API.

AppleSeed can decode its payload prior to execution.

AppleSeed can achieve execution through users running malicious file attachments distributed via email.

AppleSeed can call regsvr32.exe for execution.

AppleSeed has the ability to create the Registry key name EstsoftAutoUpdate at HKCU\Software\Microsoft/Windows\CurrentVersion\RunOnce to establish persistence.

AppleSeed has compressed collected data before exfiltration.

AppleSeed can zip and encrypt data collected on a target system.

AppleSeed has been distributed to victims through malicious e-mail attachments.

AppleSeed has exfiltrated files using web services.