FireEye APT37 Feb 2018

APT37 has collected data from victims' local systems.

WINERACK can enumerate services.

WINERACK can enumerate active windows.

WINERACK can gather information on the victim username.

can collect the victim user name.

CORALDECK has exfiltrated data in HTTP POST headers.

DOGCALL is capable of logging keystrokes.

POORAIM can enumerate processes.

WINERACK can enumerate processes.

WINERACK can create a reverse shell that utilizes statically-linked Wine cmd.exe code to emulate Windows command prompt commands.

APT37 has used the command-line interface.

WINERACK can gather information about the host.

POORAIM can identify system information, including battery status.

SLOWDRIFT collects and sends system information to its C2.

KARAE can collect system information.

SHUTTERSPEED can collect system information.

can collect system information, including computer name, system manufacturer, IsDebuggerPresent state, and execution path.

CORALDECK searches for specified files.

WINERACK can enumerate files and directories.

POORAIM can conduct file browsing.

SLOWDRIFT uses cloud based services for C2.

KARAE can use public cloud-based storage providers for command and control.

APT37 leverages social networking sites and cloud platforms (AOL, Twitter, Yandex, Mediafire, pCloud, Dropbox, and Box) for C2.

POORAIM has used AOL Instant Messenger for C2.

DOGCALL is capable of leveraging cloud storage APIs such as Cloud, Box, Dropbox, and Yandex for C2.

SHUTTERSPEED can download and execute an arbitary executable.

SLOWDRIFT downloads additional payloads.

KARAE can upload and download files, including second-stage malware.

APT37 has downloaded second stage malware from compromised websites.

can download and execute a second-stage payload.

SHUTTERSPEED can capture screenshots.

DOGCALL is capable of capturing screenshots of the victim's machine.

POORAIM can perform screen capturing.

APT37 has used an audio capturing utility known as SOUNDWAVE that captures microphone input.

KARAE was distributed through torrent file-sharing websites to South Korean victims, using a YouTube video downloader application as a lure.

APT37 has used strategic web compromises, particularly of South Korean websites, to distribute malware. The group has also used torrent file-sharing sites to more indiscriminately disseminate malware to victims. As part of their compromises, the group has used a Javascript based profiler called RICECURRY to profile a victim's web browser and deliver malicious code accordingly.

POORAIM has been delivered through compromised sites acting as watering holes.

APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.

APT37 has sent spearphishing attachments attempting to get a user to open them.

APT37's has added persistence via the Registry key HKCU\Software\Microsoft\CurrentVersion\Run\.

APT37 has used a credential stealer known as ZUMKONG that can harvest usernames and passwords stored in browsers.

CORALDECK has created password-protected RAR, WinImage, and zip archives to be exfiltrated.

APT37 has access to destructive malware that is capable of overwriting a machine's Master Boot Record (MBR).

APT37 delivers malware using spearphishing emails with malicious HWP attachments.