Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025

PAKLOG has used `GetForegroundWindow` to access the foreground window. PAKLOG has also captured text from the foreground windows.

Mustang Panda has delivered initial payloads hidden using archives and encoding measures. Mustang Panda has also utilized opaque predicates in payloads to hinder analysis.

SplatDropper has leveraged hashed Windows API calls using a seed value of "131313".

PAKLOG has utilized a simple encoding mechanism to encode characters in the buffer.

SplatDropper has also utilized XOR encrypted payload.

CorKLOG has encrypted collected contents using RC4. CorKLOG has also utilized XOR encrypted strings.

SplatCloak has used a revoked certificate to exploit Windows driver execution policy where certificates issued before a specific date could still load.

CorKLOG has achieved persistence through the creation of a scheduled task named TableInputServices by using the command `schtasks /create /tn TabletlnputServices /tr /sc minute /mo 10 /f`.

CorKLOG has captured keystrokes.

PAKLOG has captured keystrokes using Windows API.

PAKLOG has detected and logged the full path of processes active in the foreground using Windows API calls.

Mustang Panda will delete their tools and files, and kill processes after their objectives are reached.

SplatDropper has deleted its malicious payload and removed its own created service to avoid leaving traces of its presence on victim devices.

PAKLOG has stored the captured data in a file located `C:\\Users\\Public\\Libraries\\record.txt`.

CorKLOG has stored the captured data in an encrypted file using a 48-character RC4 key.

SplatCloak has collected the Windows build number using the windows kernel API `RtlGetVersion` to determine if the response is 19000 or higher (Windows 10 version 2004 or later).

SplatCloak has used Windows API to identify files associated with Windows Defender and Kaspersky.

SplatDropper has utilized hashed Native Windows API calls.

PAKLOG has used Windows API `SetWindowsHookExW` with `idHook` set to `WH_KEYBOARD_LL` and a custom hook procedure to support its keylogging functions.

Mustang Panda has used various Windows API calls during execution and defense evasion.

SplatCloak has utilized Native Windows API calls dynamically through `ZwQuerySystemInformation`.

PAKLOG has monitored and extracted clipboard contents.

PAKLOG has collected a timestamp to log the precise time a key was pressed, formatted as %Y-%m-%d %H:%M:%S.

SplatDropper has decoded XOR encrypted payload.

CorKLOG has decoded XOR encrypted strings.

Mustang Panda has sent malicious files requiring direct victim interaction to execute. Mustang Panda has also leveraged executable files that display decoy documents to the victim to provide a resemblance of legitimacy with customized themes related to the victim.

SplatCloak has identified drivers of AV solutions by searching for related filenames, keywords and signed certificates.

CorKLOG has created a service to establish persistence.

SplatDropper has created a service to execute a payload.

CorKLOG has used legitimate signed binaries such as lcommute.exe for follow-on execution of malicious DLLs through DLL side-loading.

SplatDropper has used legitimate signed binaries such as BugSplatHD64.exe for follow-on execution of malicious DLLs through DLL side-loading.

PAKLOG has used legitimate signed binaries such as PACLOUD.exe for follow-on execution of malicious DLLs through DLL Side-Loading.

Mustang Panda has used valid legitimate digital signatures and certificates to evade detection.

Mustang Panda has used a legitimately signed executable to execute a malicious payload within a DLL file. Mustang Panda has abused legitimate executables to side-load malicious DLLs.

CorKLOG has leveraged legitimate binaries to conduct DLL side-loading.

PAKLOG has leveraged legitimate binaries to conduct DLL side-loading.

SplatDropper has leveraged legitimate binaries to conduct DLL side-loading.

Mustang Panda has used revoked code signing certificates for its malicious payloads.

SplatCloak has identified and disabled API callback features of Windows Defender and Kaspersky.