Securelist APT10 March 2021

P8RAT can send randomly-generated data as part of its C2 communication.

SodaMaster has the ability to query the Registry to detect a key specific to VMware.

Ecipekac can use XOR, AES, and DES to encrypt loader shellcode.

SodaMaster can use "stackstrings" for obfuscation.

FYAnti has used ConfuserEx to pack its .NET module.

SodaMaster can identify the username on a compromised host.

SodaMaster can search a list of running processes.

P8RAT can check for specific processes associated with virtual environments.

menuPass has used Wevtutil to remove PowerShell execution logs.

Cobalt Strike can use a custom command and control protocol that can be encapsulated in HTTP or HTTPS. All protocols use their standard assigned ports.

menuPass has used valid accounts including shared between Managed Service Providers and clients to move between the two environments.

SodaMaster can enumerate the host name and OS version on a target system.

FYAnti can search the C:\Windows\Microsoft.NET\ directory for files of a specified size.

P8RAT can download additional payloads to a target system.

Ecipekac can download additional payloads to a compromised host.

FYAnti can download additional payloads to a compromised host.

SodaMaster has the ability to download additional payloads from C2 to the targeted system.

SodaMaster can use RegOpenKeyW to access the Registry.

FYAnti has the ability to decrypt an embedded .NET module.

Ecipekac has the ability to decrypt fileless loader modules.

menuPass has leveraged vulnerabilities in Pulse Secure VPNs to hijack sessions.

SodaMaster can check for the presence of the Registry key HKEY_CLASSES_ROOT\\Applications\\VMwareHostOpen.exe before proceeding to its main functionality.

P8RAT can check the compromised host for processes associated with VMware or VirtualBox environments.

P8RAT has the ability to "sleep" for a specified time to evade detection.

SodaMaster has the ability to put itself to "sleep" for a specified time.

menuPass has resized and added data to the certificate table to enable the signing of modified files with legitimate signatures.

Ecipekac has used a valid, legitimate digital signature to evade detection.

SodaMaster can use RC4 to encrypt C2 communications.

SodaMaster can use a hardcoded RSA key to encrypt some of its C2 traffic.

Ecipekac can abuse the legitimate application policytool.exe to load a malicious DLL.