MSTIC Nobelium Toolset May 2021

EnvyScout can collect sensitive NTLM material from a compromised host.

BoomBox can encrypt data using AES prior to exfiltration.

EnvyScout contains JavaScript code that can extract an encoded blob from its HTML body and write it to disk.

EnvyScout can Base64 encode payloads.

BoomBox can enumerate the username on a compromised host.

BoomBox has the ability to mask malicious data strings as PDF files.

EnvyScout has used folder icons for malicious files to lure victims into opening them.

EnvyScout can use cmd.exe to execute malicious files on compromised hosts.

EnvyScout can write files to disk with JavaScript using a modified version of the open-source tool FileSaver.

APT29 has leveraged the Microsoft Graph API to perform various actions across Azure and M365 environments. They have also utilized AADInternals PowerShell Modules to access the API

BoomBox has used HTTP POST requests for C2.

VaporRage can use HTTP to download shellcode from compromised websites.

EnvyScout can determine whether the ISO payload was received by a Windows or iOS device.

BoomBox can enumerate the hostname, domain, and IP of a compromised host.

BoomBox can search for specific files and directories on a machine.

BoomBox has the ability to execute an LDAP query to enumerate the distinguished name, SAM account name, and display name for all domain users.

BoomBox can execute an LDAP query to discover e-mail accounts for domain users.

BoomBox can download files from Dropbox using a hardcoded access token.

VaporRage has the ability to download malicious shellcode to compromised systems.

BoomBox has the ability to download next stage malware components to a compromised system.

EnvyScout can deobfuscate and write malicious ISO files to disk.

BoomBox can decrypt AES-encrypted files downloaded from C2.

NativeZone can decrypt and decode embedded Cobalt Strike beacon stage shellcode.

VaporRage can deobfuscate XOR-encoded shellcode prior to execution.

EnvyScout can use protocol handlers to coax the operating system to send NTLMv2 authentication responses to attacker-controlled infrastructure.

BoomBox has gained execution through user interaction with a malicious file.

NativeZone can display an RTF document to the user to enable execution of Cobalt Strike stage shellcode.

EnvyScout has been executed through malicious files attached to e-mails.

BoomBox can use RunDLL32 for execution.

EnvyScout has the ability to proxy execution of malicious files with Rundll32.

BoomBox can check its current working directory and for the presence of a specific file and terminate if specific values are not found.

VaporRage has the ability to check for the presence of a specific DLL and terminate if it is not found.

NativeZone can check for the presence of KM.EkeyAlmaz1C.dll and will halt execution unless it is in the same directory as the rest of the malware's components.

EnvyScout can call window.location.pathname to ensure that embedded files are being executed from the C: drive, and will terminate if they are not.

NativeZone has checked if Vmware or VirtualBox VM is running on a compromised host.

BoomBox can establish persistence by writing the Registry value MicroNativeCacheSvc to HKCU\Software\Microsoft\Windows\CurrentVersion\Run.

EnvyScout can use hidden directories and files to hide malicious executables.

EnvyScout has been distributed via spearphishing as an email attachment.

BoomBox can upload data to dedicated per-victim folders in Dropbox.

APT29 has used unique malware in many of their operations.