Unit42 Emissary Panda May 2019

HyperBro can list all services and their configurations.

A Threat Group-3390 tool can encrypt payloads using XOR. Threat Group-3390 malware is also obfuscated using Metasploit’s shikata_ga_nai encoder.

Threat Group-3390 malware is compressed with LZNT1 compression.

Threat Group-3390 actors use the Hunter tool to conduct network service discovery for vulnerable systems.

HyperBro can run shellcode it injects into a newly created process.

Threat Group-3390 has used command-line interfaces for execution.

HyperBro has the ability to delete a specified file.

HyperBro has used HTTPS for C2 communications.

HyperBro has the ability to download additional files.

HyperBro has the ability to run an application (CreateProcessW) or script/file (ShellExecuteW) via API.

HyperBro has the ability to take screenshots.

Threat Group-3390 has exploited MS17-010 to move laterally to other systems on the network.

Threat Group-3390 has used a variety of Web shells.

HyperBro has the ability to start and stop a specified service.

HyperBro has used a legitimate application to sideload a DLL to decrypt, decompress, and run a payload.

Threat Group-3390 has performed DLL search order hijacking to execute their payload. Threat Group-3390 has also used DLL side-loading, including by using legitimate Kaspersky antivirus variants as well as `rc.exe`, a legitimate Microsoft Resource Compiler.

Threat Group-3390 has obtained and used tools such as Impacket, pwdump, Mimikatz, gsecdump, NBTscan, and Windows Credential Editor.