FireEye APT10 Sept 2018

UPPERCUT has the capability to gather the victim's proxy information.

menuPass has encoded strings in its malware with base64 as well as with a simple, single-byte XOR obfuscation using key 0x40.

UPPERCUT has the capability to collect the current logged on user’s username from a machine.

menuPass has used esentutl to change file extensions to their true type that were masquerading as .txt files.

menuPass has renamed certutil and moved it to a different location on the system to avoid detection based on use of the tool.

menuPass executes commands using a command-line interface and reverse shell. The group has used a modified version of pentesting script wmiexec.vbs to execute commands. menuPass has used malicious macros embedded inside Office documents to execute files.

UPPERCUT uses cmd.exe to execute commands on the victim’s machine.

UPPERCUT has used HTTP for C2, including sending error codes in cookie headers.

UPPERCUT has the capability to gather the system’s hostname and OS version.

UPPERCUT has the capability to gather the victim's current directory.

menuPass has used a global service provider's IP as a proxy for C2 traffic from a victim.

UPPERCUT can download and upload files to and from the victim’s machine.

UPPERCUT can capture desktop screenshots in the PNG format and send them to the C2 server.

UPPERCUT has the capability to obtain the time zone information and the current timestamp of the victim’s machine.

menuPass has used certutil in a macro to decode base64-encoded content contained in a dropper document attached to an email. The group has also used certutil -decode to decode files on the victim’s machine when dropping UPPERCUT.

menuPass has attempted to get victims to open malicious files such as Windows Shortcuts (.lnk) and/or Microsoft Office documents, sent via email as part of spearphishing campaigns.

menuPass has sent malicious Office documents via email as part of spearphishing campaigns as well as executables disguised as documents.

Some versions of UPPERCUT have used the hard-coded string “this is the encrypt key” for Blowfish encryption when communicating with a C2. Later versions have hard-coded keys uniquely for each C2 address. UPPERCUT has also used custom ChaCha20, XOR, and LZO algorithms for C2 communication.

menuPass has used DLL side-loading to launch versions of Mimikatz and PwDump6 as well as UPPERCUT. menuPass has also used DLL search order hijacking.