Profero APT27 December 2020

RCSession can collect data from a compromised host.

RCSession can store its obfuscated configuration file in the Registry under `HKLM\SOFTWARE\Plus` or `HKCU\SOFTWARE\Plus`.

RCSession can gather system owner information, including user and administrator privileges.

RCSession can launch itself from a hollowed svchost.exe process.

RCSession has the ability to capture keystrokes on a compromised host.

RCSession can identify processes based on PID.

Threat Group-3390 has used CVE-2014-6324 and CVE-2017-0213 to escalate privileges.

RCSession can remove files from a targeted system.

RCSession can use HTTP in C2 communications.

RCSession can gather system information from a compromised host.

RCSession has the ability to use TCP and UDP in C2 communications.

RCSession has the ability to drop additional files to an infected machine.

RCSession can use WinSock API for communication including WSASend and WSARecv.

RCSession can write its configuration file to the Registry.

RCSession can capture screenshots from a compromised host.

Threat Group-3390 has compromised third party service providers to gain access to victim's environments.

RCSession has the ability to execute inside the msiexec.exe process.

RCSession has the ability to modify a Registry Run key to establish persistence.

PlugX has the ability to use DLL search order hijacking for installation on targeted systems. PlugX has also used DLL side-loading to evade anti-virus. PlugX has also used a legitimately signed executable to side-load a malicious payload within a DLL file.

RCSession can be installed via DLL side-loading.