ATT&CK SoftwareSeasalt

Seasalt

S0345

Malware.View on attack.mitre.org

About this malware

Seasalt is malware that has been linked to APT1's 2010 operations. It shares some code similarities with OceanSalt.

Techniques used10

Execution1

T1059.003Windows Command Shell

Persistence2

T1543.003Windows Service T1547.001Registry Run Keys / Startup Folder

Privilege Escalation2

T1543.003Windows Service T1547.001Registry Run Keys / Startup Folder

Stealth3

T1027.013Encrypted/Encoded File T1036.004Masquerade Task or Service T1070.004File Deletion

Discovery2

T1057Process Discovery T1083File and Directory Discovery

Command and Control2

T1071.001Web Protocols T1105Ingress Tool Transfer

Procedure examples10

Technique	Procedure example
T1027.013 Encrypted/Encoded File	Seasalt obfuscates configuration data. Mandiant APT1 Appendix
T1036.004 Masquerade Task or Service	Seasalt has masqueraded as a service called "SaSaut" with a display name of "System Authorization Service" in an apparent attempt to masquerade as a legitimate service. Mandiant APT1 Appendix
T1057 Process Discovery	Seasalt has a command to perform a process listing. Mandiant APT1 Appendix
T1059.003 Windows Command Shell	Seasalt uses cmd.exe to create a reverse shell on the infected endpoint. Mandiant APT1 Appendix
T1070.004 File Deletion	Seasalt has a command to delete a specified file. Mandiant APT1 Appendix
T1071.001 Web Protocols	Seasalt uses HTTP for C2 communications. Mandiant APT1 Appendix
T1083 File and Directory Discovery	Seasalt has the capability to identify the drive type on a victim. McAfee Oceansalt Oct 2018
T1105 Ingress Tool Transfer	Seasalt has a command to download additional files. Mandiant APT1 Appendix
T1543.003 Windows Service	Seasalt is capable of installing itself as a service. Mandiant APT1 Appendix
T1547.001 Registry Run Keys / Startup Folder	Seasalt creates a Registry entry to ensure infection after reboot under `HKLM\Software\Microsoft\Windows\currentVersion\Run`. McAfee Oceansalt Oct 2018

Groups that use it1

Campaigns0

None recorded.

References2

Mandiant APT1 Appendix Open source
Mandiant. (n.d.). Appendix C (Digital) - The Malware Arsenal. Retrieved July 18, 2016.
McAfee Oceansalt Oct 2018 Open source
Sherstobitoff, R., Malhotra, A. (2018, October 18). ‘Operation Oceansalt’ Attacks South Korea, U.S., and Canada With Source Code From Chinese Hacker Group. Retrieved November 30, 2018.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.