1 - appv

APT38 has renamed system utilities, such as `rundll32.exe` and `mshta.exe`, to avoid detection.

APT38 has put several spaces before a file extension to avoid detection and suspicion.

APT38 has used Task Scheduler to run programs at system startup or on a scheduled basis for persistence. Additionally, APT38 has used living-off-the-land scripts to execute a malicious script via a scheduled task.

APT38 has injected malicious payloads into the `explorer.exe` process.

APT38 has used a command-line tunneler, NACHOCHEESE, to give them shell access to a victim’s machine. Additionally, APT38 has used batch scripts.

APT38 has used VBScript to execute commands and other operational tasks.

APT38 used a backdoor, NESTEGG, that has the capability to download and upload files to and from a victim’s machine. Additionally, APT38 has downloaded other payloads onto a victim’s machine.

APT38 has used the RC4 algorithm to decrypt configuration data.

APT38 has used links to execute a malicious Visual Basic script.

APT38 has attempted to lure victims into enabling malicious macros within email attachments. Additionally, APT38 has used malicious Word documents and shortcut files.

APT38 has used a renamed version of `mshta.exe` to execute malicious HTML files.

APT38 has used `msiexec.exe` to execute malicious files.

APT38 has used rundll32.exe to execute binaries, scripts, and Control Panel Item files and to execute code via proxy to avoid triggering security tools.

APT38 has created a mutex to avoid duplicate execution.

APT38 has identified security software, configurations, defensive tools, and sensors installed on a compromised system.

APT38 has used the legitimate application `ieinstal.exe` to bypass UAC.

APT38 has used ISO and VHD files to deploy malware and to bypass Mark-of-the-Web (MOTW) security measures.

APT38 has created fake domains to imitate legitimate venture capital or bank domains.

APT38 has unhooked DLLs to disable endpoint detection and response (EDR) or anti-virus (AV) tools.