FireEye APT10 April 2017

menuPass uses scripts to enumerate IP ranges on the victim network. menuPass has also issued the command net view /domain to a PlugX implant to gather information about remote systems on the network.

In one instance, menuPass added PlugX as a service with a display name of "Corel Writing Tools Utility."

SNUGRIDE is capable of executing commands and spawning a reverse shell.

RedLeaves can receive and execute commands with cmd.exe. It can also provide a reverse shell.

RedLeaves can communicate to its C2 over HTTP and HTTPS if directed.

SNUGRIDE communicates with its C2 server over HTTP.

RedLeaves can enumerate and search for files and directories.

ChChes collects the victim's %TEMP% directory path and version of Internet Explorer.

menuPass has used a global service provider's IP as a proxy for C2 traffic from a victim.

ChChes is capable of downloading files, including additional modules.

RedLeaves can capture screenshots.

menuPass has used legitimate access granted to Managed Service Providers in order to access victims of interest.

menuPass has attempted to get victims to open malicious files such as Windows Shortcuts (.lnk) and/or Microsoft Office documents, sent via email as part of spearphishing campaigns.

PlugX can be added as a service to establish persistence. PlugX also has a module to change service configurations as well as start, control, and delete services.

SNUGRIDE establishes persistence through a Registry Run key.

menuPass has sent malicious Office documents via email as part of spearphishing campaigns as well as executables disguised as documents.

SNUGRIDE encrypts C2 traffic using AES with a static key.

RedLeaves is launched through use of DLL search order hijacking to load a malicious dll.