Zscaler

Mustang Panda has utilized TLS record headers in network packets to impersonate various versions of TLS protocols to blend in with legitimate network traffic. Mustang Panda has used FakeTLS to communicate with its C2 servers.

TONESHELL used FakeTLS headers in network packets to impersonate various versions of TLS protocols to blend in with legitimate network traffic. TONESHELL variants have utilized FakeTLS headers with the bytes `0x17 0x03 0x03` to represent TLSv1.2 and `0x17 0x03 0x04` for TLSv1.3.

StarProxy has utilized TLS record headers in network packets to impersonate various versions of TLS protocols to blend in with legitimate network traffic. StarProxy used FakeTLS to communicate with its C2 server.

Mustang Panda has delivered initial payloads hidden using archives and encoding measures. Mustang Panda has also utilized opaque predicates in payloads to hinder analysis.

TONESHELL has used randomized padding to obfuscate payloads.

TONESHELL has utilized a modified DJB2 algorithm to resolve APIs.

TONESHELL has renamed malicious files to mimic legitimate file names and file extensions. TONESHELL has also masqueraded as legitimate file names to include LogMeIn.dll.

TONESHELL has used DLL injection to execute payloads received from the C2 server.

StarProxy has used the command line for execution of commands.

TONESHELL has created a reverse shell using `cmd.exe`.

TONESHELL has deleted payload files received from the C2 server.

TONESHELL has the ability to retrieve the name of the infected machine.

TONESHELL included functionality to retrieve a list of user accounts.

StarProxy has proxied traffic between infected devices and their C2 servers.

StarProxy has used TCP for C2 communications to target IPs or domains. StarProxy contained code to support both UDP and TCP connections.

StarProxy has used native windows API calls such as `GetLocalTime()` to retrieve system data.

TONESHELL has utilized Native Windows API functions such as `WriteProcessMemory` and `CreateRemoteThreadEx`. TONESHELL has also utilized Windows API functions for creating seed values including `CoCreateGuid` and `GetTickCount`. TONESHELL has leveraged the legitimate API function `EnumSystemLocalesA` to run its shellcode through the callback function.

Mustang Panda has used various Windows API calls during execution and defense evasion.

StarProxy has utilized the windows API call `GetLocalTime()` to retrieve a SystemTime structure to generate a seed value.

TONESHELL included functionality to create sub-processes with a specific user’s token.

TONESHELL has decoded its payload prior to execution.

StarProxy has decrypted network packets using a custom algorithm.

TONESHELL has generated unique GUIDs to identify victim devices. TONESHELL has leveraged environmental keying in payload delivery using the victim computer name and other configuration values. TONESHELL has also tracked IDs associated with reverse shell subprocesses to manage interactions and terminations from C2.

Mustang Panda has used valid legitimate digital signatures and certificates to evade detection.

StarProxy has leveraged two 256-byte XOR keys to encrypt and decrypt network packets using a custom algorithm.

TONESHELL has used RC4 encryption in C2 communications. TONESHELL variants used a randomly generated variable length (0x20 - 0x200 bytes) rolling XOR key to encrypt and decrypt network packets.

StarProxy has been side-loaded by the legitimate, signed executable, IsoBurner.exe.

Mustang Panda has used a legitimately signed executable to execute a malicious payload within a DLL file. Mustang Panda has abused legitimate executables to side-load malicious DLLs.

TONESHELL has abused legitimate executables to side-load malicious DLLs. TONESHELL has also been loaded via DLL side-loading, using legitimate, signed executables to include: FastVD.exe, Bandizip.exe and gpgconf.exe.

TONESHELL has the ability to pause operations for a specified duration prior to follow-on execution of activities.