FireEye APT34 Dec 2017

POWRUNER may query the Registry by running reg query on a victim.

POWRUNER may collect network configuration data by running ipconfig /all on a victim.

OilRig has encrypted and encoded data in its malware, including by using base64.

POWRUNER may collect information about the currently logged in user by running whoami on a victim.

POWRUNER may use WMI when collecting information about a victim.

POWRUNER may collect active network connections by running netstat -an on a victim.

POWRUNER persists through a scheduled task that executes it every minute.

POWRUNER may collect process information by running tasklist on a victim.

OilRig has used various types of scripting for execution.

BONDUPDATER is written in PowerShell.

OilRig has used PowerShell scripts for execution, including use of a macro to run a PowerShell command to decode file contents.

POWRUNER is written in PowerShell.

OilRig has used macros to deliver malware such as QUADAGENT and OopsIE. OilRig has used batch scripts.

POWRUNER can execute commands from its C2 server.

POWRUNER may collect local group information by running net localgroup administrators or a series of other commands on a victim.

POWRUNER may collect domain group information by running net group /domain or a series of other commands on a victim.

OilRig has deleted files associated with their payload after execution.

POWRUNER can use HTTP for C2 communications.

POWRUNER can use DNS for C2 communications.

POWRUNER may collect information about the system by running hostname and systeminfo on a victim.

POWRUNER may enumerate user directories on a victim.

POWRUNER may collect user account information by running net user /domain or a series of other commands on a victim.

POWRUNER can download or upload files from its C2 server.

OilRig had downloaded remote files onto victim infrastructure.

POWRUNER can capture a screenshot from a victim.

POWRUNER can use base64 encoded C2 communications.

A OilRig macro has run a PowerShell command to decode file contents. OilRig has also used certutil to decode base64-encoded files on victims.

POWRUNER may collect information on the victim's anti-virus software.

BONDUPDATER uses -windowstyle hidden to conceal a PowerShell window that downloads a payload.

BONDUPDATER uses a DGA to communicate with command and control servers.