SentinelOne Aoqin Dragon June 2022

Mongall has the ability to upload files from victim's machines.

Heyoka Backdoor can check if it is running as a service on a compromised host.

Aoqin Dragon has used the Themida packer to obfuscate malicious payloads.

Mongall has been packed with Themida.

Heyoka Backdoor can encrypt its payload.

Aoqin Dragon has used fake icons including antivirus and external drives to disguise malicious payloads.

Heyoka Backdoor has been named `srvdll.dll` to appear as a legitimate service.

Mongall can upload files and information from a compromised host to its C2 server.

Heyoka Backdoor can inject a DLL into rundll32.exe for execution.

Mongall can inject a DLL into `rundll32.exe` for execution.

Heyoka Backdoor can gather process information.

Heyoka Backdoor has the ability to delete folders and files from a targeted system.

Mongall can use HTTP for C2 communication.

Heyoka Backdoor can use DNS tunneling for C2 communications.

Mongall can retrieve the hostname via `gethostbyname`.

Heyoka Backdoor has the ability to search the compromised host for files.

Aoqin Dragon has run scripts to identify file formats including Microsoft Word.

Aoqin Dragon has used a dropper that employs a worm infection strategy using a removable device to breach a secure network environment.

Mongall can download files to targeted systems.

Mongall can identify removable media attached to compromised hosts.

Heyoka Backdoor can identify removable media attached to victim's machines.

Mongall can use Base64 to encode information sent to its C2.

Mongall has the ability to decrypt its payload prior to execution.

Heyoka Backdoor can decrypt its payload prior to execution.

Aoqin Dragon has exploited CVE-2012-0158 and CVE-2010-3333 for execution against targeted systems.

Mongall has relied on a user opening a malicious document for execution.

Aoqin Dragon has lured victims into opening weaponized documents, fake external drives, and fake antivirus to execute malicious payloads.

Heyoka Backdoor has been spread through malicious document lures.

Mongall can use `rundll32.exe` for execution.

Heyoka Backdoor can use rundll32.exe to gain execution.

Mongall can establish persistence with the auto start function including using the value `EverNoteTrayUService`.

Heyoka Backdoor can establish persistence with the auto start function including using the value `EverNoteTrayUService`.

Aoqin Dragon has spread malware in target networks by copying modules to folders masquerading as removable devices.

Heyoka Backdoor can use spoofed DNS requests to create a bidirectional tunnel between a compromised host and its C2 servers.

Mongall has the ability to RC4 encrypt C2 communications.

Aoqin Dragon has used custom malware, including Mongall and Heyoka Backdoor, in their operations.

Aoqin Dragon obtained the Heyoka open source exfiltration tool and subsequently modified it for their operations.

Heyoka Backdoor can enumerate drives on a compromised host.

Mongall can identify drives on compromised hosts.