Korean FSI TA505 2020

FlawedAmmyy has collected information and files from a compromised machine.

FlawedAmmyy enumerates the current user during the initial infection.

SDBbot has sent collected data from a compromised host to its C2 servers.

FlawedAmmyy has sent data collected from a compromised host to its C2 servers.

FlawedAmmyy can collect mouse events.

FlawedAmmyy can collect keyboard events.

SDBbot can enumerate a list of running processes on a compromised machine.

FlawedAmmyy has used PowerShell to execute commands.

FlawedAmmyy has used `cmd` to execute commands on a compromised host.

FlawedAmmyy enumerates the privilege level of the victim during the initial infection.

FlawedAmmyy can execute batch scripts to delete files.

Amadey has collected the computer name and OS version from a compromised machine.

SDBbot has the ability to identify the OS version, OS bit information and computer name.

Amadey has searched for folders associated with antivirus software.

FlawedAmmyy can transfer files from C2.

TA505 has deployed payloads that use Windows API calls on a compromised host.

TA505 has used malware to disable Windows Defender through modification of the Registry.

FlawedAmmyy can capture screenshots.

FlawedAmmyy can collect clipboard data.

Amadey has decoded antivirus name strings.

FlawedAmmyy has been installed via `msiexec.exe`.

FlawedAmmyy has used `rundll32` for execution.

SDBbot has used rundll32.exe to execute DLLs.

Amadey has checked for a variety of antivirus products.

Amadey has changed the Startup folder to the one containing its executable by overwriting the registry keys.

FlawedAmmyy has established persistence via the `HKCU\SOFTWARE\microsoft\windows\currentversion\run` registry key.

Amadey has modified the `:Zone.Identifier` in the ADS area to zero.

Amadey has used fast flux DNS for its C2.

TA505 has registered domains to impersonate services such as Dropbox to distribute malware.

TA505 has staged malware on actor-controlled domains.

SDBbot can collected the country code of a compromised machine.

TA505 has used malware to disable Windows Defender.