Palo Alto Sofacy 06-2018

APT28 encrypted a .dll payload using RTL and a custom encryption algorithm. APT28 has also obfuscated payloads with base64, XOR, and RC4.

APT28 downloads and executes PowerShell scripts and performs PowerShell commands.

Zebrocy uses HTTP for C2.

Zebrocy uses SMTP and POP3 for C2.

Zebrocy collects the OS version and computer name. Zebrocy also runs the systeminfo command to gather system information.

Zebrocy obtains additional code to execute on the victim's machine, including the downloading of a secondary payload.

An APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload.

APT28 executed CHOPSTICK by using rundll32 commands such as rundll32.exe “C:\Windows\twain_64.dll”. APT28 also executed a .dll for a first stage dropper using rundll32.exe. An APT28 loader Trojan saved a batch script that uses rundll32 to execute a DLL payload.

APT28 has delivered JHUHUGIT and Koadic by executing PowerShell commands through DDE in Word documents.

APT28 has used the WindowStyle parameter to conceal PowerShell windows.

APT28 sent spearphishing emails containing malicious Microsoft Office and RAR attachments.

APT28 has obtained and used open-source tools like Koadic, Mimikatz, and Responder.

Zebrocy collects the serial number for the storage volume C:\.