QiAnXin APT-C-36 Feb2019

Imminent Monitor has a module for performing remote desktop access.

APT-C-36 has used ConfuserEx to obfuscate its variant of Imminent Monitor, compressed payloads and RAT packages, and password protected encrypted email attachments to avoid detection. APT-C-36 has also compressed initial droppers into ZIP, LHA and UUE formats.

Imminent Monitor has encrypted the spearphish attachments to avoid detection from email gateways; the debugger also encrypts information before sending to the C2.

APT-C-36 has disguised its scheduled tasks as those used by Google.

Imminent Monitor has uploaded a file containing debugger logs, network information and system information to the C2.

APT-C-36 has used a macro function to set scheduled tasks, disguised as those used by Google.

Imminent Monitor has a CommandPromptPacket and ScriptPacket module(s) for creating a remote shell and executing scripts.

APT-C-36 has used VBScript for initial malware deployment including within a malicious Word document which is executed upon the document opening.

Imminent Monitor has deleted files related to its dynamic debugger feature.

Imminent Monitor has a dynamic debugging feature to check whether it is located in the %TEMP% directory, otherwise it copies itself there.

APT-C-36 has downloaded binary data from a specified domain after the malicious document is opened.

Imminent Monitor has leveraged CreateProcessW() call to execute the debugger.

Imminent Monitor has a remote microphone monitoring capability.

Imminent Monitor has a remote webcam monitoring capability.

Imminent Monitor has decoded malware components that are then dropped to the system.

APT-C-36 has prompted victims to open attachments and to accept macros in order to execute the subsequent payload. APT-C-36 has also lured victims into opening malicious files hosted on Google Drive that triggered WebDAV requests to download malware.

Imminent Monitor has a PasswordRecoveryPacket module for recovering browser passwords.

Imminent Monitor has a dynamic debugging feature to set the file attribute to hidden.

APT-C-36 has used spearphishing emails with malicious .pdf and .docx files and password protected RAR attachments to avoid being detected by the email gateway.

APT-C-36 has used port 4050 for C2 communications.

APT-C-36 utilizes tools well known in crime communities and has obtained and used a modified variant of Imminent Monitor.