ESET OceanLotus Mar 2019

APT32's backdoor can query the Windows Registry to gather system information.

APT32's backdoor has stored its configuration in a registry key.

APT32 has performed code obfuscation, including encoding payloads using Base64 and using a framework called "Dont-Kill-My-Cat (DKMC). APT32 also encrypts the library used for network exfiltration with AES-256 in CBC mode in their macOS backdoor.

APT32 includes garbage code to mislead anti-malware software and researchers.

APT32's backdoor has exfiltrated data using the already opened channel with its C&C server.

APT32's backdoor can exfiltrate data by encoding it in the subdomain field of DNS packets.

APT32 has used scheduled tasks to persist on victim systems.

APT32 has used scheduled task raw XML with a backdated timestamp of June 2, 2016. The group has also set the creation time of the files dropped by the second stage of the exploit to match the creation time of kernel32.dll. Additionally, APT32 has used a random value to modify the timestamp of the file storing the clientID.

APT32 has collected the OS version and computer name from victims. One of the group's backdoors can also query the Windows Registry to gather system information, and another macOS backdoor performs a fingerprint of the machine on its first connection to the C&C server. APT32 executed shellcode to identify the name of the infected host.

APT32's backdoor possesses the capability to list files and directories on a machine.

APT32's backdoor has modified the Windows Registry to store the backdoor's configuration.

APT32 has used RTF document that includes an exploit to execute malicious code. (CVE-2017-11882)

APT32 has attempted to lure users to execute a malicious dropper delivered via a spearphishing attachment.

APT32 created a Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory. The group has also used regsvr32 to run their backdoor.

APT32 modified Windows Services to ensure PowerShell scripts were loaded on the system. APT32 also creates a Windows service to establish persistence.

APT32 established persistence using Registry Run keys, both to execute PowerShell and VBS scripts as well as to execute their backdoor directly.

APT32's backdoor has used LZMA compression and RC4 encryption before exfiltration.

APT32 has sent spearphishing emails with a malicious executable disguised as a document or spreadsheet.

APT32's backdoor has used Windows services as a way to execute its malicious payload.

An APT32 backdoor can use HTTP over a non-standard TCP port (e.g 14146) which is specified in the backdoor configuration.

APT32 ran legitimately-signed executables from Symantec and McAfee which load a malicious DLL. The group also side-loads its backdoor by dropping a library and a legitimate, signed executable (AcroTranscoder).