admin@338
admin@338 is a China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in financial, economic, and trade policy, typically using publicly available RATs such as PoisonIvy, as well as some non-public backdoors. [1]
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1036 | .005 | 伪装: Match Legitimate Name or Location |
admin@338 actors used the following command to rename one of their tools to a benign file name: |
| Enterprise | T1059 | .003 | 命令与脚本解释器: Windows Command Shell |
Following exploitation with LOWBALL malware, admin@338 actors created a file containing a list of commands to be executed on the compromised computer.[1] |
| Enterprise | T1203 | 客户端执行漏洞利用 |
admin@338 has exploited client software vulnerabilities for execution, such as Microsoft Word CVE-2012-0158.[1] |
|
| Enterprise | T1083 | 文件和目录发现 |
admin@338 actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about files and directories: |
|
| Enterprise | T1069 | .001 | 权限组发现: Local Groups |
admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to list local groups: |
| Enterprise | T1204 | .002 | 用户执行: Malicious File |
admin@338 has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails.[1] |
| Enterprise | T1082 | 系统信息发现 |
admin@338 actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about the OS: |
|
| Enterprise | T1007 | 系统服务发现 |
admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to obtain information about services: |
|
| Enterprise | T1049 | 系统网络连接发现 |
admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to display network connections: |
|
| Enterprise | T1016 | 系统网络配置发现 |
admin@338 actors used the following command after exploiting a machine with LOWBALL malware to acquire information about local networks: |
|
| Enterprise | T1087 | .001 | 账号发现: Local Account |
admin@338 actors used the following commands following exploitation of a machine with LOWBALL malware to enumerate user accounts: |
| Enterprise | T1566 | .001 | 钓鱼: Spearphishing Attachment |
admin@338 has sent emails with malicious Microsoft Office documents attached.[1] |