admin@338
admin@338 is a China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in financial, economic, and trade policy, typically using publicly available RATs such asPoisonIvy, as well as some non-public backdoors.[1]
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1087 | .001 | Account Discovery:Local Account | admin@338 actors used the following commands following exploitation of a machine withLOWBALL malware to enumerate user accounts: |
| Enterprise | T1059 | .003 | Command and Scripting Interpreter:Windows Command Shell | Following exploitation withLOWBALL malware,admin@338 actors created a file containing a list of commands to be executed on the compromised computer.[1] |
| Enterprise | T1203 | Exploitation for Client Execution | admin@338 has exploited client software vulnerabilities for execution, such as Microsoft Word CVE-2012-0158.[1] | |
| Enterprise | T1083 | File and Directory Discovery | admin@338 actors used the following commands after exploiting a machine withLOWBALL malware to obtain information about files and directories: | |
| Enterprise | T1036 | .005 | Masquerading:Match Legitimate Resource Name or Location | admin@338 actors used the following command to rename one of their tools to a benign file name: |
| Enterprise | T1069 | .001 | Permission Groups Discovery:Local Groups | admin@338 actors used the following command following exploitation of a machine withLOWBALL malware to list local groups: |
| Enterprise | T1566 | .001 | Phishing:Spearphishing Attachment | admin@338 has sent emails with malicious Microsoft Office documents attached.[1] |
| Enterprise | T1082 | System Information Discovery | admin@338 actors used the following commands after exploiting a machine withLOWBALL malware to obtain information about the OS: | |
| Enterprise | T1016 | System Network Configuration Discovery | admin@338 actors used the following command after exploiting a machine withLOWBALL malware to acquire information about local networks: | |
| Enterprise | T1049 | System Network Connections Discovery | admin@338 actors used the following command following exploitation of a machine withLOWBALL malware to display network connections: | |
| Enterprise | T1007 | System Service Discovery | admin@338 actors used the following command following exploitation of a machine withLOWBALL malware to obtain information about services: | |
| Enterprise | T1204 | .002 | User Execution:Malicious File | admin@338 has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails.[1] |