AppleSeed can gain system level privilege by passingSeDebugPrivilege to theAdjustTokenPrivilege API.^[1]

AppleSeed has the ability to communicate with C2 over HTTP.^[1][2]

AppleSeed has compressed collected data before exfiltration.^[2]

AppleSeed can zip and encrypt data collected on a target system.^[1]

AppleSeed has automatically collected data from USB drives, keystrokes, and screen images before exfiltration.^[2]

AppleSeed has the ability to create the Registry key nameEstsoftAutoUpdate atHKCU\Software\Microsoft/Windows\CurrentVersion\RunOnce to establish persistence.^[1]

AppleSeed has the ability to execute its payload via PowerShell.^[1]

AppleSeed has the ability to use JavaScript to execute PowerShell.^[1]

AppleSeed can collect data on a compromised host.^[1][2]

AppleSeed can find and collect data from removable media devices.^[1][2]

AppleSeed can stage files in a central location prior to exfiltration.^[1]

AppleSeed has divided files if the size is 0x1000000 bytes or more.^[2]

AppleSeed can decode its payload prior to execution.^[1]

AppleSeed can exfiltrate files via the C2 channel.^[1]

AppleSeed has exfiltrated files using web services.^[2]

AppleSeed can use a second channel for C2 when the primary channel is in upload mode.^[1]

AppleSeed has the ability to search for .txt, .ppt, .hwp, .pdf, and .doc files in specified directories.^[1]

AppleSeed can delete files from a compromised host after they are exfiltrated.^[1]

AppleSeed can useGetKeyState andGetKeyboardState to capture keystrokes on the victim’s machine.^[1][2]

AppleSeed can disguise JavaScript files as PDFs.^[1]

AppleSeed has the ability to rename its payload to ESTCommon.dll to masquerade as a DLL belonging to ESTsecurity.^[1]

AppleSeed has the ability to use multiple dynamically resolved API calls.^[1]

AppleSeed has the ability to Base64 encode its payload and custom encrypt API calls.^[1]

AppleSeed has used UPX packers for its payload DLL.^[1]

AppleSeed has been distributed to victims through malicious e-mail attachments.^[1]

AppleSeed can enumerate the current process on a compromised host.^[1]

AppleSeed can take screenshots on a compromised host by calling a series of APIs.^[1][2]

AppleSeed can call regsvr32.exe for execution.^[1]

AppleSeed can identify the OS version of a targeted system.^[1]

AppleSeed can identify the IP of a targeted system.^[1]

AppleSeed can pull a timestamp from the victim's machine.^[1]

AppleSeed can achieve execution through users running malicious file attachments distributed via email.^[1]

^[1][2]