admin@338
admin@338 is a China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in financial, economic, and trade policy, typically using publicly available RATs such as PoisonIvy, as well as some non-public backdoors. [1]
Techniques Used
Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1087 | .001 | Account Discovery: Local Account |
admin@338 actors used the following commands following exploitation of a machine with LOWBALL malware to enumerate user accounts: |
Enterprise | T1059 | .003 | Command and Scripting Interpreter: Windows Command Shell |
Following exploitation with LOWBALL malware, admin@338 actors created a file containing a list of commands to be executed on the compromised computer.[1] |
Enterprise | T1203 | Exploitation for Client Execution |
admin@338 has exploited client software vulnerabilities for execution, such as Microsoft Word CVE-2012-0158.[1] |
|
Enterprise | T1083 | File and Directory Discovery |
admin@338 actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about files and directories: |
|
Enterprise | T1036 | .005 | Masquerading: Match Legitimate Name or Location |
admin@338 actors used the following command to rename one of their tools to a benign file name: |
Enterprise | T1069 | .001 | Permission Groups Discovery: Local Groups |
admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to list local groups: |
Enterprise | T1566 | .001 | Phishing: Spearphishing Attachment |
admin@338 has sent emails with malicious Microsoft Office documents attached.[1] |
Enterprise | T1082 | System Information Discovery |
admin@338 actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about the OS: |
|
Enterprise | T1016 | System Network Configuration Discovery |
admin@338 actors used the following command after exploiting a machine with LOWBALL malware to acquire information about local networks: |
|
Enterprise | T1049 | System Network Connections Discovery |
admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to display network connections: |
|
Enterprise | T1007 | System Service Discovery |
admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to obtain information about services: |
|
Enterprise | T1204 | .002 | User Execution: Malicious File |
admin@338 has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails.[1] |