admin@338

Introduction

admin@338 is a China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in financial, economic, and trade policy, typically using publicly available RATs such as PoisonIvy, as well as some non-public backdoors. FireEye admin@338

Activities and Tactics

Information pending cataloguing.

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

• T1566.001 Spearphishing Attachment
• T1016 System Network Configuration Discovery
• T1036.005 Match Legitimate Resource Name or Location
• T1083 File and Directory Discovery
• T1069.001 Local Groups
• T1049 System Network Connections Discovery
• T1087.001 Local Account
• T1203 Exploitation for Client Execution
• T1007 System Service Discovery
• T1204.002 Malicious File
• T1082 System Information Discovery
• T1059.003 Windows Command Shell

ATT&CK technique IDs (denormalized)

• T1007
• T1016
• T1036.005
• T1049
• T1059.003
• T1069.001
• T1082
• T1083
• T1087.001
• T1203
• T1204.002
• T1566.001

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

MITRE ATT&CK Software

• BUBBLEWRAP (S0043) — malware
• LOWBALL (S0042) — malware
• Systeminfo (S0096) — tool
• PoisonIvy (S0012) — malware
• Net (S0039) — tool
• netstat (S0104) — tool
• ipconfig (S0100) — tool

Attribution and Evidence

Information pending cataloguing.

References

[1] mitre-attack [3] FireEye admin@338 FireEye Threat Intelligence. (2015, December 1). China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets. Retrieved December 4, 2015.