Carry-On Compromise: TA4922 Packs PackClient

MITRE Techniques

• [T1566.001 ] Spearphishing Attachment – Delivered ZIP/IMG attachments via tax-themed email lures to get victims to open malicious files (‘click a link to review documentation’ and ‘attached tax documents contained within a ZIP archive’).
• [T1204.002 ] User Execution: Malicious File – Victims were induced to open downloaded archives and executables to start the infection chain (‘the archive contained an executable’ and ‘When mounted, the image contained an executable’).
• [T1105 ] Ingress Tool Transfer – Malware downloaded next-stage payloads and plugins from C2 infrastructure (‘downloads the next stage of the chain’ and ‘downloaded another executable payload’).
• [T1055 ] Process Injection / Reflective Loading – The launcher reflectively loaded the core RAT DLL into memory (‘reflectively loads this PE file into memory’).
• [T1547.001 ] Boot or Logon Autostart Execution: Registry Run Keys/Startup Folder – Persistence was set through registry autorun entries (‘reg add HKCU…RunOnce’).
• [T1574.002 ] Hijack Execution Flow: DLL Side-Loading – An IMG file contained a malicious DLL used to execute the loader (‘leveraged DLL sideloading to execute Donut Loader’).
• [T1053.005 ] Scheduled Task/Job: Scheduled Task – Plugin functionality includes creating scheduled tasks (‘system administration type activities such as process listing, creating scheduled tasks’).
• [T1027 ] Obfuscated Files or Information – Packets and payloads used encrypted/XOR-decrypted content and encoded delivery (‘XOR-decrypts the Stage 2 payload’ and ‘base-64 encoded binary data’).
• [T1082 ] System Information Discovery – The malware collected OS version, machine GUID, local IP, architecture, and related system data (‘the rest of the TCP frame contains system information’).
• [T1057 ] Process Discovery – It enumerated running processes, including security tools and browsers (‘Enumerates running processes and reports on processes such as security products’).
• [T1056.001 ] Keylogging – PackClient includes keylogger capabilities (‘Keylogger and clipper capabilities’ and ‘start the keylogger’).
• [T1113 ] Screen Capture – The C2 can request screenshots/desktop previews (‘Start screen capture’ and ‘Enables desktop screenshot thumbnail functionality’).
• [T1219 ] Remote Access Software – The framework includes remote desktop, terminal, webcam, and proxy features (‘Support for remote desktop screen sharing’ and ‘Interactive remote shell’).
• [T1090.001 ] Proxy: Internal Proxy – The malware can create SOCKS/TCP tunnels (‘Start a proxy/SOCKS tunnel’ and ‘SOCKS/TCP proxy tunneling’).
• [T1041 ] Exfiltration Over C2 Channel – Stolen data such as screenshots and keylogger output was sent to the C2 (‘sync keylogger data’ and desktop screenshot transmission).