Overview 2,099 indicators
APT1 is a Chinese threat group that has been attributed to the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd Department, commonly known by its Military Unit Cover Designator (MUCD) as Unit 61398.
| domain | 2,099 | G0006-domain.txt |
Techniques 28 ATT&CK
Open in ATT&CK Navigator → or download the layer (28 techniques, layer 4.5)
- T1003.001 LSASS Memory
- T1005 Data from Local System
- T1007 System Service Discovery
- T1016 System Network Configuration Discovery
- T1021.001 Remote Desktop Protocol
- T1036.005 Match Legitimate Resource Name or Location
- T1049 System Network Connections Discovery
- T1057 Process Discovery
- T1059.003 Windows Command Shell
- T1087.001 Local Account
- T1114.001 Local Email Collection
- T1114.002 Remote Email Collection
- T1119 Automated Collection
- T1135 Network Share Discovery
- T1312 Compromise 3rd party infrastructure to support delivery
- T1326 Domain registration hijacking
- T1330 Acquire and/or use 3rd party software services
- T1333 Dynamic DNS
- T1346 Obtain/re-use payloads
- T1550.002 Pass the Hash
- T1560.001 Archive via Utility
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1583.001 Domains
- T1584.001 Domains
- T1585.002 Email Accounts
- T1588.001 Malware
- T1588.002 Tool
Software 17
- Mimikatz
- pwdump
- gsecdump
- PoisonIvy
- BISCUIT
- CALENDAR
- GLOOXMAIL
- PsExec
- Net
- Tasklist
- ipconfig
- WEBC2
- Cachedump
- Lslsass
- Pass-The-Hash Toolkit
- xCmd
- Seasalt
Principal sources 4 reports
Ranked by how many of this actor's indicators each report brought in.
- 2,046raw.githubusercontent.com/carbonblack/cbapi-python/master/example…
- 85secureworks.com/cyber-threat-intelligence/threats/htran
- 10samples.vx-underground.org/APTs/2011/2011.08.03/Paper/HTran.pdf
- 10virustotal.com/gui/file/f60d20f420e2860759944bb47b0c3e…
Related groups 2
What the sources have in common — not a claim that these are the same actor. See the whole graph.
Timeline 2,099 indicators
Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.
300 shown
Showing the 300 most recent of 2,099. Complete: G0006.json.
No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.
-
samples.vx-underground.org/APTs/2011/2011.08.03/Paper/HTran.pdf · virustotal.com/gui/file/f60d20f420e2860759944bb47b0c3e…
amazingrm.com bit.amazingrm.com dev.amazingrm.com funnygamea.vicp.net kxx.amazingrm.com my.amazingrm.com my.tpznet.net qa.amazingrm.com tpznet.net zp.amazingrm.com -
raw.githubusercontent.com/carbonblack/cbapi-python/master/example…
08elec.purpledaily.com 09back.purpledaily.com 3ml.infosupports.com 3pma.firefoxupdata.com 4cback.hugesoft.org 7cback.hugesoft.org 911.cnnnewsdaily.com a-ad.arrowservice.net a-af.arrowservice.net a-bne.arrowservice.net a-co.purpledaily.com a-dl.arrowservice.net a-ec.businessconsults.net a-ep.arrowservice.net a-ex.arrowservice.net a-fj.purpledaily.com a-ga.purpledaily.com a-gon.arrowservice.net a-he.arrowservice.net a-he.softsolutionbox.net a-if.arrowservice.net a-iho.arrowservice.net a-ja.purpledaily.com a-jsm.arrowservice.net a-jsm.infobusinessus.org a-ol.arrowservice.net a-ov.businessconsults.net a-pep.arrowservice.net a-rdr.arrowservice.net a-ri.comrepair.net a-uac.arrowservice.net a-un.purpledaily.com a-za.arrowservice.net a-za.businessconsults.net a-zx.purpledaily.com aam.businessconsults.net aarco.bigdepression.net abs.businessconsults.net acer.firefoxupdata.com acli-mail.businessconsults.net acu.businessconsults.net adb.businessconsults.net add.infosupports.com addr.infosupports.com adi002.hugesoft.org admin.arrowservice.net admin.datastorage01.org admin.firefoxupdata.com admin.softsolutionbox.net adobe.firefoxupdata.com ads.bpyoyo.com adt.businessconsults.net adt001.hugesoft.org adt002.hugesoft.org adtk.newsonet.net adtkl.bigish.net adtkl.gmailboxes.com adtlk.bigish.net advanbusiness.com ae.firefoxupdata.com aero.blackcake.net aes.infosupports.com af.arrowservice.net afda.businessconsults.net africa.mcafeepaying.com africa.todayusa.org africa.usabbs.org africadb.arrowservice.net afw.globalowa.com agl.softsolutionbox.net ago.businessconsults.net aiic.arrowservice.net aip.comrepair.net airline.firefoxupdata.com airplane.defenceonline.net ait.busketball.com ak47.infobusinessus.org ak47.msnhome.org alarm.arrowservice.net alarm.infobusinessus.org alcan.arrowservice.net alion.businessconsults.net alone.infosupports.com amanda.firefoxupdata.com amne.purpledaily.com ams.busketball.com amusement.firefoxupdata.com analysis.firefoxupdata.com anglo.arrowservice.net anti.firefoxupdata.com aol.arrowservice.net aol.infobusinessus.org aol.softsolutionbox.net aoldaily.com aolon1ine.com aon.infobusinessus.org apa.infosupports.com apa.newsonet.net apa.safalife.com apejack.bigish.net apekl.newsonet.net app.blackcake.net app.infobusinessus.org apple.blackcake.net apple.firefoxupdata.com apple.infosupports.com apple.rssadvanced.org applesoftupdate.com aps.bigdepression.net apss.newsonet.net apss.purpledaily.com ara.blackcake.net ara.infosupports.com ara2.blackcake.net ara2.infosupports.com arainfo.bigdepression.net arainfo.infosupports.com ares.aunewsonline.com argsafhq.blackberrycluter.com armi.arrowservice.net army.newsonlinesite.com army.todayusa.org arrowservice.net ascn.arrowservice.net asiv.softsolutionbox.net asp.arrowservice.net asp.businessconsults.net asp.busketball.com asp.softsolutionbox.net ass.globalowa.com astone.newsonet.net atm.firefoxupdata.com atom.busketball.com attnpower.com aunewsonline.com ausi.businessconsults.net auto.aoldaily.com auto.companyinfosite.com auto.firefoxupdata.com auto.gmailboxes.com auto.livemymsn.com auto.mcafeepaying.com auto.myyahoonews.com avast.firefoxupdata.com avph.earthsolution.org avvmail.com b.firefoxupdata.com bab.infosupports.com back.earthsolution.org back.firefoxupdata.com back.infobusinessus.org back.worthhummer.net backsun.busketball.com backup.infobusinessus.org backup.infosupports.com backup.msnhome.org backupsw.infobusinessus.org banner.infobusinessus.org barity.gmailboxes.com basketball.todayusa.org bass.busketball.com bat.bigdepression.net bat.blackcake.net bat.infosupports.com bat.safalife.com bbb.hugesoft.org bbh.dnsweb.org bbs.busketball.com bbs.firefoxupdata.com bbsfu.firefoxupdata.com bcc.blackberrycluter.com bcc.firefoxupdata.com bcc.infobusinessus.org bee.businessconsults.net bee.newspappers.org bee.usapappers.com bg-g.comrepair.net bhbt.infobusinessus.org bhbt.newsonet.net bigdepression.net bigish.net bing.firefoxupdata.com bitdefender.firefoxupdata.com bkav.firefoxupdata.com bkav2007.firefoxupdata.com bksy.businessconsults.net black.infobusinessus.org black.msnhome.org blackberrycluter.com blackcake.net blackfish.defenceonline.net bll.dnsweb.org blog.arrowservice.net blog.busketball.com blog.firefoxupdata.com blog.regicsgf.net blow.reutersnewsonline.com blue.infosupports.com bluefin.aunewsonline.com bmi.businessconsults.net bob.dnsweb.org bobo.businessconsults.net bobo.oplaymagzine.com book.firefoxupdata.com book.pop-musicsite.com book.reutersnewsonline.com booksonlineclub.com bot.bigdepression.net bourne.firefoxupdata.com bphb.arrowservice.net bpyoyo.com bring.busketball.com brog.regicsgf.net bswt.purpledaily.com built.arrowservice.net business.aunewsonline.com business.chileexe77.com business.infosupports.com business.jobsadvanced.com business.satellitebbs.com business.yahoodaily.com businessconsults.net businessformars.com busketball.com buy.infobusinessus.org buy.msnhome.org buycow.busketball.com buyer.arrowservice.net buz.businessconsults.net c.firefoxupdata.com caaid.newsonet.net cac.bigdepression.net cac.worthhummer.net cache.aolon1ine.com cacq.bigdepression.net cadfait.softsolutionbox.net cais.blackcake.net cais.hugesoft.org can.infobusinessus.org canada.cnndaily.com canadatvsite.com canary.firefoxupdata.com canoedaily.com cappuccino.firefoxupdata.com car1.bigdepression.net care.jobsadvanced.com care.satellitebbs.com cars.firefoxupdata.com carvin.infosupports.com ccsukl.purpledaily.com cdc01.hugesoft.org cdcd.newsonet.net cdd.purpledaily.com cdrnkl.worthhummer.net ce-ip.msnhome.org cecilia.firefoxupdata.com center.arrowservice.net center.busketball.com center.infosupports.com ceros.businessconsults.net cetv.firefoxupdata.com chat.infobusinessus.org chat.msnhome.org check.staycools.net check.thehealthmood.net chicken.hugesoft.org chicken.pop-musicsite.com chileexe77.com chivas.firefoxupdata.com chq.newsonet.net christitannahill.appspot.com cib.businessconsults.net cibuc.blackcake.net citrix.globalowa.com citt.downloadsite.me city.gmailboxes.com class.arrowservice.net client.infobusinessus.org climate.newsonet.net climate.oplaymagzine.com clin.earthsolution.org cman.blackcake.net cmp.gmailboxes.com cnndaily.com cnndaily.net cnnnewsdaily.com cobh.businessconsults.net coco.purpledaily.com code.jobsadvanced.com code.mcafeepaying.com · 1,709 more in this batch, in the JSON
Further reading 7
- cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence…
- attack.mitre.org/groups/G0006
- fireeye.com/content/dam/fireeye-www/services/pdfs/m…
- raw.githubusercontent.com/carbonblack/cbapi-python/master/example…
- samples.vx-underground.org/APTs/2011/2011.08.03/Paper/HTran.pdf
- secureworks.com/cyber-threat-intelligence/threats/htran
- virustotal.com/gui/file/f60d20f420e2860759944bb47b0c3e…