Putter Panda G0024

Overview 10 indicators

Putter Panda is a Chinese threat group that has been attributed to Unit 61486 of the 12th Bureau of the PLA’s 3rd General Staff Department (GSD).

Techniques 4 ATT&CK

Open in ATT&CK Navigator → or download the layer (4 techniques, layer 4.5)

• T1027.013 Encrypted/Encoded File
• T1055.001 Dynamic-link Library Injection
• T1547.001 Registry Run Keys / Startup Folder
• T1685 Disable or Modify Tools

Software 4

• 4H RAT
• 3PARA RAT
• pngdowner
• httpclient

Principal sources 6 reports

Ranked by how many of this actor's indicators each report brought in.

• 3virustotal.com/gui/file/452b1789b5f9c6acc390148048f923…
• 2virustotal.com/gui/file/75d3c3875744196cedff55d179bc62…
• 2virustotal.com/gui/file/6a237ffe0f7d84ffd9652662a2638a…
• 2virustotal.com/gui/file/2ab81ed10aa5f5f3443714924e4d89…
• 1samples.vx-underground.org/APTs/2010/2010.09.06/Paper/MSUpdater%20…
• 1virustotal.com/gui/file/d8a976979d4eeaf7485249c49d4a31…

Timeline 10 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.

1. 2022-04-10 1 domain, 2 url_path4 yrs ago

   virustotal.com/gui/file/452b1789b5f9c6acc390148048f923…

   domain	red.vssigma.com
   url_path	/microsoft/errorpost/default/connect.aspx
   url_path	/microsoftupdate/getupdate/default.aspx

   copy batch

2. 2022-04-10 2 domain4 yrs ago

   virustotal.com/gui/file/75d3c3875744196cedff55d179bc62…

   great.vssigma.com

   vssigma.com

   copy batch

3. 2022-04-10 2 domain4 yrs ago

   virustotal.com/gui/file/6a237ffe0f7d84ffd9652662a2638a…

   resell.siseau.com

   siseau.com

   copy batch

4. 2022-04-10 2 url4 yrs ago

   virustotal.com/gui/file/2ab81ed10aa5f5f3443714924e4d89…

   mail.hfmforum.com/microsoft/errorpost/default/connect.aspx

   mail.hfmforum.com/microsoftupdate/getupdate/default.aspx

   copy batch

5. 2022-04-10 1 url4 yrs ago

   samples.vx-underground.org/APTs/2010/2010.09.06/Paper/MSUpdater%20… · virustotal.com/gui/file/d8a976979d4eeaf7485249c49d4a31…

   http://140.112.19.195

   copy batch

Further reading 9

• cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence…
• attack.mitre.org/groups/G0024
• blogs.blackberry.com/en/2016/01/puttering-into-the-future
• virustotal.com/gui/file/75d3c3875744196cedff55d179bc62…
• virustotal.com/gui/file/452b1789b5f9c6acc390148048f923…
• samples.vx-underground.org/APTs/2010/2010.09.06/Paper/MSUpdater%20…
• virustotal.com/gui/file/2ab81ed10aa5f5f3443714924e4d89…
• virustotal.com/gui/file/6a237ffe0f7d84ffd9652662a2638a…
• virustotal.com/gui/file/d8a976979d4eeaf7485249c49d4a31…