AppleSeed is a backdoor that has been used by Kimsuky to target South Korean government, academic, and commercial targets since at least 2021.
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
| IP:Port | Timestamp |
|---|
| Domain | Timestamp |
|---|
| URL | Timestamp |
|---|
Tool: AppleSeed
Names: AppleSeed, JamBog
Description: AppleSeed is a backdoor that has been used by Kimsuky to target South Korean government, academic, and commercial targets since at least 2021.
Category: Malware
Type: Backdoor
Information: https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite
Mitre-attack: https://attack.mitre.org/software/S0622/
Malpedia: https://malpedia.caad.fkie.fraunhofer.de/details/win.appleseed
Last-card-change: 2022-12-30
Source: https://apt.etda.or.th/cgi-bin/listtools.cgi
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
T1566.001 PHISHING : SPEARPHISHING ATTACHMENT appleseed has been distributed to victims through malicious e-mail attachments. | T1059.001 COMMAND AND SCRIPTING INTERPRETER : POWERSHELL appleseed has the ability to execute its payload via powershell. T1059.007 COMMAND AND SCRIPTING INTERPRETER : JAVASCRIPT appleseed has the ability to use javascript to execute powershell. T1204.002 USER EXECUTION : MALICIOUS FILE appleseed can achieve execution through users running malicious file attachments distributed via email. | T1547.001 BOOT OR LOGON AUTOSTART EXECUTION : REGISTRY RUN KEYS / STARTUP FOLDER appleseed has the ability to create the registry key name estsoftautoupdate at hkcu\software\microsoft/windows\currentversion\runonce to establish persistence. | T1134 ACCESS TOKEN MANIPULATION appleseed can gain system level privilege by passing sedebugprivilege to the adjusttokenprivilege api. T1547.001 BOOT OR LOGON AUTOSTART EXECUTION : REGISTRY RUN KEYS / STARTUP FOLDER appleseed has the ability to create the registry key name estsoftautoupdate at hkcu\software\microsoft/windows\currentversion\runonce to establish persistence. | T1134 ACCESS TOKEN MANIPULATION appleseed can gain system level privilege by passing sedebugprivilege to the adjusttokenprivilege api. T1070.004 INDICATOR REMOVAL : FILE DELETION appleseed can delete files from a compromised host after they are exfiltrated. T1036.005 MASQUERADING : MATCH LEGITIMATE NAME OR LOCATION appleseed has the ability to rename its payload to estcommon.dll to masquerade as a dll belonging to estsecurity. T1027 OBFUSCATED FILES OR INFORMATION appleseed has the ability to base64 encode its payload and custom encrypt api calls. T1027.002 OBFUSCATED FILES OR INFORMATION : SOFTWARE PACKING appleseed has used upx packers for its payload dll. | T1056.001 INPUT CAPTURE : KEYLOGGING appleseed can use getkeystate and getkeyboardstate to capture keystrokes on the victim’s machine. | T1083 FILE AND DIRECTORY DISCOVERY appleseed has the ability to search for .txt, .ppt, .hwp, .pdf, and .doc files in specified directories. | T1560.001 ARCHIVE COLLECTED DATA : ARCHIVE VIA UTILITY appleseed can zip and encrypt data collected on a target system. T1119 AUTOMATED COLLECTION appleseed has automatically collected data from usb drives, keystrokes, and screen images before exfiltration. T1074.001 DATA STAGED : LOCAL DATA STAGING appleseed can stage files in a central location prior to exfiltration. T1056.001 INPUT CAPTURE : KEYLOGGING appleseed can use getkeystate and getkeyboardstate to capture keystrokes on the victim’s machine. T1113 SCREEN CAPTURE appleseed can take screenshots on a compromised host by calling a series of apis. | T1071.001 APPLICATION LAYER PROTOCOL : WEB PROTOCOLS appleseed has the ability to communicate with c2 over http. T1008 FALLBACK CHANNELS appleseed can use a second channel for c2 when the primary channel is in upload mode. |