Skip to content
Threat Feed
Subscribe

Tag

APT37

4 briefs RSS
medium threat

Abuse of expand.exe for Malicious Payload Staging

APT37 leverages the native Windows expand.exe utility to extract malicious CAB archives into common staging directories like C:\ProgramData as a precursor to persistence and execution.

APT37 defense-evasion execution windows living-off-the-land
1r 2t
medium threat

Windows Cabinet File Extraction via Expand.exe

Detection of expand.exe being used to extract Microsoft Cabinet (CAB) archives, specifically when extracting to C:\ProgramData or similar staging locations, potentially indicating ingress tool transfer and payload staging by threat actors like APT37.

Splunk Enterprise +2 APT37 cabinet_extraction expand.exe windows endpoint
2r 2t
high threat

ScarCruft (APT37) Deploying BirdCall Android Backdoor via Compromised Game Platform

The APT37 group (ScarCruft) is distributing an Android version of the BirdCall backdoor via a supply-chain attack targeting a Chinese video game platform, sqgame[.]net, to collect sensitive information from users.

Google Play +2 ScarCruft android malware spyware apt37 supply-chain
2r 5t 1i
high threat

Braodo Stealer Screen Capture in TEMP Directory

This analytic detects the creation of screen capture files in the TEMP directory, specifically targeting activity associated with the Braodo stealer malware, which captures screenshots of the victim's desktop as part of its data theft activities.

Splunk Enterprise +2 Braodo Stealer stealc-stealer crypto-stealer braodo-stealer apt37 hellcat-ransomware vip-keylogger screen-capture malware
2r 1t