admin@338

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file s

Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a sys

Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries dete

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to ope

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is don

Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a sp

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and

Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through info

Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems

Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as wel

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the prima

BUBBLEWRAP is a full-featured, second-stage backdoor used by the [admin@338](https://attack.mitre.org/group

LOWBALL is malware used by admin@338. It was used in August 2015 i

The Net utility is a component of the Windows operating system. It is used in command-line operations for c

PoisonIvy is a popular remote access tool (RAT) that has been used by many groups.(Citation: FireEye Poison

Systeminfo is a Windows utility that can be used to gather detailed information about a computer. (Citation

ipconfig is a Windows utility that can be used to find information about a system's TCP/IP, DNS, DHCP, and

netstat is an operating system utility that displays active TCP connections, listening ports, and network s