S0345 Seasalt

Seasalt is malware that has been linked to APT1‘s 2010 operations. It shares some code similarities with OceanSalt.¹²

Techniques Used

Domain	ID	Name	Use
enterprise	T1071	Application Layer Protocol	-
enterprise	T1071.001	Web Protocols	Seasalt uses HTTP for C2 communications.¹
enterprise	T1547	Boot or Logon Autostart Execution	-
enterprise	T1547.001	Registry Run Keys / Startup Folder	Seasalt creates a Registry entry to ensure infection after reboot under `HKLM\Software\Microsoft\Windows\currentVersion\Run`.²
enterprise	T1059	Command and Scripting Interpreter	-
enterprise	T1059.003	Windows Command Shell	Seasalt uses cmd.exe to create a reverse shell on the infected endpoint.¹
enterprise	T1543	Create or Modify System Process	-
enterprise	T1543.003	Windows Service	Seasalt is capable of installing itself as a service.¹
enterprise	T1083	File and Directory Discovery	Seasalt has the capability to identify the drive type on a victim.²
enterprise	T1070	Indicator Removal	-
enterprise	T1070.004	File Deletion	Seasalt has a command to delete a specified file.¹
enterprise	T1105	Ingress Tool Transfer	Seasalt has a command to download additional files.¹¹
enterprise	T1036	Masquerading	-
enterprise	T1036.004	Masquerade Task or Service	Seasalt has masqueraded as a service called “SaSaut” with a display name of “System Authorization Service” in an apparent attempt to masquerade as a legitimate service.¹
enterprise	T1027	Obfuscated Files or Information	Seasalt obfuscates configuration data.¹
enterprise	T1057	Process Discovery	Seasalt has a command to perform a process listing.¹

ID	Name	References
G0006	APT1	¹²