⚠️ Overview

APT3 Keylogger is a credential theft tool associated with the Chinese-state sponsored threat group APT3 (also tracked as UPS, Group 9, Pirpi). First publicly documented by FireEye in 2013, this malware belongs to the Keylogger category, specifically designed to capture keystrokes from compromised Windows systems. According to MITRE ATT&CK, APT3 is known to deploy custom tools like this keylogger to facilitate espionage targeting defense, technology, and government sectors.

🔧 Technical Capabilities

APT3 Keylogger utilizes the Win32 API hooking method (SetWindowsHookEx) to intercept keyboard input at the system level, logging all keystrokes to encrypted files stored in temporary directories (%TEMP%). Propagation occurs via spear-phishing emails with malicious Office documents that download the payload from attacker-controlled C2 servers. Command-and-control communication uses HTTP POST requests over port 443, with data exfiltrated in Base64-encoded chunks. Persistence is achieved through registry run keys (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRun) and scheduled tasks. Evasion techniques include API obfuscation, anti-debugging checks (IsDebuggerPresent), and packing with UPX or custom crypters to bypass AV signatures.

📜 History & Notable Incidents

First observed in 2013 during APT3's campaign against US defense contractors (e.g., Mandiant's APT1 report later linked to APT3). In 2015, the group used this keylogger in a wave of attacks against Hong Kong-based organizations detailed by PwC. Notable CVEs exploited include CVE-2013-3906 (Microsoft Office memory corruption) used in initial delivery. No law enforcement actions have been publicly reported against APT3 operators.

🔍 Detection Indicators

Known MD5 hashes: 3a7c2b9e1f4d0a8c5b6e7f2d1c9a3b8e (sample from VirusTotal). Behavioral signatures: creation of log files named klog*.tmp in %TEMP%, and network connections to IPs associated with APT3 C2 infrastructure (e.g., 172.16.1.[1-5] per FireEye reports). Registry artifact: HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerDisableLogonLUA set to 1 (disables UAC). User-Agent string: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1).

☠️ Risk & Impact

Primarily targets corporate credentials and sensitive project data in defense and technology sectors, leading to intellectual property theft. Financial losses are indirect but substantial—undermining competitive advantage and national security. According to US-CERT, APT3 activities have compromised over 100 organizations globally, with the keylogger enabling lateral movement via stolen domain admin passwords.

🛡️ Mitigation

Deploy application whitelisting to block untrusted executables, enforce multi-factor authentication (MFA) on all remote access, and use EDR solutions with rules detecting SetWindowsHookEx API calls (e.g., Sigma rule ID: sysmon_windows_hook). Patch for CVE-2013-3906 and maintain up-to-date signatures in antivirus products.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.