Uninstallation Of APT33 From PC

Understand APT33

 

APT33 (Advanced Persistent Threat) is a suspected Iranian malware group that has carried out various operations for years since 2013. This Iranian threat group has targeted many organizations across multiple industries in the United States, Saudi Arabia, and South Korea with a particular interest in the aviation and energy sectors. This APT33 comes with so many groups. It targets competing industries of foreign countries in the area of aerospace, defense, and chemicals. Its main aim is to espionage operations to gather intelligence information and steal trade secrets. The malware used by the espionage group includes SHAPESHIFT (wiper), DROPSHOT (dropper) and TURNEDUP (custom backdoor, which is the final payload).

Techniques Used

APT33 sprays password to gain access to targeted computer systems. It uses port 443 for command and control. It uses a variety of publicly available tools like LaZagne, Mimikatz, Gpppassword, SniffPass, and ProcDump to dump user credentials. It uses WinRAR to compress all data prior to exfil. It uses base64 to encipher command and control traffic. It uses kill dates in their malware to guardrail execution. It uses FTP to exfiltrate files(separately from the C2 channel). It attempts to exploit a known vulnerability in WinRAR (CVE-2018-20250). It uses an available exploit for CVE-2017-0213 to escalate privileges on a local system. It uses SniffPass to collect credentials by sniffing network traffic. It uses base64 to encode payloads. It utilizes PowerShell to download files from the C2 server and run various scripts as well. It downloads additional files and programs from its C2 server. It sends spear-phishing emails containing links to .hta files. It uses HTTP for command and control. It uses AES for encryption of command and control traffic. It lures to click on links to malicious HTML applications delivered through spear-phishing emails. It uses valid accounts for initial access and privilege escalation.

Avoiding Tips

Always choose Custom/Advanced installation mode for every software downloads and installation. Always un-check to all hidden options which attempt to install additional and unwanted programs. Always do a complete scan of all downloaded attachments of email before opening. Don't open any suspicious and unknown attachments of spam emails that harm your PC. Don't try to visit any pornographic websites. Never try to update any applications from nonofficial websites and links. Always turn on the Windows Firewall security program and keep it updated all the time as well. Always try to use a well-reputed anti-virus program to keep your PC safe from APT33. Don't try to download any cracked software, themes, and similar respective products. Always try to keep a regular backup of all vital files. Always create a system restore point for security purpose on PC.

APT33 can be removed completely from the infected computer system by using two different modes. Manual and Automatic mode. In Manual mode, it requires high technical skill and well knowledge of computer system whereas, in Automatic mode, it doesn't require such all these things. Therefore, we recommend using Automatic mode for obtaining the best results in removing.

>>Free Download APT33 Scanner<<

 

Manual APT33 Removal Guide

Step 1: How to Start your PC in Safe Mode with Networking to Get Rid of APT33

(For Win 7 | XP | Vista Users)

• first of all PC is to be rebooted in Safe Mode with Networking
• Select on Start Button and Click on Shutdown | Restart option and select OK
• when the PC restarts, keep tapping on F8 until you don’t get Advanced Boot Options.
• Safe Mode with Networking Option is to be selected from the list.

(For Win 8 | 8.1 | Win 10 Users)

• Click on Power Button near Windows Login Screen
• Keep Shift Button on the keyboard pressed and select Restart Option
• Now Select on Enable Safe Mode with Networking Option

In case APT33, is not letting your PC to Start in Safe Mode, then following Step is to followed

Step 2: Remove APT33 Using System Restore Process

• PC need to be rebooted to Safe Mode with Command Prompt
• As soon as Command Prompt Window appear on the screen, select on cd restore and press on Enter option

Type rstrui.exe and Click on Enter again.

Now users need to Click on Next option and Choose restore point that was the last time Windows was working fine prior to APT33 infection. Once done, Click on Next button.

Select Yes to Restore your System and get rid of APT33 infection.

However, if the above steps does not work to remove APT33, follow the below mentioned steps

Step:3  Unhide All Hidden Files and Folders to Delete APT33

How to View APT33 Hidden Folders on Windows XP

1. In order to show the hidden files and folders, you need to follow the given instructions:-
2. Close all the Windows or minimize the opened application to go to desktop.
3. Open “My Computer” by double-clicking on its icon.
4. Click on Tools menu and select Folder options.
5. Click on the View tab from the new Window.
6. Check the Display contents of the system folders options.
7. In the Hidden files and folders section, you need to put a check mark on Show hidden files and folders option.
8. Click on Apply and then OK button. Now, close the Window.
9. Now, you can see all the APT33 related hidden files and folders on the system.

How to Access APT33 Hidden folders on Windows Vista

1. Minimize or close all opened tabs and go to Desktop.
2. Go to the lower left of your screen, you will see Windows logo there, click on Start button.
3. Go to Control Panel menu and click on it.
4. After Control Panel got opened, there will two options, either “Classic View” or “Control Panel Home View”.
5. Do the following when you are in “Classic View”.
6. Double click on the icon and open Folder Options.
7. Choose View tab.
8. Again move to step 5.
9. Do the following if you are “Control Panel Home View”.
10. Hit button on Appearance and Personalization link.
11. Chose Show Hidden Files or Folders.
12. Under the Hidden File or Folder section, click on the button which is right next to the Show Hidden Files or Folders.
13. Click on Apply button and then hit OK. Now, close the window.
14. Now, to show you all hidden files or folders created by APT33, you have successfully considered Windows Vista.

How to Unhide APT33 Created Folders on Windows 7

1. Go to the desktop and tap on the small rectangle which is located in the lower-right part of the system screen.

2. Now, just open the “Start” menu by clicking on the Windows start button which is located in the lower-left side of the PC screen that carries the windows logo.

3. Then after, look for the “Control Panel” menu option in the right-most row and open it.

4. When the Control Panel menu opens, then look for the “Folder Options” link.

5. Tap over the “View tab”.

6. Under the “Advanced Settings” category, double click on the “Hidden Files or Folders” associated with APT33.

7. Next, just select the check-box in order to Show hidden files, folders, or drives.

8. After this, click on “Apply” >> “OK” and then close the menu.

9. Now, the Windows 7 should be configured to show you all hidden files, folders or drives.

Steps to Unhide APT33 related Files and Folders on Windows 8

1. First of all, power on your Windows PC and click on start logo button that is found in left side of the system screen.
2. Now, move to program lists and select control panel app.
3. When Control panel is open completely, click on more settings option.
4. After, you will see a Control panel Window and then you choose “Appearance and Personalization” tab.
5. In Advance settings dialogue box, you need to tick mark on Show hidden files and folders and clear the check box for Hide protected system files.
6. Click on Apply and Ok button. This apply option helps you to detect and eradicate all types of APT33 related suspicious files.
7. Finally, navigate your mouse cursor on close option to exit this panel.

How to View APT33 associated folders on Windows 10

1. Open the folder if you wish to unhide files.

2. Search and Click on View in Menu bar

3. In Menu click on to view folder options.

4. Again click on View and Enable Radio Button associated with Show hidden files created by APT33, folder and drive.

5. Press apply and OK.

Step 4: Press Start Key along with R- copy + paste the below stated command and Click on OK

notepad %windir%/system32/Drivers/etc/hosts

• This will open up a new file, in case if your system has been hacked, some IP’s will be shown at the bottom of the screen

Click on the Start Menu, Input “Control Panel” in the search box —> Select. Network and Internet —> Network and Sharing Center —> Next Change Adapter Settings. Right-click your Internet connection —> Select on Properties.

• In case if you find Suspicious IP in the local host –or if you are finding it difficult and have any problem then submit question to us and we will be happy to help you.