Procedure examples

Molerats has delivered compressed executables within ZIP files to victims.

Molerats has created scheduled tasks to persistently run VBScripts.

Molerats actors obtained a list of active processes on the victim and sent them to C2 servers.

Molerats used PowerShell implants on target machines.

Molerats used various implants, including those built with VBScript, on target machines.

Molerats used various implants, including those built with JS, on target machines.

Molerats used executables to download malicious files from different sources.

Molerats decompresses ZIP files once on the victim machine.

Molerats has sent malicious links via email trick users into opening a RAR archive and running an executable.

Molerats has sent malicious files via email that tricked users into clicking Enable Content to run an embedded macro and to download malicious archives.

Molerats has used msiexec.exe to execute an MSI payload.

Molerats saved malicious files within the AppData and Startup folders to maintain persistence.

Molerats has used forged Microsoft code-signing certificates on malware.

Molerats used the public tool BrowserPasswordDump10 to dump passwords saved in browsers on victims.

Molerats has sent phishing emails with malicious Microsoft Word and PDF attachments.

Molerats has sent phishing emails with malicious links included.