ESET Turla Mosquito Jan 2018

Mosquito uses the ipconfig command.

Mosquito stores configuration values under the Registry key HKCU\Software\Microsoft\[dllname].

Mosquito’s installer is obfuscated with a custom crypter to obfuscate the installer.

Mosquito runs whoami on the victim’s machine.

Mosquito's installer uses WMI to search for antivirus display names.

Mosquito runs tasklist to obtain running processes.

Mosquito can launch PowerShell Scripts.

Mosquito executes cmd.exe and uses a pipe to read the results and send back the output to the C2 server.

Turla has used various JavaScript-based backdoors.

Mosquito deletes files using DeleteFileW API call.

Turla has used HTTP and HTTPS for C2 communications.

A Turla JavaScript backdoor has used Google Apps Script as its C2 server.

Mosquito can upload and download files to the victim.

Mosquito leverages the CreateProcess() and LoadLibrary() calls to execute files with the .dll and .exe extensions.

Mosquito can modify Registry keys under HKCU\Software\Microsoft\[dllname] to store configuration values. Mosquito also modifies Registry keys under HKCR\CLSID\...\InprocServer32 with a path to the launcher.

Turla has used spearphishing via a link to get users to download and run their malware.

Mosquito's launcher uses rundll32.exe in a Registry Key value to start the main backdoor capability.

Mosquito's installer searches the Registry and system to see if specific antivirus tools are installed on the system.

Mosquito uses COM hijacking as a method of persistence.

A Turla Javascript backdoor added a local_update_check value under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to establish persistence. Additionally, a Turla custom executable containing Metasploit shellcode is saved to the Startup folder to gain persistence.

Mosquito establishes persistence under the Registry key HKCU\Software\Run auto_update.

Turla established persistence by adding a Shell value under the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon.

Turla attempted to trick targets into clicking on a link featuring a seemingly legitimate domain from Adobe.com to download their malware and gain initial access.

Mosquito uses a custom encryption algorithm, which consists of XOR and a stream that is similar to the Blum Blum Shub algorithm.