Cybereason Molerats Dec 2020

SharpStage can use WMI for execution.

MoleNet can perform WMI commands on the system.

SharpStage has a persistence component to write a scheduled task for the payload.

MoleNet can use PowerShell to set persistence.

SharpStage can execute arbitrary commands with PowerShell.

SharpStage can execute arbitrary commands with the command line.

MoleNet can execute commands via the command line utility.

DropBook can execute arbitrary shell commands on the victims' machines.

DropBook is a Python-based backdoor compiled with PyInstaller.

DropBook has checked for the presence of Arabic language in the infected machine's settings.

MoleNet can collect information about the about the system.

DropBook can collect the names of all files and folders in the Program Files directories.

DropBook can communicate with its operators by exploiting the Simplenote, DropBox, and the social media platform, Facebook, where it can create fake accounts to control the backdoor and receive instructions.

SharpStage has used a legitimate web service for evading detection.

DropBook can download and execute additional files.

SharpStage has the ability to download and execute additional payloads via a DropBox API.

MoleNet can download additional payloads from the C2.

SharpStage has the ability to capture the victim's screen.

DropBook can unarchive data downloaded from the C2 to obtain the payload and persistence modules.

Molerats has sent malicious files via email that tricked users into clicking Enable Content to run an embedded macro and to download malicious archives.

MoleNet can use WMI commands to check the system for firewall and antivirus software.

SharpStage has the ability to create persistence for the malware using the Registry autorun key and startup folder.

MoleNet can achieve persitence on the infected machine by setting the Registry run key.

Molerats has sent phishing emails with malicious Microsoft Word and PDF attachments.