Kaspersky MoleRATs April 2019

Molerats has delivered compressed executables within ZIP files to victims.

DustySky has exfiltrated data to the C2 server.

DustySky collects information about running processes from victims.

Molerats used PowerShell implants on target machines.

Molerats used various implants, including those built with VBScript, on target machines.

Molerats used various implants, including those built with JS, on target machines.

DustySky can delete files it creates from the infected system.

DustySky created folders in temp directories to host collected files before exfiltration.

DustySky scans the victim for files that contain certain keywords and document types including PDF, DOC, DOCX, XLS, and XLSX, from a list that is obtained from the C2 as a text file. It can also identify logical drives for the infected machine.

Molerats used executables to download malicious files from different sources.

DustySky captures PNG screenshots of the main screen.

DustySky can detect connected USB devices.

Molerats decompresses ZIP files once on the victim machine.

Molerats has sent malicious links via email trick users into opening a RAR archive and running an executable.

Molerats has sent malicious files via email that tricked users into clicking Enable Content to run an embedded macro and to download malicious archives.

DustySky lists all installed software for the infected machine.

Molerats saved malicious files within the AppData and Startup folders to maintain persistence.

DustySky can compress files via RAR while staging data to be exfiltrated.

Molerats has sent phishing emails with malicious Microsoft Word and PDF attachments.

Molerats has sent phishing emails with malicious links included.