Unit42 Molerat Mar 2020

Spark has been packed with Enigma Protector to obfuscate its contents.

Spark has run the whoami command and has a built-in command to identify the user logged in.

Spark has exfiltrated data over the C2 channel.

Molerats has created scheduled tasks to persistently run VBScripts.

Spark can use cmd.exe to run commands.

Molerats used various implants, including those built with VBScript, on target machines.

Spark has used HTTP POST requests to communicate with its C2 server to receive commands.

Spark can collect the hostname, keyboard layout, and language from the system.

Molerats used executables to download malicious files from different sources.

Spark has encoded communications with the C2 server with base64.

Spark has used a custom XOR algorithm to decrypt the payload.

Molerats has sent malicious links via email trick users into opening a RAR archive and running an executable.

Molerats has sent malicious files via email that tricked users into clicking Enable Content to run an embedded macro and to download malicious archives.

Molerats has used msiexec.exe to execute an MSI payload.

Spark has used a splash screen to check whether an user actively clicks on the screen before running malicious code.

Molerats has sent phishing emails with malicious Microsoft Word and PDF attachments.

Spark has checked the results of the GetKeyboardLayoutList and the language name returned by GetLocaleInfoA to make sure they contain the word “Arabic” before executing.