ESET InvisiMole June 2018

InvisiMole can mimic HTTP protocol with custom HTTP “verbs” HIDE, ZVVP, and NOP.

InvisiMole can collect data from the system, and can monitor changes in specified directories.

InvisiMole can obtain running services on the victim.

InvisiMole has been configured with several servers available for alternate C2 communications.

InvisiMole can enumerate windows and child windows on a compromised host.

InvisiMole can enumerate Registry values, keys, and data.

InvisiMole gathers information on the IP forwarding table, MAC address, configured proxy, and network SSID.

InvisiMole avoids analysis by encrypting all strings, internal files, configuration data and by using a custom executable format.

InvisiMole lists local users and session information.

InvisiMole has disguised its droppers as legitimate software or documents, matching their original names and locations, and saved its files as mpr.dll in the Windows folder.

InvisiMole can obtain a list of running processes.

InvisiMole can launch a remote shell to execute commands.

InvisiMole has deleted files and directories including XML and files successfully uploaded to C2 servers.

InvisiMole can disconnect previously connected remote drives.

InvisiMole samples were timestomped by the authors by setting the PE timestamps to all zero values. InvisiMole also has a built-in command to modify file times.

InvisiMole uses HTTP for C2 communications.

InvisiMole determines a working directory where it stores all the gathered data about the compromised machine.

InvisiMole can gather information on the OS version, computer name, DEP policy, and memory size.

InvisiMole can list information about files in a directory and recently opened or used documents. InvisiMole can also search for specific files by supplied file mask.

InvisiMole has a command to list account information on the victim’s machine.

InvisiMole can function as a proxy to create a server that relays communication between the client and C&C server, or between two clients.

InvisiMole InvisiMole can identify proxy servers used by the victim and use them for C2 communication.

InvisiMole can upload files to the victim's machine for operations.

InvisiMole has a command to create, set, copy, or delete a specified Registry key or value.

InvisiMole can capture screenshots of not only the entire screen, but of each separate window open, in case they are overlapping.

InvisiMole can sort and collect specific documents as well as generate a list of all files on a newly inserted drive and store them in an encrypted file.

InvisiMole can record sound using input audio devices.

InvisiMole gathers the local system time from the victim’s machine.

InvisiMole can remotely activate the victim’s webcam to capture content.

InvisiMole can gather network share information.

InvisiMole can decrypt, unpack and load a DLL from its resources, or from blobs encrypted with Data Protection API, two-key triple DES, and variations of the XOR cipher.

InvisiMole can can remove all system restore points.

InvisiMole can collect information about installed software used by specific users, software executed on user login, and software executed by each system.

InvisiMole can use fileless UAC bypass and create an elevated COM object to escalate privileges.

InvisiMole uses WinRAR to compress data that is intended to be exfiltrated.

InvisiMole can use zlib to compress and decompress data.

InvisiMole uses a variation of the XOR cipher to encrypt files before exfiltration.

InvisiMole uses variations of a simple XOR encryption routine for C&C communications.

InvisiMole can be launched by using DLL search order hijacking in which the wrapper DLL is placed in the same folder as explorer.exe and loaded during startup into the Windows Explorer process instead of the legitimate library.

InvisiMole can gather information on the mapped drives and system volume serial number.

InvisiMole has a command to disable routing and the Firewall on the victim’s machine.