ESET InvisiMole June 2020

InvisiMole can mimic HTTP protocol with custom HTTP “verbs” HIDE, ZVVP, and NOP.

InvisiMole has been configured with several servers available for alternate C2 communications.

InvisiMole can enumerate windows and child windows on a compromised host.

InvisiMole gathers information on the IP forwarding table, MAC address, configured proxy, and network SSID.

InvisiMole can collect jpeg files from connected MTP devices.

InvisiMole avoids analysis by encrypting all strings, internal files, configuration data and by using a custom executable format.

InvisiMole has undergone regular technical improvements in an attempt to evade detection.

InvisiMole has attempted to disguise itself by registering under a seemingly legitimate service name.

InvisiMole has disguised its droppers as legitimate software or documents, matching their original names and locations, and saved its files as mpr.dll in the Windows folder.

InvisiMole can scan the network for open ports and vulnerable instances of RDP and SMB protocols.

InvisiMole has used scheduled tasks named MSST and \Microsoft\Windows\Autochk\Scheduled to establish persistence.

InvisiMole can inject itself into another process to avoid detection including use of a technique called ListPlanting that customizes the sorting algorithm in a ListView structure.

InvisiMole can inject its backdoor as a portable executable into a target process.

InvisiMole can inject its code into a trusted process via the APC queue.

InvisiMole has used ListPlanting to inject code into a trusted process.

InvisiMole can capture keystrokes on a compromised host.

InvisiMole can obtain a list of running processes.

InvisiMole can launch a remote shell to execute commands.

InvisiMole can use a JavaScript file as part of its execution chain.

InvisiMole has exploited CVE-2007-5633 vulnerability in the speedfan.sys driver to obtain kernel mode privileges.

InvisiMole has deleted files and directories including XML and files successfully uploaded to C2 servers.

InvisiMole has used a custom implementation of DNS tunneling to embed C2 communications in DNS requests and replies.

InvisiMole determines a working directory where it stores all the gathered data about the compromised machine.

InvisiMole can replace legitimate software or documents in the compromised network with their trojanized versions, in an attempt to propagate itself within the network.

InvisiMole can gather information on the OS version, computer name, DEP policy, and memory size.

InvisiMole InvisiMole can identify proxy servers used by the victim and use them for C2 communication.

InvisiMole has used TCP to download additional modules.

InvisiMole can upload files to the victim's machine for operations.

InvisiMole can use winapiexec tool for indirect execution of ShellExecuteW and CreateProcessA.

InvisiMole has a command to create, set, copy, or delete a specified Registry key or value.

InvisiMole can capture screenshots of not only the entire screen, but of each separate window open, in case they are overlapping.

InvisiMole can sort and collect specific documents as well as generate a list of all files on a newly inserted drive and store them in an encrypted file.

InvisiMole can record sound using input audio devices.

InvisiMole gathers the local system time from the victim’s machine.

InvisiMole can remotely activate the victim’s webcam to capture content.

InvisiMole can use a modified base32 encoding to encode data within the subdomain of C2 requests.

InvisiMole can decrypt, unpack and load a DLL from its resources, or from blobs encrypted with Data Protection API, two-key triple DES, and variations of the XOR cipher.

InvisiMole has installed legitimate but vulnerable Total Video Player software and wdigest.dll library drivers on compromised hosts to exploit stack overflow and input validation vulnerabilities for code execution.

InvisiMole can deliver trojanized versions of software and documents, relying on user execution.

InvisiMole can spread within a network via the BlueKeep (CVE-2019-0708) and EternalBlue (CVE-2017-0144) vulnerabilities in RDP and SMB respectively.

InvisiMole can register itself for execution and persistence via the Control Panel.

InvisiMole has used rundll32.exe for execution.

InvisiMole can use Data Protection API to encrypt its components on the victim’s computer, to evade detection, and to make sure the payload can only be decrypted and loaded on one specific compromised computer.

InvisiMole can check for artifacts of VirtualBox, Virtual PC and VMware environment, and terminate itself if they are detected.

InvisiMole can collect information about installed software used by specific users, software executed on user login, and software executed by each system.

InvisiMole can check for the presence of network sniffers, AV, and BitDefender firewall.

InvisiMole can register a Windows service named CsPower as part of its execution chain, and a Windows service named clr_optimization_v2.0.51527_X86 to achieve persistence.

InvisiMole can place a lnk file in the Startup Folder to achieve persistence.

InvisiMole can use a .lnk shortcut for the Control Panel to establish persistence.

InvisiMole can use fileless UAC bypass and create an elevated COM object to escalate privileges.