MITRE ATT&CKsoftware (malware)
S0260 InvisiMole
- Domain
- enterprise
- Platforms
- Windows
- Version
- 2.1
- Created
- 2018-10-17
Description
InvisiMole is a modular spyware program that has been used by the InvisiMole Group since at least 2013. InvisiMole has two backdoor modules called RC2FM and RC2CL that are used to perform post-exploitation activities. It has been discovered on compromised victims in the Ukraine and Russia. Gamaredon Group infrastructure has been used to download and execute InvisiMole against a small number of victims.
Related
Uses · MITRE ATT&CK (73)
- T1686 Disable or Modify System Firewall technique
- T1680 Local Storage Discovery technique
- T1055.015 ListPlanting sub-technique
- T1059.007 JavaScript sub-technique
- T1480.001 Environmental Keying sub-technique
- T1027.005 Indicator Removal from Tools sub-technique
- T1573.001 Symmetric Cryptography sub-technique
- T1001.003 Protocol or Service Impersonation sub-technique
- T1071.001 Web Protocols sub-technique
- T1071.004 DNS sub-technique
- T1090.001 Internal Proxy sub-technique
- T1090.002 External Proxy sub-technique
- T1132.002 Non-Standard Encoding sub-technique
- T1074.001 Local Data Staging sub-technique
- T1564.003 Hidden Window sub-technique
- T1574.001 DLL sub-technique
- T1204.002 Malicious File sub-technique
- T1569.002 Service Execution sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1497.001 System Checks sub-technique
- T1564.001 Hidden Files and Directories sub-technique
- T1087.001 Local Account sub-technique
- T1518.001 Security Software Discovery sub-technique
- T1560.001 Archive via Utility sub-technique
- T1560.002 Archive via Library sub-technique
- T1560.003 Archive via Custom Method sub-technique
- T1559.001 Component Object Model sub-technique
- T1056.001 Keylogging sub-technique
- T1036.004 Masquerade Task or Service sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
References
- https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/ ESET InvisiMole June 2018
- https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf ESET InvisiMole June 2020