1. Home
  2. Software
  3. MoleNet

MoleNet

MoleNet is a downloader tool with backdoor capabilities that has been observed in use since at least 2019.[1]

ID: S0553
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.0
Created: 28 December 2020
Last Modified: 27 April 2021
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

MoleNet can achieve persitence on the infected machine by setting the Registry run key.[1]

Enterprise T1059 .001 Command and Scripting Interpreter: PowerShell

MoleNet can use PowerShell to set persistence.[1]

.003 Command and Scripting Interpreter: Windows Command Shell

MoleNet can execute commands via the command line utility.[1]
Enterprise T1105 Ingress Tool Transfer

MoleNet can download additional payloads from the C2.[1]

Enterprise T1518 .001 Software Discovery: Security Software Discovery

MoleNet can use WMI commands to check the system for firewall and antivirus software.[1]
Enterprise T1082 System Information Discovery

MoleNet can collect information about the about the system.[1]
Enterprise T1047 Windows Management Instrumentation

MoleNet can perform WMI commands on the system.[1]

Groups That Use This Software

ID Name References
G0021 Molerats

[1]

References

  1. Cybereason Nocturnus Team. (2020, December 9). MOLERATS IN THE CLOUD: New Malware Arsenal Abuses Cloud Platforms in Middle East Espionage Campaign. Retrieved December 22, 2020.