Reminder: the TAXII 2.0 server will be retiring on December 18. Please switch to the TAXII 2.1 server to ensure uninterrupted service.

MoleNet

MoleNet is a downloader tool with backdoor capabilities that has been observed in use since at least 2019.^[1]

ID: S0553

ⓘ

Type: MALWARE

ⓘ

Platforms: Windows

Version: 1.0

Created: 28 December 2020

Last Modified: 27 April 2021

Version Permalink

Live Version

Techniques Used

Domain	ID		Name	Use
Enterprise	T1547	.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder	MoleNet can achieve persitence on the infected machine by setting the Registry run key.^[1]
Enterprise	T1059	.001	Command and Scripting Interpreter: PowerShell	MoleNet can use PowerShell to set persistence.^[1]
		.003	Command and Scripting Interpreter: Windows Command Shell	MoleNet can execute commands via the command line utility.^[1]
Enterprise	T1105		Ingress Tool Transfer	MoleNet can download additional payloads from the C2.^[1]
Enterprise	T1518	.001	Software Discovery: Security Software Discovery	MoleNet can use WMI commands to check the system for firewall and antivirus software.^[1]
Enterprise	T1082		System Information Discovery	MoleNet can collect information about the about the system.^[1]
Enterprise	T1047		Windows Management Instrumentation	MoleNet can perform WMI commands on the system.^[1]

Groups That Use This Software

ID	Name	References
G0021	Molerats	^[1]

References

Cybereason Nocturnus Team. (2020, December 9). MOLERATS IN THE CLOUD: New Malware Arsenal Abuses Cloud Platforms in Middle East Espionage Campaign. Retrieved December 22, 2020.