MoleNet is a downloader tool with backdoor capabilities that has been observed in use since at least 2019.[1]

ID: S0553
Platforms: Windows
Version: 1.0
Created: 28 December 2020
Last Modified: 27 April 2021

Techniques Used

Domain ID Name Use
Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

MoleNet can achieve persitence on the infected machine by setting the Registry run key.[1]

Enterprise T1059 .001 Command and Scripting Interpreter: PowerShell

MoleNet can use PowerShell to set persistence.[1]

.003 Command and Scripting Interpreter: Windows Command Shell

MoleNet can execute commands via the command line utility.[1]

Enterprise T1105 Ingress Tool Transfer

MoleNet can download additional payloads from the C2.[1]

Enterprise T1518 .001 Software Discovery: Security Software Discovery

MoleNet can use WMI commands to check the system for firewall and antivirus software.[1]

Enterprise T1082 System Information Discovery

MoleNet can collect information about the about the system.[1]

Enterprise T1047 Windows Management Instrumentation

MoleNet can perform WMI commands on the system.[1]

Groups That Use This Software

ID Name References
G0021 Molerats