Procedure examples

InvisiMole can mimic HTTP protocol with custom HTTP “verbs” HIDE, ZVVP, and NOP.

InvisiMole can collect data from the system, and can monitor changes in specified directories.

InvisiMole can obtain running services on the victim.

InvisiMole has been configured with several servers available for alternate C2 communications.

InvisiMole can enumerate windows and child windows on a compromised host.

InvisiMole can enumerate Registry values, keys, and data.

InvisiMole gathers information on the IP forwarding table, MAC address, configured proxy, and network SSID.

InvisiMole can collect jpeg files from connected MTP devices.

InvisiMole avoids analysis by encrypting all strings, internal files, configuration data and by using a custom executable format.

InvisiMole has undergone regular technical improvements in an attempt to evade detection.

InvisiMole lists local users and session information.

InvisiMole has attempted to disguise itself by registering under a seemingly legitimate service name.

InvisiMole has disguised its droppers as legitimate software or documents, matching their original names and locations, and saved its files as mpr.dll in the Windows folder.

InvisiMole can scan the network for open ports and vulnerable instances of RDP and SMB protocols.

InvisiMole has used scheduled tasks named MSST and \Microsoft\Windows\Autochk\Scheduled to establish persistence.

InvisiMole can inject itself into another process to avoid detection including use of a technique called ListPlanting that customizes the sorting algorithm in a ListView structure.

InvisiMole can inject its backdoor as a portable executable into a target process.

InvisiMole can inject its code into a trusted process via the APC queue.

InvisiMole has used ListPlanting to inject code into a trusted process.

InvisiMole can capture keystrokes on a compromised host.

InvisiMole can obtain a list of running processes.

InvisiMole can launch a remote shell to execute commands.

InvisiMole can use a JavaScript file as part of its execution chain.

InvisiMole has exploited CVE-2007-5633 vulnerability in the speedfan.sys driver to obtain kernel mode privileges.

InvisiMole has deleted files and directories including XML and files successfully uploaded to C2 servers.

InvisiMole can disconnect previously connected remote drives.

InvisiMole samples were timestomped by the authors by setting the PE timestamps to all zero values. InvisiMole also has a built-in command to modify file times.

InvisiMole uses HTTP for C2 communications.

InvisiMole has used a custom implementation of DNS tunneling to embed C2 communications in DNS requests and replies.

InvisiMole determines a working directory where it stores all the gathered data about the compromised machine.

InvisiMole can replace legitimate software or documents in the compromised network with their trojanized versions, in an attempt to propagate itself within the network.

InvisiMole can gather information on the OS version, computer name, DEP policy, and memory size.

InvisiMole can list information about files in a directory and recently opened or used documents. InvisiMole can also search for specific files by supplied file mask.

InvisiMole has a command to list account information on the victim’s machine.

InvisiMole can function as a proxy to create a server that relays communication between the client and C&C server, or between two clients.

InvisiMole InvisiMole can identify proxy servers used by the victim and use them for C2 communication.

InvisiMole has used TCP to download additional modules.

InvisiMole can upload files to the victim's machine for operations.

InvisiMole can use winapiexec tool for indirect execution of ShellExecuteW and CreateProcessA.

InvisiMole has a command to create, set, copy, or delete a specified Registry key or value.

InvisiMole can capture screenshots of not only the entire screen, but of each separate window open, in case they are overlapping.

InvisiMole can sort and collect specific documents as well as generate a list of all files on a newly inserted drive and store them in an encrypted file.

InvisiMole can record sound using input audio devices.

InvisiMole gathers the local system time from the victim’s machine.

InvisiMole can remotely activate the victim’s webcam to capture content.

InvisiMole can use a modified base32 encoding to encode data within the subdomain of C2 requests.

InvisiMole can gather network share information.

InvisiMole can decrypt, unpack and load a DLL from its resources, or from blobs encrypted with Data Protection API, two-key triple DES, and variations of the XOR cipher.

InvisiMole has installed legitimate but vulnerable Total Video Player software and wdigest.dll library drivers on compromised hosts to exploit stack overflow and input validation vulnerabilities for code execution.

InvisiMole can deliver trojanized versions of software and documents, relying on user execution.