InvisiMole (Malware Family)

InvisiMole

VTCollection

InvisiMole had a modular architecture, starting with a wrapper DLL, and performing its activities using two other modules that were embedded in its resources, named RC2FM and RC2CL. They were feature-rich backdoors and turned the affected computer into a video camera, letting the attackers to spy the victim.
The malicious actors behind this malware were active at least since 2013 in highly targeted campaigns with only a few dozen compromised computers in Ukraine and Russia. The wrapper DLL posed as a legitimate mpr.dll library and was placed in the same folder as explorer.exe, which made it being loaded during the Windows startup into the Windows Explorer process instead of the legitimate library.
Malware came in both 32-bit and 64-bit versions, which made this persistence technique functional on both architectures.

The smaller of the modules, RC2FM, contained a backdoor with fifteen supported commands indexed by numbers. The commands could perform simple changes on the system and spying features like capturing sounds, taking screenshots or monitoring all fixed and removable drives.

The second module, RC2CL, offered features for collecting as much data about the infected computer as possible, rather than for making system changes. The module supported up to 84 commands such as file system operations, file execution, registry key manipulation, remote shell activation, wireless network scanning, listing of installed software etc. Though the backdoor was capable of interfering with the system (e.g. to log off a user, terminate a process or shut down the system), it mostly provided passive operations. Whenever possible, it tried to hide its activities by restoring the original file access time or safe-deleting its traces.

References

2020-06-08 ⋅ ESET Research ⋅ Anton Cherepanov, Zuzana Hromcová
InvisiMole: The Hidden Part of the Story - Unearthing InvisiMole's Espionage Toolset and Strategic Cooperations
InvisiMole RC2FM

Yara Rules

[TLP:WHITE] win_invisimole_auto (20260504 | Detects win.invisimole.)

rule win_invisimole_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.invisimole."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.invisimole"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8d45c8 50 8d75fc b80a020000 e8???????? 8bf0 83c404 }
            // n = 7, score = 100
            //   8d45c8               | lea                 eax, [ebp - 0x38]
            //   50                   | push                eax
            //   8d75fc               | lea                 esi, [ebp - 4]
            //   b80a020000           | mov                 eax, 0x20a
            //   e8????????           |                     
            //   8bf0                 | mov                 esi, eax
            //   83c404               | add                 esp, 4

        $sequence_1 = { 57 6810040000 6a08 50 ff15???????? 8bf8 85ff }
            // n = 7, score = 100
            //   57                   | push                edi
            //   6810040000           | push                0x410
            //   6a08                 | push                8
            //   50                   | push                eax
            //   ff15????????         |                     
            //   8bf8                 | mov                 edi, eax
            //   85ff                 | test                edi, edi

        $sequence_2 = { 8b06 6a00 050080c12a 6880969800 }
            // n = 4, score = 100
            //   8b06                 | mov                 eax, dword ptr [esi]
            //   6a00                 | push                0
            //   050080c12a           | add                 eax, 0x2ac18000
            //   6880969800           | push                0x989680

        $sequence_3 = { 7418 8b45fc 40 8945fc 83f80a 0f8c51ffffff 5e }
            // n = 7, score = 100
            //   7418                 | je                  0x1a
            //   8b45fc               | mov                 eax, dword ptr [ebp - 4]
            //   40                   | inc                 eax
            //   8945fc               | mov                 dword ptr [ebp - 4], eax
            //   83f80a               | cmp                 eax, 0xa
            //   0f8c51ffffff         | jl                  0xffffff57
            //   5e                   | pop                 esi

        $sequence_4 = { 50 ffd7 8bd8 895df4 85db 0f843e010000 }
            // n = 6, score = 100
            //   50                   | push                eax
            //   ffd7                 | call                edi
            //   8bd8                 | mov                 ebx, eax
            //   895df4               | mov                 dword ptr [ebp - 0xc], ebx
            //   85db                 | test                ebx, ebx
            //   0f843e010000         | je                  0x144

        $sequence_5 = { c645bc0d 668955bd 894dbf 8bde 7409 83c302 66833b2a }
            // n = 7, score = 100
            //   c645bc0d             | mov                 byte ptr [ebp - 0x44], 0xd
            //   668955bd             | mov                 word ptr [ebp - 0x43], dx
            //   894dbf               | mov                 dword ptr [ebp - 0x41], ecx
            //   8bde                 | mov                 ebx, esi
            //   7409                 | je                  0xb
            //   83c302               | add                 ebx, 2
            //   66833b2a             | cmp                 word ptr [ebx], 0x2a

        $sequence_6 = { 0f8443010000 8b15???????? 52 ffd7 8bd8 895c2434 }
            // n = 6, score = 100
            //   0f8443010000         | je                  0x149
            //   8b15????????         |                     
            //   52                   | push                edx
            //   ffd7                 | call                edi
            //   8bd8                 | mov                 ebx, eax
            //   895c2434             | mov                 dword ptr [esp + 0x34], ebx

        $sequence_7 = { ff15???????? 807c241300 0f85e8030000 33f6 33db 89742414 89742418 }
            // n = 7, score = 100
            //   ff15????????         |                     
            //   807c241300           | cmp                 byte ptr [esp + 0x13], 0
            //   0f85e8030000         | jne                 0x3ee
            //   33f6                 | xor                 esi, esi
            //   33db                 | xor                 ebx, ebx
            //   89742414             | mov                 dword ptr [esp + 0x14], esi
            //   89742418             | mov                 dword ptr [esp + 0x18], esi

        $sequence_8 = { 52 ff15???????? e9???????? a1???????? 50 ffd7 8bf0 }
            // n = 7, score = 100
            //   52                   | push                edx
            //   ff15????????         |                     
            //   e9????????           |                     
            //   a1????????           |                     
            //   50                   | push                eax
            //   ffd7                 | call                edi
            //   8bf0                 | mov                 esi, eax

        $sequence_9 = { 50 8b07 e8???????? 83c414 83f801 0f85920c0000 d1ee }
            // n = 7, score = 100
            //   50                   | push                eax
            //   8b07                 | mov                 eax, dword ptr [edi]
            //   e8????????           |                     
            //   83c414               | add                 esp, 0x14
            //   83f801               | cmp                 eax, 1
            //   0f85920c0000         | jne                 0xc98
            //   d1ee                 | shr                 esi, 1

    condition:
        7 of them and filesize < 139264
}

Download all Yara Rules

InvisiMole Propose Change

References

Yara Rules

InvisiMole