SYMBOLCOMMON_NAMEaka. SYNONYMS
win.invisimole (Back to overview)

InvisiMole


InvisiMole had a modular architecture, starting with a wrapper DLL, and performing its activities using two other modules that were embedded in its resources, named RC2FM and RC2CL. They were feature-rich backdoors and turned the affected computer into a video camera, letting the attackers to spy the victim.
The malicious actors behind this malware were active at least since 2013 in highly targeted campaigns with only a few dozen compromised computers in Ukraine and Russia. The wrapper DLL posed as a legitimate mpr.dll library and was placed in the same folder as explorer.exe, which made it being loaded during the Windows startup into the Windows Explorer process instead of the legitimate library.
Malware came in both 32-bit and 64-bit versions, which made this persistence technique functional on both architectures.

The smaller of the modules, RC2FM, contained a backdoor with fifteen supported commands indexed by numbers. The commands could perform simple changes on the system and spying features like capturing sounds, taking screenshots or monitoring all fixed and removable drives.

The second module, RC2CL, offered features for collecting as much data about the infected computer as possible, rather than for making system changes. The module supported up to 84 commands such as file system operations, file execution, registry key manipulation, remote shell activation, wireless network scanning, listing of installed software etc. Though the backdoor was capable of interfering with the system (e.g. to log off a user, terminate a process or shut down the system), it mostly provided passive operations. Whenever possible, it tried to hide its activities by restoring the original file access time or safe-deleting its traces.

References
2022-01-11ESET ResearchMichal Poslušný
@online{poslun:20220111:signed:1c59d41, author = {Michal Poslušný}, title = {{Signed kernel drivers – Unguarded gateway to Windows’ core}}, date = {2022-01-11}, organization = {ESET Research}, url = {https://www.welivesecurity.com/2022/01/11/signed-kernel-drivers-unguarded-gateway-windows-core/}, language = {English}, urldate = {2022-01-18} } Signed kernel drivers – Unguarded gateway to Windows’ core
InvisiMole LoJax RobinHood Slingshot
2021-04-29ESET ResearchRobert Lipovsky, Matthieu Faou, Tony Anscombe, Andy Garth, Daniel Chromek
@techreport{lipovsky:20210429:eset:ff67b6c, author = {Robert Lipovsky and Matthieu Faou and Tony Anscombe and Andy Garth and Daniel Chromek}, title = {{ESET Industry Report on Government: Targeted but not alone}}, date = {2021-04-29}, institution = {ESET Research}, url = {https://www.welivesecurity.com/wp-content/uploads/2021/04/ESET_Industry_Report_Government.pdf}, language = {English}, urldate = {2021-05-03} } ESET Industry Report on Government: Targeted but not alone
Exaramel Crutch Exaramel HyperBro HyperSSL InvisiMole XDSpy
2020-06-18ESET ResearchZuzana Hromcová, Anton Cherepanov
@online{hromcov:20200618:digging:285d02f, author = {Zuzana Hromcová and Anton Cherepanov}, title = {{Digging up InvisiMole’s hidden arsenal}}, date = {2020-06-18}, organization = {ESET Research}, url = {https://www.welivesecurity.com/2020/06/18/digging-up-invisimole-hidden-arsenal/}, language = {English}, urldate = {2020-06-29} } Digging up InvisiMole’s hidden arsenal
InvisiMole Gamaredon Group InvisiMole
2020-06-08ESET ResearchZuzana Hromcová, Anton Cherepanov
@techreport{hromcov:20200608:invisimole:70a4dc1, author = {Zuzana Hromcová and Anton Cherepanov}, title = {{InvisiMole: The Hidden Part of the Story - Unearthing InvisiMole's Espionage Toolset and Strategic Cooperations}}, date = {2020-06-08}, institution = {ESET Research}, url = {https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf}, language = {English}, urldate = {2020-06-29} } InvisiMole: The Hidden Part of the Story - Unearthing InvisiMole's Espionage Toolset and Strategic Cooperations
InvisiMole RC2FM
2018-06-07ESET ResearchZuzana Hromcová
@online{hromcov:20180607:invisimole:5c5f0ed, author = {Zuzana Hromcová}, title = {{InvisiMole: Surprisingly equipped spyware, undercover since 2013}}, date = {2018-06-07}, organization = {ESET Research}, url = {https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/}, language = {English}, urldate = {2019-11-14} } InvisiMole: Surprisingly equipped spyware, undercover since 2013
InvisiMole InvisiMole
Yara Rules
[TLP:WHITE] win_invisimole_auto (20211008 | Detects win.invisimole.)
rule win_invisimole_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2021-10-07"
        version = "1"
        description = "Detects win.invisimole."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.invisimole"
        malpedia_rule_date = "20211007"
        malpedia_hash = "e5b790e0f888f252d49063a1251ca60ec2832535"
        malpedia_version = "20211008"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8bca 894e5c 894e64 8b4de2 83c0c4 83e10f }
            // n = 6, score = 100
            //   8bca                 | mov                 ecx, edx
            //   894e5c               | mov                 dword ptr [esi + 0x5c], ecx
            //   894e64               | mov                 dword ptr [esi + 0x64], ecx
            //   8b4de2               | mov                 ecx, dword ptr [ebp - 0x1e]
            //   83c0c4               | add                 eax, -0x3c
            //   83e10f               | and                 ecx, 0xf

        $sequence_1 = { 8bd3 83f201 0fafd3 8b5df4 c1ea08 32541dc8 }
            // n = 6, score = 100
            //   8bd3                 | mov                 edx, ebx
            //   83f201               | xor                 edx, 1
            //   0fafd3               | imul                edx, ebx
            //   8b5df4               | mov                 ebx, dword ptr [ebp - 0xc]
            //   c1ea08               | shr                 edx, 8
            //   32541dc8             | xor                 dl, byte ptr [ebp + ebx - 0x38]

        $sequence_2 = { 56 884dff e8???????? 0fb64710 6a01 8d4dff 51 }
            // n = 7, score = 100
            //   56                   | push                esi
            //   884dff               | mov                 byte ptr [ebp - 1], cl
            //   e8????????           |                     
            //   0fb64710             | movzx               eax, byte ptr [edi + 0x10]
            //   6a01                 | push                1
            //   8d4dff               | lea                 ecx, dword ptr [ebp - 1]
            //   51                   | push                ecx

        $sequence_3 = { 83c404 84c0 0f8475030000 8d8578fbffff 50 ff15???????? 8b55f8 }
            // n = 7, score = 100
            //   83c404               | add                 esp, 4
            //   84c0                 | test                al, al
            //   0f8475030000         | je                  0x37b
            //   8d8578fbffff         | lea                 eax, dword ptr [ebp - 0x488]
            //   50                   | push                eax
            //   ff15????????         |                     
            //   8b55f8               | mov                 edx, dword ptr [ebp - 8]

        $sequence_4 = { 7505 897b04 eb06 8b5308 897a08 8d45f4 897b08 }
            // n = 7, score = 100
            //   7505                 | jne                 7
            //   897b04               | mov                 dword ptr [ebx + 4], edi
            //   eb06                 | jmp                 8
            //   8b5308               | mov                 edx, dword ptr [ebx + 8]
            //   897a08               | mov                 dword ptr [edx + 8], edi
            //   8d45f4               | lea                 eax, dword ptr [ebp - 0xc]
            //   897b08               | mov                 dword ptr [ebx + 8], edi

        $sequence_5 = { c645bc0d 668955bd 894dbf 8bde 7409 83c302 66833b2a }
            // n = 7, score = 100
            //   c645bc0d             | mov                 byte ptr [ebp - 0x44], 0xd
            //   668955bd             | mov                 word ptr [ebp - 0x43], dx
            //   894dbf               | mov                 dword ptr [ebp - 0x41], ecx
            //   8bde                 | mov                 ebx, esi
            //   7409                 | je                  0xb
            //   83c302               | add                 ebx, 2
            //   66833b2a             | cmp                 word ptr [ebx], 0x2a

        $sequence_6 = { 50 57 ff15???????? c6466c01 897e7c 33c0 5b }
            // n = 7, score = 100
            //   50                   | push                eax
            //   57                   | push                edi
            //   ff15????????         |                     
            //   c6466c01             | mov                 byte ptr [esi + 0x6c], 1
            //   897e7c               | mov                 dword ptr [esi + 0x7c], edi
            //   33c0                 | xor                 eax, eax
            //   5b                   | pop                 ebx

        $sequence_7 = { 0fb64f2d 6a01 8d55ff 52 56 884dff e8???????? }
            // n = 7, score = 100
            //   0fb64f2d             | movzx               ecx, byte ptr [edi + 0x2d]
            //   6a01                 | push                1
            //   8d55ff               | lea                 edx, dword ptr [ebp - 1]
            //   52                   | push                edx
            //   56                   | push                esi
            //   884dff               | mov                 byte ptr [ebp - 1], cl
            //   e8????????           |                     

        $sequence_8 = { 895654 0fb7d0 8b45e6 83e01f 0bd0 }
            // n = 5, score = 100
            //   895654               | mov                 dword ptr [esi + 0x54], edx
            //   0fb7d0               | movzx               edx, ax
            //   8b45e6               | mov                 eax, dword ptr [ebp - 0x1a]
            //   83e01f               | and                 eax, 0x1f
            //   0bd0                 | or                  edx, eax

        $sequence_9 = { ffd7 53 53 6804010000 }
            // n = 4, score = 100
            //   ffd7                 | call                edi
            //   53                   | push                ebx
            //   53                   | push                ebx
            //   6804010000           | push                0x104

    condition:
        7 of them and filesize < 139264
}
Download all Yara Rules