Search/InvisiMole
● Malware

InvisiMole

InvisiMole is a modular spyware program that has been used by the InvisiMole Group since at least 2013. InvisiMole has two backdoor modules called RC2FM and RC2CL that are used to perform post-exploitation activities. It has been discovered on compromised victims in the Ukraine and Russia. Gamaredon Group infrastructure has been used to download and execute InvisiMole against a small number of victims.

View graph Watch Export
Indicators tracked
0
Intelligence Reports20
20 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium
Connections
76 relationships
T1053.005: Scheduled Task
source
T1560.001: Archive via Utility
source
T1113: Screen Capture
source
T1033: System Owner/User Discovery
source
T1218.011: Rundll32
source
T1056.001: Keylogging
source
T1059.007: JavaScript
source
T1123: Audio Capture
source
T1548.002: Bypass User Account Control
source
T1560.003: Archive via Custom Method
source
T1071.004: DNS
source
T1025: Data from Removable Media
source
T1074.001: Local Data Staging
source
T1036.005: Match Legitimate Resource Name or Location
source
T1204.002: Malicious File
source
T1080: Taint Shared Content
source
T1573.001: Symmetric Cryptography
source
T1087.001: Local Account
source
T1543.003: Windows Service
source
T1497.001: System Checks
source
T1559.001: Component Object Model
source
T1574.001: DLL
source
T1119: Automated Collection
source
T1007: System Service Discovery
source
T1135: Network Share Discovery
source
T1082: System Information Discovery
source
T1106: Native API
source
T1005: Data from Local System
source
T1140: Deobfuscate/Decode Files or Information
source
T1560.002: Archive via Library
source
T1055: Process Injection
source
T1070.006: Timestomp
source
T1547.009: Shortcut Modification
source
T1010: Application Window Discovery
source
T1218.002: Control Panel
source
T1112: Modify Registry
source
T1090.002: External Proxy
source
T1125: Video Capture
source
T1016: System Network Configuration Discovery
source
T1083: File and Directory Discovery
source
Loading 33 more…