Mosquito
Mosquito is a Win32 backdoor that has been used by Turla. Mosquito is made up of three parts: the installer, the launcher, and the backdoor. The main backdoor is called CommanderDLL and is launched by the loader program. [1]
Techniques Used
Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1547 | .001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
Mosquito establishes persistence under the Registry key |
Enterprise | T1059 | .003 | Command and Scripting Interpreter: Windows Command Shell |
Mosquito executes cmd.exe and uses a pipe to read the results and send back the output to the C2 server.[1] |
.001 | Command and Scripting Interpreter: PowerShell | |||
Enterprise | T1573 | .001 | Encrypted Channel: Symmetric Cryptography |
Mosquito uses a custom encryption algorithm, which consists of XOR and a stream that is similar to the Blum Blum Shub algorithm.[1] |
Enterprise | T1546 | .015 | Event Triggered Execution: Component Object Model Hijacking | |
Enterprise | T1070 | .004 | Indicator Removal on Host: File Deletion | |
Enterprise | T1105 | Ingress Tool Transfer | ||
Enterprise | T1112 | Modify Registry |
Mosquito stores configuration values under the Registry key |
|
Enterprise | T1106 | Native API |
Mosquito leverages the CreateProcess() and LoadLibrary() calls to execute files with the .dll and .exe extensions.[1] |
|
Enterprise | T1027 | Obfuscated Files or Information |
Mosquito’s installer is obfuscated with a custom crypter to obfuscate the installer.[1] |
|
Enterprise | T1057 | Process Discovery | ||
Enterprise | T1218 | .011 | Signed Binary Proxy Execution: Rundll32 |
Mosquito's launcher uses rundll32.exe in a Registry Key value to start the main backdoor capability.[1] |
Enterprise | T1518 | .001 | Software Discovery: Security Software Discovery |
Mosquito's installer searches the Registry and system to see if specific antivirus tools are installed on the system.[1] |
Enterprise | T1016 | System Network Configuration Discovery | ||
Enterprise | T1033 | System Owner/User Discovery | ||
Enterprise | T1047 | Windows Management Instrumentation |
Mosquito's installer uses WMI to search for antivirus display names.[1] |
Groups That Use This Software
ID | Name | References |
---|---|---|
G0010 | Turla |