MosquitoMalware
Mosquito is a Win32 backdoor that has been used by Turla. Mosquito is made up of three parts: the installer, the launcher, and the backdoor. The main backdoor is called CommanderDLL and is launched by the loader program.From MITRE ATT&CK
Last reported 4 years ago, by Elastic Security Labs1 report
ATT&CK techniques
6 of 16 · each with the sentence it comes from- T1003OS Credential Dumping
“OS Credential Dumping - LSA Secrets”
- T1003.004LSA Secrets
“OS Credential Dumping - LSA Secrets”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information”
- T1036Masquerading
“Masquerading - Match Legitimate Name or Location”
- T1053Scheduled Task/Job
“Scheduled Task/Job - Scheduled Task”
- T1053.005Scheduled Task
“To ensure that Defender Control continued to run, the threat actor used svchost.exe to create a scheduled task.”
What the reports say
1 report, newest first · the exact sentence from each-
CUBA Ransomware Campaign Analysis“This new injected process again executes komar2.ps1 and includes a new PDB entry of F:\Source\Mosquito\Agent\x64\Release\Agent.pdb.”
Indicators in its reports
named in the reports above- 0f385cc69a93abea…805bdfe468a3in 1 report
- 33352a38454cfc24…8ec45b4d3d0ein 1 report
- b495456a2239f3ba…a48746e8051fin 1 report
- 159.203.70[.]39in 1 report
- hxxp://208.76.253[.]84in 1 report
- 208.76.253[.]84in 1 report
- hxxp://108.170.31[.]115/add.dllin 1 report
- 108.170.31[.]115in 1 report
- 104.217.8[.]100in 1 report
- 193.23.244[.]244in 1 report
- 86.59.21[.]38in 1 report
- 199.58.81[.]140in 1 report
- 204.13.164[.]118in 1 report
- 194.109.206[.]212in 1 report
- 131.188.40[.]189in 1 report
- 154.35.175[.]225in 1 report
- 171.25.193[.]9in 1 report
- 128.31.0[.]34in 1 report
- 128.31.0[.]39in 1 report
- scams[.]inin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.