Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics
AI summary · glm-5.3-flashSummaries by Vani AI
Unit 42 tracks the new Mole ransomware (CryptoMix family) spread via USPS-themed malspam, with tactics escalating to JavaScript downloaders dropping multiple malware families.
On April 11, 2017, a malspam campaign began distributing Mole ransomware, a CryptoMix-family strain, through USPS-themed emails linking to fake Microsoft Word Online sites offering a bogus Office plugin. By April 13 the campaign added Nemucod JavaScript downloaders installing Mole alongside Kovter and Miuref, and by April 18 it switched to the KINS banking Trojan before moving to speeding-ticket themes and a fake parking services website. Unit 42 notes the rapid tactic changes are likely intended to evade detection, and CryptoMix variants like Mole are typically repackaged within weeks.
Key facts
- Mole ransomware appends .MOLE extensions and belongs to the CryptoMix family
- Campaign evolved in days: Google Docs links gave way to zip archives with Nemucod .js downloaders
- Downloaders install three executables: Mole ransomware, Kovter, and Miuref
- By April 18 the campaign switched to the KINS banking Trojan and later fake parking-ticket lures
- ATT&CK
- T1566.002 Spearphishing LinkT1204.002 User Execution: Malicious FileT1059.007 JavaScript/JScriptT1105 Ingress Tool TransferT1486 Data Encrypted for Impact
- Vendors
- Palo Alto Networks
- Organizations
- USPSPalo Alto Networks
- Countries
- United States
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | alita.kz | ugin.zip Examples for start of URLs generated by plugin.js: alita[.]kz/tmp/installation/language/cs-CZ/counter/ avtotur.com/libr |
| domain | anilstone.ir | /woorutu63408454 Links from the emails on Friday, April 14: anilstone[.]ir/libraries/joomla/string/wrapper/counter/1.htm Associated |
| domain | bel.tr | amples of fake Microsoft Microsoft Word Online pages: posof.bel[.]tr/counter/1.htm tramplinonline[.]ru/counter/1.htm mattsfoto |
| domain | boorsemsport.be | om/libraries/fof/utils/ip/counter/ circus-stroy.ru/counter/ boorsemsport[.]be/templates/yoo_aurora/less/uikit/counter/ eurostandard[.]r |
| domain | eurostandard.ro | boorsemsport[.]be/templates/yoo_aurora/less/uikit/counter/ eurostandard[.]ro/pics/size1/counter/ forum-turism.org[.]ro/images/layout/c |
| domain | glochemindia.com | size1/counter/ forum-turism.org[.]ro/images/layout/counter/ glochemindia[.]com/modules/mod_roknavmenu/lib/librokmenu/counter/ sportbelij |
| domain | ideliverys.com | s from the emails on Wednesday, April 12: uspsaeyyuia158140.ideliverys[.]com/ioxoory254772 uspsbhusisoz75.ideliverys[.]com/aagupto83 u |
| domain | maildeliverys.com | s from the emails on Thursday, April 13: aexhnneq102342usps.maildeliverys[.]com/kovcemaw707572 bdguz0371usps.maildeliverys[.]com/usvyneye |
| domain | mattsfotoalbum.de | : 1,537 bytes File description: Contents of plugin.zip from mattsfotoalbum[.]de on April 13th SHA256 hash: 40e8dc147f189baf4660d5db8e0cd1 |
| domain | online.ru | ytes File description: Contents of plugin.zip from tramplin.online[.]ru on April 13th SHA256 hash: a1670db6204f7666ad246cc11736b0 |
| domain | sportbelijning.be | mindia[.]com/modules/mod_roknavmenu/lib/librokmenu/counter/ sportbelijning[.]be/libraries/joomla/application/web/counter/ |
| domain | tramplinonline.ru | t Microsoft Word Online pages: posof.bel[.]tr/counter/1.htm tramplinonline[.]ru/counter/1.htm mattsfotoalbum[.]de/cache/counter/1.htm ani |
| sha256 | 3b5b19ebe8d8b6c7e5b2ffd2cc194fad1ae6c9eade7646f48c595bd154f4b1e1 | f plugin.zip from anilstone[.]ir on April 14th SHA256 hash: 3b5b19ebe8d8b6c7e5b2ffd2cc194fad1ae6c9eade7646f48c595bd154f4b1e1 File name: exe1.exe File size: 85,504 bytes File descriptio |
| sha256 | 40e8dc147f189baf4660d5db8e0cd1c647c7f167f7176c5d8ee03b6cac26fed2 | gin.zip from mattsfotoalbum[.]de on April 13th SHA256 hash: 40e8dc147f189baf4660d5db8e0cd1c647c7f167f7176c5d8ee03b6cac26fed2 File name: plugin.js File size: 1,382 bytes File descriptio |
| sha256 | 41f171eb916d555dc7771ce71013572c498b8d620d2f72872c4b2f3b50c7ccb1 | malware retrieved by plugin.js on April 13th) SHA256 hash: 41f171eb916d555dc7771ce71013572c498b8d620d2f72872c4b2f3b50c7ccb1 File name: exe2.exe File size: 363,728 bytes File descripti |
| sha256 | 50117ce3fe5dba572cf23584dc7541a7cfd4026d4316e69d29cdf536873fdf20 | malware retrieved by plugin.js on April 13th) SHA256 hash: 50117ce3fe5dba572cf23584dc7541a7cfd4026d4316e69d29cdf536873fdf20 File name: exe1.exe File size: 91,136 bytes File descriptio |
| sha256 | 5459be968e2296a759dcafa7107ef06d02331b5291c9f3056077bcf38ce37d9e | malware retrieved by plugin.js on April 13th) SHA256 hash: 5459be968e2296a759dcafa7107ef06d02331b5291c9f3056077bcf38ce37d9e File name: exe3.exe File size: 117,561 bytes File descripti |
| sha256 | 8e210658f17a265f0c595b4f63ee7ba3db4c83f64c93f522e74e57e6fc547b11 | /wrapper/counter/1.htm Associated file hashes: SHA256 hash: 8e210658f17a265f0c595b4f63ee7ba3db4c83f64c93f522e74e57e6fc547b11 File name: plugin.exe File size: 149,346 bytes File descrip |
| sha256 | a1670db6204f7666ad246cc11736b052713a4413663f5cbe6aec90ab299431a7 | in.zip from tramplin.online[.]ru on April 13th SHA256 hash: a1670db6204f7666ad246cc11736b052713a4413663f5cbe6aec90ab299431a7 File name: plugin.js File size: 1,537 bytes File descriptio |
| sha256 | b2dfa063fa605d942822cc84ef90419e26cfa0030444751fc2b87f1456b72e30 | malware retrieved by plugin.js on April 13th) SHA256 hash: b2dfa063fa605d942822cc84ef90419e26cfa0030444751fc2b87f1456b72e30 File name: exe2.exe File size: 363,922 bytes File descripti |
| sha256 | b36a3a9e2b9129cbe7385c97fa24666d2d086f7bb8a3c9c4e019f14a41538be0 | omware from thru Google Docs URL on April 12th SHA256 hash: b36a3a9e2b9129cbe7385c97fa24666d2d086f7bb8a3c9c4e019f14a41538be0 File name: plugin.js File size: 1,369 bytes File descriptio |
| sha256 | ba1327106fa0bf82050cf1a1b9c0c119eb0ded63931af4127e5d541dfa2c6850 | malware retrieved by plugin.js on April 14th) SHA256 hash: ba1327106fa0bf82050cf1a1b9c0c119eb0ded63931af4127e5d541dfa2c6850 File name: exe3.exe File size: 221,974 bytes File descripti |
| sha256 | d9189f6df89acf8e2f0d689ab73429cde37f974ed423f91d1bcabfe5dda700fa | malware retrieved by plugin.js on April 14th) SHA256 hash: d9189f6df89acf8e2f0d689ab73429cde37f974ed423f91d1bcabfe5dda700fa File name: exe2.exe File size: 366,249 bytes File descripti |
From the original article
8 min read at unit42.paloaltonetworks.com
On April 11th 2017, we saw a new malicious spam campaign using United States Postal Service (USPS)-themed emails with links that redirected to fake Microsoft Word online sites. These fake Word sites asked victims to install malware disguised as a Microsoft Office plugin. This campaign introduced a new ransomware called Mole , because names for any encrypted files by this ransomware end with .
By Brad Duncan · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.