Molerats used executables to download malicious files from different sources.(Citation: Kaspersky MoleRATs April 2019)(Citation: Unit42 Molerat Mar 2020) |
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

Molerats saved malicious files within the AppData and Startup folders to maintain persistence.(Citation: Kaspersky MoleRATs April 2019)|
|mitre-attack|enterprise-attack|macOS,Windows|T1553.002|Code Signing|

Molerats has used forged Microsoft code-signing certificates on malware.(Citation: FireEye Operation Molerats)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1555.003|Credentials from Web Browsers|

Molerats used the public tool BrowserPasswordDump10 to dump passwords saved in browsers on victims.(Citation: DustySky)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

Molerats actors obtained a list of active processes on the victim and sent them to C2 servers.(Citation: DustySky)|