A malicious software used for eavesdropping was recently discovered by security researchers at ESET. The spyware is called InvisiMole and has been active since at least 2013.
As its name suggests, InvisiMole remains hidden and performs highly targeted actions to avoid detection by victims. The malicious spyware elements turn the target computer into a “spy camera” so that it can closely monitor the victim’s activities.
Its capabilities also extend to computer monitoring to identify system information, active services and active processes, networking information, scanning wireless networks, finding location information (geolocation), monitoring specific disk drives, etc. All of these tasks are performed using the component modules, RC2FM and RC2CL.
The operation of this spyware can be explained through its architecture. Initially, the malware uses a DLL wrapper, which makes the malicious software look like a legitimate DLL file.
The malware also uses other advanced methods to infect vulnerable systems and to avoid detection to remain active.
Regardless of the methods this spyware adopts to stay active on infected systems, the actual payload of the attack remains the same. After connecting to the command and control server, it downloads additional data to install backdoors.
InvisiMole encrypts its internal files, network communications, and configuration files to stay hidden.
You can read the full technical analysis of the InvisiMole spyware on the ESET and learn more about this notorious hacking tool.
