Malware

MoiClient

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence1

The attack begins with an invoice sent via email. MoiClient is distributed as a .Vhdx file that is disguised as an invoice.

Execution

2 techniques

T1053.005Scheduled TaskEvidence1

MoiClient registers a Task Scheduler job... The registered task runs every 30 minutes... SumatraPDF—named “demo.Exe”—is launched, and “uxtheme.Dll”... is reloaded.

T1059.001PowerShellEvidence1

MoiClient downloads defendnot.DLL and defendnot-loader.Exe from the C2 server, then executes them in PowerShell using privileges obtained through UAC bypass.

Persistence

2 techniques

T1053.005Scheduled TaskEvidence1

MoiClient registers a Task Scheduler job... The registered task runs every 30 minutes... SumatraPDF—named “demo.Exe”—is launched, and “uxtheme.Dll”... is reloaded.

T1543.003Windows ServiceEvidence1

MoiClient creates this driver in the %Public% Path under the name moimoi.Sys, then uses the previously performed UAC bypass to register and execute the kernel driver Service.

Privilege Escalation

5 techniques

T1053.005Scheduled TaskEvidence1

MoiClient registers a Task Scheduler job... The registered task runs every 30 minutes... SumatraPDF—named “demo.Exe”—is launched, and “uxtheme.Dll”... is reloaded.

T1055Process InjectionEvidence1

Creation of an explorer.Exe process in the “Suspended” state... Inserting shellcode from the data.Dat file... into the entry point (EP) of the explorer.Exe process... Loads and executes the final payload in memory.

T1068Exploitation for Privilege EscalationEvidence1

MoiClient uses the BYOVD technique to neutralize security products... version 2.5.30.11281 of BootRepair.Sys—a vulnerable driver in Lenovo PC Manager—was exploited.

T1543.003Windows ServiceEvidence1

MoiClient creates this driver in the %Public% Path under the name moimoi.Sys, then uses the previously performed UAC bypass to register and execute the kernel driver Service.

T1548.002Bypass User Account ControlEvidence1

MoiClient uses an RPC-based UAC bypass technique... connect[s] to the RPC interface of the AppInfo Service... [and] executes ComputerDefaults.Exe... allowing them to bypass UAC.

Stealth

3 techniques

T1036MasqueradingEvidence1

Invoice.Pdf.Exe is SumatraPDF, a legitimate PDF viewer; all other files are marked as hidden... When a user executes Invoice.Pdf.Exe, believing it to be a PDF document...

T1055Process InjectionEvidence1

T1564.001Hidden Files and DirectoriesEvidence1

All other files are marked as hidden, making it difficult for ordinary users to detect the presence of related files such as uxtheme.Dll.

Discovery

1 technique

T1057Process DiscoveryEvidence1

It then checks the list of running processes; if any processes related to security software are detected...

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

MoiClient then receives an additional payload from the threat actor’s C2 server... MoiClient downloads an additional payload named “c.Txt” from the C2 server.

Other

1 technique

T1562.001Disable or Modify ToolsEvidence1

If any processes related to security software are detected, it passes the corresponding PID to the \\.\BootRepair device to terminate them... A separate method is also used to target Windows Defender.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

ahnlab asec blogNews

Sep 1, 2026

"Evasive" Malware Attack Tactics: Hiding, Bypassing, and Reappearing - ASEC

An evasive backdoor distributed in a VHDX invoice lure. It uses DLL side-loading through SumatraPDF, multi-stage process injection into explorer.exe, an RPC-based UAC bypass, and a vulnerable Lenovo BootRepair.sys driver to terminate security-product processes. It persists using a recurring Task Scheduler task and downloads in-memory payloads from C2 infrastructure.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

MoiClient

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence1

The attack begins with an invoice sent via email. MoiClient is distributed as a .Vhdx file that is disguised as an invoice.

Execution

2 techniques

T1053.005Scheduled TaskEvidence1

MoiClient registers a Task Scheduler job... The registered task runs every 30 minutes... SumatraPDF—named “demo.Exe”—is launched, and “uxtheme.Dll”... is reloaded.

T1059.001PowerShellEvidence1

MoiClient downloads defendnot.DLL and defendnot-loader.Exe from the C2 server, then executes them in PowerShell using privileges obtained through UAC bypass.

Persistence

2 techniques

T1053.005Scheduled TaskEvidence1

MoiClient registers a Task Scheduler job... The registered task runs every 30 minutes... SumatraPDF—named “demo.Exe”—is launched, and “uxtheme.Dll”... is reloaded.

T1543.003Windows ServiceEvidence1

MoiClient creates this driver in the %Public% Path under the name moimoi.Sys, then uses the previously performed UAC bypass to register and execute the kernel driver Service.

Privilege Escalation

5 techniques

T1053.005Scheduled TaskEvidence1

MoiClient registers a Task Scheduler job... The registered task runs every 30 minutes... SumatraPDF—named “demo.Exe”—is launched, and “uxtheme.Dll”... is reloaded.

T1055Process InjectionEvidence1

T1068Exploitation for Privilege EscalationEvidence1

MoiClient uses the BYOVD technique to neutralize security products... version 2.5.30.11281 of BootRepair.Sys—a vulnerable driver in Lenovo PC Manager—was exploited.

T1543.003Windows ServiceEvidence1

MoiClient creates this driver in the %Public% Path under the name moimoi.Sys, then uses the previously performed UAC bypass to register and execute the kernel driver Service.

T1548.002Bypass User Account ControlEvidence1

MoiClient uses an RPC-based UAC bypass technique... connect[s] to the RPC interface of the AppInfo Service... [and] executes ComputerDefaults.Exe... allowing them to bypass UAC.

Stealth

3 techniques

T1036MasqueradingEvidence1

Invoice.Pdf.Exe is SumatraPDF, a legitimate PDF viewer; all other files are marked as hidden... When a user executes Invoice.Pdf.Exe, believing it to be a PDF document...

T1055Process InjectionEvidence1

T1564.001Hidden Files and DirectoriesEvidence1

All other files are marked as hidden, making it difficult for ordinary users to detect the presence of related files such as uxtheme.Dll.

Discovery

1 technique

T1057Process DiscoveryEvidence1

It then checks the list of running processes; if any processes related to security software are detected...

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

MoiClient then receives an additional payload from the threat actor’s C2 server... MoiClient downloads an additional payload named “c.Txt” from the C2 server.

Other

1 technique

T1562.001Disable or Modify ToolsEvidence1

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

ahnlab asec blogNews

Sep 1, 2026

"Evasive" Malware Attack Tactics: Hiding, Bypassing, and Reappearing - ASEC

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.