Skip to content

S1090 NightClub

NightClub is a modular implant written in C++ that has been used by MoustachedBouncer since at least 2014.1

Item Value
ID S1090
Associated Names
Type MALWARE
Version 1.0
Created 27 September 2023
Last Modified 27 September 2023
Navigation Layer View In ATT&CK® Navigator

Techniques Used

Domain ID Name Use
enterprise T1071 Application Layer Protocol -
enterprise T1071.003 Mail Protocols NightClub can use emails for C2 communications.1
enterprise T1071.004 DNS NightClub can use a DNS tunneling plugin to exfiltrate data by adding it to the subdomain portion of a DNS request.1
enterprise T1010 Application Window Discovery NightClub can use GetForegroundWindow to enumerate the active window.1
enterprise T1123 Audio Capture NightClub can load a module to leverage the LAME encoder and mciSendStringW to control and capture audio.1
enterprise T1543 Create or Modify System Process -
enterprise T1543.003 Windows Service NightClub has created a Windows service named WmdmPmSp to establish persistence.1
enterprise T1132 Data Encoding -
enterprise T1132.002 Non-Standard Encoding NightClub has used a non-standard encoding in DNS tunneling removing any = from the result of base64 encoding, and replacing / characters with -s and + characters with -p.1
enterprise T1005 Data from Local System NightClub can use a file monitor to steal specific files from targeted systems.1
enterprise T1074 Data Staged -
enterprise T1074.001 Local Data Staging NightClub has copied captured files and keystrokes to the %TEMP% directory of compromised hosts.1
enterprise T1041 Exfiltration Over C2 Channel NightClub can use SMTP and DNS for file exfiltration and C2.1
enterprise T1083 File and Directory Discovery NightClub can use a file monitor to identify .lnk, .doc, .docx, .xls, .xslx, and .pdf files.1
enterprise T1070 Indicator Removal -
enterprise T1070.006 Timestomp NightClub can modify the Creation, Access, and Write timestamps for malicious DLLs to match those of the genuine Windows DLL user32.dll.1
enterprise T1105 Ingress Tool Transfer NightClub can load multiple additional plugins on an infected host.1
enterprise T1056 Input Capture -
enterprise T1056.001 Keylogging NightClub can use a plugin for keylogging.1
enterprise T1036 Masquerading -
enterprise T1036.004 Masquerade Task or Service NightClub has created a service named WmdmPmSp to spoof a Windows Media service.1
enterprise T1036.005 Match Legitimate Resource Name or Location NightClub has chosen file names to appear legitimate including EsetUpdate-0117583943.exe for its dropper.1
enterprise T1112 Modify Registry NightClub can modify the Registry to set the ServiceDLL for a service created by the malware for persistence.1
enterprise T1106 Native API NightClub can use multiple native APIs including GetKeyState, GetForegroundWindow, GetWindowThreadProcessId, and GetKeyboardLayout.1
enterprise T1027 Obfuscated Files or Information NightClub can obfuscate strings using the congruential generator (LCG): staten+1 = (690069 × staten + 1) mod 232.1
enterprise T1120 Peripheral Device Discovery NightClub has the ability to monitor removable drives.1
enterprise T1057 Process Discovery NightClub has the ability to use GetWindowThreadProcessId to identify the process behind a specified window.1
enterprise T1113 Screen Capture NightClub can load a module to call CreateCompatibleDC and GdipSaveImageToStream for screen capture.1

Groups That Use This Software

ID Name References
G1019 MoustachedBouncer 1

References

  1. Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023. ↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩