Malware
InvisiMole
InvisiMole had a modular architecture, starting with a wrapper DLL, and performing its activities using two other modules that were embedded in its resources, named RC2FM and RC2CL.
InvisiMole is a Windows malware family.
Background
InvisiMole was built on a modular design: a wrapper DLL kicked things off and then carried out operations through two further modules, RC2FM and RC2CL, that were stored inside its resources. Both were richly featured backdoors that could convert the infected machine into a video camera so the operators could surveil the victim. The group behind the malware had been operating since at least 2013 in narrowly focused campaigns affecting only a few dozen machines across Ukraine and Russia. The wrapper DLL masqueraded as the legitimate mpr.dll library and sat in the same directory as explorer.exe, causing it to be loaded into the Windows Explorer process at startup in place of the genuine library. Because the malware shipped in both 32-bit and 64-bit builds, this persistence trick worked on either architecture.
RC2FM, the smaller module, was a backdoor offering fifteen numbered commands. These allowed minor system tweaks and surveillance functions such as recording audio, grabbing screenshots, or watching all fixed and removable drives.
The larger module, RC2CL, was geared toward harvesting as much information about the host as possible rather than altering it. It supported as many as 84 commands, including file system actions, executing files, manipulating registry keys, opening a remote shell, scanning wireless networks, enumerating installed programs, and so on. While it could meddle with the system (for instance logging off a user, killing a process, or shutting down the machine), its behavior was largely passive, and it sought to conceal its tracks where it could by restoring original file access timestamps or securely deleting evidence.
Source: Malpedia (Fraunhofer FKIE).