Skip to content
MalwareWiki

Malware

MOONTAG

The malware, potentially named "MOON_TAG" by its developer as indicated by the strings within, is derived from code shared in a Google Group (https://groups.google.com/g/ph4nt0m/c/2J3_1XPeKD8/m/AYPoWu

MOONTAG is a Windows malware family.

Background

Internal strings suggest the developer may have called this malware "MOON_TAG," and it builds on code published in a Google Group (https://groups.google.com/g/ph4nt0m/c/2J3_1XPeKD8/m/AYPoWudRcTAJ?pli=1). Every observed variant is able to communicate through the Microsoft Graph API, and the family currently appears to still be under active development.

Source: Malpedia (Fraunhofer FKIE).