{
  "family": "mokes",
  "sample_count": 35,
  "category": "rat",
  "description": "Mokes (extensively analyzed by Kaspersky Lab under Backdoor:Win32/Mokes.a, Backdoor.OSX.Mokes, and Backdoor.Linux.Mokes) is a sophisticated multi-platform remote access backdoor and surveillance framework first discovered in 2016. Written in C++ utilizing the Qt cross-platform application framework, Mokes was engineered to target Windows, macOS, and Linux operating systems with near-identical surveillance capabilities. Once executed on Windows, Mokes decrypts AES-256 strings in memory, establishes persistence via the CurrentVersion\\Run registry key, and connects to remote C2 servers over TCP port 443 with custom encryption. Mokes implements exhaustive espionage modules including continuous keystroke logging, scheduled desktop screenshots, microphone audio capture, webcam surveillance, monitoring removable drives for Office documents, and exfiltrating harvested files packaged inside encrypted temporary archives.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor:Win32/Mokes.A",
    "Backdoor:Win32/Mokes",
    "Backdoor.OSX.Mokes",
    "Backdoor.Linux.Mokes",
    "Trojan.Mokes",
    "Win32/Mokes"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Backdoor:Win32/Mokes?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Mokes is a sophisticated cross-platform backdoor and espionage tool built with the Qt framework that targets Windows, macOS, and Linux systems."
      }
    },
    {
      "@type": "Question",
      "name": "What surveillance capabilities does Mokes feature?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Mokes captures keystrokes, records ambient microphone audio, captures webcam photos and screenshots, and exfiltrates Office documents."
      }
    },
    {
      "@type": "Question",
      "name": "How does Mokes communicate with its command and control infrastructure?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It connects to remote C2 servers over TCP port 443 using proprietary binary protocols encrypted with AES-256 CBC."
      }
    },
    {
      "@type": "Question",
      "name": "Why is the Qt framework significant in the design of Mokes?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Using Qt allowed the author to maintain a single codebase that compiled cleanly across Windows, Linux, and macOS platforms."
      }
    },
    {
      "@type": "Question",
      "name": "How can organizations protect against Mokes infections?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Deploy behavioral endpoint security, monitor for unauthorized audio/video device capture, restrict execution of unapproved Qt executables, and inspect outbound encrypted traffic."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1113",
    "T1123",
    "T1125",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Trojanized Attachments",
    "Compromised Software Installers",
    "Watering Hole Attacks"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "macOS",
    "Linux"
  ],
  "capabilities": [
    "Cross-Platform Qt Framework Architecture",
    "Keystroke Logging & Audio Recording",
    "Periodic Desktop & Webcam Capture",
    "Removable Drive Document Harvesting",
    "AES-256 Encrypted C2 Exfiltration"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Qt-linked C++)",
      "Cross-Platform ELF / Mach-O Binary"
    ],
    "network_signatures": [
      "Outbound TCP connections to port 443 with custom non-TLS AES-encrypted binary frames",
      "Periodic keepalive packets transmitting host hostname, OS architecture, and screenshot timestamps"
    ],
    "evasion_techniques": [
      "Using cross-platform Qt GUI libraries statically linked to blend in with legitimate desktop software",
      "Encrypting all configuration strings, C2 domains, and file filters with AES-256 CBC"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b",
      "6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ssfile"
    ],
    "file_paths": [
      "%AppData%\\Mokes\\ssfile.exe",
      "%AppData%\\Roaming\\screen.png",
      "%Temp%\\mokes_audio.wav"
    ]
  },
  "defensive_measures": [
    "Deploy endpoint detection and response (EDR) to intercept unauthorized SetWindowsHookEx calls and direct audio recording APIs",
    "Block outbound TCP connections on non-standard TLS configurations to unknown IP addresses",
    "Restrict execution of unsigned Qt application binaries in sensitive enterprise subnets"
  ],
  "sources": [
    {
      "name": "Kaspersky Securelist - The Missing Piece: Multi-OS Mokes Backdoor",
      "url": "https://securelist.com"
    },
    {
      "name": "Microsoft Defender Threat Encyclopedia - Backdoor:Win32/Mokes.A",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Mokes.A"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Backdoor:Win32/Mokes.A",
      "Backdoor.OSX.Mokes.a",
      "Backdoor.Linux.Mokes.a"
    ]
  },
  "motivation": "Espionage, Host Surveillance & Sensitive Data Theft",
  "sample_hashes": []
}