{
  "family": "mozla",
  "sample_count": 1,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\nMozla is a highly deceptive Trojan designed to exploit user trust by masquerading as legitimate components of the Mozilla Firefox web browser. By mimicking official processes and file structures, Mozla attempts to bypass behavioral detection and user scrutiny, enabling it to establish a persistent backdoor for remote attackers.\n\n<h3>Infection Vector and Stealth Mechanisms</h3>\nMozla is predominantly distributed through deceptive drive-by downloads or as part of a bundled software package downloaded from untrustworthy software repositories. It may also be delivered via phishing emails containing links to fake \"browser update\" pages.\n\nUpon execution, Mozla employs sophisticated camouflage techniques:\n<ul>\n<li><strong>Process Spoofing:</strong> It injects its malicious payload into memory and names the executing process `firefox.exe` or `mozla.exe`. To the untrained eye checking the Windows Task Manager, the process appears to be a legitimate instance of the Firefox browser running in the background.</li>\n<li><strong>Directory Mimicry:</strong> Mozla frequently installs its binary files within the `%AppData%\\Mozilla` or `%ProgramFiles%\\Mozilla Firefox` directories, attempting to blend in with valid browser extensions and configuration files.</li>\n</ul>\nOnce persistence is established (often via registry run keys), Mozla acts as a downloader and backdoor, communicating with a command-and-control (C2) server to receive instructions and download secondary payloads, such as banking trojans or info-stealers.\n\n<h3>Security and Privacy Implications</h3>\nThe primary threat posed by Mozla is its ability to evade initial detection and grant an attacker persistent, remote access to the compromised host. Because it operates under the guise of a trusted application, standard endpoint firewalls may inadvertently allow its outbound C2 communications.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Process Verification:</strong> Utilize advanced task management tools (like Sysinternals Process Explorer) to verify the digital signature of all running `firefox.exe` instances. Legitimate Mozilla executables are signed by the Mozilla Corporation.</li>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for anomalous parent-child process relationships. A legitimate browser process should generally not be spawning `cmd.exe` or `powershell.exe`.</li>\n<li><strong>Automated Removal:</strong> Run a comprehensive scan using a reputable anti-malware platform to isolate and remove the Mozla binaries and their associated registry persistence mechanisms.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan.Mozla",
    "Win32/Mozla",
    "Backdoor.Mozla"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1036.005",
    "T1055",
    "T1105",
    "T1059"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T16:09:08Z",
  "type": "Trojan",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}