Mokes

Overview

Backdoor:Win32/Mokes (also known as Ekipa) is a rare, highly sophisticated Remote Access Trojan (RAT) notable for being a true cross-platform threat. It is engineered with distinct variants capable of natively infecting Windows, macOS (OSX/Mokes), and Linux environments, providing the threat actor with comprehensive surveillance capabilities across an entire heterogeneous enterprise network.

Understanding Mokes
To the end-user, Mokes operates completely invisibly. For threat intelligence analysts, Mokes represents a targeted espionage tool. While most malware is written specifically for Windows, Mokes is written in C++ (often utilizing Qt libraries statically linked to bypass dependency issues on Linux/macOS) to ensure seamless compilation across operating systems. This allows the threat actor to maintain a single C2 infrastructure to control a wildly diverse botnet.

Execution and Surveillance Strategies
Mokes is typically delivered via spearphishing or exploiting unpatched vulnerabilities on public-facing servers. Upon execution, it establishes persistence (e.g., via Registry Run keys on Windows, or `.plist` LaunchAgents on macOS) (`T1547.001`). Mokes possesses exhaustive surveillance capabilities. It can capture screenshots (`T1113`), record audio via the microphone (`T1120`), log keystrokes (`T1056.001`), and silently exfiltrate office documents (`T1005`). Notably, it encrypts all its exfiltrated data using AES-256 before transmitting it over HTTP/HTTPS to hardcoded C2 servers.

Indicators of Compromise & Impact
The impact is a total loss of confidentiality across the network, regardless of the operating system used by the victim. EDR platforms will flag anomalous child processes and unauthorized access to the microphone or screen capture APIs. Network logs will reveal encrypted, periodic beaconing to the C2 infrastructure. On Windows, the presence of anomalous executables in `%AppData%\AppStore\` or `%Temp%` is a common IoC. On macOS, look for unsigned binaries in `~/Library/AppStore/`.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056.001: Implement Endpoint Detection and Response (EDR) to monitor for suspicious API calls related to keystroke interception. Enforce Multi-Factor Authentication (MFA) to render stolen passwords useless.
• T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.
• T1113: Monitor for frequent or unauthorized screen captures or clipboard reads. Restrict background applications from accessing desktop APIs.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_MOKES {
    meta:
        description = "Detects Mokes (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "mokes" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Mokes Activity
id: 72a2084e94c2b14a2fe8faf1fe404bef
status: experimental
description: Detects generic indicators of the mokes malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*mokes*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Instantly isolate the endpoint from the network to sever the attacker's interactive, remote-control session and halt data exfiltration.
2. Capture a full forensic memory image of the machine to extract the decrypted Mokes payload, its C2 configuration, and any buffered keystrokes.
3. Audit the persistence mechanisms appropriate for the OS (Windows Registry Run keys, macOS LaunchAgents, or Linux crontabs) to remove the backdoor.
4. Assume total endpoint compromise; perform a clean OS rebuild and force password resets for all accounts that accessed the machine.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not leave the machine connected to the network during triage; the attacker has live access and will likely destroy evidence or move laterally.
2. Avoid assuming that macOS or Linux endpoints are safe; Mokes is explicitly designed to compromise those systems.

References & External Analysis

• Search "mokes" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Candyopen
• Cryptominer
• Casbaneiro
• Kelvir
• Favadd

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/mokes.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.