Threat Intelligence Directory

Also known as Wacatac ransomware due to its .wctc extension.

According to PCrisk, DearCry ransomware has been observed infecting systems via ProxyLogon vulnerabilities of Microsoft Exchange servers - mail and calendaring servers developed by Microsoft. While a patch has been released addressing these vulnerabilities, thousands of Microsoft Exchange servers remained unpatched at the time of research.

Malware family identifying win.dealply. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.deadwood. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.ddkong. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.ddkeylogger. Origin and technical characteristics tracked via Malpedia.

A ransomware as used by MosesStaff, built around the DiskCryptor tool.

DCRat is a typical RAT that has been around since at least June 2019.

Ransomware written in .NET.

This malware uses DropBox as C&C channel.

This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.

Symantec describes this as a malware written as Windows kernel driver, used by China-linked threat actors. The malware has a custom TCP/IP stack and is capable of hijacking connections.

Malware family identifying win.datper. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.data_exfiltrator. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.daserf. Origin and technical characteristics tracked via Malpedia.

According to Enigmasoft, DarkVNC malware is a hacking tool that is available for purchase online. it is can be used as a Virtual Network Computing service, which means that the attackers can get full access to the targeted system via this malware. However, unlike a genuine Virtual Network Computing utility, the DarkVNC threat operates in the background silently. Therefore, it is highly likely that the victims may not notice that their systems have been compromised.

DarkVision_RAT is a highly customizable Remote Access Trojan (RAT) first identified in 2020. Written in C/C++ and assembler, it has gained popularity due to its low cost and broad range of functionalities, including keylogging, screenshot capture, file manipulation, process injection, remote code execution, and password theft. In July 2024, a malware campaign was observed distributing DarkVision_RAT using PureCrypter as a loader. This RAT communicates with its command and control server through a custom network protocol via sockets. It also employs evasion and privilege escalation techniques such as DLL hijacking, self-elevation, and process injection. DarkVision_RAT supports a wide array of commands and plugins, enabling additional capabilities like keylogging, remote access, password theft, audio recording, and screenshot capture.

According to PCrisk, DarkTrack is a malicious program classified as a Remote Access Trojan (RAT). This type of malware enables remote access and control over an infected device. The level of control these programs have varies, however, some can allow user-level manipulation of the affected machine. The functionalities of RATs likewise varies and so does the scope of potential misuse. DarkTrack has a broad range of functions/capabilities, which make this Trojan a highly-dangerous piece of software.

DarkTortilla is a complex and highly configurable .NET-based crypter that has possibly been active since at least August 2015. It typically delivers popular information stealers and remote access trojans (RATs) such as AgentTesla, AsyncRat, NanoCore, and RedLine. While it appears to primarily deliver commodity malware, Secureworks® Counter Threat Unit™ (CTU) researchers identified DarkTortilla samples delivering targeted payloads such as Cobalt Strike and Metasploit. It can also deliver "addon packages" such as additional malicious payloads, benign decoy documents, and executables. It features robust anti-analysis and anti-tamper controls that can make detection, analysis, and eradication challenging. From January 2021 through May 2022, an average of 93 unique DarkTortilla samples per week were uploaded to the VirusTotal analysis service. Code similarities suggest possible links between DarkTortilla and other malware: a crypter operated by the RATs Crew threat group, which was active between 2008 and 2012, and the Gameloader malware that emerged in 2021.

Dark Tequila is a complex malicious campaign targeting Mexican users, with the primary purpose of stealing financial information, as well as login credentials to popular websites that range from code versioning repositories to public file storage accounts and domain registrars.

Malware family identifying win.darkstrat. Origin and technical characteristics tracked via Malpedia.

DarkSky is a botnet that is capable of downloading malware, conducting a number of network and application-layer distributed denial-of-service (DDoS) attacks, and detecting and evading security controls, such as sandboxes and virtual machines. It is advertised for sale on the dark web for $20. Much of the malware that DarkSky has available to download onto targeted systems is associated with cryptocurrency-mining activity. The DDoS attacks that DarkSky can perform include DNS amplification attacks, TCP (SYN) flood, UDP flood, and HTTP flood. The botnet can also perform a check to determine whether or not the DDoS attack succeeded and turn infected systems into a SOCKS/HTTP proxy to route traffic to a remote server.

FireEye describes DARKSIDE as a ransomware written in C and configurable to target files whether on fixed, removable disks, or network shares. The malware can be customized by the affiliates to create a build for specific victims.

DarkShell is a DDoS bot seemingly of Chinese origin, discovered in 2011. During 2011, DarkShell was reported to target the industrial food processing industry.

Malware family identifying win.darkrat. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.darkpulsar. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.darkmoon. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.darkmegi. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.darkme. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.darkloader. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.darkirc. Origin and technical characteristics tracked via Malpedia.

First documented in 2018, DarkGate is a commodity loader with features that include the ability to download and execute files to memory, a Hidden Virtual Network Computing (HVNC) module, keylogging, information-stealing capabilities, and privilege escalation. DarkGate makes use of legitimate AutoIt files and typically runs multiple AutoIt scripts. New versions of DarkGate have been advertised on a Russian language eCrime forum since May 2023.

Malware family identifying win.darkeye. Origin and technical characteristics tracked via Malpedia.

Mandiant associates this with UNC4191, this malware spreads to removable drives.

DarkComet is one of the most famous RATs, developed by Jean-Pierre Lesueur in 2008. After being used in the Syrian civil war in 2011, Lesuer decided to stop developing the trojan. Indeed, DarkComet is able to enable control over a compromised system through use of a simple graphic user interface. Experts think that this user friendliness is the key of its mass success.

Stealer is written in Visual Basic.

Malware family identifying win.darkbit. Origin and technical characteristics tracked via Malpedia.

Malware family identifying win.daolpu. Origin and technical characteristics tracked via Malpedia.

According to Kaspersky Labs, Dante is the commercial spyware developed by Memento Labs (formerly Hacking Team).

Malware family identifying win.danderspritz. Origin and technical characteristics tracked via Malpedia.