DCSrv
DCSrv is malware associated with Moses Staff that masquerades as the legitimate Windows svchost.exe process/service. It is used to block access to infected computers and encrypt all volumes using the core encryption mechanism and signed drivers from the legitimate open-source DiskCryptor utility. Reported behavior includes creating Registry keys for persistence, comparing the current host time against a configuration value to determine when encryption should begin, using Windows API functions including DeviceIoControl during encryption, and sleeping for two hours before rebooting the system. PyDCrypt has been observed dropping DCSrv to disk under the svchost.exe name and ensuring execution of the payload. The malware is discussed in the context of Moses Staff operations targeting primarily Israeli organizations, including disruptive intrusions and data theft/publication activity, with additional victim organizations reported in Italy, India, Germany, Chile, Turkey, the UAE, and the United States. High-confidence indicators mentioned in the content include the hashes 48220a3a4c72317ae0fbb08e255b8350, 4cba27111c5fca7a1ae78566de2df5b3, a7704fbccaeb78678a5f94714993567c, aa579d5f062f02d9ff76910560bb312c, and f8c06e955718639ba9ffdd4265965593.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
DCSrv is a malicious process masquerading as the legitimate “svchost.exe” process. DCSrv blocks all access to the computer and encrypts all its volumes using the legitimate open-source encryption utility DiskCryptor.
Techniques & procedures
17 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 techniqueMoses Staff has built malware, such as DCSrv and PyDCrypt, for targeting victims' machines.
Execution
2 techniquesPersistence
3 techniquesThe content repeatedly describes threat actors and malware modifying, creating, deleting, or storing data in Windows Registry keys and values for persistence, configuration storage, defense evasion, credential access, privilege escalation, and execution.
“Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer… replaced the ImagePath registry value of a Windows service with a new backdoor binary… [multiple groups/malware] creating a service / installing as a service / modifying service configurations for persistence.”
Agent Tesla can achieve persistence by modifying Registry key entries. Attor's dispatcher can modify the Run registry key. Kimsuky has also modified the registry entry for HKCU:\Software\Microsoft\Windows\CurrentVersion\Run registry key for persistence with the name WindowsSecurityCheck. PLAINTEE uses reg add to add a Registry Run key for persistence.
Privilege Escalation
2 techniques“Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer… replaced the ImagePath registry value of a Windows service with a new backdoor binary… [multiple groups/malware] creating a service / installing as a service / modifying service configurations for persistence.”
Agent Tesla can achieve persistence by modifying Registry key entries. Attor's dispatcher can modify the Run registry key. Kimsuky has also modified the registry entry for HKCU:\Software\Microsoft\Windows\CurrentVersion\Run registry key for persistence with the name WindowsSecurityCheck. PLAINTEE uses reg add to add a Registry Run key for persistence.
Stealth
4 techniquesThe content repeatedly describes payloads, strings, configuration files, scripts, URLs, and binaries being obfuscated or encoded using Base64, XOR, RC4, AES, RSA, hex encoding, custom algorithms, and other methods across many malware families and threat actors.
Examples throughout the content include 'encrypted payloads decrypted and executed in memory,' 'encrypts its configuration file,' 'AES-encrypted resource,' 'RC4 encrypted embedded scripts,' and 'payload includes an encrypted main component.'
During the 2016 Ukraine Electric Power Attack, DLLs and EXEs with filenames associated with common electric power sector protocols were used to masquerade files.
Defense Impairment
1 techniqueDiscovery
1 techniqueMultiple malware and threat groups are described as collecting/deriving local system time, date, timestamp, tick count, or time zone (e.g., "used time /t and net time \ip/hostname for system time discovery"; "collects the timestamp from the victim’s machine"; "can collect the time zone information from the system").
Lateral Movement
1 techniquePyDCrypt is a program written in Python and built with PyInstaller that is used to infect other computers on the network and ensure that the main payload DCSrv is executed properly.
Exfiltration
2 techniquesOverall, the leaked data seems to be the result of hacking operations by Moses Staff: the files seem to have been exfiltrated through the use of malware from computers belonging to the targeted organization...
Their main activity is to damage Israeli companies by stealing and publishing sensitive data... The archive was first published by Moses Staff in June 2022, it included leaked data from multiple companies in Israel.
Impact
3 techniquesDCSrv blocks all access to the computer and encrypts all its volumes using the legitimate open-source encryption utility DiskCryptor... Since the Moses Staff group is not attempting financial gain, and its main objective is to cause damage, there is usually no way to pay the ransom and decrypt the data.
DCSrv blocks all access to the computer and encrypts all its volumes using the legitimate open-source encryption utility DiskCryptor.
"AcidPour includes functionality to reboot the victim system following wiping actions..."; "AcidRain reboots the target system once the various wiping processes are complete"; "Apostle reboots the victim machine following wiping"; "APT37 ... issue the command shutdown /r /t 1 to reboot a system after wiping its MBR"; "APT38 ... BOOTWRECK ... initiate a system reboot after wiping the victim's MBR"; "Black Basta ... used ShellExecuteA to shut down and restart"; "DarkGate ... used the shutdown command"; "HermeticWiper can initiate a system shutdown"; "NotPetya will reboot the system one hour after infection"; "Shamoon will reboot the infected system once the wiping functionality has been completed"; "WhisperGate can shutdown ... through ... ExitWindowsEx"
Recent activity
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Custom malware built by Moses Staff for targeting victims' machines.
A malicious payload masquerading as svchost.exe that blocks access to the computer and encrypts all volumes using DiskCryptor, functioning as destructive pseudo-ransomware without a payment path.
Malware used by Moses Staff to target victim machines.
Ransomware that encrypts drives leveraging DiskCryptor’s core encryption mechanism.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.