Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The first encounter I had with this CVE in exploit kit, was in the Sweet Orange... already containing CVE-2014-6332... Sweet Orange firing CVE-2014-6332 and DarkShell Call back... Here a more "standard" Sweet Orange : CVE-2014-6332 fired by Sweet Orange - And Betabot call back... Neutrino Firing CVE-2014-6332... Archie... CVE-2014-6332... Flash EK firing CVE-2014-6332... NB : it's in RIG and Angler | The first encounter I had with this CVE in exploit kit, was in the Sweet Orange from the actor pushing DarkShell via KR compromised website... GET http://v.krtedun .com/sum.exe - DarkShell
DarkShell pushed by Da Gong CK VIP ... via CVE-2014-0515 2014-09-28 that we saw moving to Sweet Orange | The first encounter I had with this CVE in exploit kit, was in the Sweet Orange from the actor pushing DarkShell via KR compromised website... GET http://v.krtedun .com/sum.exe - DarkShell
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
...a backdoor based on DarkShell (an open source RAT) that we named Doraemon.
12 distinct techniques documented for this family, organized by ATT&CK tactic.
Each binary contained a lot of junk code and made multiple calls between the junk codes to complete a single task.
Following that, the bot built its import address table using the “LoadLibrary()” and “GetProcAddress()” functions.
It then sends the system information of the infected machine to its control server in encrypted format.
The bot sends a TCP packet of 228 bytes in encrypted format to its control server.
13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Open-source RAT framework used as the basis for a Winnti-linked backdoor variant (named Doraemon by ESET in this reporting).
Payload delivered via the Sweet Orange exploit kit after exploitation of CVE-2014-6332.
A DDoS botnet that infects systems, reports host information to a control server, receives attack instructions, and launches multiple flooding attacks including SYN, UDP, ICMP, SuperSYN, and HTTP GET floods. The malware also uses anti-debugging, anti-disassembly, string/code decryption, and can download and execute additional malicious binaries from its control servers.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.