Deimos

Techniques / Sub Techniques Acquire Infrastructure - Virtual Private Server

Techniques / Sub Techniques ... Develop Capabilities - Malware ... The Deimos implant was first reported in 2020 and has been in active development

Techniques / Sub Techniques ... Develop Capabilities - Malware, Code Signing Certificates ... lure file samples ... were signed with a digital certificate

Techniques / Sub Techniques ... or Obtain Capabilities - Malware, Code Signing Certificates

Techniques / Sub Techniques ... or Obtain Capabilities - Malware, Code Signing Certificates

Techniques / Sub Techniques ... Drive-by Compromise ... In all observed cases, the malware used techniques known as Google Sneaky Redirects and Search Engine Optimization (SEO) Poisoning to trick users into installing the malware.

During dynamic analysis of the malware, we observed behavior ... an XOR cipher, and Base64 encoded commands... "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command ... iex $d6ffa847bb31b563e9b7b08aad22d447;

The malware will leverage a PDF icon even though it is an executable as an attempt to trick the user into executing the PE file... Techniques / Sub Techniques ... User Execution - Malicious File

The final persistence artifact is a .LNk file that is placed in the user's StartUp directory... The next function script will create two registry keys that provide a Windows shell handler... Techniques / Sub Techniques ... Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder

The final persistence artifact is a .LNk file that is placed in the user's StartUp directory... The next function script will create two registry keys that provide a Windows shell handler... Techniques / Sub Techniques ... Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder

The malware employs multiple layers of complex obfuscation and encryption techniques... employing advanced analysis countermeasures to frustrate analysis.

Once this encoded file was read by PowerShell, it is deleted as shown in Figure 2. FromBase64String([System.IO.File]::ReadAllText($650326ac2b1100c4508b8a700b658ad7));remove-item $650326ac2b1100c4508b8a700b658ad7

During dynamic analysis of the malware, we observed behavior ... an XOR cipher, and Base64 encoded commands... Once this encoded file was read by PowerShell, it is deleted... this value was the XOR key used to decrypt the value of the file.

Hunting C2/Adversaries Infrastructure with Shodan and Censys ... My research Cobalt Strike C2 Metasploit/MSF Covenant C2 Deimos C2 Posh C2 Brute Ratel C4 Mythic C2 Sliver C2 ... Night Hawk C2 NimPlant C2 ShadowPad C2 Infrastructure Async Rat C2 Infrastructure Meterpreter C2 Infrastructure

The web request uses an HTTP POST method and sets a 10-minute timeout on establishing communication. No additional headers are set other than the default headers populated by the .Net WebRequest provider.