MalwareUsed by 1 actor

Dark Utilities

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

LAPSUS$

Dark Utilities, released in early 2022, is a platform that provides full-featured C2 capabilities to adversaries. It is marketed as a means to enable remote access, command execution, distributed denial-of-service (DDoS) attacks and cryptocurrency mining operations on infected systems.

via talosintelligence otherblog.talosintelligence.com

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

5 techniques

T1053.003CronEvidence1

It will then create either a Crontab entry or a Systemd service to ensure that the payload is launched following system reboots.

T1059.001PowerShellEvidence1

The Stage 1 payload is an executable responsible for dropping a PowerShell script stored within a subfolder of the %TEMP% directory... The PowerShell is responsible for retrieving the Dark Utilities payload via IPFS and executing it on the system.

T1059.004Unix ShellEvidence1

We have observed similar implementations targeting other operating systems like Linux, where adversaries are leveraging shell scripts to perform the payload retrieval and execution.

T1059.006PythonEvidence1

A built-in Python interpreter allows adversaries to define Python scripts to be executed on systems under their control from within the admin panel itself.

T1569System ServicesEvidence1

The platform also provides distributed command execution... An interactive PowerShell prompt is provided directly within the admin panel.

Persistence

3 techniques

T1053.003CronEvidence1

It will then create either a Crontab entry or a Systemd service to ensure that the payload is launched following system reboots.

T1543.002Systemd ServiceEvidence1

It will then create either a Crontab entry or a Systemd service to ensure that the payload is launched following system reboots.

T1547.001Registry Run Keys / Startup FolderEvidence1

If the infected system is Windows, the malware will create a Registry run key.

Privilege Escalation

3 techniques

T1053.003CronEvidence1

It will then create either a Crontab entry or a Systemd service to ensure that the payload is launched following system reboots.

T1543.002Systemd ServiceEvidence1

It will then create either a Crontab entry or a Systemd service to ensure that the payload is launched following system reboots.

T1547.001Registry Run Keys / Startup FolderEvidence1

If the infected system is Windows, the malware will create a Registry run key.

Stealth

1 technique

T1070Indicator RemovalEvidence1

If the system is a Linux-compatible system, the malware will attempt to locate and remove any existing Kinsing malware and clear the existing Crontab configuration.

Discovery

1 technique

T1082System Information DiscoveryEvidence1

The Python script contains code for Windows and Linux-based systems and first identifies the architecture of the system it is running on, CPU information and other system details.

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

Dark Utilities, released in early 2022, is a platform that provides full-featured C2 capabilities to adversaries.

T1105Ingress Tool TransferEvidence1

Selecting an operating system causes the platform to generate a command string that threat actors are typically embedding into PowerShell or Bash scripts to facilitate the retrieval and execution of the payload on victim machines.

T1219Remote Access ToolsEvidence1

Once an infected system has established an active C2 channel, the adversary obtains full access to the system in the context of the compromised user account.

Impact

2 techniques

T1496Resource HijackingEvidence1

The cryptocurrency mining functionality leverages pool[.]hashvault[.]pro for Monero mining... If the Monero mining option is deployed, the malware will retrieve XMRig via an IPFS gateway and execute it on the system.

T1498Network Denial of ServiceEvidence1

The platform provides built-in interfaces to conduct two different types of DDoS attacks... Layer 4 supports TCP, UDP and ICMP... Layer 7 supports the GET, POST, HEAD, PATCH, PUT, DELETE, OPTIONS and CONNECT methods.

Other

1 technique

T1562Impair DefensesEvidence1

If Task Manager is launched on the infected machine, the malware attempts to evade detection by terminating the mining process.

INDICATORS OF COMPROMISE

IOCs tracked for this family

61 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

6 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

52 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

3 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app1 month ago

domain●●●●●●●●●●●●View more in app4 years ago

hash.sha256●●●●●●●●●●●●View more in app4 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

talosintelligence otherNews

Aug 4, 2022

Attackers leveraging Dark Utilities "C2aaS" platform in malware campaigns

A malicious command-and-control platform and payload framework used to register infected systems, provide remote access, execute commands, launch DDoS attacks, and deploy Monero mining on compromised Windows and Linux hosts. Payloads are hosted via IPFS and support persistence, remote shell access, Python execution, and bot management through an admin panel and API.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching61

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

Dark Utilities

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

LAPSUS$

via talosintelligence otherblog.talosintelligence.com

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

5 techniques

T1053.003CronEvidence1

It will then create either a Crontab entry or a Systemd service to ensure that the payload is launched following system reboots.

T1059.001PowerShellEvidence1

T1059.004Unix ShellEvidence1

We have observed similar implementations targeting other operating systems like Linux, where adversaries are leveraging shell scripts to perform the payload retrieval and execution.

T1059.006PythonEvidence1

A built-in Python interpreter allows adversaries to define Python scripts to be executed on systems under their control from within the admin panel itself.

T1569System ServicesEvidence1

The platform also provides distributed command execution... An interactive PowerShell prompt is provided directly within the admin panel.

Persistence

3 techniques

T1053.003CronEvidence1

It will then create either a Crontab entry or a Systemd service to ensure that the payload is launched following system reboots.

T1543.002Systemd ServiceEvidence1

It will then create either a Crontab entry or a Systemd service to ensure that the payload is launched following system reboots.

T1547.001Registry Run Keys / Startup FolderEvidence1

If the infected system is Windows, the malware will create a Registry run key.

Privilege Escalation

3 techniques

T1053.003CronEvidence1

It will then create either a Crontab entry or a Systemd service to ensure that the payload is launched following system reboots.

T1543.002Systemd ServiceEvidence1

It will then create either a Crontab entry or a Systemd service to ensure that the payload is launched following system reboots.

T1547.001Registry Run Keys / Startup FolderEvidence1

If the infected system is Windows, the malware will create a Registry run key.

Stealth

1 technique

T1070Indicator RemovalEvidence1

If the system is a Linux-compatible system, the malware will attempt to locate and remove any existing Kinsing malware and clear the existing Crontab configuration.

Discovery

1 technique

T1082System Information DiscoveryEvidence1

The Python script contains code for Windows and Linux-based systems and first identifies the architecture of the system it is running on, CPU information and other system details.

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

Dark Utilities, released in early 2022, is a platform that provides full-featured C2 capabilities to adversaries.

T1105Ingress Tool TransferEvidence1

T1219Remote Access ToolsEvidence1

Once an infected system has established an active C2 channel, the adversary obtains full access to the system in the context of the compromised user account.

Impact

2 techniques

T1496Resource HijackingEvidence1

T1498Network Denial of ServiceEvidence1

Other

1 technique

T1562Impair DefensesEvidence1

If Task Manager is launched on the infected machine, the malware attempts to evade detection by terminating the mining process.

INDICATORS OF COMPROMISE

IOCs tracked for this family

61 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

6 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

52 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

3 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app1 month ago

domain●●●●●●●●●●●●View more in app4 years ago

hash.sha256●●●●●●●●●●●●View more in app4 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

talosintelligence otherNews

Aug 4, 2022

Attackers leveraging Dark Utilities "C2aaS" platform in malware campaigns

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching61

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.