SYMBOLCOMMON_NAMEaka. SYNONYMS
win.deimos_c2 (Back to overview)

DeimosC2

Trend Micro describes DeimosC2 as an open-source C&C framework that was released in June 2020. It is a fully-functional framework that allows for multiple attackers to access, create payloads for, and interact with victim computers. As a post-exploitation C&C framework, DeimosC2 will generate the payloads that need to be manually executed on computer servers that have been compromised through other means such as social engineering, exploitation, or brute-force attacks. Once it is deployed, the threat actors will gain the same access to the systems as the user account that the payload was executed as, either as an administrator or a regular user. Note that DeimosC2 does not perform active or privilege escalation of any kind.

References
2022-11-08 ⋅ Feike Hacquebord, Fernando Mercês, Stephen Hilt
DeimosC2: What SOC Analysts and Incident Responders Need to Know About This C&C Framework
DeimosC2
2022-07-21 ⋅ Censys ⋅ Matt Lembright
Russian Ransomware C2 Network Discovered in Censys Data
DeimosC2 PoshC2
2022-07-18 ⋅ Censys ⋅ Censys
Russian Ransomware C2 Network Discovered in Censys Data
Cobalt Strike DeimosC2 MimiKatz PoshC2
Yara Rules
[TLP:WHITE] win_deimos_c2_w0 (20230125 | Detect the beacon used in the DeimosC2 framework (x64 version))
rule win_deimos_c2_w0 {
   meta:
        description = "Detect the beacon used in the DeimosC2 framework (x64 version)"
        author = "Arkbird_SOLG"
        reference = "https://www.trendmicro.com/en_us/research/22/k/deimosc2-what-soc-analysts-and-incident-responders-need-to-know.html"
        date = "2022-11-08"
        hash1 = "4f069ec1dc6e88a2b4e1c50a8dda6a7935f91424724499b41ff1c3a9f87b143c"
        hash2 = "21827cb6d8409ddea5097384d86f3004f5ec4ebe387a9340d8f3443598bdd2af"
        hash3 = "dbc5b2946b58deb1c40d787e3c5386b9020086b5d01dbbfbaccc44b322aca68c"
        hash4 = "6f3394a5980ddbc28c7e889c636cddabd48a710588a5c10427d10a19d07b1c0a"
        tlp = "Clear"
        adversary = "-"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.deimos_c2"
        malpedia_rule_date = "20230221"
        malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686"
        malpedia_version = "20230125"
        malpedia_license = ""
        malpedia_sharing = "TLP:WHITE"
   strings:
        $s1 = { 48 83 ec 70 48 89 6c 24 68 48 8d 6c 24 68 48 c7 44 24 30 00 00 00 00 48 c7 44 24 28 00 00 00 00 48 8b 05 a7 [2] 00 48 89 04 24 48 c7 44 24 08 ff ff ff ff 48 8d 44 24 30 48 89 44 24 10 48 8d 44 24 28 48 89 44 24 18 e8 59 18 00 00 48 83 7c 24 20 00 74 35 31 c0 31 c9 eb 24 48 89 ca 48 89 c1 bb 01 00 00 00 48 d3 e3 48 23 5c 24 30 48 8d 72 01 48 85 db 48 0f 45 d6 48 ff c0 48 89 d1 48 83 f8 40 7c d6 48 85 c9 75 3e 0f 57 c0 0f 11 44 24 38 0f 11 44 24 48 0f 11 44 24 58 48 8b 05 0b [2] 00 48 89 04 24 48 8d 44 24 38 48 89 44 24 08 e8 30 17 00 00 8b 44 24 58 89 44 24 78 48 8b 6c }
        $s2 = { 48 8b 05 a0 [2] 00 48 8d 0d [3] 00 48 89 04 24 48 89 4c 24 08 48 c7 44 24 10 08 02 00 00 e8 12 22 00 00 48 8b 44 24 18 48 85 c0 74 33 48 3d 08 02 00 00 77 2b 48 8d 1d [3] 00 c6 04 03 5c 48 ff c0 48 89 05 [3] 00 e9 d6 fe ff ff 31 c0 e8 9f 2e 03 00 ba 09 02 00 00 e8 c5 2e 03 00 48 8d 05 [3] 00 48 89 04 24 48 c7 44 24 }
        $s3 = { 48 8b 15 36 [2] 00 48 89 14 24 48 89 4c 24 08 48 89 44 24 10 48 c7 44 24 18 00 10 00 00 48 c7 44 24 20 04 00 00 00 e8 e1 a6 01 00 48 83 7c 24 28 00 40 0f 94 c6 48 8b 44 24 38 48 8b 4c 24 48 48 8b 54 24 68 48 8b 5c 24 40 e9 61 ff ff ff 48 8b 6c 24 50 48 83 c4 58 c3 48 8b 6c 24 50 48 83 }
        $s4 = { 48 81 ec b0 00 00 00 48 89 ac 24 a8 00 00 00 48 8d ac 24 a8 00 00 00 48 c7 44 24 48 00 00 00 00 48 8b 05 12 [2] 00 48 89 04 24 48 c7 44 24 08 ff ff ff ff 48 c7 44 24 10 fe ff ff ff 48 c7 44 24 18 ff ff ff ff 48 8d 44 24 48 48 89 44 24 20 0f 57 c0 0f 11 44 24 28 48 c7 44 24 38 02 00 00 00 e8 fb 05 00 00 65 48 8b 04 25 28 00 00 00 48 8b 80 00 00 00 00 48 8b 40 30 48 89 84 24 98 00 00 00 84 00 48 8d 88 10 03 00 00 48 89 8c 24 a0 00 00 00 48 89 0c 24 e8 45 81 fd ff 48 8b 44 24 48 48 8b 8c 24 98 00 00 00 48 89 81 18 03 00 00 48 8b 84 24 a0 00 00 00 48 89 04 24 e8 10 83 fd ff 0f 57 c0 0f 11 44 24 68 0f 11 44 24 78 0f 11 84 24 88 00 00 00 48 8b 05 84 [2] 00 48 89 04 24 48 8d 44 24 68 48 89 44 24 08 48 8d 44 24 68 48 89 44 24 10 48 c7 44 24 18 30 00 00 00 e8 de 03 00 00 48 83 7c }
   condition:
       uint16(0) == 0x5A4D and filesize > 300KB and all of ($s*)
}
[TLP:WHITE] win_deimos_c2_w1 (20230125 | Detect the beacon used in the DeimosC2 framework (x86 version))
rule win_deimos_c2_w1 {
   meta:
        description = "Detect the beacon used in the DeimosC2 framework (x86 version)"
        author = "Arkbird_SOLG"
        reference = "https://www.trendmicro.com/en_us/research/22/k/deimosc2-what-soc-analysts-and-incident-responders-need-to-know.html"
        date = "2022-11-08"
        hash1 = "29305f74260d56f94a80d514505dbef949b0e6fae7989a9cd84e956ec4f6cffe"
        hash2 = "980b4076a9571ef2c1ef0328ce63074f22adeb29ef1001f328783ca5783979cc"
        hash3 = "a325c7729d39e5530b2c0804cd28b4dfb1d7560736ae5cbc7631fa5949cf7940"
        hash4 = "8c6ab7a051eedf9f119778bdc71cd96a40f52101657881e84262237083ba4a51"
        tlp = "Clear"
        adversary = "-"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.deimos_c2"
        malpedia_rule_date = "20230221"
        malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686"
        malpedia_version = "20230125"
        malpedia_license = ""
        malpedia_sharing = "TLP:WHITE"
   strings:
        $s1 = { 83 ec 40 c7 44 24 18 00 00 00 00 c7 44 24 14 00 00 00 00 8b 05 84 [2] 00 89 04 24 c7 44 24 04 ff ff ff ff 8d 44 24 18 89 44 24 08 8d 44 24 14 89 44 24 0c e8 b1 15 00 00 8b 44 24 10 85 c0 74 32 31 c0 31 c9 eb 03 40 89 d1 83 f8 20 7d 20 19 d2 89 cb 89 c1 bd 01 00 00 00 d3 e5 21 d5 23 6c 24 18 85 ed 74 05 8d 53 01 eb dc 89 da eb d8 85 c9 75 2d 8d 7c 24 1c 31 c0 e8 a3 cc 02 00 8b 0d 74 [2] 00 89 0c 24 8d 4c 24 1c 89 4c 24 04 e8 d6 14 00 00 8b 4c 24 30 89 4c 24 44 83 c4 }
        $s2 = { 8b 05 78 [2] 00 8d 0d [3] 00 89 04 24 89 4c 24 04 c7 44 24 08 08 02 00 00 e8 f0 1d 00 00 8b 44 24 0c 85 c0 74 2e 3d 08 02 00 00 77 27 8d 1d [3] 00 c6 04 03 5c 40 89 05 [3] 00 e9 0b ff ff ff 31 c0 e8 24 d3 02 00 ba 09 02 00 00 e8 4a d3 02 00 8d 05 [2] 77 00 89 04 24 c7 44 24 }
        $s3 = { 8b 15 38 [2] 00 89 14 24 89 4c 24 04 89 44 24 08 c7 44 24 0c 00 10 00 00 c7 44 24 10 04 00 00 00 e8 32 9c 01 00 8b 44 24 14 85 c0 87 dd 0f 94 c3 87 dd 8b 44 24 18 8b 4c 24 24 8b 54 24 30 8b 5c 24 1c e9 73 ff ff ff 83 c4 28 c3 83 c4 28 c3 e8 d3 dd 01 00 8d 05 [3] 00 89 04 24 c7 44 24 04 19 00 00 00 e8 5d e6 01 00 8b 44 24 18 89 04 24 c7 44 24 04 00 00 00 00 e8 59 e3 01 00 8d 05 [3] 00 89 04 24 c7 44 24 04 19 00 00 00 e8 33 e6 01 00 8b 44 24 20 89 04 24 c7 44 24 04 00 00 00 }
        $s4 = { 83 ec 58 c7 44 24 24 00 00 00 00 8b 05 9c [2] 00 89 04 24 c7 44 24 04 ff ff ff ff c7 44 24 08 fe ff ff ff c7 44 24 0c ff ff ff ff 8d 44 24 24 89 44 24 10 c7 44 24 14 00 00 00 00 c7 44 24 18 00 00 00 00 c7 44 24 1c 02 00 00 00 e8 89 04 00 00 64 8b 05 14 00 00 00 8b 80 00 00 00 00 8b 40 18 89 44 24 50 84 00 8d 88 b8 01 00 00 89 4c 24 54 89 0c 24 e8 91 ab fd ff 8b 44 24 24 8b 4c 24 50 89 81 bc 01 00 00 8b 44 24 54 89 04 24 e8 57 ad fd ff 8d 7c 24 34 31 c0 e8 75 ba 02 00 8b 05 30 [2] 00 89 04 24 8d 44 24 34 89 44 24 04 8d 44 24 34 89 44 24 08 c7 44 24 0c 1c 00 00 00 e8 16 03 00 00 8b 44 }
   condition:
       uint16(0) == 0x5A4D and filesize > 300KB and all of ($s*)
}
Download all Yara Rules