DeimosC2 (Malware Family)

DeimosC2

Trend Micro describes DeimosC2 as an open-source C&C framework that was released in June 2020. It is a fully-functional framework that allows for multiple attackers to access, create payloads for, and interact with victim computers. As a post-exploitation C&C framework, DeimosC2 will generate the payloads that need to be manually executed on computer servers that have been compromised through other means such as social engineering, exploitation, or brute-force attacks. Once it is deployed, the threat actors will gain the same access to the systems as the user account that the payload was executed as, either as an administrator or a regular user. Note that DeimosC2 does not perform active or privilege escalation of any kind.

References

2022-11-08 ⋅ Feike Hacquebord, Stephen Hilt, Fernando Mercês
DeimosC2: What SOC Analysts and Incident Responders Need to Know About This C&C Framework
DeimosC2

Yara Rules

[TLP:WHITE] win_deimos_c2_w0 (20230125 | Detect the beacon used in the DeimosC2 framework (x64 version))

rule win_deimos_c2_w0 {
   meta:
        description = "Detect the beacon used in the DeimosC2 framework (x64 version)"
        author = "Arkbird_SOLG"
        reference = "https://www.trendmicro.com/en_us/research/22/k/deimosc2-what-soc-analysts-and-incident-responders-need-to-know.html"
        date = "2022-11-08"
        hash1 = "4f069ec1dc6e88a2b4e1c50a8dda6a7935f91424724499b41ff1c3a9f87b143c"
        hash2 = "21827cb6d8409ddea5097384d86f3004f5ec4ebe387a9340d8f3443598bdd2af"
        hash3 = "dbc5b2946b58deb1c40d787e3c5386b9020086b5d01dbbfbaccc44b322aca68c"
        hash4 = "6f3394a5980ddbc28c7e889c636cddabd48a710588a5c10427d10a19d07b1c0a"
        tlp = "Clear"
        adversary = "-"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.deimos_c2"
        malpedia_rule_date = "20230221"
        malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686"
        malpedia_version = "20230125"
        malpedia_license = ""
        malpedia_sharing = "TLP:WHITE"
   strings:
        $s1 = { 48 83 ec 70 48 89 6c 24 68 48 8d 6c 24 68 48 c7 44 24 30 00 00 00 00 48 c7 44 24 28 00 00 00 00 48 8b 05 a7 [2] 00 48 89 04 24 48 c7 44 24 08 ff ff ff ff 48 8d 44 24 30 48 89 44 24 10 48 8d 44 24 28 48 89 44 24 18 e8 59 18 00 00 48 83 7c 24 20 00 74 35 31 c0 31 c9 eb 24 48 89 ca 48 89 c1 bb 01 00 00 00 48 d3 e3 48 23 5c 24 30 48 8d 72 01 48 85 db 48 0f 45 d6 48 ff c0 48 89 d1 48 83 f8 40 7c d6 48 85 c9 75 3e 0f 57 c0 0f 11 44 24 38 0f 11 44 24 48 0f 11 44 24 58 48 8b 05 0b [2] 00 48 89 04 24 48 8d 44 24 38 48 89 44 24 08 e8 30 17 00 00 8b 44 24 58 89 44 24 78 48 8b 6c }
        $s2 = { 48 8b 05 a0 [2] 00 48 8d 0d [3] 00 48 89 04 24 48 89 4c 24 08 48 c7 44 24 10 08 02 00 00 e8 12 22 00 00 48 8b 44 24 18 48 85 c0 74 33 48 3d 08 02 00 00 77 2b 48 8d 1d [3] 00 c6 04 03 5c 48 ff c0 48 89 05 [3] 00 e9 d6 fe ff ff 31 c0 e8 9f 2e 03 00 ba 09 02 00 00 e8 c5 2e 03 00 48 8d 05 [3] 00 48 89 04 24 48 c7 44 24 }
        $s3 = { 48 8b 15 36 [2] 00 48 89 14 24 48 89 4c 24 08 48 89 44 24 10 48 c7 44 24 18 00 10 00 00 48 c7 44 24 20 04 00 00 00 e8 e1 a6 01 00 48 83 7c 24 28 00 40 0f 94 c6 48 8b 44 24 38 48 8b 4c 24 48 48 8b 54 24 68 48 8b 5c 24 40 e9 61 ff ff ff 48 8b 6c 24 50 48 83 c4 58 c3 48 8b 6c 24 50 48 83 }
        $s4 = { 48 81 ec b0 00 00 00 48 89 ac 24 a8 00 00 00 48 8d ac 24 a8 00 00 00 48 c7 44 24 48 00 00 00 00 48 8b 05 12 [2] 00 48 89 04 24 48 c7 44 24 08 ff ff ff ff 48 c7 44 24 10 fe ff ff ff 48 c7 44 24 18 ff ff ff ff 48 8d 44 24 48 48 89 44 24 20 0f 57 c0 0f 11 44 24 28 48 c7 44 24 38 02 00 00 00 e8 fb 05 00 00 65 48 8b 04 25 28 00 00 00 48 8b 80 00 00 00 00 48 8b 40 30 48 89 84 24 98 00 00 00 84 00 48 8d 88 10 03 00 00 48 89 8c 24 a0 00 00 00 48 89 0c 24 e8 45 81 fd ff 48 8b 44 24 48 48 8b 8c 24 98 00 00 00 48 89 81 18 03 00 00 48 8b 84 24 a0 00 00 00 48 89 04 24 e8 10 83 fd ff 0f 57 c0 0f 11 44 24 68 0f 11 44 24 78 0f 11 84 24 88 00 00 00 48 8b 05 84 [2] 00 48 89 04 24 48 8d 44 24 68 48 89 44 24 08 48 8d 44 24 68 48 89 44 24 10 48 c7 44 24 18 30 00 00 00 e8 de 03 00 00 48 83 7c }
   condition:
       uint16(0) == 0x5A4D and filesize > 300KB and all of ($s*)
}

[TLP:WHITE] win_deimos_c2_w1 (20230125 | Detect the beacon used in the DeimosC2 framework (x86 version))

rule win_deimos_c2_w1 {
   meta:
        description = "Detect the beacon used in the DeimosC2 framework (x86 version)"
        author = "Arkbird_SOLG"
        reference = "https://www.trendmicro.com/en_us/research/22/k/deimosc2-what-soc-analysts-and-incident-responders-need-to-know.html"
        date = "2022-11-08"
        hash1 = "29305f74260d56f94a80d514505dbef949b0e6fae7989a9cd84e956ec4f6cffe"
        hash2 = "980b4076a9571ef2c1ef0328ce63074f22adeb29ef1001f328783ca5783979cc"
        hash3 = "a325c7729d39e5530b2c0804cd28b4dfb1d7560736ae5cbc7631fa5949cf7940"
        hash4 = "8c6ab7a051eedf9f119778bdc71cd96a40f52101657881e84262237083ba4a51"
        tlp = "Clear"
        adversary = "-"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.deimos_c2"
        malpedia_rule_date = "20230221"
        malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686"
        malpedia_version = "20230125"
        malpedia_license = ""
        malpedia_sharing = "TLP:WHITE"
   strings:
        $s1 = { 83 ec 40 c7 44 24 18 00 00 00 00 c7 44 24 14 00 00 00 00 8b 05 84 [2] 00 89 04 24 c7 44 24 04 ff ff ff ff 8d 44 24 18 89 44 24 08 8d 44 24 14 89 44 24 0c e8 b1 15 00 00 8b 44 24 10 85 c0 74 32 31 c0 31 c9 eb 03 40 89 d1 83 f8 20 7d 20 19 d2 89 cb 89 c1 bd 01 00 00 00 d3 e5 21 d5 23 6c 24 18 85 ed 74 05 8d 53 01 eb dc 89 da eb d8 85 c9 75 2d 8d 7c 24 1c 31 c0 e8 a3 cc 02 00 8b 0d 74 [2] 00 89 0c 24 8d 4c 24 1c 89 4c 24 04 e8 d6 14 00 00 8b 4c 24 30 89 4c 24 44 83 c4 }
        $s2 = { 8b 05 78 [2] 00 8d 0d [3] 00 89 04 24 89 4c 24 04 c7 44 24 08 08 02 00 00 e8 f0 1d 00 00 8b 44 24 0c 85 c0 74 2e 3d 08 02 00 00 77 27 8d 1d [3] 00 c6 04 03 5c 40 89 05 [3] 00 e9 0b ff ff ff 31 c0 e8 24 d3 02 00 ba 09 02 00 00 e8 4a d3 02 00 8d 05 [2] 77 00 89 04 24 c7 44 24 }
        $s3 = { 8b 15 38 [2] 00 89 14 24 89 4c 24 04 89 44 24 08 c7 44 24 0c 00 10 00 00 c7 44 24 10 04 00 00 00 e8 32 9c 01 00 8b 44 24 14 85 c0 87 dd 0f 94 c3 87 dd 8b 44 24 18 8b 4c 24 24 8b 54 24 30 8b 5c 24 1c e9 73 ff ff ff 83 c4 28 c3 83 c4 28 c3 e8 d3 dd 01 00 8d 05 [3] 00 89 04 24 c7 44 24 04 19 00 00 00 e8 5d e6 01 00 8b 44 24 18 89 04 24 c7 44 24 04 00 00 00 00 e8 59 e3 01 00 8d 05 [3] 00 89 04 24 c7 44 24 04 19 00 00 00 e8 33 e6 01 00 8b 44 24 20 89 04 24 c7 44 24 04 00 00 00 }
        $s4 = { 83 ec 58 c7 44 24 24 00 00 00 00 8b 05 9c [2] 00 89 04 24 c7 44 24 04 ff ff ff ff c7 44 24 08 fe ff ff ff c7 44 24 0c ff ff ff ff 8d 44 24 24 89 44 24 10 c7 44 24 14 00 00 00 00 c7 44 24 18 00 00 00 00 c7 44 24 1c 02 00 00 00 e8 89 04 00 00 64 8b 05 14 00 00 00 8b 80 00 00 00 00 8b 40 18 89 44 24 50 84 00 8d 88 b8 01 00 00 89 4c 24 54 89 0c 24 e8 91 ab fd ff 8b 44 24 24 8b 4c 24 50 89 81 bc 01 00 00 8b 44 24 54 89 04 24 e8 57 ad fd ff 8d 7c 24 34 31 c0 e8 75 ba 02 00 8b 05 30 [2] 00 89 04 24 8d 44 24 34 89 44 24 04 8d 44 24 34 89 44 24 08 c7 44 24 0c 1c 00 00 00 e8 16 03 00 00 8b 44 }
   condition:
       uint16(0) == 0x5A4D and filesize > 300KB and all of ($s*)
}

Download all Yara Rules

DeimosC2 Propose Change

References

Yara Rules

DeimosC2