SYMBOLCOMMON_NAMEaka. SYNONYMS
win.deimos_c2 (Back to overview)

DeimosC2


Trend Micro describes DeimosC2 as an open-source C&C framework that was released in June 2020. It is a fully-functional framework that allows for multiple attackers to access, create payloads for, and interact with victim computers. As a post-exploitation C&C framework, DeimosC2 will generate the payloads that need to be manually executed on computer servers that have been compromised through other means such as social engineering, exploitation, or brute-force attacks. Once it is deployed, the threat actors will gain the same access to the systems as the user account that the payload was executed as, either as an administrator or a regular user. Note that DeimosC2 does not perform active or privilege escalation of any kind.

References
2022-11-08Feike Hacquebord, Stephen Hilt, Fernando Mercês
@online{hacquebord:20221108:deimosc2:961543e, author = {Feike Hacquebord and Stephen Hilt and Fernando Mercês}, title = {{DeimosC2: What SOC Analysts and Incident Responders Need to Know About This C&C Framework}}, date = {2022-11-08}, url = {https://www.trendmicro.com/en_us/research/22/k/deimosc2-what-soc-analysts-and-incident-responders-need-to-know.html}, language = {English}, urldate = {2023-02-21} } DeimosC2: What SOC Analysts and Incident Responders Need to Know About This C&C Framework
DeimosC2
Yara Rules
[TLP:WHITE] win_deimos_c2_w0 (20230125 | Detect the beacon used in the DeimosC2 framework (x64 version))
rule win_deimos_c2_w0 {
   meta:
        description = "Detect the beacon used in the DeimosC2 framework (x64 version)"
        author = "Arkbird_SOLG"
        reference = "https://www.trendmicro.com/en_us/research/22/k/deimosc2-what-soc-analysts-and-incident-responders-need-to-know.html"
        date = "2022-11-08"
        hash1 = "4f069ec1dc6e88a2b4e1c50a8dda6a7935f91424724499b41ff1c3a9f87b143c"
        hash2 = "21827cb6d8409ddea5097384d86f3004f5ec4ebe387a9340d8f3443598bdd2af"
        hash3 = "dbc5b2946b58deb1c40d787e3c5386b9020086b5d01dbbfbaccc44b322aca68c"
        hash4 = "6f3394a5980ddbc28c7e889c636cddabd48a710588a5c10427d10a19d07b1c0a"
        tlp = "Clear"
        adversary = "-"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.deimos_c2"
        malpedia_rule_date = "20230221"
        malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686"
        malpedia_version = "20230125"
        malpedia_license = ""
        malpedia_sharing = "TLP:WHITE"
   strings:
        $s1 = { 48 83 ec 70 48 89 6c 24 68 48 8d 6c 24 68 48 c7 44 24 30 00 00 00 00 48 c7 44 24 28 00 00 00 00 48 8b 05 a7 [2] 00 48 89 04 24 48 c7 44 24 08 ff ff ff ff 48 8d 44 24 30 48 89 44 24 10 48 8d 44 24 28 48 89 44 24 18 e8 59 18 00 00 48 83 7c 24 20 00 74 35 31 c0 31 c9 eb 24 48 89 ca 48 89 c1 bb 01 00 00 00 48 d3 e3 48 23 5c 24 30 48 8d 72 01 48 85 db 48 0f 45 d6 48 ff c0 48 89 d1 48 83 f8 40 7c d6 48 85 c9 75 3e 0f 57 c0 0f 11 44 24 38 0f 11 44 24 48 0f 11 44 24 58 48 8b 05 0b [2] 00 48 89 04 24 48 8d 44 24 38 48 89 44 24 08 e8 30 17 00 00 8b 44 24 58 89 44 24 78 48 8b 6c }
        $s2 = { 48 8b 05 a0 [2] 00 48 8d 0d [3] 00 48 89 04 24 48 89 4c 24 08 48 c7 44 24 10 08 02 00 00 e8 12 22 00 00 48 8b 44 24 18 48 85 c0 74 33 48 3d 08 02 00 00 77 2b 48 8d 1d [3] 00 c6 04 03 5c 48 ff c0 48 89 05 [3] 00 e9 d6 fe ff ff 31 c0 e8 9f 2e 03 00 ba 09 02 00 00 e8 c5 2e 03 00 48 8d 05 [3] 00 48 89 04 24 48 c7 44 24 }
        $s3 = { 48 8b 15 36 [2] 00 48 89 14 24 48 89 4c 24 08 48 89 44 24 10 48 c7 44 24 18 00 10 00 00 48 c7 44 24 20 04 00 00 00 e8 e1 a6 01 00 48 83 7c 24 28 00 40 0f 94 c6 48 8b 44 24 38 48 8b 4c 24 48 48 8b 54 24 68 48 8b 5c 24 40 e9 61 ff ff ff 48 8b 6c 24 50 48 83 c4 58 c3 48 8b 6c 24 50 48 83 }
        $s4 = { 48 81 ec b0 00 00 00 48 89 ac 24 a8 00 00 00 48 8d ac 24 a8 00 00 00 48 c7 44 24 48 00 00 00 00 48 8b 05 12 [2] 00 48 89 04 24 48 c7 44 24 08 ff ff ff ff 48 c7 44 24 10 fe ff ff ff 48 c7 44 24 18 ff ff ff ff 48 8d 44 24 48 48 89 44 24 20 0f 57 c0 0f 11 44 24 28 48 c7 44 24 38 02 00 00 00 e8 fb 05 00 00 65 48 8b 04 25 28 00 00 00 48 8b 80 00 00 00 00 48 8b 40 30 48 89 84 24 98 00 00 00 84 00 48 8d 88 10 03 00 00 48 89 8c 24 a0 00 00 00 48 89 0c 24 e8 45 81 fd ff 48 8b 44 24 48 48 8b 8c 24 98 00 00 00 48 89 81 18 03 00 00 48 8b 84 24 a0 00 00 00 48 89 04 24 e8 10 83 fd ff 0f 57 c0 0f 11 44 24 68 0f 11 44 24 78 0f 11 84 24 88 00 00 00 48 8b 05 84 [2] 00 48 89 04 24 48 8d 44 24 68 48 89 44 24 08 48 8d 44 24 68 48 89 44 24 10 48 c7 44 24 18 30 00 00 00 e8 de 03 00 00 48 83 7c }
   condition:
       uint16(0) == 0x5A4D and filesize > 300KB and all of ($s*)
}
[TLP:WHITE] win_deimos_c2_w1 (20230125 | Detect the beacon used in the DeimosC2 framework (x86 version))
rule win_deimos_c2_w1 {
   meta:
        description = "Detect the beacon used in the DeimosC2 framework (x86 version)"
        author = "Arkbird_SOLG"
        reference = "https://www.trendmicro.com/en_us/research/22/k/deimosc2-what-soc-analysts-and-incident-responders-need-to-know.html"
        date = "2022-11-08"
        hash1 = "29305f74260d56f94a80d514505dbef949b0e6fae7989a9cd84e956ec4f6cffe"
        hash2 = "980b4076a9571ef2c1ef0328ce63074f22adeb29ef1001f328783ca5783979cc"
        hash3 = "a325c7729d39e5530b2c0804cd28b4dfb1d7560736ae5cbc7631fa5949cf7940"
        hash4 = "8c6ab7a051eedf9f119778bdc71cd96a40f52101657881e84262237083ba4a51"
        tlp = "Clear"
        adversary = "-"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.deimos_c2"
        malpedia_rule_date = "20230221"
        malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686"
        malpedia_version = "20230125"
        malpedia_license = ""
        malpedia_sharing = "TLP:WHITE"
   strings:
        $s1 = { 83 ec 40 c7 44 24 18 00 00 00 00 c7 44 24 14 00 00 00 00 8b 05 84 [2] 00 89 04 24 c7 44 24 04 ff ff ff ff 8d 44 24 18 89 44 24 08 8d 44 24 14 89 44 24 0c e8 b1 15 00 00 8b 44 24 10 85 c0 74 32 31 c0 31 c9 eb 03 40 89 d1 83 f8 20 7d 20 19 d2 89 cb 89 c1 bd 01 00 00 00 d3 e5 21 d5 23 6c 24 18 85 ed 74 05 8d 53 01 eb dc 89 da eb d8 85 c9 75 2d 8d 7c 24 1c 31 c0 e8 a3 cc 02 00 8b 0d 74 [2] 00 89 0c 24 8d 4c 24 1c 89 4c 24 04 e8 d6 14 00 00 8b 4c 24 30 89 4c 24 44 83 c4 }
        $s2 = { 8b 05 78 [2] 00 8d 0d [3] 00 89 04 24 89 4c 24 04 c7 44 24 08 08 02 00 00 e8 f0 1d 00 00 8b 44 24 0c 85 c0 74 2e 3d 08 02 00 00 77 27 8d 1d [3] 00 c6 04 03 5c 40 89 05 [3] 00 e9 0b ff ff ff 31 c0 e8 24 d3 02 00 ba 09 02 00 00 e8 4a d3 02 00 8d 05 [2] 77 00 89 04 24 c7 44 24 }
        $s3 = { 8b 15 38 [2] 00 89 14 24 89 4c 24 04 89 44 24 08 c7 44 24 0c 00 10 00 00 c7 44 24 10 04 00 00 00 e8 32 9c 01 00 8b 44 24 14 85 c0 87 dd 0f 94 c3 87 dd 8b 44 24 18 8b 4c 24 24 8b 54 24 30 8b 5c 24 1c e9 73 ff ff ff 83 c4 28 c3 83 c4 28 c3 e8 d3 dd 01 00 8d 05 [3] 00 89 04 24 c7 44 24 04 19 00 00 00 e8 5d e6 01 00 8b 44 24 18 89 04 24 c7 44 24 04 00 00 00 00 e8 59 e3 01 00 8d 05 [3] 00 89 04 24 c7 44 24 04 19 00 00 00 e8 33 e6 01 00 8b 44 24 20 89 04 24 c7 44 24 04 00 00 00 }
        $s4 = { 83 ec 58 c7 44 24 24 00 00 00 00 8b 05 9c [2] 00 89 04 24 c7 44 24 04 ff ff ff ff c7 44 24 08 fe ff ff ff c7 44 24 0c ff ff ff ff 8d 44 24 24 89 44 24 10 c7 44 24 14 00 00 00 00 c7 44 24 18 00 00 00 00 c7 44 24 1c 02 00 00 00 e8 89 04 00 00 64 8b 05 14 00 00 00 8b 80 00 00 00 00 8b 40 18 89 44 24 50 84 00 8d 88 b8 01 00 00 89 4c 24 54 89 0c 24 e8 91 ab fd ff 8b 44 24 24 8b 4c 24 50 89 81 bc 01 00 00 8b 44 24 54 89 04 24 e8 57 ad fd ff 8d 7c 24 34 31 c0 e8 75 ba 02 00 8b 05 30 [2] 00 89 04 24 8d 44 24 34 89 44 24 04 8d 44 24 34 89 44 24 08 c7 44 24 0c 1c 00 00 00 e8 16 03 00 00 8b 44 }
   condition:
       uint16(0) == 0x5A4D and filesize > 300KB and all of ($s*)
}
Download all Yara Rules