Dacls

Malware & Tools · Dacls

· MalwareS0497 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

macOS, Linux, Windows

Description

Dacls is a multi-platform remote access tool used by Lazarus Group since at least December 2019.(Citation: TrendMicro macOS Dacls May 2020)(Citation: SentinelOne Lazarus macOS July 2020)

Tactic Coverage

stealth (3)discovery (2)command and control (2)persistence (2)privilege escalation (2)

Used By (1 groups)

G0032Lazarus GroupLabyrinth Chollima, HIDDEN COBRA

Techniques (9)

T1027.013Encrypted/Encoded File

stealth

T1036Masquerading

stealth

T1057Process Discovery

discovery

T1071.001Web Protocols

command and control

T1083File and Directory Discovery

discovery

T1105Ingress Tool Transfer

command and control

T1543.001Launch Agent

References

https://attack.mitre.org/software/S0497 https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability/https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/