Dacls RAT

Description

(Qihoo 360) Dacls is a new type of remote-control software targeting both Windows and Linux environment. Its functions are modular, the C2 protocol uses TLS and RC4 double-layer encryption, the configuration file uses AES encryption and supports C2 instruction dynamic update. The Win32.Dacls plug-in module is dynamically loaded through a remote URL, and the Linux version of the plug-in is compiled directly in the Bot program.

Names

Name
Dacls RAT
Dacls

Category

Malware

Type

• Backdoor

Information

• https://blog.netlab.360.com/dacls-the-dual-platform-rat-en/
• https://blog.malwarebytes.com/threat-analysis/2020/05/new-mac-variant-of-lazarus-dacls-rat-distributed-via-trojanized-2fa-app/

Malpedia

• https://malpedia.caad.fkie.fraunhofer.de/details/elf.dacls
• https://malpedia.caad.fkie.fraunhofer.de/details/win.dacls
• https://malpedia.caad.fkie.fraunhofer.de/details/osx.dacls

Alienvault Otx

• https://otx.alienvault.com/browse/pulses?q=tag:Dacls

Other Information

Uuid

ece6a72a-df67-40cb-8f1a-17bb6fee43cc

Last Card Change

2022-12-29