Hello! My name is Dtrack

mood · Sep 23, 2019

Hello! My name is Dtrack
Investigation into the Dtrack RAT
September 23, 2019
https://securelist.com/my-name-is-dtrack/93338/

In the late summer of 2018, we discovered ATMDtrack, a piece of banking malware targeting Indian banks. Further analysis showed that the malware was designed to be planted on the victim’s ATMs, where it could read and store the data of cards that were inserted into the machines. Naturally, we wanted to know more about that ATM malware, so we used YARA and Kaspersky Attribution Engine to uncover more interesting material: over 180 new malware samples of a spy tool that we now call Dtrack.

All the Dtrack samples we initially found were dropped samples, as the real payload was encrypted with various droppers—we were able to find them because of the unique sequences shared by ATMDtrack and the Dtrack memory dumps.
[...] we saw similarities with the DarkSeoul campaign, dating back to 2013 and attributed to the Lazarus group. It seems that they reused part of their old code to attack the financial sector and research centers in India. According to our telemetry, the last activity of DTrack was detected in the beginning of September 2019.
Click to expand...

mood · Nov 15, 2022

North Korean hackers target European orgs with updated malware
By Bill Toulas @billtoulas - November 15, 2022

North Korean hackers are using a new version of the DTrack backdoor to attack organizations in Europe and Latin America.

DTrack is a modular backdoor featuring a keylogger, a screenshot snapper, a browser history retriever, a running processes snooper, an IP address and network connection information snatcher, and more.
Click to expand...

Apart from spying, it can also run commands to perform file operations, fetch additional payloads, steal files and data, and execute processes on the compromised device.

The new malware version doesn't feature many functional or code changes compared to samples analyzed in the past, but it is now deployed far more widely.
A wider distribution
As Kaspersky explains in a report published today, their telemetry shows DTrack activity in Germany, Brazil, India, Italy, Mexico, Switzerland, Saudi Arabia, Turkey, and the United States.
Click to expand...

Kaspersky told BleepingComputer that DTrack continues to be installed by breaching networks using stolen credentials or exploiting Internet-exposed servers, as seen in previous campaigns.
Click to expand...

Kaspersky: DTrack activity targeting Europe and Latin America

November 15, 2022
DTrack is a backdoor used by the Lazarus group. Initially discovered in 2019, the backdoor remains in use three years later. It is used by the Lazarus group against a wide variety of targets. For example, we’ve seen it being used in financial environments where ATMs were breached, in attacks on a nuclear power plant and also in targeted ransomware attacks. Essentially, anywhere the Lazarus group believes they can achieve some financial gain.
Click to expand...

As part of our crimeware reporting service, we published a new private report about recent Dtrack activity. In this public article we highlight some of the main findings shared in that report.
Click to expand...

Log in or Sign up

Hello! My name is Dtrack

mood Updates Team

mood Updates Team

Log in or Sign up

Hello! My name is Dtrack

mood Updates Team

mood Updates Team

Useful Searches