MITRE ATT&CKsoftware (malware)
S1033 DCSrv
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.1
- Created
- 2022-08-11
Description
DCSrv is destructive malware that has been used by Moses Staff since at least September 2021. Though DCSrv has ransomware-like capabilities, Moses Staff does not demand ransom or offer a decryption key.
Related
Uses · MITRE ATT&CK (8)
- T1027.013 Encrypted/Encoded File sub-technique
- T1036.004 Masquerade Task or Service sub-technique
- T1543.003 Windows Service sub-technique
- T1529 System Shutdown/Reboot technique
- T1486 Data Encrypted for Impact technique
- T1106 Native API technique
- T1112 Modify Registry technique
- T1124 System Time Discovery technique
Referenced by MITRE ATT&CK · uses (1)
- G1009 Moses Staff group
References
- https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/ Checkpoint MosesStaff Nov 2021