TF-MAL-elf.dacls
📛 Threat Title
Malware family: Dacls
Description
ThreatFox malware family `elf.dacls`. Printable name: Dacls.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
elf.dacls
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.dacls
IOC database
- Type
- domain
- Value
elf.dacls- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-elf.dacls
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/elf.dacls
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:attack.mitre.org
Dacls Dacls is a multi-platform remote access tool used by Lazarus Group since at least December 2019. [1] [2]
-
web:cve.nohackme.com
Dacls is a multi-platform remote access tool used by Lazarus Group since at least December 2019.
-
web:cybernews.com
The FBI warns of a surge in ATM jackpotting attacks, with more than 700 incidents in 2025 alone. Hackers use Ploutus malware to force machines to dispense cash.
-
web:hunt.io
Dacls is a remote access trojan (RAT) attributed to the Lazarus Group, targeting Windows, Linux, and macOS systems. This modular malware enables attackers to perform a wide range of actions, including process manipulation, file operations, and DLL injection. Dacls is also capable of encrypting its command-and-control (C2) communications, making detection and analysis more challenging. Its ...
-
web:malpedia.caad.fkie.fraunhofer.de
According to PCrisk, Dacls is the name of a remote access Trojan (RAT), a malicious program that allows cyber criminals to control infected computers remotely. Research shows that this malware is tied to Lazarus Group (a group of cyber criminals) and targets Linux and the Windows Operating System. Typically, cyber criminals use RATs to steal sensitive, confidential information, infect systems ...
-
web:medium.com
For malware , this means gaining access to protected files by adding itself or a specific user to the DACL . By modifying DACLs , malware can bypass normal access controls.
-
web:windowsforum.com
The emergence of RESURGE signals more than just another entry in a long line of malware threats. According to CISA, RESURGE contains advanced persistence features inherited from the SPAWNCHIMERA malware family—a group notorious for its ability to survive system reboots and avoid simplistic remediation .
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.ncsc.gov.uk
This guidance helps private and public sector organisations deal with the effects of malware (which includes ransomware). It provides actions to help organisations prevent a malware infection, and also steps to take if you're already infected. Following this guidance will reduce: the likelihood of becoming infected the spread of malware throughout your organisation the impact of the infection
-
web:www.thehacker.recipes
DACLs (Active Directory Discretionary Access Control Lists) are lists made of ACEs (Access Control Entries) that identify the users and groups that are allowed or denied access on an object. SACLs (Systems Access Control Lists) define the audit and monitoring rules over a securable object.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.