TF-MAL-osx.dacls
📛 Threat Title
Malware family: Dacls
Description
ThreatFox malware family `osx.dacls`. Printable name: Dacls.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
osx.dacls
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/osx.dacls
IOC database
- Type
- domain
- Value
osx.dacls- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-osx.dacls
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/osx.dacls
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:attack.mitre.org
Dacls Dacls is a multi-platform remote access tool used by Lazarus Group since at least December 2019. [1] [2]
-
web:cve.nohackme.com
Dacls is a multi-platform remote access tool used by Lazarus Group since at least December 2019.
-
web:hunt.io
Dacls is a remote access trojan (RAT) attributed to the Lazarus Group, targeting Windows, Linux, and macOS systems. This modular malware enables attackers to perform a wide range of actions, including process manipulation, file operations, and DLL injection. Dacls is also capable of encrypting its command-and-control (C2) communications, making detection and analysis more challenging. Its ...
-
web:learn.microsoft.com
If a Windows object does not have a discretionary access control list ( DACL ), the system allows everyone full access to it. Learn how DACLs and access control entries (ACEs) work in Windows security to effectively manage access to objects in your apps.
-
web:malpedia.caad.fkie.fraunhofer.de
According to PCrisk, Dacls is the name of a remote access Trojan (RAT), a malicious program that allows cyber criminals to control infected computers remotely. Research shows that this malware is tied to Lazarus Group (a group of cyber criminals) and targets Linux and the Windows Operating System. Typically, cyber criminals use RATs to steal sensitive, confidential information, infect systems ...
-
web:medium.com
For malware , this means gaining access to protected files by adding itself or a specific user to the DACL . By modifying DACLs , malware can bypass normal access controls.
-
web:windowsforum.com
The emergence of RESURGE signals more than just another entry in a long line of malware threats. According to CISA, RESURGE contains advanced persistence features inherited from the SPAWNCHIMERA malware family—a group notorious for its ability to survive system reboots and avoid simplistic remediation .
-
web:www.hackingarticles.in
Explore AllExtendedRights Active Directory abuse and learn how attackers exploit DACLs to reset passwords and escalate privileges.
-
web:www.ncsc.gov.uk
This guidance helps private and public sector organisations deal with the effects of malware (which includes ransomware). It provides actions to help organisations prevent a malware infection, and also steps to take if you're already infected. Following this guidance will reduce: the likelihood of becoming infected the spread of malware throughout your organisation the impact of the infection
-
web:www.thehacker.recipes
DACLs (Active Directory Discretionary Access Control Lists) are lists made of ACEs (Access Control Entries) that identify the users and groups that are allowed or denied access on an object. SACLs (Systems Access Control Lists) define the audit and monitoring rules over a securable object.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.