DarkVNCMalware
According to Enigmasoft, DarkVNC malware is a hacking tool that is available for purchase online. it is can be used as a Virtual Network Computing service, which means that the attackers can get full access to the targeted system via this malware. However, unlike a genuine Virtual Network Computing utility, the DarkVNC threat operates in the background silently.From MISP Galaxy
Last reported 3 days ago, by The Hacker News5 reports
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1053.005Scheduled Task
“ICEDID employs multiple stages before establishing persistence via a scheduled task and may retrieve components from C2 dynamically.”
- T1199Trusted Relationship
“"The attacked organization possessed an extensive infrastructure and two-way trusted relationships with numerous subsidiary medical institutions," Solar said.”
- T1543.003Windows Service
“The primary responsibility of the Windows service is to launch the rogue binary "C:\Program Files\VMware\VMware Tools\authd.exe" that, besides launching a GOST tunnel every Saturday from 10 p.m.”
- T1684Social Engineering
“Phantom Deal profile: Gen Digital has stumbled upon a cybercrime group that poses as executives who use WhatsApp social-engineering to trick victims into investing or acquiring fake companies.”
- T1685.005Clear Windows Event Logs
“…tor is their ability to stage destructive attacks with a wiper referred to as Pryanik, alongside taking steps to systematically clear Windows event logs using a utility dubbed Evlx.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion“… attacks led to the deployment of two types of malware, a variant of the TVRAT (aka Sheldor, SpyAgent, TeamBot, TeamSpy, and TVSPY) and DarkVNC, to harvest and send data from a victim computer to a remote server under the attacker's control.”
-
Risky Bulletin: Russia tells data centers to deploy drone defenses“The messages contained malicious Excel files that deployed the TVSPY and DarkVNC malware on job seekers' devices.”
-
Russian Man Extradited Over Malware Campaign Targeting Freelancers“…ess Trojan, also known as TVSPY or TeamSpy, exploited a vulnerability in TeamViewer to give remote control of infected computers, while DarkVNC had similar functionality through VNC Viewer.”
-
Unpacking ICEDID“ICEDID has been linked to the distribution of several distinct malware families including DarkVNC and COBALT STRIKE.”
-
Thawing the permafrost of ICEDID Summary“ICEDID has been linked to the distribution of other distinct malware families including DarkVNC and COBALT STRIKE.”
Indicators in its reports
named in the reports above- idscan[.]netin 1 report
- 54d064799115f302…c532b53e855fin 1 report
- alishaskainz[.]comin 1 report
- villageskaier[.]comin 1 report
- hxxps://securityintelligence[.]com/new-banking-trojan-icedid-discovered-by-ibm-x-force-research/in 1 report
- hxxps://www.justice[.]gov/opa/pr/emotet-botnet-disrupted-international-cyber-operationin 1 report
- hxxps://malpedia.caad.fkie.fraunhofer[.]de/details/win.darkvncin 1 report
- hxxps://www.cybereason[.]com/blog/threat-analysis-report-all-paths-lead-to-cobalt-strike-icedid-emotet-and-qbotin 1 report
- hxxps://github[.]com/hasherezade/funky_malware_formats/blob/f1cacba4ee347601dceacda04e4de8c699971d29/iced_id_parser/iceid_to_pe.cppin 1 report
- hxxps://mh-nexus[.]de/en/hxd/in 1 report
- mh-nexus[.]dein 1 report
- hxxps://hex-rays[.]com/IDA-pro/in 1 report
- hex-rays[.]comin 1 report
- hxxps://github[.]com/elastic/protections-artifacts/in 1 report
- crypto[.]newsin 1 report
Copy these 15 indicators · defanged
Thanks — we review every report.