Malware: DCSrv

Description

[DCSrv](https://attack.mitre.org/software/S1033) is destructive malware that has been used by [Moses Staff](https://attack.mitre.org/groups/G1009) since at least September 2021. Though [DCSrv](https://attack.mitre.org/software/S1033) has ransomware-like capabilities, [Moses Staff](https://attack.mitre.org/groups/G1009) does not demand ransom or offer a decryption key.(Citation: Checkpoint MosesStaff Nov 2021)

External References

• mitre-attack
• Checkpoint MosesStaff Nov 2021

Techniques Used by This Malware

• T1027.013 — Encrypted/Encoded File
• T1036.004 — Masquerade Task or Service
• T1106 — Native API
• T1112 — Modify Registry
• T1124 — System Time Discovery
• T1486 — Data Encrypted for Impact
• T1529 — System Shutdown/Reboot
• T1543.003 — Windows Service

APT Groups Using This Malware

• Moses Staff