Dtrack

DTrack is a type of malware, short for malicious software, that is designed to exploit and damage computers or devices. It can infiltrate systems through suspicious downloads, emails, or websites and once inside, it can steal personal information, disrupt operations, or even hold data hostage for ransom. This malware has been associated with the Andariel group, a subset of the Lazarus group, known for their use of DTrack and Maui ransomware. In mid-2022, Andariel deployed these two harmful programs, as reported by securelist.com. The group also engages in cybercrime to fund its operations, deploying custom-built tools such as DTrack malware and Maui ransomware to target organizations worldwide. DTrack was also part of a broader landscape of increasing malware activity. New banking Trojans emerged that sought banking credentials, and there was heightened activity from some well-known ones, including DTrack, Zbot, and Qbot. Unfortunately, the first piece of malware downloaded was not caught, but the subsequent exploitation was closely followed by the download of the DTrack backdoor. This period saw the introduction of several new malware families like YamaBot and MagicRat, as well as updated versions of NukeSped and DTrack. More recently, the group was detected using another new malware family called EarlyRat, which was being used in conjunction with DTrack malware and Maui ransomware, exploiting the Log4j flaw for initial access. In several of the attacks, Stonefly's custom malware Backdoor.Preft (also known as Dtrack, Valefor) was deployed, according to Symantec's blog post. The evolution of DTrack's targeting towards Europe and Latin America further exemplifies the persistent threat landscape posed by advanced persistent threats (APTs) using API hashing.