Dtrack

DTrack is a malicious software (malware) known for its data theft capabilities. It was first associated with North Korean threat groups and has been used in numerous cyber attacks globally. The malware infiltrates systems through suspicious downloads, emails, or websites, and once inside, it collects sensitive information, disguises it as a GIF file, and exfiltrates the data. It has also been linked to other well-known malware such as Zbot and Qbot, which are notorious for hunting banking credentials. Despite its potency, some advanced endpoint detection and response (EDR) solutions have successfully blocked DTrack execution. In mid-2022, Andariel, a faction of the Lazarus group, deployed DTrack alongside Maui ransomware in a series of targeted attacks. The group also utilized another malware family called EarlyRat, exploiting vulnerabilities like the Log4j flaw for initial access. The compromised account that attackers used for initial access and subsequent spreading of various toolsets, including DTrack, was the same one used prior to ransomware deployment. In several instances, Stonefly's custom malware Backdoor.Preft (also known as Dtrack, Valefor) was found to be deployed. Additionally, DTrack was seen being spread laterally across networks by Jumpy Pisces, using the Server Message Block (SMB) protocol. This group maintained persistence in compromised systems by deploying the open-source tool Sliver and their unique custom malware, DTrack, to other hosts via SMB. The attackers copied files associated with the Sliver and DTrack malware family to various hosts using the compromised account, demonstrating the malware's ability to infiltrate and persist within networks.