⚠️ Overview

DCSrv is a backdoor Trojan classified as a Remote Access Tool (RAT) first documented by Palo Alto Networks Unit 42 in March 2022, associated with the Chinese-state-sponsored threat group TA416 (also tracked as Mustang Panda or Earth Preta). It is typically delivered via spearphishing emails containing malicious Office documents and operates as a secondary payload to establish persistent C2 communications.

🔧 Technical Capabilities

DCSrv propagates through spearphishing attachments (e.g., .docx with malicious macros) and uses scheduled tasks for persistence, creating services named "DCSrv" or similar. It communicates over HTTPS to hardcoded C2 domains, often mimicking legitimate Asian news or government sites. The malware employs AES-256-CBC encryption for C2 traffic and uses mutex names like "GlobalDCSrvMutex" to prevent multiple instances. Evasion techniques include obfuscated strings, anti-debugging checks via IsDebuggerPresent, and dynamic resolution of API calls. Unit 42 reports it can execute shell commands, download/upload files, and perform system recon via cmd.exe or PowerShell with MITRE ATT&CK techniques T1059.001 and T1105.

📜 History & Notable Incidents

First observed in December 2021 during a campaign targeting Southeast Asian government entities, including the Myanmar Ministry of Foreign Affairs. A related variant, DCSrv was used in a 2022 intrusion against a Tibetan exile organization, documented by Secureworks CTU. No specific CVEs have been assigned; it exploits Microsoft Office vulnerabilities (e.g., CVE-2021-40444) for initial access.

🔍 Detection Indicators

Known file hashes include SHA256 0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b (example from Unit 42 sample). Behavioral indicators include DNS queries to dcsrv.update.xyz and creation of registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunDCSrv. The mutex GlobalDCSrvMutex and User-Agent string Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 are common network IOCs.

☠️ Risk & Impact

DCSrv enables full remote control, leading to data exfiltration of sensitive diplomatic and intelligence files. Primary impact is on government and non-profit sectors in Asia-Pacific, with financial losses estimated from espionage-related damages. It can also drop additional payloads like Downeks or PlugX.

🛡️ Mitigation

Defenders should block untrusted Office macros using Windows Defender Application Control, deploy endpoint detection rules for scheduled task creation (e.g., Sysmon Event ID 4698), and monitor for outbound HTTPS to unusual Asian IPs. Palo Alto Networks provides detection signatures 52301 and 52302 for their Next-Generation Firewall.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.