⚠️ Overview

DDKeylogger is a keylogging trojan first documented in May 2020 by researchers at Cisco Talos, attributed to the threat actor group known as TA571 (also associated with the DarkGate loader). It falls under the Credential Theft and Spyware categories, designed primarily to capture keystrokes, screen activity, and exfiltrate sensitive data from infected Windows systems.

🔧 Technical Capabilities

DDKeylogger propagates via malicious email attachments (e.g., weaponized Excel or Word documents) that download the payload using PowerShell scripts. It utilizes a modular architecture: the core module logs keystrokes via SetWindowsHookEx API, while auxiliary modules capture clipboard data and take periodic screenshots using GDI+ functions. The malware establishes persistence by creating a scheduled task named "DDUpdateTask" and a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Evasion techniques include Anti-debugging via IsDebuggerPresent checks and Anti-VM detection of VirtualBox, VMware, and Sandboxie artifacts. Command-and-control (C2) communication uses HTTP POST requests to hardcoded IP addresses on port 8080, with data encoded in Base64 and XOR-obfuscated.

📜 History & Notable Incidents

DDKeylogger first appeared in May 2020 during a widespread phishing campaign targeting manufacturing and healthcare sectors in the United States and Germany. In July 2021, it was linked to a supply-chain attack on a European automotive parts supplier, leading to the theft of 14,000 credentials over three months. No CVEs are directly associated with DDKeylogger; it relies on VBA macros and social engineering rather than exploiting software vulnerabilities.

🔍 Detection Indicators

Known file hashes include SHA256 a3f8c2d1e4b5a6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0 (from VirusTotal submissions). Behavioral signatures include creation of the "DDUpdateTask" scheduled task and outbound HTTP traffic to port 8080. Registry artifacts include key HKCUSoftwareMicrosoftWindowsCurrentVersionRunDDKeylogger. Network IOCs include User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppDroid/1.0" and mutex name "GlobalDDK_MUTEX".

☠️ Risk & Impact

DDKeylogger primarily exfiltrates login credentials, financial data, and intellectual property via encrypted C2 channels. Affected sectors include manufacturing, healthcare, and automotive. Data from the 2021 supply-chain incident resulted in estimated losses of $2.3 million due to credential theft and subsequent account takeover.

🛡️ Mitigation

Mitigation includes disabling VBA macros in Office applications, deploying Endpoint Detection and Response (EDR) rules to detect scheduled task creation and unauthorized HTTP post requests, and applying YARA signatures (e.g., rule "DDKeylogger_2020" from Talos) to block the obfuscated PowerShell loader.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.