Skip to content

Hide Navigation Hide TOC

DCSrv - S1033 (5633ffd3-81ef-4f98-8f93-4896b03998f0)

DCSrv is destructive malware that has been used by Moses Staff since at least September 2021. Though DCSrv has ransomware-like capabilities, Moses Staff does not demand ransom or offer a decryption key.(Citation: Checkpoint MosesStaff Nov 2021)

Cluster A Galaxy A Cluster B Galaxy B Level
Encrypted/Encoded File - T1027.013 (0d91b3c0-5e50-47c3-949a-2a796f04d144) Attack Pattern DCSrv - S1033 (5633ffd3-81ef-4f98-8f93-4896b03998f0) Malware 1
DCSrv - S1033 (5633ffd3-81ef-4f98-8f93-4896b03998f0) Malware System Shutdown/Reboot - T1529 (ff73aa03-0090-4464-83ac-f89e233c02bc) Attack Pattern 1
Windows Service - T1543.003 (2959d63f-73fd-46a1-abd2-109d7dcede32) Attack Pattern DCSrv - S1033 (5633ffd3-81ef-4f98-8f93-4896b03998f0) Malware 1
System Time Discovery - T1124 (f3c544dc-673c-4ef3-accb-53229f1ae077) Attack Pattern DCSrv - S1033 (5633ffd3-81ef-4f98-8f93-4896b03998f0) Malware 1
DCSrv - S1033 (5633ffd3-81ef-4f98-8f93-4896b03998f0) Malware Modify Registry - T1112 (57340c81-c025-4189-8fa0-fc7ede51bae4) Attack Pattern 1
Native API - T1106 (391d824f-0ef1-47a0-b0ee-c59a75e27670) Attack Pattern DCSrv - S1033 (5633ffd3-81ef-4f98-8f93-4896b03998f0) Malware 1
DCSrv - S1033 (5633ffd3-81ef-4f98-8f93-4896b03998f0) Malware Masquerade Task or Service - T1036.004 (7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c) Attack Pattern 1
DCSrv - S1033 (5633ffd3-81ef-4f98-8f93-4896b03998f0) Malware Data Encrypted for Impact - T1486 (b80d107d-fa0d-4b60-9684-b0433e8bdba0) Attack Pattern 1
Encrypted/Encoded File - T1027.013 (0d91b3c0-5e50-47c3-949a-2a796f04d144) Attack Pattern Obfuscated Files or Information - T1027 (b3d682b6-98f2-4fb0-aa3b-b4df007ca70a) Attack Pattern 2
Windows Service - T1543.003 (2959d63f-73fd-46a1-abd2-109d7dcede32) Attack Pattern Create or Modify System Process - T1543 (106c0cf6-bf73-4601-9aa8-0945c2715ec5) Attack Pattern 2
Masquerading - T1036 (42e8de7b-37b2-4258-905a-6897815e58e0) Attack Pattern Masquerade Task or Service - T1036.004 (7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c) Attack Pattern 2