Darkmoon

Overview

Backdoor:Win32/Darkmoon (frequently associated with the commercial penetration testing framework Core Impact) is a highly sophisticated Remote Access Trojan (RAT) and post-exploitation agent. While Core Impact is a legitimate tool used by security professionals (similar to Cobalt Strike), threat actors often pirate or re-purpose its agents (like Darkmoon) to establish deep, stealthy control over compromised enterprise networks (`T1219`).

Understanding Darkmoon (Advanced Backdoors)
To an end-user, Darkmoon is completely invisible. For a security operations center (SOC), the detection of Darkmoon is a critical incident indicating that an advanced adversary has already bypassed perimeter defenses and achieved execution on a high-value asset. It is not an initial access vector; it is a tool for lateral movement and long-term espionage.

Execution and Post-Exploitation Mechanics
Darkmoon is usually deployed after an initial breach (e.g., via spearphishing or exploiting an edge service). It is designed to be highly modular and evasive. It operates entirely in memory (`T1055`), injecting itself into legitimate system processes to avoid writing a detectable executable to the hard drive. It utilizes encrypted command and control channels (often HTTPS or custom DNS tunneling) to blend in with normal enterprise traffic (`T1071.001`). From this foothold, the attacker uses Darkmoon to dump credentials (`T1003`), map the network infrastructure (`T1046`), and deploy further implants or ransomware.

Indicators of Compromise & Impact
The impact is total loss of confidentiality and control over the infected host. Host-based IoCs are extremely subtle due to the memory-only execution; EDR solutions may detect anomalous process injection (e.g., `CreateRemoteThread`) or unexpected network connections originating from processes like `svchost.exe` or `lsass.exe`. Network IoCs involve regular beaconing behavior to unknown IP addresses or domains with unusually high entropy.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1003: Monitor for LSASS memory dumping or registry SAM extraction. Enable Credential Guard on Windows systems.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_DARKMOON {
    meta:
        description = "Detects Darkmoon (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "darkmoon" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Darkmoon Activity
id: 8761680575611d10a13ff62749618901
status: experimental
description: Detects generic indicators of the darkmoon malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*darkmoon*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Do NOT immediately power off or reboot the machine, as Darkmoon may be running entirely in RAM; capture a live memory image first.
2. Isolate the host from the network at the switch level to sever the C2 connection while preserving evidence.
3. Conduct a full Active Directory audit, assuming that any credentials used on or by the infected machine have been compromised.
4. Hunt across the enterprise network for the C2 IP addresses or domains identified during memory analysis.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not rely on standard antivirus scans to clear a Darkmoon infection; they will almost certainly fail to detect the in-memory payload.
2. Avoid resetting passwords from the infected machine, as the attacker likely has active keylogging modules deployed.

References & External Analysis

• Search "darkmoon" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: ransomware)

Explore other malware families in the same category:

• Installbar
• Whiteice
• Tomegun
• Hidcon
• Rapidpass

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/darkmoon.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.