MalwareUsed by 1 actor

Daserf

Also known asMuirimNioupale

Daserf, also known as Muirim and Nioupale, is a custom Windows backdoor used by the cyberespionage group Tick, also tracked as BRONZE BUTLER and REDBALDKNIGHT. It provides remote access through command-and-control connections and supports shell command execution, file downloads and uploads, screenshot capture, and keystroke logging. Daserf has been used in campaigns targeting Japanese technology, engineering, and broadcasting organizations to steal sensitive information, including emails and business documents.

Daserf has been deployed through watering-hole attacks involving compromised Japanese websites and Adobe Flash exploitation, with the Gofarer downloader installing the backdoor. Associated campaigns also used spear-phishing and malicious Office documents, including exploitation of CVE-2014-4114. Daserf uses Mimikatz and Windows Credential Editor for credential theft and conceals collected data in password-protected RAR archives. Its HTTP communications are obfuscated using custom Base64 encoding and RC4 encryption, and later variants use steganography. It masquerades as legitimate software through deceptive file and folder naming, and some samples have been signed with a stolen digital certificate.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

BRONZE BUTLER

Daserf appears to be custom-developed for use in Tick’s cyberespionage campaigns. Once installed, it establishes a remote connection to Tick’s command and control server, providing the attacker with access to the compromised computer.

via broadcom communitycommunity.broadcom.com

MITRE ATT&CK

Techniques & procedures

21 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059.003Windows Command ShellEvidence4

The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

Stealth

6 techniques

T1027Obfuscated Files or InformationEvidence2

T1027.002Software PackingEvidence2

T1027.003SteganographyEvidence1

“REDBALDKNIGHT’s Daserf Backdoor Now Uses Steganography,” TrendMicro, November 7, 2017

T1027.005Indicator Removal from ToolsEvidence2

T1036MasqueradingEvidence2

actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe ... APT1 ... used ... AcroRD32.exe ... as a name for malware ... APT28 ... changed extensions on files containing exfiltrated data to make them appear benign ... APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update.

T1036.005Match Legitimate Resource Name or LocationEvidence3

Akira has used legitimate names and locations for files to evade defenses.

Defense Impairment

1 technique

T1553.002Code SigningEvidence2

Credential Access

2 techniques

T1003.001LSASS MemoryEvidence2

T1056.001KeyloggingEvidence3

The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.

Collection

4 techniques

T1056.001KeyloggingEvidence3

The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.

T1113Screen CaptureEvidence4

The content is a MITRE ATT&CK-style listing of malware and threat actors that "can capture screenshots," "take screenshots," "perform screen captures," or "watch the victim's screen." It ends with references to "CopyFromScreen" and "xwd."

T1560Archive Collected DataEvidence2

T1560.001Archive via UtilityEvidence2

Command and Control

8 techniques

T1001Data ObfuscationEvidence1

Cobian RAT obfuscates communications with the C2 server using Base64 encoding... Daserf uses custom base64 encoding to obfuscate HTTP traffic... Pikabot uses base64 encoding in conjunction with symmetric encryption mechanisms to obfuscate command and control communications.

T1001.002SteganographyEvidence2

T1071.001Web ProtocolsEvidence4

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.

T1105Ingress Tool TransferEvidence3

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

T1132Data EncodingEvidence3

ADVSTORESHELL C2 traffic is encrypted, then encoded with Base64 encoding. APT19 HTTP malware variant used Base64 to encode communications to the C2 server. APT33 has used base64 to encode command and control traffic.

T1132.001Standard EncodingEvidence3

Cobalt Strike can use Base64, URL-safe Base64, or NetBIOS encoding in its C2 traffic. More_eggs has used basE91 encoding, along with encryption, for C2 communication. Zebrocy has used URL/Percent Encoding on data exfiltrated via HTTP POST requests.

T1573Encrypted ChannelEvidence1

The content is a catalog of malware and threat groups that encrypt command-and-control communications using algorithms such as DES, AES, RC4, XOR, Blowfish, RSA, Camellia, RC2, RC6, and custom ciphers.

T1573.001Symmetric CryptographyEvidence2

ACTIVITY FEED

Recent activity

42 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

42 SOURCESView more in app

secureworksNews

Jan 1, 2026

Cyber Threat Group Profiles: Their Objectives, Aliases, and Malware Tools | Sophos

Listed as a tool used by the BRONZE BUTLER threat profile.

mitre attack websiteNews

Apr 25, 2022

OS Credential Dumping: LSASS Memory, Sub-technique T1003.001 - Enterprise | MITRE ATT&CK®

Uses Mimikatz and Windows Credential Editor for credential theft.

mitre attack websiteNews

Oct 21, 2021

Encrypted Channel: Symmetric Cryptography, Sub-technique T1573.001 - Enterprise | MITRE ATT&CK®

Backdoor that uses RC4 to obfuscate HTTP C2 traffic.

mitre attack websiteNews

Oct 21, 2021

Masquerading: Match Legitimate Name or Location, Sub-technique T1036.005 - Enterprise | MITRE ATT&CK®

Malware that blends in by using file and folder names associated with legitimate software vendors.

+38 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping21

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Daserf

Also known asMuirimNioupale