Downeks
Downeks is a downloader malware family associated in reporting with the DustySky campaign and linked by other researchers to Gaza Cybergang/Molerats activity targeting government interests in the Middle East. Unit 42 reported that an observed intrusion chain installed the Downeks downloader, which then installed a modified, obfuscated, and packed version of the open-source .NET Quasar RAT. The initial infection vector in the 2016-2017 reporting was not confirmed. Downeks used third-party websites to determine the victim’s external IP address, likely for GeoIP-based targeting, and dropped Arabic and Hebrew political decoy documents to camouflage the attack. Reported Downeks/.NET SharpDownloader capabilities included an HTTP POST command-and-control loop, download-and-execute functionality, screen capture, persistence, antivirus enumeration, and external IP discovery. Unit 42 identified both earlier native Downeks samples and newer .NET variants internally named SharpDownloader, with the .NET samples observed only against Hebrew-speaking targets. Infrastructure noted in the reporting included dw.downloadtesting[.]com as a Downeks C2/download point; an initial dropper named "Joint Ministerial Council between the GCC and the EU Council.exe" (SHA256: 0d235478ae9cc87b7b907181ccd151b618d74955716ba2dbc40a74dc1cdfc4aa) extracted an embedded Downeks instance "ati.exe" (SHA256: f19bc664558177b7269f52edcec74ecdb38ed2ab9e706b68d9cbb3a53c243dec), and additional Downeks samples included SHA256 15abd32342e87455b73f1e2ecf9ab10331600eb4eae54e1dfc25ba2f9d8c2e8a and 9a8d73cb7069832b9523c55224ae4153ea529ecc50392fef59da5b5d1db1c740. Separate reporting also notes development and installation similarities between Downeks and the Molerats-linked Spark backdoor family.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
01/2017: Downeks and Quasar RAT Used in Recent Targeted Attacks Against Governments – Unit42
Techniques & procedures
12 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
2 techniques
Execution
Persistence
1 technique
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Stealth
2 techniques
Stealth
Discovery
3 techniques
Discovery
Collection
1 technique
Collection
IOCs tracked for this family
127 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware referenced in recommended public reporting as used in targeted attacks against governments linked to Gaza Cybergang reporting.
Malware family associated with Molerats (DustySky campaign) and discussed in comparison to Spark (shared development/installation traits and use of cURL/JSON libraries).
Downloader/backdoor used as a first-stage implant to beacon over HTTP POST, profile the host (including installed AV and external IP), maintain persistence (Run key or Startup folder), and receive commands such as download-and-execute, self-update, screen capture, process kill/delete, and host/user/IP allowlist checks with message display.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.