Loading malware…
Downeks is a Windows malware family used as a downloader in targeted intrusion campaigns linked to DustySky, an activity cluster that has been associated by other researchers with the Gaza Cybergang. It has been observed in operations targeting government interests in the Middle East, including campaigns using Arabic- and Hebrew-language political decoy documents and masquerading as legitimate software or common document types.
Downeks exists in both earlier native-code forms and newer .NET variants, including a C# implementation internally named SharpDownloader. Its primary role is to contact command-and-control infrastructure, identify the infected host, and retrieve or install follow-on payloads, notably modified Quasar RAT samples. The malware communicates over HTTP POST and has been observed using encrypted and base64-encoded JSON for command-and-control traffic. It operates as a polling implant that can download and execute additional payloads, execute existing binaries, self-update, and return execution results.
Beyond downloader functionality, Downeks includes basic post-compromise and reconnaissance features. Observed capabilities include screen capture, collection of host-identifying information to generate a pseudo-unique machine identifier, enumeration of installed antivirus products through WMI, and discovery of the victim’s external IP address, likely to support geographic victim selection. It also drops decoy documents to reduce suspicion during execution.
Downeks establishes persistence on Windows systems through autorun mechanisms such as the Run key or Startup-folder shortcuts. Samples have also used obfuscation to hinder analysis, including .NET variants protected with Yano. In observed attack chains, Downeks served as an intermediate stage between an initial dropper of uncertain origin and the final remote-access payload, making it a key delivery component in espionage-oriented campaigns associated with Middle Eastern targeting.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The initial infection vector in this attack is not clear, but it results in installing the “Downeks” downloader, which in turn infects the victim computer with the “Quasar” RAT.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
It constructs this list using the WMI query: “SELECT displayName FROM AntivirusProduct”
Downeks can also be instructed to execute binaries that already exist on the victim machine.
“Upload / download / execute files… Downeks can also be instructed to execute binaries that already exist on the victim machine.”
The attackers invested significant effort in attempting to hide the tool by changing the source code of the RAT and the RAT server, and by using an obfuscator and packer.
The data that is sent in the POST is serialized with json, which is then is encrypted, and finally encoded in base64.
“Dowenks assesses the victim’s external IP using an HTTP request to http://www.myexternalip.com/raw.”
Check if the computer name and user name, or external IP address, is in a provided list and if so, display a message box
Downeks is a backdoor with only very basic capabilities. It communicates with the C2 server using HTTP POST requests.
128 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware referenced in recommended public reporting as used in targeted attacks against governments linked to Gaza Cybergang reporting.
Malware family associated with Molerats (DustySky campaign) and discussed in comparison to Spark (shared development/installation traits and use of cURL/JSON libraries).
Downloader/backdoor used as a first-stage implant to beacon over HTTP POST, profile the host (including installed AV and external IP), maintain persistence (Run key or Startup folder), and receive commands such as download-and-execute, self-update, screen capture, process kill/delete, and host/user/IP allowlist checks with message display.
Downloader/backdoor used as the first-stage payload. It communicates with C2 over HTTP POST using JSON plus encryption/base64, can download and execute payloads, self-update, capture screenshots, enumerate installed antivirus, establish persistence via Run key or startup shortcut, check external IP, and was used here to install Quasar RAT.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.