“Remember the Name: DARK KURD” - A Destructive Ransomware and Stealer Horror Themed Threat

SonicWall Capture Labs threat researchers have identified "Dark Kurd" — a destructive, multi-stage threat that combines ransomware, a Telegram-controlled RAT, credential stealer, keylogger, worm, and aggressive system sabotage into a single native 64-bit PE binary. Disguised as a Kurdish horror game ("KurdishHorror.exe"), the malware operates as a dropper that, upon execution, systematically disables all security defenses, destroys recovery infrastructure, encrypts files with AES-256, establishes Telegram bot C2, replicates itself across the filesystem and network, and deploys a full-featured PowerShell RAT capable of screen capture, keylogging, credential theft, and arbitrary command execution.

The threat is exceptionally aggressive. It disables Windows Defender through over a dozen registry modifications and PowerShell commands, kills security processes by name (including EDR agents from CrowdStrike, SentinelOne, Sophos, Cylance, Bitdefender, ESET, Norton, and Carbon Black), blocks analysis tools via Image File Execution Options (IFEO) debugger injection, and suppresses all Windows Security notifications. Recovery destruction is equally thorough — Volume Shadow Copies, System Restore, Windows Recovery Environment, boot configuration, and event logs are all systematically eliminated.

Technical Overview

The malware uses the following application icon in an attempt to masquerade as a legitimate “Kurdish Horror” game:

Initial Execution and Mutex Check

The binary launches as a standard Windows GUI application (subsystem WINDOWS_GUI). On startup, it creates a named mutex Global\DK_RuntimeBroker_Mtx_7A3F to prevent multiple instances:

Security Infrastructure Destruction

Before any payload activity, the dropper systematically disables Windows Defender and related security services through registry manipulation. The following registry keys were created during execution:

Static analysis confirms these keys receive values including DisableAntiSpyware, DisableAntiVirus, DisableRealtimeMonitoring, DisableBehaviorMonitoring, DisableOnAccessProtection, DisableScanOnRealtimeEnable, DisableIOAVProtection, and DisableRawWriteNotification. Exclusion paths are added for C:\, C:\ProgramData\Microsoft\Windows\Caches, and processes including RuntimeBroker.exe, HelloHello.exe, svchost.exe, with the .darkkurd and .exe extensions excluded from scanning.

A PowerShell child process is spawned immediately after to reinforce these settings programmatically:

Static strings reveal the injected PowerShell command disables every Defender preference, adds broad exclusions, and is executed with -NoP -NonI -W Hidden -EP Bypass flags.

Security Process Termination and Service Disablement

The dropper attempts to open multiple security-related services with full control access (0xf01ff = SERVICE_ALL_ACCESS), and spawns taskkill.exe to force-terminate security processes:

Our analysis identifies the targeted processes: MsMpEng.exe, NisSrv.exe, SecurityHealthService.exe, SecurityHealthSystray.exe, smartscreen.exe, MpCmdRun.exe, MSASCuiL.exe, SgrmBroker.exe, CSFalconService.exe (CrowdStrike), CylanceSvc.exe, SentinelAgent.exe, SophosFileScanner.exe, bdagent.exe (Bitdefender), avp.exe (Kaspersky), egui.exe/ekrn.exe (ESET), NortonSecurity.exe, and others.

Browser and System Policy Manipulation

Additional registry keys are created to disable SmartScreen, browser phishing filters, and system security prompts:

Self-Replication to Persistent Locations

The binary copies itself to three separate filesystem locations using legitimate-looking directory paths and process names:

Persistence Mechanisms

Multiple scheduled tasks are created via schtasks.exe:

Registry Run keys and IFEO debugger entries are also written:

Recovery Destruction

Multiple recovery-destruction tools are spawned in sequence:

Static strings confirm the commands passed to each:

Self-Replication Loop and Process Spawning

After initial setup, the dropper enters a replication loop that generates numbered copies of itself across three directories, each with a randomized filename suffix derived from GetTickCount():

Each iteration creates three files (svchost_N_RAND.exe, RuntimeBroker_N.exe, AppHost_N.exe) and launches the svchost copy as a new process. This produces 36 executable copies and 12 child processes in a single pass.

Persistent Copy and C2 Script Launch

The three primary persistent copies are then launched:

C2 Script Deployment and Victim Fingerprinting

A PowerShell RAT script is written to disk and a sentinel file is created:

Victim fingerprinting is performed:

Network Probing and Lateral Movement (Worm)

The dropper implements a fully automated worm propagation module that attempts to spread to every reachable host on the local network. Our execution trace captured two connection attempts to the default gateway — an SMB probe on port 445 and an RPC/DCOM probe on port 135:

These probes are the first step in a multi-phase lateral movement chain extracted from embedded strings. The worm module follows a four-stage attack sequence for each discovered host:

Phase 1 — Target Discovery and Null-Session Authentication

The malware establishes an anonymous IPC$ connection using null credentials to enumerate accessible hosts. This tests reachability before attempting payload delivery.:

Phase 2 — Payload Delivery via Admin Shares

If the null session succeeds, the dropper copies itself to two locations on the remote host using the administrative C$ and ADMIN$ shares:

Phase 3 — Remote Execution via Four Independent Methods

After staging the payload, the worm attempts remote execution using four separate techniques, maximizing the probability that at least one succeeds:

Phase 4 — Propagation Tracking

The malware tracks the number of hosts it has successfully infected with an internal counter:

In the analysis environment, the lateral movement probes targeted our honeypot network gateway (10.152.152.1) which did not have open admin shares. In a corporate environment with domain-joined machines sharing credentials or weak local administrator passwords, this worm module would enable rapid propagation across the entire network segment.

Core Capability: Telegram-Controlled Multi-Function RAT

The malware's defining feature is a full-featured PowerShell RAT controlled entirely through the Telegram Bot API. The dropper writes the complete RAT script to C:\Windows\TEMP\dk_c2_loop.ps1 and launches it via PowerShell with -NoP -NonI -W Hidden -ExecutionPolicy Bypass flags. The embedded bot token and chat ID — recovered in full from static strings — are:

The RAT polls for commands using the Telegram getUpdates long-polling API:

The RAT supports the following commands, all recovered from the embedded script:

The /stealer command targets browser data files across four browsers:

Targeted files include: Login Data, Cookies, Web Data, History, places.sqlite, logins.json, cookies.sqlite, key4.db, cert9.db. WiFi credentials are harvested using netsh wlan show profile name="$n" key=clear.

Additional Features

File Encryption (Ransomware)

The PE imports CryptAcquireContextA, CryptImportKey, CryptSetKeyParam, CryptEncrypt, and CryptGenRandom from ADVAPI32.dll, with the provider string "Microsoft Enhanced RSA and AES Cryptographic Provider" present in static strings. Encrypted files receive the .darkkurd extension. A ransom note is presented to the victim and contains the following message with a spine chilling tagline: “Remember the name: DARK KURD”

The binary iterates drives via GetLogicalDrives and GetDriveTypeA, and walks directories with FindFirstFileA/FindNextFileA in order to find files for encrytion. A FULL_DRIVE_ENCRYPT_DONE status beacon is sent to Telegram after completion.

Boot Configuration Destruction

Static strings reveal extensive boot sabotage eliminating all boot recovery options:

Additional PowerShell commands delete restore points, disable System Restore on C: and D: drives, remove Windows Recovery Environment packages, take ownership of and delete C:\Windows\System32\Recovery, clear event logs, and delete C:\Recovery, C:\Windows.old, C:\$Windows.~BT, and C:\$Windows.~WS.

Scare Tactic Notifications

The binary contains extensive fake Windows Security notification messages designed to intimidate the victim

These are displayed using the imported MessageBoxA and window creation APIs (CreateWindowExA, RegisterClassA). The binary also changes the desktop wallpaper and plays sounds via SystemParametersInfoA and PlaySoundA.

Desktop wallpaper

Dark Kurd ransomware wallpaper image (flag.jpg) is dropped to C:\ProgramData\Microsoft\Windows\Caches\flag.jpg and set as the desktop background via SystemParametersInfoA and registry policy writes to Control Panel\Desktop. This screen appeared approximately 90 seconds after launch, replacing the Windows desktop.

Horror Game Disguise

The binary embeds a complete Kurdish horror game narrative as a social engineering lure. Static strings include game prompts, narrative text, and UI controls:

C2 / Exfiltration

All command-and-control communication uses the Telegram Bot API exclusively — no custom C2 infrastructure is required. The protocol is HTTPS to api.telegram.org using three API methods:

• sendMessage — text-based beacon, command output, and status updates
• sendPhoto — screenshot exfiltration (via curl.exe)
• sendDocument — file exfiltration (stolen credentials ZIP archive, via curl.exe)
• getUpdates — 20-second long-poll for incoming commands

The beacon message format (from static strings):

A second elevated-access beacon format is sent after full system compromise:

Dark Kurd is a dangerous all-in-one threat that steals credentials, encrypts files, and gives an attacker live remote control — all within 90 seconds of a single click. Its political messaging targets Kurdish and Iraqi communities, but the real victims are anyone who runs the file. Despite the hacktivist branding, the combination of double extortion, credential theft, and data exfiltration makes this a serious financial and operational threat that should not be dismissed as mere hacktivism.

Sonicwall Protection

SonicWall Capture Labs protects against this threat via the following signature:

• GAV: DarkKurd.STL (Trojan)

This threat is also detected by SonicWall Capture ATP with RTDMI™, SonicWall Endpoint Security, and the Capture Client endpoint solution.