Going Coast to Coast - Climbing the Pyramid with the Deimos Implant

This Elastic Security analysis documents the Deimos remote access implant: a actively developed, obfuscated .NET-based RAT used for initial access, persistence, and C2 across multiple organizations. The report describes its multi-stage PowerShell/XOR/Base64 obfuscation chain, persistence via randomized files, registry and .lnk artifacts, HTTP-based C2 with RSA/AES handshakes, sample metadata, and IoCs (including SHA256 hashes and IP 216.230.232.134), and provides hunting queries, YARA rules, and detection recommendations to aid defenders.