Derusbi

Malware & Tools · Derusbi

· MalwareS0021 · Zararlı Yazılım

Type

malware

Techniques

Used By

4 groups

Platforms

Windows, Linux

Description

Derusbi is malware used by multiple Chinese APT groups.(Citation: Novetta-Axiom)(Citation: ThreatConnect Anthem) Both Windows and Linux variants have been observed.(Citation: Fidelis Turbo)

Tactic Coverage

discovery (5)command and control (4)stealth (4)collection (4)privilege escalation (1)credential access (1)execution (1)

Used By (4 groups)

G0096APT41Wicked Panda, Brass Typhoon G0001AxiomGroup 72 G0009Deep PandaShell Crew, WebMasters G0065LeviathanMUDCARP, Kryptonite Panda

Techniques (18)

T1008Fallback Channels

command and control

T1012Query Registry

discovery

T1033System Owner/User Discovery

discovery

T1055.001Dynamic-link Library Injection

stealthprivilege escalation

T1056.001Keylogging

collectioncredential access

T1057Process Discovery

discovery

References

https://attack.mitre.org/software/S0021 https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2016/2016.02.29.Turbo_Campaign_Derusbi/TA_Fidelis_Turbo_1602_0.pdf https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf https://www.threatconnect.com/the-anthem-hack-all-roads-lead-to-china/