Anchor

Malware & Tools · Anchor

· MalwareS0504 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Linux, Windows

Description

Anchor is one of a family of backdoor malware that has been used in conjunction with TrickBot on selected high profile targets since at least 2018.(Citation: Cyberreason Anchor December 2019)(Citation: Medium Anchor DNS July 2020)

Tactic Coverage

command and control (5)stealth (5)execution (5)persistence (3)privilege escalation (3)discovery (2)lateral movement (1)defense impairment (1)

Used By (1 groups)

G0102Wizard SpiderUNC1878, TEMP.MixMaster

Techniques (20)

T1008Fallback Channels

command and control

T1016System Network Configuration Discovery

discovery

T1021.002SMB/Windows Admin Shares

lateral movement

T1027Obfuscated Files or Information

stealth

T1027.002Software Packing

stealth

T1053.003Cron

executionpersistence

References

https://attack.mitre.org/software/S0504 https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware https://medium.com/stage-2-security/anchor-dns-malware-family-goes-cross-platform-d807ba13ca30