Malware: Derusbi

Description

[Derusbi](https://attack.mitre.org/software/S0021) is malware used by multiple Chinese APT groups.(Citation: Novetta-Axiom)(Citation: ThreatConnect Anthem) Both Windows and Linux variants have been observed.(Citation: Fidelis Turbo)

External References

• mitre-attack
• Fidelis Turbo
• FireEye Periscope March 2018
• Novetta-Axiom
• ThreatConnect Anthem

Techniques Used by This Malware

• T1008 — Fallback Channels
• T1012 — Query Registry
• T1033 — System Owner/User Discovery
• T1055.001 — Dynamic-link Library Injection
• T1056.001 — Keylogging
• T1057 — Process Discovery
• T1059.004 — Unix Shell
• T1070.004 — File Deletion
• T1070.006 — Timestomp
• T1082 — System Information Discovery
• T1083 — File and Directory Discovery
• T1095 — Non-Application Layer Protocol
• T1113 — Screen Capture
• T1123 — Audio Capture
• T1125 — Video Capture
• T1218.010 — Regsvr32
• T1571 — Non-Standard Port
• T1573.001 — Symmetric Cryptography

APT Groups Using This Malware

• Leviathan
• APT41
• Axiom
• Deep Panda