anubisMalware
Last reported today, by ransomware.live6 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1053.005Scheduled Task
“Cron: sets a scheduled task with an entry to download the script every 5 minutes:”
- T1110Brute Force
“…leaked Mirai source code, it extends the original framework with numerous capabilities, including encrypted C2 communications, an SSH brute-force scanner, a SOCKS relay module, a credential sniffer, and an integrated exploit arsenal targeting multiple known vulnerabilities.”
- T1505.003Web Shell
“It has been reported that after exploitation, the threat actors deploy a web shell with filenames such as “human2.aspx.” However, this exploit module doesn’t execute the file upload procedure but only passes a payload argument to “human2.aspx.””
- T1543.002Systemd Service
“systemd service: sets up a unit file with “Description=Apache HTTPD Cache Manager” and “Restart=always.””
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
6 reports, newest first · the exact sentence from each-
anubis lists Newcomer Cremations, Funerals & Receptions“anubis lists Newcomer Cremations, Funerals & Receptions”
-
anubis lists Fisher59“anubis lists Fisher59”
-
anubis lists Mynd“anubis lists Mynd”
-
anubis lists Leadec“anubis lists Leadec”
-
anubis lists Gaedke & Partner Steuerberatung“anubis lists Gaedke & Partner Steuerberatung”
-
Multi-Functional Linux Botnet “Evooo1Bot”“Sandbox service name check: sandboxie, cuckoo, anubis, threatexpert, joebox, comodo, hybrid-analysis, cape-sandbox, fireeye, normanbox, and drakvuf.”
Indicators in its reports
named in the reports above- 91.92.40[.]118in 1 report
- f13cb360768363d3…aed8cf390109in 1 report
- 4c0886349e9d3485…9c2a73525e4din 1 report
Copy these 3 indicators · defanged
Thanks — we review every report.