X-Agent (Windows)Malware
- backdoor.sofacyx
- chopstick
- fysbis
- splm
- webhp
- X-Agent
- x-agent (elf)
- Xagent
Fysbis is a Linux-based backdoor used by APT28 that dates back to at least 2014.From MITRE ATT&CK
Last reported 4 months ago, by Sekoia.io3 reports
ATT&CK techniques
6 of 23 · each with the sentence it comes from- T1056.001Keylogging
“T1056.001”
- T1001Data Obfuscation
“T1001”
- T1005Data from Local System
“T1005”
- T1027Obfuscated Files or Information
“T1027”
- T1056Input Capture
“Input Capture: Keylogging”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: PowerShell”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
APT28: An Evolution of Tradecraft from X-Agent to LLM Malware“APT28: An Evolution of Tradecraft from X-Agent to LLM Malware”
-
Sednit recargado: un APT histórico reactiva su arsenal“El código de SlimAgent fue derivado de Xagent, la backdoor insignia de Sednit en la década de 2010.”
-
Sednit reloaded: Back in the trenches“SlimAgent code was derived from Xagent, Sednit’s flagship backdoor from the 2010s.”
Indicators in its reports
named in the reports above- d0db619a7a160949…151bf9775c32in 2 reports
- 99b454262dc26b08…82a49d334e5ein 2 reports
- 5603e99151f8803c…4d071542f01bin 2 reports
- 6d39f49aa11ce057…9bae423ce3d5in 2 reports
Copy these 4 indicators · defanged
Thanks — we review every report.