Derusbi
Associated Software Descriptions
| Name | Description |
|---|---|
| PHOTO |
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1123 | Audio Capture | ||
| Enterprise | T1059 | .004 | Command and Scripting Interpreter: Unix Shell |
Derusbi is capable of creating a remote Bash shell and executing commands.[3][4] |
| Enterprise | T1573 | .001 | Encrypted Channel: Symmetric Cryptography |
Derusbi obfuscates C2 traffic with variable 4-byte XOR keys.[3] |
| Enterprise | T1008 | Fallback Channels |
Derusbi uses a backup communication method with an HTTP beacon.[3] |
|
| Enterprise | T1083 | File and Directory Discovery |
Derusbi is capable of obtaining directory, file, and drive listings.[3][4] |
|
| Enterprise | T1070 | .004 | Indicator Removal: File Deletion |
Derusbi is capable of deleting files. It has been observed loading a Linux Kernel Module (LKM) and then deleting it from the hard disk as well as overwriting the data with null bytes.[3][4] |
| .006 | Indicator Removal: Timestomp | |||
| Enterprise | T1056 | .001 | Input Capture: Keylogging | |
| Enterprise | T1095 | Non-Application Layer Protocol |
Derusbi binds to a raw socket on a random source port between 31800 and 31900 for C2.[3] |
|
| Enterprise | T1571 | Non-Standard Port | ||
| Enterprise | T1057 | Process Discovery | ||
| Enterprise | T1055 | .001 | Process Injection: Dynamic-link Library Injection |
Derusbi injects itself into the secure shell (SSH) process.[5] |
| Enterprise | T1012 | Query Registry |
Derusbi is capable of enumerating Registry keys and values.[4] |
|
| Enterprise | T1113 | Screen Capture | ||
| Enterprise | T1218 | .010 | System Binary Proxy Execution: Regsvr32 |
Derusbi variants have been seen that use Registry persistence to proxy execution through regsvr32.exe.[6] |
| Enterprise | T1082 | System Information Discovery |
Derusbi gathers the name of the local host, version of GNU Compiler Collection (GCC), and the system information about the CPU, machine, and operating system.[3] |
|
| Enterprise | T1033 | System Owner/User Discovery |
A Linux version of Derusbi checks if the victim user ID is anything other than zero (normally used for root), and the malware will not execute if it does not have root privileges. Derusbi also gathers the username of the victim.[3] |
|
| Enterprise | T1125 | Video Capture | ||
Groups That Use This Software
References
- Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
- ThreatConnect Research Team. (2015, February 27). The Anthem Hack: All Roads Lead to China. Retrieved January 26, 2016.
- Fidelis Cybersecurity. (2016, February 29). The Turbo Campaign, Featuring Derusbi for 64-bit Linux. Retrieved March 2, 2016.
- FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.
- Perigaud, F. (2015, December 15). Newcomers in the Derusbi family. Retrieved September 12, 2024.
- Fidelis Threat Research Team. (2016, May 2). Turbo Twist: Two 64-bit Derusbi Strains Converge. Retrieved August 16, 2018.
- CISA. (2021, July 19). (AA21-200A) Joint Cybersecurity Advisory – Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China’s MSS Hainan State Security Department. Retrieved August 12, 2021.
- Esler, J., Lee, M., and Williams, C. (2014, October 14). Threat Spotlight: Group 72. Retrieved January 14, 2016.
- Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.