MITRE ATT&CKsoftware (malware)

S0021 Derusbi

Published 2017-05-31 Modified 2025-04-16 Official page ↗
Domain
enterprise
Platforms
Windows, Linux
Aliases
PHOTO
Version
1.2
Created
2017-05-31

Description

Derusbi is malware used by multiple Chinese APT groups. Both Windows and Linux variants have been observed.

Related

Uses · MITRE ATT&CK (18)

  • T1573.001 Symmetric Cryptography sub-technique
  • T1571 Non-Standard Port technique
  • T1059.004 Unix Shell sub-technique
  • T1056.001 Keylogging sub-technique
  • T1070.004 File Deletion sub-technique
  • T1070.006 Timestomp sub-technique
  • T1218.010 Regsvr32 sub-technique
  • T1055.001 Dynamic-link Library Injection sub-technique
  • T1008 Fallback Channels technique
  • T1012 Query Registry technique
  • T1033 System Owner/User Discovery technique
  • T1057 Process Discovery technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
  • T1095 Non-Application Layer Protocol technique
  • T1113 Screen Capture technique
  • T1123 Audio Capture technique
  • T1125 Video Capture technique

Referenced by MITRE ATT&CK · uses (4)

References