MITRE ATT&CK Malware

Derusbi (S0021)

PHOTO

[Derusbi](https://attack.mitre.org/software/S0021) is malware used by multiple Chinese APT groups.(Citation: Novetta-Axiom)(Citation: ThreatConnect Anthem) Both Windows and Linux variants have been observed.(Citation: Fidelis Turbo)

Platforms: Windows, Linux

▪Techniques implemented (18)

T1056.001Keylogging T1059.004Unix Shell T1218.010Regsvr32 T1082System Information Discovery T1070.006Timestomp T1055.001Dynamic-link Library Injection T1070.004File Deletion T1571Non-Standard Port T1573.001Symmetric Cryptography T1033System Owner/User Discovery T1123Audio Capture T1083File and Directory Discovery T1008Fallback Channels T1095Non-Application Layer Protocol T1113Screen Capture T1125Video Capture T1057Process Discovery T1012Query Registry

▪Used by groups (4)

G0065Leviathan G0009Deep Panda G0001Axiom G0096APT41

S0021on MITRE ATT&CK →

MITRE ATT&CK Malware

Derusbi (S0021)

PHOTO

ShareX LinkedIn Reddit HN

Platforms: Windows, Linux

▪Techniques implemented (18)

▪Used by groups (4)

G0065Leviathan G0009Deep Panda G0001Axiom G0096APT41

S0021on MITRE ATT&CK →

Derusbi (S0021)

▪Techniques implemented (18)

▪Used by groups (4)

Explore Gold

Security Data & Tools

Products

Use Cases

Company

Derusbi (S0021)

▪Techniques implemented (18)

▪Used by groups (4)