Severity
High
Analysis Summary
A new info-stealing malware called Anubis was first observed in the cybercriminal underground. The malware uses forked code from Loki to steal vast amounts of data including system info, credentials, credit card details, and cryptocurrency wallets such as Bitcoin and Electrum. This malware should not be confused with the Android banking malware also named Anubis. At present, the new Anubis is being deployed in limited campaigns and contains only a handful of download URLs and C2 servers. This malware uses a text file to exfiltrate data from the victim.
Impact
- Information Theft
- Credential Theft
- Theft of Financial Information
Indicators of Compromise
SHA-256
- df35d04cc8c5415fd4e0c724c512c81e655bf835d7c54769005fc0e420150be6
- 3a97ad1a04b42b2d1ad24549b6c3b909d9a429cd4114fe91af7b99f483b6ac5a
- 5461f6fab47e6faf253d93f58123f3689a0578a8a4a833c2b15bdf06e5432b87
- a826140d06eba7da17c424398913c371eaeef62b8765de656aafa0fd64a605d0
Remediation
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.