1. Home
  2. Software
  3. Anchor

Anchor

Anchor is one of a family of backdoor malware that has been used in conjunction with TrickBot on selected high profile targets since at least 2018.[1][2]

ID: S0504
ⓘ
Associated Software: Anchor_DNS
ⓘ
Type: MALWARE
ⓘ
Platforms: Linux, Windows
Contributors: Cybereason Nocturnus, @nocturnus
Version: 1.1
Created: 10 September 2020
Last Modified: 04 December 2023

Associated Software Descriptions

Name Description
Anchor_DNS

[1][2]
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1543 .003 创建或修改系统进程: Windows Service

Anchor can establish persistence by creating a service.[1]

Enterprise T1059 .003 命令与脚本解释器: Windows Command Shell

Anchor has used cmd.exe to run its self deletion routine.[1]
.004 命令与脚本解释器: Unix Shell

Anchor can execute payloads via shell scripting.[2]
Enterprise T1008 回退信道

Anchor can use secondary C2 servers for communication after establishing connectivity and relaying victim information to primary C2 servers.[1]
Enterprise T1071 .001 应用层协议: Web Protocols

Anchor has used HTTP and HTTPS in C2 communications.[1]
.004 应用层协议: DNS

Variants of Anchor can use DNS tunneling to communicate with C2.[1][2]
Enterprise T1480 执行保护

Anchor can terminate itself if specific execution flags are not present.[1]
Enterprise T1027 混淆文件或信息

Anchor has obfuscated code with stack strings and string encryption.[1]
.002 Software Packing

Anchor has come with a packed payload.[1]
Enterprise T1070 .004 移除指标: File Deletion

Anchor can self delete its dropper after the malware is successfully deployed.[1]
Enterprise T1082 系统信息发现

Anchor can determine the hostname and linux version on a compromised host.[2]
Enterprise T1569 .002 系统服务: Service Execution

Anchor can create and execute services to load its payload.[1][2]
Enterprise T1016 系统网络配置发现

Anchor can determine the public IP and location of a compromised host.[2]
Enterprise T1105 输入工具传输

Anchor can download additional payloads.[1][2]
Enterprise T1021 .002 远程服务: SMB/Windows Admin Shares

Anchor can support windows execution via SMB shares.[2]
Enterprise T1564 .004 隐藏伪装: NTFS File Attributes

Anchor has used NTFS to hide files.[1]
Enterprise T1095 非应用层协议

Anchor has used ICMP in C2 communications.[1]
Enterprise T1053 .003 预定任务/作业: Cron

Anchor can install itself as a cron job.[2]
.005 预定任务/作业: Scheduled Task

Anchor can create a scheduled task for persistence.[1]
Enterprise T1553 .002 颠覆信任控制: Code Signing

Anchor has been signed with valid certificates to evade detection by security tools.[1]

Groups That Use This Software

ID Name References
G0102 Wizard Spider

[3]

References

  1. Dahan, A. et al. (2019, December 11). DROPPING ANCHOR: FROM A TRICKBOT INFECTION TO THE DISCOVERY OF THE ANCHOR MALWARE. Retrieved September 10, 2020.
  2. Grange, W. (2020, July 13). Anchor_dns malware goes cross platform. Retrieved September 10, 2020.
  1. Microsoft. (2022, May 9). Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself. Retrieved March 10, 2023.