A new info-stealing malware called Anubis was first observed in the cybercriminal underground and is now being seen in the wild. The malware uses forked code from Loki to steal vast amounts of data including system info, credentials, credit card details, and cryptocurrency wallets such as Bitcoin and Electrum. This malware should not be confused with the Android banking malware also named Anubis. At present, the new Anubis is being deployed in limited campaigns and contains only a handful of download URLs and C2 servers. This malware uses a text file to exfiltrate data from the victim.
Block the threat indicators at their respective controls.