Rewterz Threat Alert – New Anubis Malware Being Distributed in the Wild

Severity

Medium

Analysis Summary

A new info-stealing malware called Anubis was first observed in the cybercriminal underground and is now being seen in the wild. The malware uses forked code from Loki to steal vast amounts of data including system info, credentials, credit card details, and cryptocurrency wallets such as Bitcoin and Electrum. This malware should not be confused with the Android banking malware also named Anubis. At present, the new Anubis is being deployed in limited campaigns and contains only a handful of download URLs and C2 servers. This malware uses a text file to exfiltrate data from the victim.

Impact

• Information Theft 
• Credential Theft
• Theft of Financial Information

Indicators of Compromise

MD5

• 9664ef2d82e819afa20e5411e0855027
• d1c5f40f5efc38cef649d5e690a397df
• b73e3725ddcddbbf83db1610c162a950

SHA-256

• 895b3b6890d192de8bc3744ce0757edb909351081744403663a9c3b04e409125
• 341b474228bf3d99a3570a3b55b4a9b965db00cfbc52988236ffb49990aa8aef
• c2ca3c7810fbd2eb4933299433a0e58ffe0707700c780fe420b2c258e32ebe18

SHA1

• 79cfd4b95b2de5fdbdbfe4663e04f58a4f76b9de
• 0358a3c76887d6eb0420ab72cf65cac03593a37d
• 5862e19e3a31f88dd7d69f7247b0aeab872f8efa

Remediation

Block the threat indicators at their respective controls.