Derusbi

ATP Sandbox Adv. Heuristics

Description

Derusbi is a malware family used by multiple Chinese APT groups, with both Windows and Linux variants observed in targeted espionage campaigns.

Stats

First seen: March 2022
Last seen: October 2026

MITRE ATT&CK techniques

18 techniques across 5 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.004Unix Shell

TA0005 Stealth

T1055Process Injection
- T1055.001Dynamic-link Library Injection
T1070Indicator Removal
- T1070.006Timestomp
- T1070.004File Deletion
T1218System Binary Proxy Execution
- T1218.010Regsvr32

TA0007 Discovery

T1012Query Registry
T1033System Owner/User Discovery
T1057Process Discovery
T1082System Information Discovery
T1083File and Directory Discovery

TA0009 Collection

T1056Input Capture
- T1056.001Keylogging
T1113Screen Capture
T1123Audio Capture
T1125Video Capture

TA0011 Command and Control

T1008Fallback Channels
T1095Non-Application Layer Protocol
T1571Non-Standard Port
T1573Encrypted Channel
- T1573.001Symmetric Cryptography

Associated groups

Alert name variants

Alert Name	Engine
Win32.Backdoor.Derusbi	ATP Sandbox Adv. Heuristics
Win32.Dropper.Derusbi	ATP Sandbox Adv. Heuristics
Win32.Infostealer.Derusbi	ATP Sandbox Adv. Heuristics
Win32.Trojan.Derusbi	ATP Sandbox Adv. Heuristics
Win64.Backdoor.Derusbi	ATP Sandbox Adv. Heuristics
Win64.Trojan.Derusbi	ATP Sandbox Adv. Heuristics

Related families

InvisiMole MacMa Metamorfo PlugX ZxShell

References