Anchor (Malware Family)

SYMBOL	COMMON_NAME	aka. SYNONYMS

win.anchor (Back to overview)

Anchor

Actor(s): WIZARD SPIDER

Anchor is a sophisticated backdoor served as a module to a subset of TrickBot installations. Operating since August 2018 it is not delivered to everybody, but contrary is delivered only to high-profile targets. Since its C2 communication scheme is very similar to the one implemented in the early TrickBot, multiple experts believe it could be attributed to the same authors.

References

2022-05-09 ⋅ cocomelonc ⋅ cocomelonc
Malware development: persistence - part 4. Windows services. Simple C++ example.
Anchor AppleJeus Attor BBSRAT BlackEnergy Carbanak Cobalt Strike DuQu

2022-04-15 ⋅ Bleeping Computer ⋅ Ionut Ilascu
Karakurt revealed as data extortion arm of Conti cybercrime syndicate
Anchor BazarBackdoor Conti TrickBot

2021-09-06 ⋅ cocomelonc ⋅ cocomelonc
AV engines evasion for C++ simple malware: part 2
Agent Tesla Amadey Anchor AnchorMTea Carbanak Carberp Cardinal RAT Felixroot Konni Loki Password Stealer (PWS) Maze

2021-07-15 ⋅ Kryptos Logic ⋅ Kryptos Logic Vantage Team
Adjusting the Anchor
Anchor

2021-04-14 ⋅ InfoSec Handlers Diary Blog ⋅ Brad Duncan
April 2021 Forensic Quiz: Answers and Analysis
Anchor BazarBackdoor Cobalt Strike

2021-03-08 ⋅ The DFIR Report ⋅ The DFIR Report
Bazar Drops the Anchor
Anchor BazarBackdoor Cobalt Strike

2021-02-23 ⋅ CrowdStrike ⋅ CrowdStrike
2021 Global Threat Report
RansomEXX Amadey Anchor Avaddon BazarBackdoor Clop Cobalt Strike Conti Cutwail DanaBot DarkSide DoppelPaymer Dridex Egregor Emotet Hakbit IcedID JSOutProx KerrDown LockBit Mailto Maze MedusaLocker Mespinoza Mount Locker NedDnLoader Nemty Pay2Key PlugX Pushdo PwndLocker PyXie QakBot Quasar RAT RagnarLocker Ragnarok RansomEXX REvil Ryuk Sekhmet ShadowPad SmokeLoader Snake SUNBURST SunCrypt TEARDROP TrickBot WastedLocker Winnti Zloader KNOCKOUT SPIDER OUTLAW SPIDER RIDDLE SPIDER SOLAR SPIDER VIKING SPIDER

2021-01-20 ⋅ Medium walmartglobaltech ⋅ Jason Reaves, Joshua Platt
Anchor and Lazarus together again?
Anchor TrickBot

2020-10-29 ⋅ Palo Alto Networks Unit 42 ⋅ Brittany Barbehenn, Doel Santos, Brad Duncan
Threat Assessment: Ryuk Ransomware and Trickbot Targeting U.S. Healthcare and Public Health Sector
Anchor BazarBackdoor Ryuk TrickBot

2020-10-28 ⋅ CISA ⋅ CISA, FBI, HHS
AA20-302A: Ransomware Activity Targeting the Healthcare and Public Health Sector
AnchorDNS Anchor BazarBackdoor Ryuk

2020-10-26 ⋅ Arbor Networks ⋅ Suweera De Souza
Dropping the Anchor
AnchorDNS Anchor TrickBot

2020-05-19 ⋅ AlienLabs ⋅ Ofer Caspi
TrickBot BazarLoader In-Depth
Anchor BazarBackdoor TrickBot

2020-04-08 ⋅ SentinelOne ⋅ Jason Reaves
Deep Dive Into TrickBot Executor Module “mexec”: Hidden “Anchor” Bot Nexus Operations
Anchor TrickBot

2020-04-07 ⋅ SecurityIntelligence ⋅ Ole Villadsen
ITG08 (aka FIN6) Partners With TrickBot Gang, Uses Anchor Framework
More_eggs Anchor TrickBot

2020-03-04 ⋅ CrowdStrike ⋅ CrowdStrike
2020 CrowdStrike Global Threat Report
MESSAGETAP More_eggs 8.t Dropper Anchor BabyShark BadNews Clop Cobalt Strike CobInt Cobra Carbon System Cutwail DanaBot Dharma DoppelDridex DoppelPaymer Dridex Emotet FlawedAmmyy FriedEx Gandcrab Get2 IcedID ISFB KerrDown LightNeuron LockerGoga Maze MECHANICAL Necurs Nokki Outlook Backdoor Phobos Predator The Thief QakBot REvil RobinHood Ryuk SDBbot Skipper SmokeLoader TerraRecon TerraStealer TerraTV TinyLoader TrickBot Vidar Winnti ANTHROPOID SPIDER APT23 APT31 APT39 APT40 BlackTech BuhTrap Charming Kitten CLOCKWORK SPIDER DOPPEL SPIDER FIN7 Gamaredon Group GOBLIN PANDA MONTY SPIDER MUSTANG PANDA NARWHAL SPIDER NOCTURNAL SPIDER PINCHY SPIDER SALTY SPIDER SCULLY SPIDER SMOKY SPIDER Thrip VENOM SPIDER VICEROY TIGER

2020-02-13 ⋅ Qianxin ⋅ Qi Anxin Threat Intelligence Center
APT Report 2019
Chrysaor Exodus Dacls VPNFilter DNSRat Griffon KopiLuwak More_eggs SQLRat AppleJeus BONDUPDATER Agent.BTZ Anchor AndroMut AppleJeus BOOSTWRITE Brambul Carbanak Cobalt Strike Dacls DistTrack DNSpionage Dtrack ELECTRICFISH FlawedAmmyy FlawedGrace Get2 Grateful POS HOPLIGHT Imminent Monitor RAT jason Joanap KerrDown KEYMARBLE Lambert LightNeuron LoJax MiniDuke PolyglotDuke PowerRatankba Rising Sun SDBbot ServHelper Snatch Stuxnet TinyMet tRat TrickBot Volgmer X-Agent Zebrocy

2019-12-11 ⋅ Cybereason ⋅ Assaf Dahan, Lior Rochberger, Eli Salem, Mary Zhao, Niv Yona, Omer Yampel, Matt Hart
Dropping Anchor: From a TrickBot Infection to the Discovery of the Anchor Malware
Anchor WIZARD SPIDER

2019-12-10 ⋅ Sentinel LABS ⋅ Vitali Kremez, Joshua Platt, Jason Reaves
Anchor Project | The Deadly Planeswalker: How The TrickBot Group United High-Tech Crimeware & APT
Anchor

2019-10-18 ⋅ NTT ⋅ NTT Security
TrickBot variant “Anchor_DNS” communicating over DNS
Anchor

Yara Rules

[TLP:WHITE] win_anchor_auto (20230715 | Detects win.anchor.)

rule win_anchor_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-07-11"
        version = "1"
        description = "Detects win.anchor."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.anchor"
        malpedia_rule_date = "20230705"
        malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
        malpedia_version = "20230715"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 740c 66c740016578 c6400365 eb0a }
            // n = 4, score = 800
            //   740c                 | je                  0xe
            //   66c740016578         | mov                 word ptr [eax + 1], 0x7865
            //   c6400365             | mov                 byte ptr [eax + 3], 0x65
            //   eb0a                 | jmp                 0xc

        $sequence_1 = { c6400365 eb0a 66c74001646c c640036c }
            // n = 4, score = 800
            //   c6400365             | mov                 byte ptr [eax + 3], 0x65
            //   eb0a                 | jmp                 0xc
            //   66c74001646c         | mov                 word ptr [eax + 1], 0x6c64
            //   c640036c             | mov                 byte ptr [eax + 3], 0x6c

        $sequence_2 = { 742b ff15???????? 8b15???????? 8bc8 2bc2 }
            // n = 5, score = 600
            //   742b                 | je                  0x2d
            //   ff15????????         |                     
            //   8b15????????         |                     
            //   8bc8                 | mov                 ecx, eax
            //   2bc2                 | sub                 eax, edx

        $sequence_3 = { 56 e8???????? 8b30 833e00 }
            // n = 4, score = 600
            //   56                   | push                esi
            //   e8????????           |                     
            //   8b30                 | mov                 esi, dword ptr [eax]
            //   833e00               | cmp                 dword ptr [esi], 0

        $sequence_4 = { 66894810 33c9 8b462c 66894812 }
            // n = 4, score = 600
            //   66894810             | mov                 word ptr [eax + 0x10], cx
            //   33c9                 | xor                 ecx, ecx
            //   8b462c               | mov                 eax, dword ptr [esi + 0x2c]
            //   66894812             | mov                 word ptr [eax + 0x12], cx

        $sequence_5 = { 68???????? 8d8dbcfeffff e8???????? 56 8d8dbcfeffff e8???????? 68???????? }
            // n = 7, score = 600
            //   68????????           |                     
            //   8d8dbcfeffff         | lea                 ecx, [ebp - 0x144]
            //   e8????????           |                     
            //   56                   | push                esi
            //   8d8dbcfeffff         | lea                 ecx, [ebp - 0x144]
            //   e8????????           |                     
            //   68????????           |                     

        $sequence_6 = { 66897810 8b461c 66895012 8b461c }
            // n = 4, score = 600
            //   66897810             | dec                 eax
            //   8b461c               | mov                 eax, dword ptr [ebp + 0xe0]
            //   66895012             | dec                 eax
            //   8b461c               | mov                 ecx, dword ptr [ebp + 0xe8]

        $sequence_7 = { b101 e8???????? e8???????? 84c0 }
            // n = 4, score = 600
            //   b101                 | mov                 cl, 1
            //   e8????????           |                     
            //   e8????????           |                     
            //   84c0                 | test                al, al

        $sequence_8 = { e8???????? 59 b001 5d c3 e9???????? 6a0c }
            // n = 7, score = 600
            //   e8????????           |                     
            //   59                   | pop                 ecx
            //   b001                 | mov                 al, 1
            //   5d                   | pop                 ebp
            //   c3                   | ret                 
            //   e9????????           |                     
            //   6a0c                 | push                0xc

        $sequence_9 = { 7509 33d2 33c9 e8???????? }
            // n = 4, score = 400
            //   7509                 | jne                 0xb
            //   33d2                 | xor                 edx, edx
            //   33c9                 | xor                 ecx, ecx
            //   e8????????           |                     

        $sequence_10 = { 4863d8 8d46f3 48f7e3 490f40c6 488bc8 e8???????? }
            // n = 6, score = 200
            //   4863d8               | sub                 edi, esi
            //   8d46f3               | jne                 0x54
            //   48f7e3               | inc                 ecx
            //   490f40c6             | lea                 ecx, [eax + 0x10]
            //   488bc8               | dec                 eax
            //   e8????????           |                     

        $sequence_11 = { 488d0d32c80200 e8???????? 0fb605???????? 8bf8 }
            // n = 4, score = 200
            //   488d0d32c80200       | lea                 esp, [ebp + 0xe8]
            //   e8????????           |                     
            //   0fb605????????       |                     
            //   8bf8                 | dec                 eax

        $sequence_12 = { 85c9 0f8496010000 d1e9 418d4424fb }
            // n = 4, score = 200
            //   85c9                 | arpl                ax, bx
            //   0f8496010000         | lea                 eax, [esi - 0xd]
            //   d1e9                 | dec                 eax
            //   418d4424fb           | mul                 ebx

        $sequence_13 = { 488d0d2fc9fdff e8???????? e8???????? e8???????? e8???????? 8bc8 }
            // n = 6, score = 200
            //   488d0d2fc9fdff       | mov                 byte ptr [eax + 3], 0x65
            //   e8????????           |                     
            //   e8????????           |                     
            //   e8????????           |                     
            //   e8????????           |                     
            //   8bc8                 | jmp                 0x10

        $sequence_14 = { 488d0d31500300 e8???????? 90 488b8500010000 }
            // n = 4, score = 200
            //   488d0d31500300       | dec                 eax
            //   e8????????           |                     
            //   90                   | lea                 ecx, [0x12b31]
            //   488b8500010000       | inc                 esp

        $sequence_15 = { 488d0d31950200 0fb60401 c1e006 b901000000 }
            // n = 4, score = 200
            //   488d0d31950200       | inc                 esp
            //   0fb60401             | mov                 dword ptr [esp + 0x48], esi
            //   c1e006               | dec                 eax
            //   b901000000           | mov                 dword ptr [esp + 0x40], ecx

        $sequence_16 = { b906000000 48898620020000 0fb7c0 66f3ab 488d3dfc3d0100 482bfe }
            // n = 6, score = 200
            //   b906000000           | mov                 ecx, 6
            //   48898620020000       | dec                 eax
            //   0fb7c0               | mov                 dword ptr [esi + 0x220], eax
            //   66f3ab               | movzx               eax, ax
            //   488d3dfc3d0100       | rep stosd           dword ptr es:[edi], eax
            //   482bfe               | dec                 eax

        $sequence_17 = { 488d0d32790200 e8???????? 488d0d7e480100 e8???????? }
            // n = 4, score = 200
            //   488d0d32790200       | dec                 eax
            //   e8????????           |                     
            //   488d0d7e480100       | mov                 dword ptr [esp + 0x30], eax
            //   e8????????           |                     

        $sequence_18 = { 488d0d33960300 e8???????? 488b85e0000000 48c70000000000 }
            // n = 4, score = 200
            //   488d0d33960300       | mov                 edx, dword ptr [ebp + 0x28]
            //   e8????????           |                     
            //   488b85e0000000       | dec                 eax
            //   48c70000000000       | lea                 ecx, [0x29531]

        $sequence_19 = { 443905???????? 7552 418d4810 48890d???????? }
            // n = 4, score = 200
            //   443905????????       |                     
            //   7552                 | lea                 edi, [0x13dfc]
            //   418d4810             | dec                 eax
            //   48890d????????       |                     

        $sequence_20 = { 488d0d312b0100 4489742448 48894c2440 488d8c24d0000000 }
            // n = 4, score = 200
            //   488d0d312b0100       | mov                 cl, 1
            //   4489742448           | test                al, al
            //   48894c2440           | shl                 ecx, 2
            //   488d8c24d0000000     | push                ecx

    condition:
        7 of them and filesize < 778240
}

[TLP:WHITE] win_anchor_w0 (20200413 | For x86 Anchor)

rule win_anchor_w0 {
    meta:
        author = "Jason Reaves"
        description = "For x86 Anchor"
        source = "https://labs.sentinelone.com/deep-dive-into-trickbot-executor-module-mexec-hidden-anchor-bot-nexus-operations/"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.anchor"
        malpedia_version = "20200413"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:
        $a1 = "/1001/" ascii wide
        $a2 = ":$GUID" ascii wide
        $a3 = ":$TASK" ascii wide
        $ua = "WinHTTP loader/1.0" ascii wide
        $hexlify = {0f be ?? ?? b8 f0 00 00 00 0f 45 ?? 8b ?? c1 e1 02 23 d0}
        $sdecode = {8a 04 0a 0f be c0 83 e8 ?? 88 04 0a 42 83}
        $xor_data = {80 b4 05 ?? ?? ff ff ?? 40 3b c6}

    condition:
        3 of them
}

[TLP:WHITE] win_anchor_w1 (20200413 | For x64 Anchor)

rule win_anchor_w1 {
    meta:
        author = "Jason Reaves"
        description = "For x64 Anchor"
        source = "https://labs.sentinelone.com/deep-dive-into-trickbot-executor-module-mexec-hidden-anchor-bot-nexus-operations/"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.anchor"
        malpedia_version = "20200413"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:
        $xor_data = {80 ?4 0? ?? ?? 48 ?? c? 48}
        $hexlify = {81 c1 f0 00 00 00 23 d1 41 8? ?? c1 e1 02}
        $a1 = "/1001/" ascii wide
        $a2 = ":$GUID" ascii wide
        $a3 = ":$TASK" ascii wide
        $ua = "WinHTTP loader/1.0" ascii wide

    condition:
       3 of them
}

Download all Yara Rules

Anchor Propose Change

References

Yara Rules

Anchor