Procedure examples

Derusbi uses a backup communication method with an HTTP beacon.

Derusbi is capable of enumerating Registry keys and values.

A Linux version of Derusbi checks if the victim user ID is anything other than zero (normally used for root), and the malware will not execute if it does not have root privileges. Derusbi also gathers the username of the victim.

Derusbi injects itself into the secure shell (SSH) process.

Derusbi is capable of logging keystrokes.

Derusbi collects current and parent process IDs.

Derusbi is capable of creating a remote Bash shell and executing commands.

Derusbi is capable of deleting files. It has been observed loading a Linux Kernel Module (LKM) and then deleting it from the hard disk as well as overwriting the data with null bytes.

The Derusbi malware supports timestomping.

Derusbi gathers the name of the local host, version of GNU Compiler Collection (GCC), and the system information about the CPU, machine, and operating system.

Derusbi is capable of obtaining directory, file, and drive listings.

Derusbi binds to a raw socket on a random source port between 31800 and 31900 for C2.

Derusbi is capable of performing screen captures.

Derusbi is capable of performing audio captures.

Derusbi is capable of capturing video.

Derusbi variants have been seen that use Registry persistence to proxy execution through regsvr32.exe.

Derusbi has used unencrypted HTTP on port 443 for C2.

Derusbi obfuscates C2 traffic with variable 4-byte XOR keys.