Procedure examples

Anchor can use secondary C2 servers for communication after establishing connectivity and relaying victim information to primary C2 servers.

Anchor can determine the public IP and location of a compromised host.

Anchor can support windows execution via SMB shares.

Anchor has obfuscated code with stack strings and string encryption.

Anchor has come with a packed payload.

Anchor can install itself as a cron job.

Anchor can create a scheduled task for persistence.

Anchor has used cmd.exe to run its self deletion routine.

Anchor can execute payloads via shell scripting.

Anchor can self delete its dropper after the malware is successfully deployed.

Anchor has used HTTP and HTTPS in C2 communications.

Variants of Anchor can use DNS tunneling to communicate with C2.

Anchor can determine the hostname and linux version on a compromised host.

Anchor has used ICMP in C2 communications.

Anchor can download additional payloads.

Anchor can terminate itself if specific execution flags are not present.

Anchor can establish persistence by creating a service.

Anchor has been signed with valid certificates to evade detection by security tools.

Anchor has used NTFS to hide files.

Anchor can create and execute services to load its payload.