TF-MAL-elf.anchor_dns
📛 Threat Title
Malware family: AnchorDNS
Description
ThreatFox malware family `elf.anchor_dns`. Printable name: AnchorDNS.
Indicators of Compromise (0)
No indicators of compromise on this threat.
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:archive.orkl.eu
TrickBot is one of the most prolific threat actors and is known for upgrading its malware from time to time. Thus, experts recommend having good detection, monitoring, and response solutions, and robust internal SOC processes. Further, it is recommended to train employees to spot phishing emails. TrickBot Anchor DNS AnchorMail Linux AnchorDNS ...
-
web:attack.mitre.org
Anchor is one of a family of backdoor malware that has been used in conjunction with TrickBot on selected high profile targets since at least 2018. [1] [2]
-
web:cybernews.com
The FBI warns of a surge in ATM jackpotting attacks, with more than 700 incidents in 2025 alone. Hackers use Ploutus malware to force machines to dispense cash.
-
web:github.com
Mapping Malware with MITRE ATT&CK is a detailed research project focused on analyzing malware threats using the MITRE ATT&CK framework. The project investigates Ryuk Ransomware, a notorious malware family , identifying its characteristics, motivations, and potential targets - MojithaR/Mapping- Malware -with-MITRE-ATT-C
-
web:malpedia.caad.fkie.fraunhofer.de
AgeLocker AnchorDNS Blackrota Cloud Snooper Dacls Doki FritzFrog IPStorm Kaiji Kinsing NOTROBIN Penquin Turla PLEAD Prometei RansomEXX Stantinko TeamTNT TSCookie WellMail elf.wellmess TeamTNT 2020-10-28 ⋅ CISA ⋅ CISA, FBI, HHS AA20-302A: Ransomware Activity Targeting the Healthcare and Public Health Sector AnchorDNS Anchor BazarBackdoor Ryuk
-
web:www.cybereason.com
Cybereason Nocturnus detected a series of attacks that started with a TrickBot infection and progressed into a hacking operation targeting sensitive financial systems using a new variant of Anchor_DNS and a new malware dubbed Anchor.
-
web:www.ibm.com
With the exception of the overhauled C2 communication mechanism, AnchorMail's behavior aligns very closely to that of its AnchorDNS predecessor. The discovery of this new Anchor variant adds a new stealthy backdoor for use during ransomware attacks and highlights the group's commitment to upgrading its malware .
-
web:www.joesandbox.com
Deep Malware Analysis - Joe Sandbox Analysis Report Overview Overview Malware Configuration Behavior Graph Screenshots Antivirus and ML Detection General Information Simulations Joe Sandbox View / Context Signatures Yara Sigma Signatures Mitre Att&ck Matrix Startup Domains / IPs Dropped Static Network Hooks Stats Behavior Behavior anchorDNS_x64.exe, pid: 6344 cmd.exe, pid: 6368 cmd.exe, pid ...
-
web:www.microsoft.com
Understand how this virus or malware spreads and how its payloads affects your computer. Protect against this threat, identify symptoms, and clean up or remove infections.
-
web:www.tha.org
Anchor_DNS is a backdoor that allows victim machines to communicate with command and control (C2) servers over DNS to evade typical network defense products and make their malicious communications blend in with legitimate DNS traffic. Anchor_DNS uses a single-byte XOR cipher to encrypt its communications, which have been observed using key 0xB9.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.