MalwareUsed by 1 actor

FYAnti

Also known asDILLJUICE stage2

FYAnti is a Windows malware component associated with menuPass, also known as APT10, and is also tracked as DILLJUICE Stage 2. It functions as an in-memory intermediary stage in a multi-layer intrusion chain in which SigLoader loads FYAnti, after which FYAnti decrypts an embedded .NET module and reflectively executes it using the CppHostCLR technique. This approach enables execution of .NET code inside a native process without writing the assembly to disk, making the malware notably fileless and complicating host-based detection and forensic recovery.

FYAnti has been observed using ConfuserEx to pack its .NET module as an additional defense-evasion measure. Its primary role is to unpack, decrypt, and launch subsequent payload logic in memory; in documented activity, it has been used to load QuasarRAT. The malware is part of tradecraft used in espionage operations attributed to APT10/menuPass, a threat actor known for targeting sectors including healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government. FYAnti is best characterized as a stealthy loader stage focused on decryption and reflective in-memory execution of downstream .NET payloads on Windows systems.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

menuPass

Eventually, SigLoader will load the first payload, FYAnti, in memory. FYAnti decrypts the first embedded .NET module and reflectively loads executing the module using the CppHostCLR technique to avoid dropping additional files to disk.

via medium mitre engenuitymedium.com

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059.005Visual BasicEvidence1

Execute-assembly runs .NET executable within memory of sacrificial process by loading the CLR.

Privilege Escalation

1 technique

T1055Process InjectionEvidence1

The malware makes use of CppHostCLR due its ability to inject and execute the .NET loader assembly without extraction to disk.

Stealth

4 techniques

T1027.002Software PackingEvidence2

"Sandworm Team used UPX to pack a copy of Mimikatz"; "APT38 has used several code packing methods such as Themida, Enigma, VMProtect, and Obsidium"; "Lazarus Group packed malicious .db files with Themida to evade detection."

T1055Process InjectionEvidence1

The malware makes use of CppHostCLR due its ability to inject and execute the .NET loader assembly without extraction to disk.

T1140Deobfuscate/Decode Files or InformationEvidence6

The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.

T1620Reflective Code LoadingEvidence1

In this blog post, we’ll delve into one such technique employed by these threat groups: Reflective Code Loading (T1620).

Discovery

1 technique

T1083File and Directory DiscoveryEvidence5

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence2

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

ACTIVITY FEED

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

6 SOURCESView more in app

medium mitre engenuityNews

Aug 26, 2024

Exploring the Frontier: Insights from ATT&CK Evaluations Managed Services Round 2 | by Lex Crumpton | Center for Threat-Informed Defense | Medium

A memory-resident loader used by menuPass that decrypts an embedded .NET module and reflectively loads it via CppHostCLR to avoid disk artifacts.

mitre attack websiteNews

Oct 21, 2021

Updates - Updates - October 2021 | MITRE ATT&CK®

Enterprise New Software: ... FYAnti

mitre attack websiteNews

Oct 21, 2021

Deobfuscate/Decode Files or Information, Technique T1140 - Enterprise | MITRE ATT&CK®

Malware that decrypts an embedded .NET module.

securelistNews

Apr 27, 2021

APT trends report Q1 2021 | Securelist

Stage-2 component that loads QuasarRAT in the described campaign.

+2 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

FYAnti

Also known asDILLJUICE stage2