FYAnti - S0628 (434ba392-ebdc-488b-b1ef-518deea65774)

FYAnti is a loader that has been used by menuPass since at least 2020, including to deploy QuasarRAT.(Citation: Securelist APT10 March 2021)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Deobfuscate/Decode Files or Information - T1140 (3ccef7ae-cb5e-48f6-8302-897105fbf55c)	Attack Pattern	FYAnti - S0628 (434ba392-ebdc-488b-b1ef-518deea65774)	Malware	1
Software Packing - T1027.002 (deb98323-e13f-4b0c-8d94-175379069062)	Attack Pattern	FYAnti - S0628 (434ba392-ebdc-488b-b1ef-518deea65774)	Malware	1
File and Directory Discovery - T1083 (7bc57495-ea59-4380-be31-a64af124ef18)	Attack Pattern	FYAnti - S0628 (434ba392-ebdc-488b-b1ef-518deea65774)	Malware	1
Ingress Tool Transfer - T1105 (e6919abc-99f9-4c6c-95a5-14761e7b2add)	Attack Pattern	FYAnti - S0628 (434ba392-ebdc-488b-b1ef-518deea65774)	Malware	1
Obfuscated Files or Information - T1027 (b3d682b6-98f2-4fb0-aa3b-b4df007ca70a)	Attack Pattern	Software Packing - T1027.002 (deb98323-e13f-4b0c-8d94-175379069062)	Attack Pattern	2