FYAnti

MITRE ATT&CK: S0628 View on attack.mitre.org

Aliases: DILLJUICE stage2, FYAnti

First seen: 2020-01-01 00:00:00
Malware type: loader
Family: Malware family
Operating systems: windows
Profile updated: 2026-07-07 15:30:56

Targeted industries: defense-and-aerospace government-and-public-sector technology-and-telecommunications

Targeted regions: country_code:us country_code:jp

Context

FYAnti is a loader that has been used by menuPass since at least 2020, including to deploy QuasarRAT.

Detection coverage

1 YARA rules
107 Sigma rules

Malware & tools used

Ingress Tool Transfer (attack-pattern)
File and Directory Discovery (attack-pattern)
Deobfuscate/Decode Files or Information (attack-pattern)
Software Packing (attack-pattern)

Used by threat actors

menuPass (threat-actor)

Detection rules

DITEKSHEN_MALWARE_Win_Fyanti (yara-rule)

Reports & references

Kaspersky — 101519 (report)
MITRE ATT&CK — S0628 (report)

External references