From 275c8feec311fcb34643041a9556c3cee78ba964 Mon Sep 17 00:00:00 2001 From: Ryan Xu Date: Mon, 12 Jun 2023 10:30:56 -0400 Subject: [PATCH] New Malware Examples + Editing References (#105) * New malware examples (#103) * fix typos * add new Use in Malware entries to behaviors * new corpus entries * remove extraneous ref * restore original IDs * fix typos * Update registry.md (#101) Update C0036.001 per "Registry micro-behavior" Discussion. * Update registry.md (#102) Update C0036.001 per "Registry micro-behavior" Discussion. * correct modified date * fix PR comments on formatting * Editing references (#104) --------- Co-authored-by: Desiree Beck --- anti-behavioral-analysis/README.md | 2 +- .../debugger-detection.md | 2 +- anti-behavioral-analysis/debugger-evasion.md | 2 +- .../dynamic-analysis-evasion.md | 2 +- anti-static-analysis/README.md | 2 +- .../call-graph-generation-evasion.md | 9 +- anti-static-analysis/disassembler-evasion.md | 2 +- anti-static-analysis/software-packing.md | 2 +- collection/cryptocurrency.md | 15 +++- collection/input-capture.md | 7 +- command-and-control/c2-communication.md | 9 +- defense-evasion/bootkit.md | 2 +- .../bypass-data-execution-prevention.md | 4 +- .../hidden-files-and-directories.md | 7 +- defense-evasion/process-injection.md | 2 +- defense-evasion/rootkit.md | 2 +- defense-evasion/self-deletion.md | 7 +- discovery/file-and-directory-discovery.md | 7 +- discovery/self-discovery.md | 27 +++++- discovery/smtp-connection-discovery.md | 14 +++- .../command-and-scripting-interpreter.md | 2 +- execution/execution-dependency.md | 16 +++- execution/install-additional-program.md | 9 +- execution/send-email.md | 2 +- execution/system-services.md | 2 +- execution/user-execution.md | 2 +- exfiltration/automated-exfiltration.md | 15 +++- impact/compromise-data-integrity.md | 15 +++- impact/data-encrypted-for-impact.md | 7 +- impact/generate-traffic-from-victim.md | 4 +- impact/modify-hardware.md | 16 +++- impact/remote-access.md | 2 +- lateral-movement/supply-chain-compromise.md | 2 +- micro-behaviors/operating-system/registry.md | 4 +- persistence/README.md | 2 +- persistence/component-firmware.md | 10 +-- persistence/kernel-modules-and-extensions.md | 15 +++- persistence/modify-existing-service.md | 2 +- .../registry-run-keys-startup-folder.md | 9 +- xample-malware/README.md | 84 ++++++++++--------- xample-malware/adwind-jrat.md | 41 +++++++++ xample-malware/attor.md | 52 ++++++++++++ xample-malware/badusb.md | 66 +++++++++++++++ xample-malware/chopstick.md | 2 +- xample-malware/clipminer.md | 2 +- xample-malware/conficker.md | 2 +- xample-malware/cozycar.md | 2 +- xample-malware/cryptolocker.md | 2 +- xample-malware/cryptowall.md | 2 +- xample-malware/dark-comet.md | 2 +- xample-malware/dnschanger.md | 2 +- xample-malware/drovorub.md | 51 +++++++++++ xample-malware/dyepack.md | 36 ++++++++ xample-malware/electrorat.md | 79 +++++++++++++++++ xample-malware/emotet.md | 2 +- xample-malware/evilbunny.md | 2 +- xample-malware/gamut.md | 2 +- xample-malware/geneio.md | 2 +- xample-malware/gobotkr.md | 2 +- xample-malware/gravity-rat.md | 2 +- xample-malware/heriplor.md | 2 +- xample-malware/hupigon.md | 2 +- xample-malware/kovter.md | 2 +- xample-malware/kraken.md | 2 +- xample-malware/locky-bart.md | 2 +- xample-malware/matanbuchus.md | 2 +- xample-malware/mazarbot.md | 2 +- xample-malware/mebromi.md | 2 +- xample-malware/netwalker.md | 2 +- xample-malware/poison-ivy.md | 2 +- xample-malware/redhip.md | 4 +- xample-malware/rombertik.md | 2 +- xample-malware/samsam.md | 2 +- xample-malware/searchawesome.md | 2 +- xample-malware/shamoon.md | 2 +- xample-malware/snake.md | 37 ++++++++ xample-malware/stuxnet.md | 8 +- xample-malware/synful-knock.md | 2 +- xample-malware/teardrop.md | 10 +-- xample-malware/terminator.md | 4 +- xample-malware/trickbot.md | 4 +- xample-malware/up007.md | 2 +- xample-malware/ursnif.md | 2 +- xample-malware/wannacry.md | 60 +++++++++++++ xample-malware/webcobra.md | 2 +- xample-malware/yispecter.md | 2 +- 86 files changed, 699 insertions(+), 165 deletions(-) create mode 100644 xample-malware/adwind-jrat.md create mode 100644 xample-malware/attor.md create mode 100644 xample-malware/badusb.md create mode 100644 xample-malware/drovorub.md create mode 100644 xample-malware/dyepack.md create mode 100644 xample-malware/electrorat.md create mode 100644 xample-malware/snake.md create mode 100644 xample-malware/wannacry.md diff --git a/anti-behavioral-analysis/README.md b/anti-behavioral-analysis/README.md index 12fd887..6a4a28a 100644 --- a/anti-behavioral-analysis/README.md +++ b/anti-behavioral-analysis/README.md @@ -32,6 +32,6 @@ Behaviors that prevent, obstruct, or evade behavioral analysis of malware--for e ## References -[1] Unprotect Project, a database about malware self-defense and protection. https://search.unprotect.it/map +[1] https://search.unprotect.it/map/ [2] InDepthUnpacking, course content for teaching malware anti-analysis techniques and mitigations, with emphasis on packers. https://github.com/knowmalware/InDepthUnpacking diff --git a/anti-behavioral-analysis/debugger-detection.md b/anti-behavioral-analysis/debugger-detection.md index 57b2d41..770249c 100644 --- a/anti-behavioral-analysis/debugger-detection.md +++ b/anti-behavioral-analysis/debugger-detection.md @@ -115,7 +115,7 @@ Details on detecting debuggers are given in the references. [3] Peter Ferrie, "The 'Ultimate' Anti-Debugging Reference," 4 May 2011. https://anti-reversing.com/Downloads/Anti-Reversing/The_Ultimate_Anti-Reversing_Reference.pdf. -[4] Atif Mushtaq, FireEye, "The Dead Giveaways of VM-Aware Malware," 27 January 2011. https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html. +[4] https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html [5] Ayoub Faouzi (LordNoteworthy), Al-Khaser v0.79. https://github.com/LordNoteworthy/al-khaser diff --git a/anti-behavioral-analysis/debugger-evasion.md b/anti-behavioral-analysis/debugger-evasion.md index 77f5085..d3eefa5 100644 --- a/anti-behavioral-analysis/debugger-evasion.md +++ b/anti-behavioral-analysis/debugger-evasion.md @@ -89,6 +89,6 @@ The related **Debugger Evasion ([T1622](https://attack.mitre.org/techniques/T162 [2] https://web.archive.org/web/20210225195315/https://www.synack.com/blog/analyzing-the-anti-analysis-logic-of-an-adware-installer/ -[3] Atif Mushtaq, FireEye, "The Dead Giveaways of VM-Aware Malware," 27 January 2011. https://web.archive.org/web/20161025013916/https:/www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html +[3] https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html [4] https://securitynews.sonicwall.com/xmlpost/revisiting-vobfus-worm-mar-8-2013/ diff --git a/anti-behavioral-analysis/dynamic-analysis-evasion.md b/anti-behavioral-analysis/dynamic-analysis-evasion.md index a83225b..3a1e302 100644 --- a/anti-behavioral-analysis/dynamic-analysis-evasion.md +++ b/anti-behavioral-analysis/dynamic-analysis-evasion.md @@ -76,7 +76,7 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t ## References -[1] https://joesecurity.org/blog/43104088277279070 +[1] https://www.joesecurity.org/blog/4310408827727907098 [2] https://www.mcafee.com/blogs/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/ diff --git a/anti-static-analysis/README.md b/anti-static-analysis/README.md index 02359b8..f0a9ae9 100644 --- a/anti-static-analysis/README.md +++ b/anti-static-analysis/README.md @@ -28,6 +28,6 @@ Behaviors and code characteristics that prevent or hinder static analysis of the ## References -[1] Unprotect Project, a database about malware self-defense and protection. https://search.unprotect.it/map/sandbox-evasion/ +[1] https://search.unprotect.it/map/sandbox-evasion/ [2] InDepthUnpacking, course content for teaching malware anti-analysis techniques and mitigations, with emphasis on packers. https://github.com/knowmalware/InDepthUnpacking diff --git a/anti-static-analysis/call-graph-generation-evasion.md b/anti-static-analysis/call-graph-generation-evasion.md index b334efc..b1bfa87 100644 --- a/anti-static-analysis/call-graph-generation-evasion.md +++ b/anti-static-analysis/call-graph-generation-evasion.md @@ -17,7 +17,7 @@ Version -2.0 +2.1 Created @@ -25,7 +25,7 @@ Last Modified -4 May 2023 +3 June 2023 @@ -40,6 +40,7 @@ Malicious code evades accurate call graph generation, which can be used for malw |---|---|---| |**Invoke NTDLL System Calls via Encoded Table**|B0010.002|Invokes ntdll.dll functions without using an export table; an encoded translation table on the stack is used instead. [[5]](#5)| |**Two-layer Function Return**|B0010.001|Two layer jumping confuses tools plotting call graphs. [[5]](#5)| +|**Shadow Process Communication**|B0010.003| Uses multiple processes (instead of one process) to make behavior detection more difficult. [[6]](#6)| ## References @@ -51,4 +52,6 @@ Malicious code evades accurate call graph generation, which can be used for malw [4] J. Kinable, "Malware Detection Through Call Graphs," Master thesis, Department of Telematics, Norwegian University of Science and Technology, Norway, June 2010. [Online]. Available: https://ntnuopen.ntnu.no/ntnu-xmlui/bitstream/handle/11250/262290/353049_FU LLTEXT01.pdf?sequence=1&isAllowed=y. -[5] http://fumalwareanalysis.blogspot.com/2012/01/malware-analysis-tutorial-10-tricks-for.html \ No newline at end of file +[5] http://fumalwareanalysis.blogspot.com/2012/01/malware-analysis-tutorial-10-tricks-for.html + +[6] Weiqin Ma, Pu Duan, Sanmin Liu, Guofei Gu and Jyh-Charn Liu,"Shadow Attacks: Automatically Evading System-Call-Behavior Based Malware Detection" https://people.engr.tamu.edu/guofei/paper/ShadowAttacks_final-onecolumn.pdf \ No newline at end of file diff --git a/anti-static-analysis/disassembler-evasion.md b/anti-static-analysis/disassembler-evasion.md index ece262c..4a7461a 100644 --- a/anti-static-analysis/disassembler-evasion.md +++ b/anti-static-analysis/disassembler-evasion.md @@ -53,7 +53,7 @@ Anti-disassembly techniques take advantage of weaknesses in either flow-oriented ## References -[1] Practical Malware Analysis by Michael Sikorski, Andrew Honig, February 2012, Publisher(s): No Starch Press. +[1] M. Sikorski and A. Honig, Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software, No Starch Press, 2012. [2] https://staff.ustc.edu.cn/~bjhua/courses/security/2014/readings/anti-disas.pdf diff --git a/anti-static-analysis/software-packing.md b/anti-static-analysis/software-packing.md index 0a982ec..ad8840e 100644 --- a/anti-static-analysis/software-packing.md +++ b/anti-static-analysis/software-packing.md @@ -71,7 +71,7 @@ This description refines the ATT&CK **Obfuscated Files or Information: Software [2] Jiang Ming et al, Towards Paving the Way for Large-Scale Windows Malware Analysis: Generic Binary Unpacking with Orders-of-Magnitude Performance Boost, October 2018, https://dl.acm.org/citation.cfm?id=3243771 -[3] Atif Mushtaq, FireEye, "The Dead Giveaways of VM-Aware Malware," 27 January 2011. https://web.archive.org/web/20161025013916/https:/www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html +[3] https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html [4] https://www.bleepingcomputer.com/virus-removal/remove-kovter-trojan diff --git a/collection/cryptocurrency.md b/collection/cryptocurrency.md index bcee0ae..86f5fe1 100644 --- a/collection/cryptocurrency.md +++ b/collection/cryptocurrency.md @@ -13,7 +13,7 @@ Version -2.0 +2.1 Created @@ -21,11 +21,10 @@ Last Modified -31 October 2022 +3 June 2023 - # Cryptocurrency Malware accesses files that contain sensitive data or credentials related to Bitcoin and other cryptocurrency wallets. @@ -37,3 +36,13 @@ Malware accesses files that contain sensitive data or credentials related to Bit |**Bitcoin**|B0028.001|Access Bitcoin data.| |**Ethereum**|B0028.002|Access Ethereum data.| |**Zcash**|B0028.003|Access Zcash data.| + +## Use in Malware + +|Name|Date|Method|Description| +|---|---|---|---| +|[**ElectroRAT**](../xample-malware/electrorat.md)|2020|--|ElectroRat examines the disk for cryptocurrency addresses and keys to steal money from a wallet. It compromises multiple currencies, including Monaro, Doegecoin, Ethereum, Litecoin, and Bitcoin. [[1]](#1)| + +## References + +[1] https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/ \ No newline at end of file diff --git a/collection/input-capture.md b/collection/input-capture.md index f0e6a6d..484ec2e 100644 --- a/collection/input-capture.md +++ b/collection/input-capture.md @@ -13,7 +13,7 @@ Version -2.0 +2.1 Created @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +6 June 2023 @@ -46,6 +46,7 @@ See ATT&CK: **Input Capture ([T1056](https://attack.mitre.org/techniques/T1056), |[**Ursnif**](../xample-malware/ursnif.md)|2016|--|The malware injects HTML into a browser session to collect sensitive online banking information when the victim performs their online banking. [[2]](#2)| |[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|Poison Ivy can capture audio and video. [[4]](#4)| |[**Clipminer**](../xample-malware/clipminer.md)|2011|--|Clipminer monitors keyboard and mouse activity to determine if the machine is in use. [[5]](#5)| +|[**ElectroRAT**](../xample-malware/electrorat.md)|2020|--|ElectroRat monitors keyboard and mouse activity to determine whether the machine is in use. [[6]](#6)| ## References @@ -60,3 +61,5 @@ See ATT&CK: **Input Capture ([T1056](https://attack.mitre.org/techniques/T1056), [5] https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf +[6] https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/ + diff --git a/command-and-control/c2-communication.md b/command-and-control/c2-communication.md index 9675e91..210ccf4 100644 --- a/command-and-control/c2-communication.md +++ b/command-and-control/c2-communication.md @@ -13,7 +13,7 @@ Version -2.0 +2.1 Created @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +6 June 2023 @@ -90,6 +90,7 @@ As "server" and "client" are confusing terminology, we use the terms "controller |[**Kovter**](../xample-malware/kovter.md)|2016|B0030.001|The malware sends data to the C2. [[19]](#19)| |[**Kovter**](../xample-malware/kovter.md)|2016|B0030.002|The malware receives data from the C2. [[19]](#19)| |[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|B0030.002|The malware receives data from the C2 server. [[18]](#18)| +|[**ElectroRAT**](../xample-malware/electrorat.md)|2020|--|ElectroRat communicates to a Pastebin site via HTTP. [[20]](#20)| ## Code Snippets @@ -121,7 +122,7 @@ jmp short loc_4019A2 [2] https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/ -[3] https://www.mandiant.com/resources/hot-knives-through-butter-evading-file-based-sandboxes +[3] https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/pf/file/fireeye-hot-knives-through-butter.pdf [4] https://citizenlab.ca/2016/04/between-hong-kong-and-burma/ @@ -154,3 +155,5 @@ jmp short loc_4019A2 [18] https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/ [19] capa v4.0, analyzed at MITRE on 10/12/2022 + +[20] https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/ \ No newline at end of file diff --git a/defense-evasion/bootkit.md b/defense-evasion/bootkit.md index f694f8b..018c2da 100644 --- a/defense-evasion/bootkit.md +++ b/defense-evasion/bootkit.md @@ -44,5 +44,5 @@ The MBC also associates the Bootkit behavior with Defense Evasion because the ma [1] https://www.webroot.com/blog/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/ -[2] https://eclypsium.com/wp-content/uploads/2020/12/TrickBot-Now-Offers-TrickBoot-Persist-Brick-Profit.pdf +[2] https://eclypsium.com/wp-content/uploads/TrickBot-Now-Offers-TrickBoot-Persist-Brick-Profit.pdf diff --git a/defense-evasion/bypass-data-execution-prevention.md b/defense-evasion/bypass-data-execution-prevention.md index b905f87..e747496 100644 --- a/defense-evasion/bypass-data-execution-prevention.md +++ b/defense-evasion/bypass-data-execution-prevention.md @@ -38,6 +38,4 @@ Malware may bypass Data Execution Prevention (DEP). ## References -[1] https://medium.com/cybersecurityservices/dep-bypass-using-rop-chains-garima-chopra-e8b3361e50ce - -[2] https://www.cybereason.com/blog/research/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware +[1] https://medium.com/cybersecurityservices/dep-bypass-using-rop-chains-garima-chopra-e8b3361e50ce \ No newline at end of file diff --git a/defense-evasion/hidden-files-and-directories.md b/defense-evasion/hidden-files-and-directories.md index 16083f0..f0ca6cb 100644 --- a/defense-evasion/hidden-files-and-directories.md +++ b/defense-evasion/hidden-files-and-directories.md @@ -13,7 +13,7 @@ Version -2.0 +2.1 Created @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +6 June 2023 @@ -54,6 +54,7 @@ See ATT&CK: **Hide Artifacts: Hidden Files and Directories ([T1564.001](https:// |[**Vobfus**](../xample-malware/vobfus.md)|2016|F0005.002|Vobfus is located on external drives or network shares and attaches itself to ZIP and RAR files, other removable drives, and network shares. Vobfus hides folders on the external drive and drops an executable with the same name and a disguised folder icon. [[4]](#4)| |[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|F0005.002|Malware looks for a specific folder on the victim. If the folder doesn't exist, the malware creates the folder on the victim by calling CreateDirectoryA and downloads the remote file into the new folder. [[5]](#5) [[6]](#6)| |[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|F0005.001|The malware also appends the filename and extension .ocx to the ProgramData folder path. [[5]](#5) [[6]](#6)| +|[**WannaCry**](../xample-malware/wannacry.md)|2017|F0005.003|WannaCry uses the +h attribute to hide its files. [[7]](#7)| ## References @@ -69,3 +70,5 @@ See ATT&CK: **Hide Artifacts: Hidden Files and Directories ([T1564.001](https:// [5] https://www.0ffset.net/reverse-engineering/matanbuchus-loader-analysis/ [6] https://www.cyberark.com/resources/threat-research-blog/inside-matanbuchus-a-quirky-loader + +[7] https://www.mandiant.com/resources/blog/wannacry-malware-profile \ No newline at end of file diff --git a/defense-evasion/process-injection.md b/defense-evasion/process-injection.md index f4ef0fc..15f3213 100644 --- a/defense-evasion/process-injection.md +++ b/defense-evasion/process-injection.md @@ -73,7 +73,7 @@ The methods table includes existing ATT&CK sub-techniques, which have been enhan ## References [1] Ashkan Hosseini, *Ten Process Injection Techniques: A Technical Survey of Common and Trending Process Injection Techniques*, July 2017. https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process -[2] https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy +[2] https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/poison-ivy [3] https://github.com/LordNoteworthy/al-khaser diff --git a/defense-evasion/rootkit.md b/defense-evasion/rootkit.md index 6c8e3b0..7818869 100644 --- a/defense-evasion/rootkit.md +++ b/defense-evasion/rootkit.md @@ -65,7 +65,7 @@ Rootkits can also be detected via memory dump analysis or virtual machine intros [1] https://en.wikipedia.org/wiki/Rootkit -[2] https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy +[2] https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/poison-ivy [3] https://www.f-secure.com/v-descs/backdoor_w32_hupigon.shtml diff --git a/defense-evasion/self-deletion.md b/defense-evasion/self-deletion.md index 1c167c8..d32ab76 100644 --- a/defense-evasion/self-deletion.md +++ b/defense-evasion/self-deletion.md @@ -12,7 +12,7 @@ Indicator Removal on Host: Uninstall Malicious Application (T1630.001), Indicator Removal on Host: File Deletion (T1070.004) Version -2.0 +2.1 Created @@ -20,7 +20,7 @@ Last Modified -21 November 2022 +6 June 2023 @@ -48,6 +48,7 @@ See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630 |[**Terminator**](../xample-malware/terminator.md)|2013|F0007.001|The RAT evades sandboxes by terminating and removing itself (DW20.exe) after installation. [[1]](#1)| |[**CozyCar**](../xample-malware/cozycar.md)|2010|--|CozyCar has a dll file that serves as a cleanup mechanism for its dropped binary. [[2]](#2)| |[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|The malware will monitor if a specific file gets deleted and then will delete itself. [[3]](#3)| +|[**WannaCry**](../xample-malware/wannacry.md)|2017|--|WannaCry looks for a DNS entry and if the entry exists, it terminates and deletes itself. [[4]](#4)| ## References @@ -57,3 +58,5 @@ See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630 [2] https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke [3] https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/ + +[4] https://www.mandiant.com/resources/blog/wannacry-malware-profile \ No newline at end of file diff --git a/discovery/file-and-directory-discovery.md b/discovery/file-and-directory-discovery.md index 7af0535..38d3e88 100644 --- a/discovery/file-and-directory-discovery.md +++ b/discovery/file-and-directory-discovery.md @@ -13,7 +13,7 @@ Version -2.0 +2.1 Created @@ -21,7 +21,7 @@ Last Modified -21 November 2022 +6 June 2022 @@ -61,6 +61,7 @@ Malware may enumerate files and directories or may search for specific files or |[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip gets a file size. [[6]](#6)| |[**Rombertik**](../xample-malware/rombertik.md)|2015|--|The malware gets the file version info. [[6]](#6)| |[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon gets a common file path. [[6]](#6)| +|[**ElectroRAT**](../xample-malware/electrorat.md)|2020|--|ElectroRat looks for wallets to steal cryptocurrency. [[7]](#7)| ## References @@ -76,3 +77,5 @@ Malware may enumerate files and directories or may search for specific files or [5] https://www.cyberark.com/resources/threat-research-blog/inside-matanbuchus-a-quirky-loader [6] capa v4.0, analyzed at MITRE on 10/12/2022 + +[7] https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/ \ No newline at end of file diff --git a/discovery/self-discovery.md b/discovery/self-discovery.md index d3a106a..75cc3fc 100644 --- a/discovery/self-discovery.md +++ b/discovery/self-discovery.md @@ -13,7 +13,7 @@ Version -2.0 +2.1 Created @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +3 June 2023 @@ -29,3 +29,26 @@ # Self Discovery Malware may gather information about itself, such as its filename or size on disk. + +# Methods + +|Name|ID|Description| +|---|---|---| +|**Use Hashquine**|B0038.001| Malware uses a hashquine (the file contains it's own hash) for use as an integrity check. [[1]](#1)| +|**Check Magic String**|B0038.002| Malware checks a static value (i.e., magic string or number) to verify integrity. [[2]](#2)| +|**Check Section Length**|B0038.003| Malware checks the length of a section to verify integrity. [[2]](#2)| + +## Use in Malware + +Name|Date|Method|Description| +|---|---|---|---| +|[**WannaCry**](../xample-malware/wannacry.md)|2017|--|WannaCry checks the size of the file it loads into memory. [[1]](#1)| +|[**WannaCry**](../xample-malware/wannacry.md)|2017|B0038.002|WannaCry checks a string, keylen and a magic number before decrypting a dll. [[2]](#2)| +|[**WannaCry**](../xample-malware/wannacry.md)|2017|B0038.003|WannaCry checks the data lengh of a section before decypting a dll. [[2]](#2)| + + +## References + +[1] https://github.com/Rogdham/gif-md5-hashquine + +[2] https://www.mandiant.com/resources/blog/wannacry-malware-profile \ No newline at end of file diff --git a/discovery/smtp-connection-discovery.md b/discovery/smtp-connection-discovery.md index 5f791eb..b1cb6d2 100644 --- a/discovery/smtp-connection-discovery.md +++ b/discovery/smtp-connection-discovery.md @@ -13,7 +13,7 @@ Version -2.0 +2.1 Created @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +3 June 2023 @@ -29,3 +29,13 @@ # SMTP Connection Discovery Malware may test whether an outgoing SMTP connection can be made from the system on which the malware instance is executing to some SMTP server, by sending a test SMTP transaction. + +## Use in Malware + +Name|Date|Method|Description| +|---|---|---|---| +|[**Snake**](../xample-malware/snake.md)|2004|--|Snake attempts to login to an attacker controlled SMTP server before sending information. [[1]](#1)| + +## References + +[1] https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware \ No newline at end of file diff --git a/execution/command-and-scripting-interpreter.md b/execution/command-and-scripting-interpreter.md index 09bb9e7..e26746f 100644 --- a/execution/command-and-scripting-interpreter.md +++ b/execution/command-and-scripting-interpreter.md @@ -59,7 +59,7 @@ See ATT&CK: **Command and Scripting Interpreter ([T1059](https://attack.mitre.or ## References -[1] https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy +[1] https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/poison-ivy [2] https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/ diff --git a/execution/execution-dependency.md b/execution/execution-dependency.md index eae5aae..c6184ab 100644 --- a/execution/execution-dependency.md +++ b/execution/execution-dependency.md @@ -13,7 +13,7 @@ Version -2.0 +2.1 Created @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +3 June 2023 @@ -29,3 +29,15 @@ # Execution Dependency Software may require certain run-time or library dependencies consistent with normal software development and deployment. For example, software may require the presence of a .NET or Java runtime or to be run by a webserver that supports PHP. Unlike in **Conditional Execution ([B0025](../execution/conditional-execution.md))**, this dependency is not because of an explicit check coded into the malware by the author. + + +## Use in Malware + +|Name|Date|Method|Description| +|---|---|---|---| +|[**Adwind jRAT**](../xample-malware/adwindjrat.md)|2019|--|Adwind jRAT uses standard Java commands to mask its behavior. [[1]](#1)| + + +## References + +[1] https://www.menlosecurity.com/blog/hiding-in-plain-sight-new-adwind-jrat-variant-uses-normal-java-commands-to-mask-its-behavior/ \ No newline at end of file diff --git a/execution/install-additional-program.md b/execution/install-additional-program.md index 343282c..d185328 100644 --- a/execution/install-additional-program.md +++ b/execution/install-additional-program.md @@ -13,7 +13,7 @@ Version -2.0 +2.1 Created @@ -21,7 +21,7 @@ Last Modified -01 May 2023 +6 June 2023 @@ -60,6 +60,7 @@ Droppers may be described as “single stage” or “two stage.” While the fo |[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|The malware contains an embedded PE file. [[19]](#19)| |[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut contains an embedded PE file. [[19]](#19)| |[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip contains an embedded PE file. [[19]](#19)| +|[**ElectroRAT**](../xample-malware/electrorat.md)|2020|--|ElectroRat looks for wallets to steal cryptocurrency. [[20]](#20)| ## References @@ -99,4 +100,6 @@ Droppers may be described as “single stage” or “two stage.” While the fo [18] https://us.norton.com/internetsecurity-emerging-threats-mazar-bot-malware-invades-and-erases-android-devices.html -[19] capa v4.0, analyzed at MITRE on 10/12/2022 \ No newline at end of file +[19] capa v4.0, analyzed at MITRE on 10/12/2022 + +[20] https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/ \ No newline at end of file diff --git a/execution/send-email.md b/execution/send-email.md index 85137a9..12cb7bb 100644 --- a/execution/send-email.md +++ b/execution/send-email.md @@ -43,7 +43,7 @@ This behavior is related to the **Phishing ([T1566](https://attack.mitre.org/tec ## References -[1] https://www.trustwave.com/Resources/SpiderLabs-Blog/Gamut-Spambot-Analysis/ +[1] https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/gamut-spambot-analysis/ [2] https://en.wikipedia.org/wiki/Bagle_(computer_worm) diff --git a/execution/system-services.md b/execution/system-services.md index 781622f..11bc68c 100644 --- a/execution/system-services.md +++ b/execution/system-services.md @@ -41,4 +41,4 @@ See ATT&CK: **System Services ([T1569](https://attack.mitre.org/techniques/T1569 ## References -[1] https://support.resolver.com/hc/en-ca/articles/207161116-Configure-Microsoft-Distributed-Transaction-Coordinator-MSDTC- \ No newline at end of file +[1] https://cyware.com/news/catb-ransomware-exploits-msdtc-service-to-steal-data-3bb46fc0 \ No newline at end of file diff --git a/execution/user-execution.md b/execution/user-execution.md index 15addfc..bbbca2f 100644 --- a/execution/user-execution.md +++ b/execution/user-execution.md @@ -52,7 +52,7 @@ See ATT&CK Technique: **User Execution ([T1204](https://attack.mitre.org/techniq [2] https://blogs.cisco.com/security/talos/rombertik -[3] https://www.mandiant.com/resources/hot-knives-through-butter-evading-file-based-sandboxes +[3] https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/pf/file/fireeye-hot-knives-through-butter.pdf [4] https://securitynews.sonicwall.com/xmlpost/revisiting-vobfus-worm-mar-8-2013/ diff --git a/exfiltration/automated-exfiltration.md b/exfiltration/automated-exfiltration.md index 6f335bf..ac094f8 100644 --- a/exfiltration/automated-exfiltration.md +++ b/exfiltration/automated-exfiltration.md @@ -13,7 +13,7 @@ Version -2.0 +2.1 Created @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +4 June 2023 @@ -37,3 +37,14 @@ See ATT&CK Technique: **Automated Exfiltration ([T1020](https://attack.mitre.org |Name|ID|Description| |---|---|---| |**Exfiltrate via File Hosting Service**|E1020.m01|Malware may exfiltrate files to a file hosting location.| + +## Use in Malware + +|Name|Date|Method|Description| +|---|---|---|---| +|[**Attor**](../xample-malware/attor.md)|2013|--|Attor has a file uploader plugin that automatically exfiltrates collected data and log files to a C2 server.[[1]](#1)| + + +## References + +[1] https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf \ No newline at end of file diff --git a/impact/compromise-data-integrity.md b/impact/compromise-data-integrity.md index 95824cf..2941bb6 100644 --- a/impact/compromise-data-integrity.md +++ b/impact/compromise-data-integrity.md @@ -17,7 +17,7 @@ Version -2.0 +2.1 Created @@ -25,7 +25,7 @@ Last Modified -4 May 2023 +3 June 2023 @@ -36,6 +36,15 @@ Data stored on the file system of a compromised system is manipulated to comprom The related **Data Manipulation: Stored Data Manipulation ([T1565.001](https://attack.mitre.org/techniques/T1565/001/))** ATT&CK sub-technique was defined subsequent to this MBC behavior. +## Use in Malware + +|Name|Date|Method|Description| +|---|---|---|---| +|[**DYEPACK**](../xample-malware/dyepack.md)|2015|--|DYEPACK alters records in databases used for SWIFT transactions. [[2]](#2)| + + ## References -[1] "TRISIS Malware: Analysis of Safety System Targeted Malware, version 1.20171213," Dragos, 13 Dec. 2017. [Online]. Available: https://www.dragos.com/wp-content/uploads/TRISIS-01.pdf. \ No newline at end of file +[1] "TRISIS Malware: Analysis of Safety System Targeted Malware, version 1.20171213," Dragos, 13 Dec. 2017. [Online]. Available: https://www.dragos.com/wp-content/uploads/TRISIS-01.pdf. + +[2] https://content.fireeye.com/apt/rpt-apt38 \ No newline at end of file diff --git a/impact/data-encrypted-for-impact.md b/impact/data-encrypted-for-impact.md index 0f33219..2eafc13 100644 --- a/impact/data-encrypted-for-impact.md +++ b/impact/data-encrypted-for-impact.md @@ -17,7 +17,7 @@ Version -2.0 +2.1 Created @@ -25,7 +25,7 @@ Last Modified -21 November 2022 +6 June 2023 @@ -51,6 +51,7 @@ See ATT&CK: **Data Encrypted for Impact ([T1486](https://attack.mitre.org/techni |[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Locky Bart encrypts files for ransom without any connection to the Internet. [[3]](#3)| |[**SamSam**](../xample-malware/samsam.md)|2015|--|SamSam encrypts data to hold for ransom. [[4]](#4)| |[**Netwalker**](../xample-malware/netwalker.md)|2020|--|Netwalker encrypts files for ransom. [[5]](#5)| +|[**WannaCry**](../xample-malware/wannacry.md)|2017|B0025|WannaCry encrypts files for ransom. [[6]](#6)| ## References @@ -65,3 +66,5 @@ See ATT&CK: **Data Encrypted for Impact ([T1486](https://attack.mitre.org/techni [5] https://www.trendmicro.com/en_us/research/20/e/netwalker-fileless-ransomware-injected-via-reflective-loading.html +[6] https://www.mandiant.com/resources/blog/wannacry-malware-profile + diff --git a/impact/generate-traffic-from-victim.md b/impact/generate-traffic-from-victim.md index eec33a8..dd01416 100644 --- a/impact/generate-traffic-from-victim.md +++ b/impact/generate-traffic-from-victim.md @@ -52,7 +52,7 @@ Malware may generate traffic from the victim system such as clicks of advertisin ## References -[1] https://www.itworld.com/article/2734253/security/behind-the--massive--malware-ad-revenue-fraud-case.html +[1] https://www.huffingtonpost.com/2011/11/09/click-hijack-hackers-online-ad-scam_n_1084497.html [2] https://www.fipp.com/news/insightnews/what-are-the-nine-types-of-digital-ad-fraud @@ -61,5 +61,3 @@ Malware may generate traffic from the victim system such as clicks of advertisin [4] https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/ [5] https://blog.malwarebytes.com/threat-analysis/2016/07/untangling-kovter/ - -[6] https://www.huffingtonpost.com/2011/11/09/click-hijack-hackers-online-ad-scam_n_1084497.html diff --git a/impact/modify-hardware.md b/impact/modify-hardware.md index 94406be..093904b 100644 --- a/impact/modify-hardware.md +++ b/impact/modify-hardware.md @@ -17,7 +17,7 @@ Version -2.0 +2.1 Created @@ -25,7 +25,7 @@ Last Modified -31 October 2022 +6 June 2023 @@ -40,4 +40,14 @@ Malware modifies hardware. |---|---|---| |**CDROM**|B0042.001|The CD-ROM is modified.| |**Mouse**|B0042.002|The mouse is modified.| -|**Printer**|B0042.003|The printer is modified.| \ No newline at end of file +|**Printer**|B0042.003|The printer is modified.| + +## Use in Malware + +Name|Date|Method|Description| +|---|---|---|---| +|[**BadUSB**](../xample-malware/badusb.md)|2014|--| BadUSB can modify USB drives. [[1]](#1)| + +## References + +[1] https://www.bleepingcomputer.com/news/security/fbi-hackers-use-badusb-to-target-defense-firms-with-ransomware/ \ No newline at end of file diff --git a/impact/remote-access.md b/impact/remote-access.md index 2eb84ad..c915fce 100644 --- a/impact/remote-access.md +++ b/impact/remote-access.md @@ -57,7 +57,7 @@ Note that the **Ingress Tool Transfer ([T1105](https://attack.mitre.org/techniqu [1] https://en.wikipedia.org/wiki/Remote_access_trojan -[2] https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy +[2] https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/poison-ivy [3] https://en.wikipedia.org/wiki/DarkComet diff --git a/lateral-movement/supply-chain-compromise.md b/lateral-movement/supply-chain-compromise.md index 4ec26a2..e6db6d5 100644 --- a/lateral-movement/supply-chain-compromise.md +++ b/lateral-movement/supply-chain-compromise.md @@ -50,5 +50,5 @@ The supply chain may be compromised to enable initial malware infection. MBC obj [1] https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/ -[2] https://eclypsium.com/wp-content/uploads/2020/12/TrickBot-Now-Offers-TrickBoot-Persist-Brick-Profit.pdf +[2] diff --git a/micro-behaviors/operating-system/registry.md b/micro-behaviors/operating-system/registry.md index 1554647..360dbfe 100644 --- a/micro-behaviors/operating-system/registry.md +++ b/micro-behaviors/operating-system/registry.md @@ -13,7 +13,7 @@ Version -2.0 +2.1 Created @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +24 May 2023 diff --git a/persistence/README.md b/persistence/README.md index c56fb45..e7899d7 100644 --- a/persistence/README.md +++ b/persistence/README.md @@ -20,7 +20,7 @@ Behaviors that enable malware to remain on a system regardless of system events, * **Bootkit** [F0013](../defense-evasion/bootkit.md) * **Component Firmware** [F0009](../persistence/component-firmware.md) * **Hide Artifacts** [E1564](../defense-evasion/hide-artifacts.md) -* **Hidden Files and Directories** [F0005](../defense-evasion/hidden-files-and-directories.md) This method is related to Unprotect technique U1230. +* **Hidden Files and Directories** [F0005](../defense-evasion/hidden-files-and-directories.md) * **Hijack Execution Flow** [E1574](../defense-evasion/hijack-execution-flow.md) * **Install Insecure or Malicious Configuration** [B0047](../defense-evasion/install-insecure-or-malicious-configuration.md) * **Kernel Modules and Extensions** [F0010](../persistence/kernel-modules-and-extensions.md) diff --git a/persistence/component-firmware.md b/persistence/component-firmware.md index 931ea21..6a0c18f 100644 --- a/persistence/component-firmware.md +++ b/persistence/component-firmware.md @@ -46,16 +46,10 @@ See ATT&CK: **Pre-OS Boot: Component Firmware ([T1542.002](https://attack.mitre. |Name|Date|Method|Description| |---|---|---|---| -|[**SYNful Knock**](../xample-malware/synful-knock.md)|2015|F0009.001|SYNful Knock is a stealthy modification of the router's firmware image that can be used to maintain persistence within a victim's network. [[2]](#2)| +|[**SYNful Knock**](../xample-malware/synful-knock.md)|2015|F0009.001|SYNful Knock is a stealthy modification of the router's firmware image that can be used to maintain persistence within a victim's network. [[1]](#1)| ## References -[1] https://www.scmagazine.com/home/opinions/are-synful-knock-style-router-attacks-set-to-become-the-new-normal/ - -[2] https://www.fireeye.com/blog/threat-research/2015/09/synful_knock_-_acis.html - -[3] https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/ - -[4] https://www.mandiant.com/resources/synful-knock-acis +[1] https://www.mandiant.com/resources/synful-knock-acis diff --git a/persistence/kernel-modules-and-extensions.md b/persistence/kernel-modules-and-extensions.md index 65a2e64..ba730a4 100644 --- a/persistence/kernel-modules-and-extensions.md +++ b/persistence/kernel-modules-and-extensions.md @@ -13,7 +13,7 @@ Version -2.0 +2.1 Created @@ -21,7 +21,7 @@ Last Modified -31 October 2022 +3 June 2023 @@ -37,3 +37,14 @@ See ATT&CK: **Boot or Logon Autostart Execution: Kernel Modules and Extensions ( |Name|ID|Description| |---|---|---| |**Device Driver**|F0010.001|Allows kernel to access hardware connected to the system.| + + +# Use in Malware + +|Name|Date|Method|Description| +|---|---|---|---| +|[**Drovorub**](../xample-malware/drovorub.md)|2020|--|Drovorub uses a kernel module rootkit for loading and for persistence. [[1]](#1)| + +## References + +[1] https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF \ No newline at end of file diff --git a/persistence/modify-existing-service.md b/persistence/modify-existing-service.md index bba5ad8..0aac670 100644 --- a/persistence/modify-existing-service.md +++ b/persistence/modify-existing-service.md @@ -45,7 +45,7 @@ See ATT&CK: **Create or Modify System Process::Windows Service ([T1543.003](http ## References -[1] https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy +[1] https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/poison-ivy [2] https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/ diff --git a/persistence/registry-run-keys-startup-folder.md b/persistence/registry-run-keys-startup-folder.md index b41c668..2a367cd 100644 --- a/persistence/registry-run-keys-startup-folder.md +++ b/persistence/registry-run-keys-startup-folder.md @@ -13,7 +13,7 @@ Version -2.0 +2.1 Created @@ -21,7 +21,7 @@ Last Modified -19 May 2023 +6 June 2023 @@ -53,13 +53,14 @@ See ATT&CK: **Boot or Logon Autostart Execution: Registry Run Keys / Startup Fol |[**Bagle**](../xample-malware/bagle.md)|2004|--|Bagle adds registry keys to enable its automatic execution at every system startup. [[14]](#14)| |[**Vobfus**](../xample-malware/vobfus.md)|2016|--|Malware adds registry keys to enable startup after reboot. [[15]](#15)| |[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip persists via a Run registry key. [[17]](#17)| +|[**WannaCry**](../xample-malware/wannacry.md)|2017|--|WannaCry creates two registry run keys to ensure persistence. [[18]](#18)| ## References [1] https://threatvector.cylance.com/en_us/home/windows-registry-persistence-part-2-the-run-keys-and-search-order.html -[2] https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy +[2] https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/poison-ivy [3] https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/HUPIGON @@ -90,3 +91,5 @@ See ATT&CK: **Boot or Logon Autostart Execution: Registry Run Keys / Startup Fol [16] https://www.trendmicro.com/en_us/research/18/k/trickbot-shows-off-new-trick-password-grabber-module.html [17] capa v4.0, analyzed at MITRE on 10/12/2022 + +[18] https://www.mandiant.com/resources/blog/wannacry-malware-profile \ No newline at end of file diff --git a/xample-malware/README.md b/xample-malware/README.md index 753630e..5aec04d 100644 --- a/xample-malware/README.md +++ b/xample-malware/README.md @@ -10,44 +10,52 @@ The MBC malware corpus comprises a variety of malware where each entry is decomp Please see [Poison-Ivy X0014](../xample-malware/poison-ivy.md) and [Kovter X0009](../xample-malware/kovter.md) for examples of malware entries included and *not* included in ATT&CK's collection, respectively. +* **Adwind jRAT** [X0048](../xample-malware/adwindjrat.md) +* **Attor** [X0049](../xample-malware/attor.md) +* **BadUSB** [X0046](../xample-malware/badusb.md) * **Bagle** [X0001](../xample-malware/bagle.md) * **Black Energy** [X0002](../xample-malware/blackenergy.md) -* **Chopstick** [X0003](../xample-malware/chopstick.md) -* **Clipminer** [X0004](../xample-malware/clipminer.md) -* **Conficker** [X0005](../xample-malware/conficker.md) -* **CozyCar** [X0006](../xample-malware/cozycar.md) -* **CryptoLocker** [X0007](../xample-malware/cryptolocker.md) -* **CryptoWall** [X0008](../xample-malware/cryptowall.md) -* **Dark Comet** [X0009](../xample-malware/dark-comet.md) -* **DNSChanger** [X0010](../xample-malware/dnschanger.md) -* **Emotet** [X0011](../xample-malware/emotet.md) -* **EvilBunny** [X0012](../xample-malware/evilbunny.md) -* **Gamut** [X0013](../xample-malware/gamut.md) -* **Geneio** [X0014](../xample-malware/geneio.md) -* **GoBotKR** [X0015](../xample-malware/gobotkr.md) -* **GravityRAT** [X0016](../xample-malware/gravity-rat.md) -* **Heriplor** [X0017](../xample-malware/heriplor.md) -* **Hupigon** [X0018](../xample-malware/hupigon.md) -* **Kovter** [X0019](../xample-malware/kovter.md) -* **Kraken** [X0020](../xample-malware/kraken.md) -* **Locky Bart** [X0021](../xample-malware/locky-bart.md) -* **Matanbuchus** [X0022](../xample-malware/matanbuchus.md) -* **Mazarbot** [X0023](../xample-malware/mazarbot.md) -* **Mebromi** [X0024](../xample-malware/mebromi.md) -* **Netwalker** [X0025](../xample-malware/netwalker.md) -* **Poison-Ivy** [X0026](../xample-malware/poison-ivy.md) -* **Redhip** [X0027](../xample-malware/rebhip.md) -* **Rombertik** [X0028](../xample-malware/rombertik.md) -* **SamSam** [X0029](../xample-malware/samsam.md) -* **SearchAwesome** [X0030](../xample-malware/searchawesome.md) -* **Shamoon** [X0031](../xample-malware/shamoon.md) -* **Stuxnet** [X0032](../xample-malware/stuxnet.md) -* **SYNful Knock** [X0033](../xample-malware/synful-knock.md) -* **Teardrop** [X0034](../xample-malware/teardrop.md) -* **Terminator** [X0035](../xample-malware/terminator.md) -* **TrickBot** [X0036](../xample-malware/trickbot.md) -* **UP007** [X0037](../xample-malware/up007.md) -* **Ursnif** [X0038](../xample-malware/ursnif.md) +* **Chopstick** [X0035](../xample-malware/chopstick.md) +* **Clipminer** [X0038](../xample-malware/clipminer.md) +* **Conficker** [X0003](../xample-malware/conficker.md) +* **CozyCar** [X0034](../xample-malware/cozycar.md) +* **CryptoLocker** [X0030](../xample-malware/cryptolocker.md) +* **CryptoWall** [X0029](../xample-malware/cryptowall.md) +* **Dark Comet** [X0004](../xample-malware/dark-comet.md) +* **DNSChanger** [X0005](../xample-malware/dnschanger.md) +* **Drovorub** [X0045](../xample-malware/drovorub.md) +* **DYEPACK** [X0042](../xample-malware/dyepack.md) +* **ElectroRAT** [X0044](../xample-malware/electrorat.md) +* **Emotet** [X0028](../xample-malware/emotet.md) +* **EvilBunny** [X0036](../xample-malware/evilbunny.md) +* **Gamut** [X0006](../xample-malware/gamut.md) +* **Geneio** [X0007](../xample-malware/geneio.md) +* **GoBotKR** [X0027](../xample-malware/gobotkr.md) +* **GravityRAT** [X0032](../xample-malware/gravity-rat.md) +* **Heriplor** [X0026](../xample-malware/heriplor.md) +* **Hupigon** [X0008](../xample-malware/hupigon.md) +* **Kovter** [X0009](../xample-malware/kovter.md) +* **Kraken** [X0010](../xample-malware/kraken.md) +* **Locky Bart** [X0011](../xample-malware/locky-bart.md) +* **Matanbuchus** [X0040](../xample-malware/matanbuchus.md) +* **Mazarbot** [X0012](../xample-malware/mazarbot.md) +* **Mebromi** [X0013](../xample-malware/mebromi.md) +* **Netwalker** [X0037](../xample-malware/netwalker.md) +* **Poison-Ivy** [X0014](../xample-malware/poison-ivy.md) +* **Redhip** [X0015](../xample-malware/redhip.md) +* **Rombertik** [X0031](../xample-malware/rombertik.md) +* **SamSam** [X0016](../xample-malware/samsam.md) +* **SearchAwesome** [X0017](../xample-malware/searchawesome.md) +* **Shamoon** [X0018](../xample-malware/shamoon.md) +* **Snake** [X0047](../xample-malware/snake.md) +* **Stuxnet** [X0019](../xample-malware/stuxnet.md) +* **SYNful Knock** [X0020](../xample-malware/synful-knock.md) +* **TEARDROP** [X0041](../xample-malware/teardrop.md) +* **Terminator** [X0021](../xample-malware/terminator.md) +* **TrickBot** [X0025](../xample-malware/trickbot.md) +* **UP007** [X0033](../xample-malware/up007.md) +* **Ursnif** [X0022](../xample-malware/ursnif.md) * **Vobfus** [X0039](../xample-malware/vobfus.md) -* **WebCobra** [X0040](../xample-malware/webcobra.md) -* **YiSpecter** [X0041](../xample-malware/yispecter.md) +* **WannaCry** [X0043](../xample-malware/wannacry.md) +* **WebCobra** [X0023](../xample-malware/webcobra.md) +* **YiSpecter** [X0024](../xample-malware/yispecter.md) diff --git a/xample-malware/adwind-jrat.md b/xample-malware/adwind-jrat.md new file mode 100644 index 0000000..0cac6fd --- /dev/null +++ b/xample-malware/adwind-jrat.md @@ -0,0 +1,41 @@ + + + + + + + + + + + + + + + + + + + + + +
IDX0048
AliasesNone
PlatformsWindows, Linus, macOS
Year2019
Associated ATT&CK SoftwarejRAT
+ +# Adwind jRAT + +Adwind jRAT is a remote access Trojan that uses Java to take control and collect data from a user's machine. [[1]](#1) + +## ATT&CK Techniques + +See ATT&CK: [jRAT - Techniques Used](https://attack.mitre.org/software/S0283/). + +## MBC Behaviors + +|Name|Use| +|---|---| +|[Execution::Execution Dependency (B0044)](../execution/execution-dependency.md)|Adwind jRAT uses standard Java commands to mask its behavior. [[1]](#1)| + + +## References + +[1] https://www.menlosecurity.com/blog/hiding-in-plain-sight-new-adwind-jrat-variant-uses-normal-java-commands-to-mask-its-behavior/ \ No newline at end of file diff --git a/xample-malware/attor.md b/xample-malware/attor.md new file mode 100644 index 0000000..fa09f55 --- /dev/null +++ b/xample-malware/attor.md @@ -0,0 +1,52 @@ + + + + + + + + + + + + + + + + + + + + + +
IDX0049
AliasesNone
PlatformsX0042
Year2013
Associated ATT&CK SoftwareAttor
+ +# Attor + +Attor is a Windows-based espionage platform used in targeted attacks since 2013. Attor has a loadable plugin architecture to customize functionality for specific targets. [[1]](#1) + +## ATT&CK Techniques + +See ATT&CK: [Attor - Techniques Used](https://attack.mitre.org/software/S0438/). + + +## Enhanced ATT&CK Techniques + +|Name|Use| +|---|---| +|[Exfiltration::Automated Exfiltration (E1020)](../exfiltration/automated-exfiltration.md) | Attor has a file uploader plugin that automatically exfiltrates collected data and log files to a C2 server [[1]](#1)| + + +## Indicators of Compromise + +SHA1 Hashes +- 47dc997d08d53e55b8450940d9de94e2b5db631e +- 52213cab4954c850a1ac51974a24b878ca88eb59 +- 8a6829b8615c5f6661a84ea3af0e15ab28c5840c +- d0528b8777d556809ac64935fa6247164aaabb4f +- f7e30a3fa186361794699d7a4fac6a9b85ccbf40 + + +## References + +[1] https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf \ No newline at end of file diff --git a/xample-malware/badusb.md b/xample-malware/badusb.md new file mode 100644 index 0000000..0bb87de --- /dev/null +++ b/xample-malware/badusb.md @@ -0,0 +1,66 @@ + + + + + + + + + + + + + + + + + + + + + +
IDX0046
AliasesNone
PlatformsWindows
Year2014
Associated ATT&CK SoftwareNone
+ + +# BadUSB + +BadUSB is an attack that exploits an inherent vulnerability in USB firmware. Such an attack reprograms a USB device, causing it to act as a human interface device; once re-engineered, the USB device is used to discreetly execute commands or run malicious programs on the victim's computer. [[1]](#1) + +## ATT&CK Techniques + +|Name|Use| +|---|---| +[Command and Control::Communication Through Removable Media (T1092)](https://attack.mitre.org/techniques/T1092/) | A USB interface is able to connect to many different devices, including cameras, keyboards, modems, webcams, wireless networking devices, and others. BadUSB leverages these devices. [[1]](#1) | +|[Initial Access :: Replication Through Removable Media (T1091)](https://attack.mitre.org/techniques/T1091/)| BadUSB can be used as a means of gaining initial access to a target machine by exploiting vulnerabilities in the USB firmware or by tricking the user into plugging in an infected USB device. [[1]](#1) | +|[Collection::Data from Local System (T1005)](https://attack.mitre.org/techniques/T1005/) | BadUSB can steal sensitive data from an infected machine (e.g., login credentials) and transmit it to a remote C2 server. [[3]](#3) | + + +## MBC Behaviors + +|Name|Use| +|---|---| +|[Impact::Modify Hardware (B0042)](../impact/modify-hardware.md) | BadUSB can modify USB drives. [[4]](#4)| + + +## Indicators of Compromise + +MD5 Hashes +- 0022c1fe1d6b036de2a08d50ac5446a5 +- 0155738045b331f44d300f4a7d08cf21 +- 0275585c3b871405dd299d458724db3d + + +## References + +[1] https://www.manageengine.com/data-security/security-threats/bad-usb.html + +[2] https://arstechnica.com/information-technology/2014/07/this-thumbdrive-hacks-computers-badusb-exploit-makes-devices-turn-evil/ + +[3] https://radetskiy.files.wordpress.com/2014/08/srlabs-badusb-blackhat-v1.pdf + +[4] https://www.bleepingcomputer.com/news/security/fbi-hackers-use-badusb-to-target-defense-firms-with-ransomware/ + +[5] https://www.darkreading.com/endpoint/when-good-usb-devices-go-bad + +[6] https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf + diff --git a/xample-malware/chopstick.md b/xample-malware/chopstick.md index 07e4599..fabb889 100644 --- a/xample-malware/chopstick.md +++ b/xample-malware/chopstick.md @@ -2,7 +2,7 @@ - + diff --git a/xample-malware/clipminer.md b/xample-malware/clipminer.md index c32e3dd..3a8debd 100644 --- a/xample-malware/clipminer.md +++ b/xample-malware/clipminer.md @@ -2,7 +2,7 @@
IDX0003X0035
Aliases
- + diff --git a/xample-malware/conficker.md b/xample-malware/conficker.md index b8f7605..30227bc 100644 --- a/xample-malware/conficker.md +++ b/xample-malware/conficker.md @@ -2,7 +2,7 @@
IDX0004X0038
Aliases
- + diff --git a/xample-malware/cozycar.md b/xample-malware/cozycar.md index ebb0565..56493b4 100644 --- a/xample-malware/cozycar.md +++ b/xample-malware/cozycar.md @@ -2,7 +2,7 @@
IDX0005X0003
Aliases
- + diff --git a/xample-malware/cryptolocker.md b/xample-malware/cryptolocker.md index b272995..6fe026b 100644 --- a/xample-malware/cryptolocker.md +++ b/xample-malware/cryptolocker.md @@ -1,7 +1,7 @@
IDX0006X0034
Aliases
- + diff --git a/xample-malware/cryptowall.md b/xample-malware/cryptowall.md index ce38db5..c3a88a6 100644 --- a/xample-malware/cryptowall.md +++ b/xample-malware/cryptowall.md @@ -2,7 +2,7 @@
IDX0007X0030
Aliases
- + diff --git a/xample-malware/dark-comet.md b/xample-malware/dark-comet.md index a19f535..4e66aab 100644 --- a/xample-malware/dark-comet.md +++ b/xample-malware/dark-comet.md @@ -1,7 +1,7 @@
IDX0008X0029
Aliases
- + diff --git a/xample-malware/dnschanger.md b/xample-malware/dnschanger.md index f15160e..2c2fade 100644 --- a/xample-malware/dnschanger.md +++ b/xample-malware/dnschanger.md @@ -1,7 +1,7 @@
IDX0009X0004
Aliases
- + diff --git a/xample-malware/drovorub.md b/xample-malware/drovorub.md new file mode 100644 index 0000000..2c3da21 --- /dev/null +++ b/xample-malware/drovorub.md @@ -0,0 +1,51 @@ +
IDX0010X0005
Aliases
+ + + + + + + + + + + + + + + + + + + + +
IDX0045
AliasesNone
PlatformsWindows
Year2020
Associated ATT&CK SoftwareDrovorub
+ +# Drovorub + +Drovorub is a Linux malware toolset consisting of an implant coupled with a kernel module rootkit, a file transfer and port forwarding tool, and a Command and Control (C2) server. [[1]](#1) + +## ATT&CK Techniques + +See ATT&CK: [Drovorub - Techniques Used](https://attack.mitre.org/software/S0502/). + + +## Enhanced ATT&CK Techniques + +|Name|Use| +|---|---| +|[Persistence::Kernel Modules and Extensions (F0010)](../persistence/kernel-modules-and-extensions.md) | Drovorub uses a kernel module rootkit for loading and persistence. [[1]](#1)| + + +## Indicators of Compromise + +SHA256 Hashes +- 92610f217e86134c695dfd11d4a81feb4f4760ef05d57407d33a7c09dfe071da +- 53dede6856e46a2fbda8cb415ac96de18e751c3bf5749e596a6d844c2c9cb707 +- 1c0d14b530632307329de7bfb3546a91f6ebfd0256664c33a92f2b6e8ad88626 +- 17bf00b67487164d1822ea48f36d62bf6f4ff9b2388cab2c0757644fdf30e5bd + + +## References + +[1] https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF \ No newline at end of file diff --git a/xample-malware/dyepack.md b/xample-malware/dyepack.md new file mode 100644 index 0000000..6b5b110 --- /dev/null +++ b/xample-malware/dyepack.md @@ -0,0 +1,36 @@ + + + + + + + + + + + + + + + + + + + + + +
IDX0042
AliasesNone
PlatformsWindows, Linux
Year2015
Associated ATT&CK SoftwareNone
+ +# DYEPACK + +DYEPACK is a malware suite that manipulates local information regarding SWIFT transaction activity. [[1]](#1) + +## MBC Behaviors + +|Name|Use| +|---|---| +|[Impact::Compromise Data Integrity (B0016)](../impact/compromise-data-integrity.md) | DYEPACK alters records in databases used for SWIFT transactions. [[1]](#1)| + +## References + +[1] https://content.fireeye.com/apt/rpt-apt38 \ No newline at end of file diff --git a/xample-malware/electrorat.md b/xample-malware/electrorat.md new file mode 100644 index 0000000..5019f44 --- /dev/null +++ b/xample-malware/electrorat.md @@ -0,0 +1,79 @@ + + + + + + + + + + + + + + + + + + + + + +
IDX0044
AliasesNone
PlatformsWindows, Linux, macOS
Year2020
Associated ATT&CK SoftwareNone
+ +# ElectroRAT + +ElectroRAT is used to steal cryptocurrency from wallets. + +## ATT&CK Techniques + +|Name|Use| +|---|---| +|[Execution::User execution (T1240)](https://attack.mitre.org/techniques/T1204/) | ElectroRat makes the user execute the malware. [[1]](#1)| +|[Command and Control::Web Service (T1102)](https://attack.mitre.org/techniques/T1102) | EletroRat uses HTTP for C&C and exfiltration. [[1]](#1)| +|[Execution::Command and Scripting Interpreter (T1059)](https://attack.mitre.org/techniques/T1059) | ElectroRat uses Python to embed additional binares. [[1]](#1)| +|[Discovery::System Information Discovery (T1082)](https://attack.mitre.org/techniques/T1082) | ElectroRat detects the OS to determine which plugins to download. [[1]](#1)| +|[Persistence::Boot or Logon Autostart Execution (T1547)](https://attack.mitre.org/techniques/T1547/) | ElectroRat enables auto start on bootup. [[1]](#1)| + +## Enhanced ATT&CK Techniques + +|Name|Use| +|---|---| +|[Collection::Input Capture (E1056)](../collection/input-capture.md) | ElectroRat monitors keyboard and mouse activity to determine whether the machine is in use. [[1]](#1)| +|[Discovery::File and Directory Discovery (E1083)](../discovery/file-and-directory-discovery.md) | ElectroRat looks for wallets to steal cryptocurrency [[1]](#1)| + +## MBC Behaviors + +|Name|Use| +|---|---| +|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md) | Upon execution, ElectroRat downloads additional executables. [[1]](#1)| +|[Collection::Cryptocurrency (B0028)](../impact/clipboard-modification.md) | ElectroRat examines the disk for cryptocurrency addresses and keys to steal money from a wallet. It compromises multiple currencies, including Monaro, Doegecoin, Ethereum, Litecoin, and Bitcoin. [[1]](#1)| +|[Command and Control::C2 Communication (B0030)](../command-and-control/c2-communication.md) | ElectroRat communicates to a Pastebin site via HTTP. [[1]](#1)| + +## Indicators of Compromise + +Command-and-Control Servers +- 193.38.55.131 +- 193.38.55.4 +- 213.226.100.140 +- kintum.io +- daopoker.com +- jamm.to +- pastebin.com/raw/r12wBrC7 +- pastebin.com/raw/DF8Gikrk +- pastebin.com/raw/bfQiiqyv +- pastebin.com/raw/UbTZx6kd +- pastebin.com/raw/U45SvK4K +- pastebin.com/raw/zrZA4L3e + +SHA256 Hashes +- 170cb5ea1a6b4af3c27358ba267a1309ed5118481619fc874f717262cb91fb77 +- 881be95a9632fa44deeeca23e4e19390d600ad817b2f66671d3f21453a16c7b7 +- e9b83d5cdefd4486b32a927d7505cdeebb43e6977759ba069d9373e46ca7d0f2 +- e547872761d81c3afc9c2a42cac3931e2a1defc2c56a0a3c57b28ea91e7686cd +- 17b0b1a9271683f30e5bfd92eec9c0a917755f54060ef40d9bd0f12e927f540f +- 5c884be3635eb55ce02e141d6fb07f760b6dbcace54f2217c69f287292ce59f6 + +## References + +[1] https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/ diff --git a/xample-malware/emotet.md b/xample-malware/emotet.md index be34dc0..cb34c7d 100644 --- a/xample-malware/emotet.md +++ b/xample-malware/emotet.md @@ -1,7 +1,7 @@ - + diff --git a/xample-malware/evilbunny.md b/xample-malware/evilbunny.md index 37efd52..4ccb774 100644 --- a/xample-malware/evilbunny.md +++ b/xample-malware/evilbunny.md @@ -2,7 +2,7 @@
IDX0011X0028
Aliases
- + diff --git a/xample-malware/gamut.md b/xample-malware/gamut.md index 5ff5282..d021716 100644 --- a/xample-malware/gamut.md +++ b/xample-malware/gamut.md @@ -1,7 +1,7 @@
IDX0012X0036
Aliases
- + diff --git a/xample-malware/geneio.md b/xample-malware/geneio.md index 34def69..de66a13 100644 --- a/xample-malware/geneio.md +++ b/xample-malware/geneio.md @@ -2,7 +2,7 @@
IDX0013X0006
Aliases
- + diff --git a/xample-malware/gobotkr.md b/xample-malware/gobotkr.md index 8a7bbc2..f38cbb8 100644 --- a/xample-malware/gobotkr.md +++ b/xample-malware/gobotkr.md @@ -1,7 +1,7 @@
IDX0014X0007
Aliases
- + diff --git a/xample-malware/gravity-rat.md b/xample-malware/gravity-rat.md index c26cb25..f0ab737 100644 --- a/xample-malware/gravity-rat.md +++ b/xample-malware/gravity-rat.md @@ -1,7 +1,7 @@
IDX0015X0027
Aliases
- + diff --git a/xample-malware/heriplor.md b/xample-malware/heriplor.md index 86315a6..85fcd5a 100644 --- a/xample-malware/heriplor.md +++ b/xample-malware/heriplor.md @@ -1,7 +1,7 @@
IDX0016X0032
Aliases
- + diff --git a/xample-malware/hupigon.md b/xample-malware/hupigon.md index 1e4ab83..733e246 100644 --- a/xample-malware/hupigon.md +++ b/xample-malware/hupigon.md @@ -1,7 +1,7 @@
IDX0017X0026
Aliases
- + diff --git a/xample-malware/kovter.md b/xample-malware/kovter.md index 9c46d58..0b19616 100644 --- a/xample-malware/kovter.md +++ b/xample-malware/kovter.md @@ -1,7 +1,7 @@
IDX0018X0008
Aliases
- + diff --git a/xample-malware/kraken.md b/xample-malware/kraken.md index 8cb697f..b4aa87a 100644 --- a/xample-malware/kraken.md +++ b/xample-malware/kraken.md @@ -1,7 +1,7 @@
IDX0019X0009
Aliases
- + diff --git a/xample-malware/locky-bart.md b/xample-malware/locky-bart.md index 043ed75..c8b128d 100644 --- a/xample-malware/locky-bart.md +++ b/xample-malware/locky-bart.md @@ -1,7 +1,7 @@
IDX0020X0010
Aliases
- + diff --git a/xample-malware/matanbuchus.md b/xample-malware/matanbuchus.md index f966096..1c2fea1 100644 --- a/xample-malware/matanbuchus.md +++ b/xample-malware/matanbuchus.md @@ -2,7 +2,7 @@
IDX0021X0011
Aliases
- + diff --git a/xample-malware/mazarbot.md b/xample-malware/mazarbot.md index 401398c..5571b07 100644 --- a/xample-malware/mazarbot.md +++ b/xample-malware/mazarbot.md @@ -2,7 +2,7 @@
IDX0022X0040
Aliases
- + diff --git a/xample-malware/mebromi.md b/xample-malware/mebromi.md index f6555b4..2d15434 100644 --- a/xample-malware/mebromi.md +++ b/xample-malware/mebromi.md @@ -1,7 +1,7 @@
IDX0023X0012
Aliases
- + diff --git a/xample-malware/netwalker.md b/xample-malware/netwalker.md index bd63484..8260f75 100644 --- a/xample-malware/netwalker.md +++ b/xample-malware/netwalker.md @@ -2,7 +2,7 @@
IDX0024X0013
Aliases
- + diff --git a/xample-malware/poison-ivy.md b/xample-malware/poison-ivy.md index 404b87c..27ea1a0 100644 --- a/xample-malware/poison-ivy.md +++ b/xample-malware/poison-ivy.md @@ -1,7 +1,7 @@
IDX0025X0037
Aliases
- + diff --git a/xample-malware/redhip.md b/xample-malware/redhip.md index 59defa9..ee04ae8 100644 --- a/xample-malware/redhip.md +++ b/xample-malware/redhip.md @@ -1,7 +1,7 @@
IDX0026X0014
Aliases
- + @@ -94,7 +94,7 @@ SHA256 Hashes ## References -[1] Atif Mushtaq, FireEye, "The Dead Giveaways of VM-Aware Malware," 27 January 2011. https://web.archive.org/web/20161025013916/https:/www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html +[1] https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html [2] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/xample-malware/rombertik.md b/xample-malware/rombertik.md index 13bba66..a0616a8 100644 --- a/xample-malware/rombertik.md +++ b/xample-malware/rombertik.md @@ -1,7 +1,7 @@
IDX0027X0015
Aliases
- + diff --git a/xample-malware/samsam.md b/xample-malware/samsam.md index 4fd11c8..9e3feac 100644 --- a/xample-malware/samsam.md +++ b/xample-malware/samsam.md @@ -1,7 +1,7 @@
IDX0028X0031
Aliases
- + diff --git a/xample-malware/searchawesome.md b/xample-malware/searchawesome.md index 7611748..c8acd08 100644 --- a/xample-malware/searchawesome.md +++ b/xample-malware/searchawesome.md @@ -2,7 +2,7 @@
IDX0029X0016
Aliases
- + diff --git a/xample-malware/shamoon.md b/xample-malware/shamoon.md index 9a8e03c..a90ecb9 100644 --- a/xample-malware/shamoon.md +++ b/xample-malware/shamoon.md @@ -1,7 +1,7 @@
IDX0030X0017
Aliases
- + diff --git a/xample-malware/snake.md b/xample-malware/snake.md new file mode 100644 index 0000000..25377c2 --- /dev/null +++ b/xample-malware/snake.md @@ -0,0 +1,37 @@ +
IDX0031X0018
Aliases
+ + + + + + + + + + + + + + + + + + + + +
IDX0047
AliasesNone
PlatformsWindows
Year2004
Associated ATT&CK SoftwareNone
+ + +# Snake + +The Snake malware is an information-stealing malware that is implemented in the .NET programming language. It has been in use since 2004 and is one of the most sophisticated cyber espionage tools designed and used by Russia's FSB for long-term intelligence collection. [[1]](#1) + +## MBC Behaviors + +|Name|Use| +|---|---| +|[Discovery::SMTP Connection Discovery (B0014)](../discovery/smtp-connection-discovery.md) | Snake attempts to login to an attacker controlled SMTP server before sending information. [[1]](#1)| + +## References + +[1] https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware \ No newline at end of file diff --git a/xample-malware/stuxnet.md b/xample-malware/stuxnet.md index eff2804..f892f32 100644 --- a/xample-malware/stuxnet.md +++ b/xample-malware/stuxnet.md @@ -1,7 +1,7 @@ - + @@ -57,7 +57,7 @@ See ATT&CK: [Stuxnet - Techniques Used](https://attack.mitre.org/software/S0603/ |Name|Use| |---|---| -|[Impact::Destroy Hardware (B0017)](../impact/destroy-hardware.md)|Stuxnet made the centrifuges at Iran's nuclear plant spin dangerously fast for 15 minutes, before returning to normal speed. About a month later, it slowed the centrifuges down for 50 minutes. This was repeated for several months, and over time the strain destroyed the machines. [[1]](#1) [[3]](#3)| +|[Impact::Destroy Hardware (B0017)](../impact/destroy-hardware.md)|Stuxnet made the centrifuges at Iran's nuclear plant spin dangerously fast for 15 minutes, before returning to normal speed. About a month later, it slowed the centrifuges down for 50 minutes. This was repeated for several months, and over time the strain destroyed the machines. [[1]](#1)| |[Micro-behaviors::Process::Create Mutex (C0042)](../micro-behaviors/process/create-mutex.md)|Malware creates global mutexes that signal rootkit installation has occurred successfully. [[1]](#1)| |[Micro-behaviors::Process::Create Process::Create Process via WMI (C0017.002)](../micro-behaviors/process/create-process.md)|Stuxnet will use WMI operations with the explorer.exe token in order to copy itself and execute on the remote share. [[1]](#1)| |[Execution::Conditional Execution::Host Fingerprint Check (B0025.004)](../execution/conditional-execution.md)|Stuxnet checks for specific operating systems on 32-bit machines, registry keys, and dates to profile a potential target machine before execution. If the conditions are not met to be considered a viable target, it will exit execution. [[1]](#1)| @@ -79,6 +79,4 @@ SHA256 Hashes [1] https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en -[2] capa v4.0, analyzed at MITRE on 10/12/2022 - -[3] https://www.bbc.com/timelines/zc6fbk7 \ No newline at end of file +[2] capa v4.0, analyzed at MITRE on 10/12/2022 \ No newline at end of file diff --git a/xample-malware/synful-knock.md b/xample-malware/synful-knock.md index 8fe10b1..778c5a4 100644 --- a/xample-malware/synful-knock.md +++ b/xample-malware/synful-knock.md @@ -2,7 +2,7 @@
IDX0032X0019
Aliases
- + diff --git a/xample-malware/teardrop.md b/xample-malware/teardrop.md index 69aaed7..4a7c2fb 100644 --- a/xample-malware/teardrop.md +++ b/xample-malware/teardrop.md @@ -2,7 +2,7 @@
IDX0033X0020
Aliases
- + @@ -25,14 +25,13 @@ # TEARDROP -TEARDROP is a memory-only loader that is associated with the Solarwinds supply chain compromise. +TEARDROP is a memory-only dropper associated with the SolarWinds supply chain compromise. ## ATT&CK Techniques See ATT&CK: [TEARDROP - Techniques Used](https://attack.mitre.org/software/S0560/). - ## Enhanced ATT&CK Techniques |Name|Use| @@ -40,8 +39,6 @@ See ATT&CK: [TEARDROP - Techniques Used](https://attack.mitre.org/software/S0560 |[Defense Evasion::Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05)](../defense-evasion/obfuscated-files-or-information.md)|Malware decrypts an embedded code buffer using an XOR-based stream cipher. [[1]](#1)| |[Command and Control::Ingress Tool Transfer (E1105)](../command-and-control/ingress-tool-transfer.md)|Malware executes the decrypted, embedded code buffer, which is a Cobalt Strike Remote Access Tool (RAT). [[1]](#1)| - - ## MBC Behaviors |Name|Use| @@ -49,9 +46,6 @@ See ATT&CK: [TEARDROP - Techniques Used](https://attack.mitre.org/software/S0560 |[Anti-Behavioral Analysis::Capture Evasion::Memory-only Payload (B0036.001)](../anti-behavioral-analysis/capture-evasion.md)|Malware loads its payload into memory. [[1]](#1)| -## Indicators of Compromise - - ## References [1] https://www.cisa.gov/uscert/ncas/analysis-reports/ar21-039b/ diff --git a/xample-malware/terminator.md b/xample-malware/terminator.md index d9f7273..990e481 100644 --- a/xample-malware/terminator.md +++ b/xample-malware/terminator.md @@ -2,7 +2,7 @@
IDX0034X0041
Aliases
- + @@ -60,6 +60,6 @@ SHA256 Hashes ## References -[1] https://www.mandiant.com/resources/hot-knives-through-butter-evading-file-based-sandboxes +[1] https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/pf/file/fireeye-hot-knives-through-butter.pdf [2] https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2013/FireEye-Terminator_RAT.pdf diff --git a/xample-malware/trickbot.md b/xample-malware/trickbot.md index 70262db..e36f867 100644 --- a/xample-malware/trickbot.md +++ b/xample-malware/trickbot.md @@ -1,7 +1,7 @@
IDX0035X0021
Aliases
- + @@ -95,7 +95,7 @@ Yara Rules [4] https://www.bitdefender.com/blog/labs/trickbot-is-dead-long-live-trickbot/ -[5] https://eclypsium.com/wp-content/uploads/2020/12/TrickBot-Now-Offers-TrickBoot-Persist-Brick-Profit.pdf +[5] https://eclypsium.com/wp-content/uploads/TrickBot-Now-Offers-TrickBoot-Persist-Brick-Profit.pdf [6] https://www.joesecurity.org/blog/498839998833561473 diff --git a/xample-malware/up007.md b/xample-malware/up007.md index 346ac8c..55fb578 100644 --- a/xample-malware/up007.md +++ b/xample-malware/up007.md @@ -1,7 +1,7 @@
IDX0036X0025
Aliases
- + diff --git a/xample-malware/ursnif.md b/xample-malware/ursnif.md index 575deba..2875dfb 100644 --- a/xample-malware/ursnif.md +++ b/xample-malware/ursnif.md @@ -1,7 +1,7 @@
IDX0037X0033
Aliases
- + diff --git a/xample-malware/wannacry.md b/xample-malware/wannacry.md new file mode 100644 index 0000000..518b71b --- /dev/null +++ b/xample-malware/wannacry.md @@ -0,0 +1,60 @@ +
IDX0038X0022
Aliases
+ + + + + + + + + + + + + + + + + + + + +
IDX0043
AliasesNone
PlatformsWindows
Year2017
Associated ATT&CK SoftwareWannaCry
+ +# WannaCry + +WannaCry is ransomware that was first seen in a global attack during May 2017, which affected more than 150 countries. It contains worm-like features to spread across a computer network using the SMBv1 exploit EternalBlue. [[1]](#1) + +## ATT&CK Techniques + +See ATT&CK: [WannaCry - Techniques Used](https://attack.mitre.org/software/S0366/). + +## Enhanced ATT&CK Techniques + +|Name|Use| +|---|---| +|[Defense Evasion:: Hidden Files and Directories(F0005.003)](../defense-evasion/hidden-files-and-directories.md) | WannaCry uses the +h attribute to hide its files. [[1]](#1)| +|[Persistence::Registry Run Keys / Startup Folder (F0012)](../persistence/registry-run-keys-startup-folder.md) | WannaCry creates two registry run keys to ensure persistence. [[1]](#1)| +|[Defense-Evasion::Self Deletion (F0007)](../defense-evasion/self-deletion.md) | WannaCry looks for a DNS entry and if the entry exists, it terminates and deletes itself. [[1]](#1)| + +## MBC Behaviors + +|Name|Use| +|---|---| +|[Discovery::Self Discovery (B0038)](../discovery/self-discovery.md) | WannaCry checks the size of the file it loads into memory. [[1]](#1)| +|[Discovery::Self Discovery (B0038.002)](../discovery/self-discovery.md) | WannaCry checks a string, keylen and a magic number before decrypting a dll. [[1]](#1)| +|[Discovery::Self Discovery (B0038.003)](../discovery/self-discovery.md) | WannaCry checks the data lengh of a section before decypting a dll. [[1]](#1)| +|[Impact::Data Encrypted for Impact (B0025)](../impact/data-encrypted-for-impact.md) | WannaCry encrypts files for ransom. [[1]](#1)| + + +## Indicators of Compromise + +MD5 Hashes +- db349b97c37d22f5ea1d1841e3c89eb4 +- 84c82835a5d21bbcf75a61706d8ab549 +- f351e1fcca0c4ea05fc44d15a17f8b36 +- 7bf2b57f2a205768755c07f238fb32cc + +## References + +[1] https://www.mandiant.com/resources/blog/wannacry-malware-profile \ No newline at end of file diff --git a/xample-malware/webcobra.md b/xample-malware/webcobra.md index 3e900ea..6d21249 100644 --- a/xample-malware/webcobra.md +++ b/xample-malware/webcobra.md @@ -2,7 +2,7 @@ - + diff --git a/xample-malware/yispecter.md b/xample-malware/yispecter.md index 36289f6..b689fc0 100644 --- a/xample-malware/yispecter.md +++ b/xample-malware/yispecter.md @@ -2,7 +2,7 @@
IDX0040X0023
Aliases
- +
IDX0041X0024
Aliases