mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
Updating Hashes to SHA256 + typo fixes
This commit is contained in:
ryan
@@ -67,7 +67,7 @@ Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|---|---|---|
|
||||
|[**Redhip**](../xample-malware/redhip.md)|January 2011|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFTICE. [[4]](#4)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|January 2011|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFTICE. [[4]](#4)|
|
||||
|[**Gamut**](../xample-malware/gamut.md)|2014|The malware detects debuggers using an INT 03h trap and IsDebuggerPresent[[8]](#8)|
|
||||
|[**Rombertik**](../xample-malware/rombertik.md)|2015|an anti-analysis function within the packer is called to check the username and filename of the executing process for strings like “malwar”, “sampl”, “viru”, and “sandb”. [[9]](#9)|
|
||||
|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|Poison Ivy Variant checks for breakpoints and exits immediately if found [[10]](#10)|
|
||||
|
||||
@@ -64,7 +64,7 @@ Malware Examples
|
||||
|---|---|---|
|
||||
|**Fake Adobe Flash Update OS X**|February 2016|[[2]](#2)|
|
||||
|**Dridex**|March 2015|[[3]](#3)|
|
||||
|[**Redhip**](../xample-malware/redhip.md)|2011|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFICE. [[6]](#6)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|2011|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFICE. [[6]](#6)|
|
||||
|
||||
References
|
||||
----------
|
||||
|
||||
@@ -44,7 +44,7 @@ Malware Examples
|
||||
Code Snippets
|
||||
-------------
|
||||
**Memory Dump::Code Encryption in Memory** (B0006.011)
|
||||
<br/>MD5: b6e1a2048ea6bd6a941a72300b2d41ce
|
||||
<br/>SHA256: 304f533ce9ea4a9ee5c19bc81c49838857c63469e26023f330823c3240ee4e03
|
||||
```asm
|
||||
mov cl, 65h ; 'e'
|
||||
mov al, 70h ; 'p'
|
||||
|
||||
@@ -39,15 +39,15 @@ Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|---|---|---|
|
||||
|[**Redhip**](../xample-malware/redhip.md)|January 2011|Redhip detects publicly available automated analysis workbenches (e.g., Joe Box) by considering OS product keys and special DLLs. [[1]](#1)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|January 2011|Redhip detects publicly available automated analysis workbenches (e.g., Joe Box) by considering OS product keys and special DLLs. [[1]](#1)|
|
||||
|[**Rombertik**](../xample-malware/rombertik.md)|May 2015|[[2]](#2)|
|
||||
|[**Terminator**](../xample-malware/terminator.md)|May 2013|The Terminator rat evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[4]](#4)|
|
||||
|[**Ursnif**](../xample-malware/ursnif.md)|2016|Ursnif uses malware macros to evade sandbox detection.|
|
||||
|[**GotBotKR**](../xample-malware/gotbotkr.md)|2019|GoBotKR performs several checks on the compromised machine to avoid being emulated or executed in a sandbox. [[5]](#5)|
|
||||
|[**GotBotKR**](../xample-malware/gobotkr.md)|2019|GoBotKR performs several checks on the compromised machine to avoid being emulated or executed in a sandbox. [[5]](#5)|
|
||||
|[**Rombertik**](../xample-malware/rombertik.md)|2015|The malware check for sandboxes that suppress errors returned from API routine calls the using ZwGetWriteWatch routine. [[6]](#6)|
|
||||
|
||||
|
||||
<a name="snippet"><a/>Code Snippets
|
||||
<a name="snippet"></a>Code Snippets
|
||||
-------------
|
||||
**Sandbox Detection::Product Key/ID Testing** (B0007.005) - the value 55274-640-2673064-23950 corresponds to Joe Sandbox.
|
||||
```asm
|
||||
|
||||
@@ -71,7 +71,7 @@ Malware Examples
|
||||
|---|---|---|
|
||||
|[**GravityRAT**](../xample-malware/gravity-rat.md)|May 2018|GravityRAT checks system temperature by recording thermal readings for detecting VMs. Heat levels indicate whether the system is a VM. [[3]](#3)|
|
||||
|[**WebCobra**](../xample-malware/webcobra.md)|2018|WebCobra injects malicious code to svchost.exe and uses an infinite loop to check all open windows and to compare each window’s title bar text with a set of strings to determine whether it is running in an isolated, malware analysis environment [[4]](#4)|
|
||||
|[**Redhip**](../xample-malware/redhip.md)|2011|Redhip detects VMWare, Virtual PC and Virtual Box. It also detects VM environments in general by considering timing lapses. [[6]](#6)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|2011|Redhip detects VMWare, Virtual PC and Virtual Box. It also detects VM environments in general by considering timing lapses. [[6]](#6)|
|
||||
|[**Emotet**](../xample-malware/emotet.md)|2018|Emotet checks for various processes that are associated with various virtual machines by comparing hash values of the process names with the hash values of the list of running process names [[7]](#7)|
|
||||
|
||||
|
||||
@@ -79,7 +79,7 @@ Malware Examples
|
||||
Code Snippets
|
||||
-------------
|
||||
**Virtual Machine Detection::Instruction Testing** (B0009.029)
|
||||
<br/>MD5: 0e058126f26b54b3a4a950313ec5dbce
|
||||
<br/>SHA256: cfaf863181e49906df33f9104795678f2fb41a007a8fd066a84fd99f613d7ef3
|
||||
```asm
|
||||
; ___unwind { // __except handler4
|
||||
push ebp
|
||||
|
||||
@@ -62,7 +62,7 @@ Malware Examples
|
||||
Code Snippets
|
||||
-------------
|
||||
**Obfuscated Files or Information::Encoding-Standard Algorithm** (E1027.m02)
|
||||
<br/>MD5: b6e1a2048ea6bd6a941a72300b2d41ce
|
||||
<br/>SHA256: 304f533ce9ea4a9ee5c19bc81c49838857c63469e26023f330823c3240ee4e03
|
||||
```asm
|
||||
jle short_40182F
|
||||
mov dl, byte ptr [ebp+eax+var_7CA8]
|
||||
@@ -73,7 +73,7 @@ cmp eax, edi
|
||||
jl short loc_40181A
|
||||
```
|
||||
**Executable Code Obfuscation::Stack Strings** (B0032.017)
|
||||
<br/>MD5: b6e1a2048ea6bd6a941a72300b2d41ce
|
||||
<br/>SHA256: 304f533ce9ea4a9ee5c19bc81c49838857c63469e26023f330823c3240ee4e03
|
||||
```asm
|
||||
mov cl, 65h ; 'e'
|
||||
mov al, 70h ; 'p'
|
||||
|
||||
@@ -42,7 +42,7 @@ Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|---|---|---|
|
||||
|[**Redhip**](../xample-malware/redhip.md)|2011|Redhip samples are packed with different custom packers. [[3]](#3)|
|
||||
|[**Redhip**](../xample-malware/rebhip.md)|2011|Redhip samples are packed with different custom packers. [[3]](#3)|
|
||||
|[**Kovter**](../xample-malware/kovter.md)|2016|The malware comes packed by a crypter/FUD [[4]](#4)|
|
||||
|[**Conficker**](../xample-malware/conficker.md)|2008|Conficker is propagated as a DLL which has been backed using the UPX packer [[5]](#5)|
|
||||
|[**DarkComet**](../xample-malware/dark-comet.md)|2008|Has the option to compress its payload using UPX or MPRESS [[6]](#6)|
|
||||
|
||||
@@ -32,7 +32,7 @@ Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|---|---|---|
|
||||
|[**GotBotKR**](../xample-malware/gotbotkr.md)|2019| GoBotKR is capable of capturing screenshots. [[1]](#1)|
|
||||
|[**GotBotKR**](../xample-malware/gobotkr.md)|2019| GoBotKR is capable of capturing screenshots. [[1]](#1)|
|
||||
|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|Screenshot plugin allows for collection of screenshots [[2]](#2)|
|
||||
|[**DarkComet**](../xample-malware/dark-comet.md)|2008|Can take screenshots of victim's computer [[3]](#3)|
|
||||
|
||||
|
||||
@@ -50,7 +50,7 @@ Malware Examples
|
||||
|Name|Date|Description|
|
||||
|---|---|---|
|
||||
|[**CryptoWall**](../xample-malware/cryptowall.md)|2014|The malware sends a hash value generated from system information [[1]](#1)|
|
||||
|[**GotBotKR**](../xample-malware/gotbotkr.md)|2019|GoBotKR receives data from the C2 [[2]](#2)|
|
||||
|[**GotBotKR**](../xample-malware/gobotkr.md)|2019|GoBotKR receives data from the C2 [[2]](#2)|
|
||||
|[**Terminator**](../xample-malware/terminator.md)|2013|The malware sends data to C2 [[3]](#3)|
|
||||
|[**UP007**](../xample-malware/up007.md)|2016|The malware receives payloads [[4]](#4)|
|
||||
|[**YiSpecter**](../xample-malware/yispecter.md)|2015|Connects to the command and control server using HTTP to send device information [[5]](#5)|
|
||||
@@ -61,7 +61,7 @@ Malware Examples
|
||||
Code Snippets
|
||||
-------------
|
||||
**C2 Communication::Receive Data** (B0030.02)
|
||||
<br/>MD5: b6e1a2048ea6bd6a941a72300b2d41ce
|
||||
<br/>SHA256: 304f533ce9ea4a9ee5c19bc81c49838857c63469e26023f330823c3240ee4e03
|
||||
```asm
|
||||
loc_401981
|
||||
mov ecx, s
|
||||
|
||||
@@ -35,7 +35,7 @@ Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|---|---|---|
|
||||
|[**GotBotKR**](../xample-malware/gotbotkr.md)|2019| GoBotKR stores itself in a file with Hidden and System attributes. [[1]](#1)|
|
||||
|[**GotBotKR**](../xample-malware/gobotkr.md)|2019| GoBotKR stores itself in a file with Hidden and System attributes. [[1]](#1)|
|
||||
|[**Shamoon**](../xample-malware/shamoon.md)|2012|Modifies target files' time to August 2012 as an antiforensic trick [[2]](#2)|
|
||||
|
||||
References
|
||||
|
||||
@@ -28,7 +28,7 @@ Malware Examples
|
||||
|---|---|---|
|
||||
|[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
|
||||
|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|
|
||||
|[**GotBotKR**](../xample-malware/gotbotkr.md)|2019|GoBotKR can modify registry keys to disable Task Manager, Registry Editor and Command Prompt. [[2]](#2)|
|
||||
|[**GotBotKR**](../xample-malware/gobotkr.md)|2019|GoBotKR can modify registry keys to disable Task Manager, Registry Editor and Command Prompt. [[2]](#2)|
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|The malware adds many entries to the registry [[3]](#3)|
|
||||
|[**Gamut**](../xample-malware/gamut.md)|2014|The malware adds a registry key [[4]](#4)|
|
||||
|[**Kovter**](../xample-malware/kovter.md)|2016|The malware modifies the registry during execution [[5]](#5)|
|
||||
|
||||
@@ -48,7 +48,7 @@ Malware Examples
|
||||
|[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
|
||||
|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|Obfuscates files.|
|
||||
|[**WebCobra**](../xample-malware/webcobra.md)|2018|Obfuscates files.|
|
||||
|[**GotBotKR**](../xample-malware/gotbotkr.md)|2019|GoBotKR uses base64 to obfuscate strings, commands and files. [[1]](#1)|
|
||||
|[**GotBotKR**](../xample-malware/gobotkr.md)|2019|GoBotKR uses base64 to obfuscate strings, commands and files. [[1]](#1)|
|
||||
|[**Kovter**](../xample-malware/kovter.md)|2016|The malware will use a key to decrypt text from a URL to create more malicious code [[2]](#2)|
|
||||
|
||||
References
|
||||
|
||||
@@ -27,7 +27,7 @@ Malware Examples
|
||||
|---|---|---|
|
||||
|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|
|
||||
|[**WebCobra**](../xample-malware/webcobra.md)|2018|From the command line, drops and unzips a password-protected Cabinet archive file. [[1]](#1)|
|
||||
|[**GotBotKR**](../xample-malware/gotbotkr.md)|2019|GoBotKR uses cmd.exe to execute commands. [[2]](#2)|
|
||||
|[**GotBotKR**](../xample-malware/gobotkr.md)|2019|GoBotKR uses cmd.exe to execute commands. [[2]](#2)|
|
||||
|[**Kovter**](../xample-malware/kovter.md)|2016|The malware executes malicious javascript and powershell [[3]](#3)|
|
||||
|[**SamSam**](../xample-malware/samsam.md)|2015|SamSam uses a batch file for executing the malware and deleting certain components [[4]](#4)|
|
||||
|[**Shamoon**](../xample-malware/shamoon.md)|2012|The wiper component of Shamoon creates a service to run the driver with the command: sc create hdv_725x type= kernel start= demand binpath= WINDOWS\hdv_725x.sys 2>&1 >nul and sends an additional reboot command after completion [[5]](#5)|
|
||||
|
||||
@@ -27,7 +27,7 @@ Malware Examples
|
||||
|---|---|---|
|
||||
|[**WebCobra**](../xample-malware/webcobra.md)|November 2018|Drops software to mine for cryptocurrency. [[1]](#1)|
|
||||
|[**Geneio**](../xample-malware/geneio.md)|August 2015|Tricks OS X keychain to create application files.|
|
||||
|[**GotBotKR**](../xample-malware/gotbotkr.md)|July 2019|GotBotKR reinstalls its running instance if it is removed. [[3]](#3)|
|
||||
|[**GotBotKR**](../xample-malware/gobotkr.md)|July 2019|GotBotKR reinstalls its running instance if it is removed. [[3]](#3)|
|
||||
|[**MazarBot**](../xample-malware/mazarbot.md)|2016|Installs a backdoor.|
|
||||
|[**Mebromi**](../xample-malware/mebromi.md)|2011|A Trojan downloader.|
|
||||
|[**YiSpecter**](../xample-malware/yispecter.md)|2015|Can download and install arbitrary iOS apps.|
|
||||
|
||||
@@ -26,7 +26,7 @@ Malware Examples
|
||||
|Name|Date|Description|
|
||||
|---|---|---|
|
||||
|[**TrickBot**](../xample-malware/trickbot.md)|2016|Trojan spyware program that has mainly been used for targeting banking sites.|
|
||||
|[**GotBotKR**](../xample-malware/gotbotkr.md)|2019| GoBotKR makes their malware look like the torrent content that the user intended to download, in order to entice a user to click on it. [[1]](#1)|
|
||||
|[**GotBotKR**](../xample-malware/gobotkr.md)|2019| GoBotKR makes their malware look like the torrent content that the user intended to download, in order to entice a user to click on it. [[1]](#1)|
|
||||
|[**Rombertik**](../xample-malware/rombertik.md)|2015|The malware relies on a victim to execute itself [[2]](#2)|
|
||||
|[**Terminator**](../xample-malware/terminator.md)|2013|The malware relies on user interaction to execute [[3]](#3)|
|
||||
|
||||
|
||||
@@ -28,7 +28,7 @@ Malware Examples
|
||||
|Name|Date|Description|
|
||||
|---|---|---|
|
||||
|[**BlackEnergy**](../xample-malware/blackenergy.md)|October 2007|Launches distributed denial of service attacks that can target more than one IP address per hostname. [[1]](#1)|
|
||||
|[**GotBotKR**](../xample-malware/gotbotkr.md)|2019|GoBotKR has been used to execute endpoint DDoS attacks – for example, TCP Flood or SYN Flood. [[2]](#2)|
|
||||
|[**GotBotKR**](../xample-malware/gobotkr.md)|2019|GoBotKR has been used to execute endpoint DDoS attacks – for example, TCP Flood or SYN Flood. [[2]](#2)|
|
||||
|
||||
References
|
||||
----------
|
||||
|
||||
@@ -34,7 +34,7 @@ Malware Examples
|
||||
|---|---|---|
|
||||
|[**WebCobra**](../xample-malware/webcobra.md)|2018|Drops software to mine for cryptocurrency. [[1]](#1)|
|
||||
|Adylkuzz|May 2017|Consumes system resources to mine for cryptocurrency. [[2]](#2)|
|
||||
|[**GotBotKR**](../xample-malware/gotbotkr.md)|2019|GoBotKR can use the compromised computer’s network bandwidth to seed torrents or execute DDoS. [[3]](#3)|
|
||||
|[**GotBotKR**](../xample-malware/gobotkr.md)|2019|GoBotKR can use the compromised computer’s network bandwidth to seed torrents or execute DDoS. [[3]](#3)|
|
||||
|
||||
References
|
||||
----------
|
||||
|
||||
@@ -48,7 +48,7 @@ Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|---|---|---|
|
||||
|[**SYNfulKnock**](../xample-malware/synful-knock.md)|2015|To initiate communication with the C2 server, a uniquely crafted TCP SYN packet is sent to port 80 of the "implanted" router [[1]](#1)|
|
||||
|[**SYNfulKnock**](../../xample-malware/synful-knock.md)|2015|To initiate communication with the C2 server, a uniquely crafted TCP SYN packet is sent to port 80 of the "implanted" router [[1]](#1)|
|
||||
|
||||
|
||||
References
|
||||
|
||||
@@ -31,9 +31,8 @@ Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|---|---|---|
|
||||
|[**Ursnif**](../micro-behaviors/memory/change-memory-protection.md)|2016|Changes the PE header of the child process to enable write access to that page, writes 18 bytes of buffer at offset 0x40 from the start of svchost.exe process executable in the target child process. Then changes the region protection back to "read only" to avoid suspicion [[1]](#1)|
|
||||
|
||||
|[**SYNfulKnock**](../xample-malware/synful-knock.md)|2015|Modifies the translation lookaside buffer (TLB) Read/Write attributes [[2]](#2)|
|
||||
|[**Ursnif**](../../xample-malware/ursnif.md)|2016|Changes the PE header of the child process to enable write access to that page, writes 18 bytes of buffer at offset 0x40 from the start of svchost.exe process executable in the target child process. Then changes the region protection back to "read only" to avoid suspicion [[1]](#1)|
|
||||
|[**SYNfulKnock**](../../xample-malware/synful-knock.md)|2015|Modifies the translation lookaside buffer (TLB) Read/Write attributes [[2]](#2)|
|
||||
|
||||
References
|
||||
----------
|
||||
|
||||
@@ -24,7 +24,7 @@ Malware Examples
|
||||
----------------
|
||||
|Name|Date|Description|
|
||||
|---|---|---|
|
||||
|[**Conficker**](../micro-behaviors/memory/overflow-buffer.md)|2008|Variants A, B, C, and E exploit a vulnerability in the Server Service on Windows computers in which an already compromised computer sends a specially-crafted RPC request to force a buffer overflow and execute shellcode on the target computer [[1]](#1)|
|
||||
|[**Conficker**](../../xample-malware/conficker.md)|2008|Variants A, B, C, and E exploit a vulnerability in the Server Service on Windows computers in which an already compromised computer sends a specially-crafted RPC request to force a buffer overflow and execute shellcode on the target computer [[1]](#1)|
|
||||
|
||||
|
||||
References
|
||||
|
||||
@@ -24,7 +24,6 @@ Malware Examples
|
||||
|Name|Date|Description|
|
||||
|---|---|---|
|
||||
|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|Poison Ivy has a default process mutex, but can be altered at build time [2] [[1]](#1)|
|
||||
|
||||
|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|Creates global mutexes signal that rootkit installation has occurred successfully [[2]](#2)|
|
||||
|
||||
References
|
||||
|
||||
@@ -19,4 +19,4 @@ Set Thread Local Storage Value
|
||||
==============================
|
||||
Malware allocates thread local storage.
|
||||
|
||||
This micro behavior is a lower level counterpart to ATT&CK's [**Process Injection::Thread Local Storage**](https://attack.mitre.org/techniques/T1055/005) technique.
|
||||
This micro behavior is a lower level counterpart to ATT&CK's [**Process Injection::Thread Local Storage (T1055.005)**](https://attack.mitre.org/techniques/T1055/005) technique.
|
||||
@@ -30,7 +30,7 @@ Malware Examples
|
||||
|[**Hupigon**](../xample-malware/hupigon.md)|2013|Hupigon drops the file "Systen.dll" and adds the registry entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\BITS DllName = "%System%\Systen.dll". [[3]](#3)|
|
||||
|[**Terminator**](../xample-malware/terminator.md)|May 2013|The Terminator rat sets "2019" as Windows' startup folder by modifying a registry value. [[4]](#4)|
|
||||
|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|The malware creates an "autorun" registry key [[5]](#5)|
|
||||
|[**GotBotKR**](../xample-malware/gotbotkr.md)|2019| GoBotKR installs itself under registry run keys to establish persistence. [[6]](#6)|
|
||||
|[**GotBotKR**](../xample-malware/gobotkr.md)|2019| GoBotKR installs itself under registry run keys to establish persistence. [[6]](#6)|
|
||||
|[**Kovter**](../xample-malware/kovter.md)|2016|The malware writes an autorun registry entry [[7]](#7)|
|
||||
|[**Rombertik**](../xample-malware/rombertik.md)|2015|it will proceed to install itself in order to ensure persistence across system reboots before continuing on to execute the payload. To install itself, Rombertik first creates a VBS script named “fgf.vbs”, which is used to kick off Rombertik every time the user logs in, and places the script into the user’s Startup folder. [[8]](#8)|
|
||||
|[**Ursnif**](../xample-malware/ursnif.md)|2016|Adds registry entries to ensure automatic execution at every system startup [[9]](#9)|
|
||||
|
||||
@@ -19,7 +19,7 @@ Please see [Poison-Ivy X0014](../xample-malware/poison-ivy.md) and [Kovter X0009
|
||||
* **Emotet** [X0028](../xample-malware/emotet.md)
|
||||
* **Gamut** [X0006](../xample-malware/gamut.md)
|
||||
* **Geneio** [X0007](../xample-malware/geneio.md)
|
||||
* **GotBotKR** [X0027](../xample-malware/gotbotkr.md)
|
||||
* **GotBotKR** [X0027](../xample-malware/gobotkr.md)
|
||||
* **GravityRAT** [X0032](../xample-malware/gravity-rat.md)
|
||||
* **Heriplor** [X0026](../xample-malware/heriplor.md)
|
||||
* **Hupigon** [X0008](../xample-malware/hupigon.md)
|
||||
@@ -29,7 +29,7 @@ Please see [Poison-Ivy X0014](../xample-malware/poison-ivy.md) and [Kovter X0009
|
||||
* **Mazarbot** [X0012](../xample-malware/mazarbot.md)
|
||||
* **Mebromi** [X0013](../xample-malware/mebromi.md)
|
||||
* **Poison-Ivy** [X0014](../xample-malware/poison-ivy.md)
|
||||
* **Redhip** [X0015](../xample-malware/redhip.md)
|
||||
* **Redhip** [X0015](../xample-malware/rebhip.md)
|
||||
* **Rombertik** [X0031](../xample-malware/rombertik.md)
|
||||
* **SamSam** [X0016](../xample-malware/samsam.md)
|
||||
* **SearchAwesome** [X0017](../xample-malware/searchawesome.md)
|
||||
|
||||
@@ -40,9 +40,13 @@ MBC Behaviors
|
||||
|[Impact::Prevent Concurrent Execution (B0024)](../execution/prevent-concurrent-execution.md)|Some variants look for an unnamed mutex to ensure only one copy of itself is running on a system [[1]](#1)|
|
||||
|[Execution::Send Email (B0020)](../execution/send-email.md)|Bagle uses its own SMTP engine to mass-mail itself as an attachment from an infected computer [[2]](#2)|
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
SHA256 Hashes
|
||||
- a1b08bc8fd95d6f7415a9394bf76abed3e7860a5eda380cb863ab2d5fc6b65a5
|
||||
|
||||
References
|
||||
----------
|
||||
|
||||
<a name="1">[1]</a> https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/WORM_BAGLE.U/
|
||||
|
||||
<a name="2">[2]</a> https://en.wikipedia.org/wiki/Bagle_(computer_worm)
|
||||
<a name="3">[3]</a> https://www.joesandbox.com/analysis/561298/0/html
|
||||
|
||||
@@ -56,20 +56,20 @@ MBC Behaviors
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
MD5 Hashes
|
||||
- 26b9816b3f9e2f350cc92ef4c30a097c6fec7798
|
||||
- bf9937489cb268f974d3527e877575b4fbb07cb0
|
||||
- 78636f7bbd52ea80d79b4e2a7882403092bbb02d
|
||||
- bf9172e87e9264d1cddfc36cbaa74402bb405708
|
||||
- 441cfbaba1dfd58ce03792ef74d183529e8e0104
|
||||
- f7d4aa90b76646f4a011585eb43b9d13c60f48eb
|
||||
- 8ccd2962bce8985d0794daed6e0bf73e5557cfe8
|
||||
- d496f99f7e07d5cbbd177a9d43febe8fb87ebc3b
|
||||
- cc71aa8f919911676fb5d775c81afc682e6e3dd3
|
||||
- abab02d663872bcdbe2e008441fcd7157c0eb52d
|
||||
- e5c8c10b10ee288512d3a7c79ae1249b57857d23
|
||||
- 8743c8994cc1e8219697394b5cb494efa7dad796
|
||||
- 285b3252a878d1c633ea988153bbc23c148dd630
|
||||
SHA256 Hashes
|
||||
- e791718c0141e3829608142fb0f0d35c9af270f78ae0b72fce2edd07a9684568
|
||||
- d841d9092239fc029b10da01c19868749b0f6bd757926ff04674658468495808
|
||||
- bc062acda428f55782710f9c4f2df88c26dfbc004b94b479459f8572b1219444
|
||||
- 16d68b740b5d9aa60929e39fd616d31be2c8528d0f1e58db4cbb16976f7cd725
|
||||
- af62f29ac01e8335bf41c02c1460ebafcbaf94956b1001f7d515eecf63cea4f2
|
||||
- 47aea6a4e1da1fb8b454c038c21736bee53d59d095a4f5b866d5dd8158fead41
|
||||
- 4b2efcda5269f4b80dc417a2b01332185f2fafabd8ba7114fa0306baaab5a72d
|
||||
- b1ca89de93a1d9bf17cdbf8a3c61e7f52f275a3bcbbd285d35d6a40c45dde9bd
|
||||
- 951e5623c20d4e9ab158fe105436389dbf61327b2c87b7fb36f8ad3ff5ad9bde
|
||||
- f8b974cf978a3828aeb9b83fc48645da576e4b90dd47c2b82a46f6c14665a9e5
|
||||
- 91f72808aaed45a76ff1044a23fd6df4b7ab7ace292725522518feb9c0b8574e
|
||||
- 2aade7381aa87f55b7d7a5284d22be5472fd8cd966d216fd4445ca3a8bbb3ff3
|
||||
- 01425582aa5001342b985270a365fd92d909be011384247e81872bff586fa142
|
||||
|
||||
|
||||
References
|
||||
|
||||
@@ -46,6 +46,11 @@ MBC Behaviors
|
||||
|[Micro-Behavior::Memory::Overflow Buffer (C0010)](../micro-behaviors/memory/overflow-buffer.md)|Variants A, B, C, and E exploit a vulnerability in the Server Service on Windows computers in which an already compromised computer sends a specially-crafted RPC request to force a buffer overflow and execute shellcode on the target computer [[1]](#1)|
|
||||
|[Execution::Conditional Execution::Suicide Exit (B0025.001)](../execution/conditional-execution.md)|Conficker B has significantly more suicide logic embedded in its code and employs anti-debugging features to avoid reverse engineering attempts [[2]](#2)|
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
SHA256 Hashes
|
||||
- 1192482f9f8f87a01977b4dd3e185d4b60319175b789b3e7a60ad6554c120a0d
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://en.wikipedia.org/wiki/Conficker
|
||||
|
||||
@@ -54,6 +54,11 @@ MBC Behaviors
|
||||
|[Command and Control::Domain Name Generation (B0031)](../command-and-control/domain-name-generation.md)|The malware uses an internal domain generation algorithm [[1]](#1)|
|
||||
|[Command and Control::Command and Control Communication::Authenticate (B0030.001)](../command-and-control/c2-communication.md)|The malware sends a phone-home message with encryption to start [[1]](#1)|
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
SHA256 Hashes
|
||||
- a2bc3059283d7cc7bc574ce32cb6b8bfd27e02ac3810a21bd3a9b84c17f18a72
|
||||
- 0be1f445537f124b5175e1f2d1da87e2e57aa4ba09ea5fe72b7bafaf0b8f9ad2
|
||||
|
||||
References
|
||||
----------
|
||||
|
||||
@@ -52,7 +52,13 @@ MBC Behaviors
|
||||
|[Command and Control::Command and Control Communication::Send Data (B0030.001)](../command-and-control/c2-communication.md)|The malware sends a hash value generated from system information [[1]](#1)|
|
||||
|[Command and Control::Command and Control Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|The malware receives a public key from the C2 [[1]](#1)|
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
SHA256 Hashes
|
||||
- 03467f231a3fce6795545ae99a6dad161effa3bf681031693815eabf1648ee66
|
||||
- 7ed58ef4fd3dc4efaea9e595614553445afb055c0c675b692f12a5629251b040
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://news.sophos.com/en-us/2015/12/17/the-current-state-of-ransomware-cryptowall/
|
||||
<a name="2">[2]</a> https://www.secureworks.com/research/cryptowall-ransomware
|
||||
@@ -50,7 +50,13 @@ MBC Behaviors
|
||||
|---|---|
|
||||
|[Impact::Remote Access (B0022)](../impact/remote-access.md)|Allows an attacker to control the system via a GUI [[1]](#1)|
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
SHA256 Hashes
|
||||
- 0369aa99d731d2de260bc63b6c4f85d997eb189155c362df478d8f5afaa655b0
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://en.wikipedia.org/wiki/DarkComet
|
||||
<a name="2">[2]</a> https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/
|
||||
<a name="3">[3]</a> https://bazaar.abuse.ch/browse/signature/DarkComet/
|
||||
@@ -34,6 +34,12 @@ Enhanced ATT&CK Techniques
|
||||
|[Impact::Generate Traffic from Victim::Advertisement Replacement Fraud (E1643)](../impact/generate-traffic-from-victim.md)|Alters DNS server settings to route to a rogue DNS server for the purpose of click hijacking. [[1]](#1)|
|
||||
|[Defense Evasion::Disable or Evade Security Tools (F0004)](../defense-evasion/disable-or-evade-security-tools.md)|Prevents the infected system from installing anti-virus software updates. [[1]](#1)|
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
SHA256 Hashes
|
||||
- c2ef46a1b6292f28c0caf08013577e8559c4b0a71bf6fc058968061a3d71ede2
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://www.huffingtonpost.com/2011/11/09/click-hijack-hackers-online-ad-scam_n_1084497.html
|
||||
<a name="2">[2]</a> https://www.joesandbox.com/analysis/258032/0/html
|
||||
@@ -47,6 +47,11 @@ MBC Behaviors
|
||||
|[Command and Control::Command and Control Communication::Request Email Address List (B0030.010)](../command-and-control/c2-communication.md)| new email addresses are collected automatically from the victim's address books [[4]](#4)|
|
||||
|[Execution::Send Email (B0020)](../execution/send-email.md)|spam email with the Emotet loader is sent automatically [[4]](#4)|
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
SHA256 Hashes
|
||||
- eea5a1c7b3cc8350f8d5a95b6e2b7e3701d22cb362f8b988e815789f95c32eca
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://cofense.com/recent-geodo-malware-campaigns-feature-heavily-obfuscated-macros/
|
||||
@@ -56,3 +61,5 @@ References
|
||||
<a name="3">[3]</a> https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1
|
||||
|
||||
<a name="4">[4]</a> https://securelist.com/the-banking-trojan-emotet-detailed-analysis/69560/
|
||||
|
||||
<a name="5">[5]</a> https://www.f-secure.com/v-descs/trojan_w32_emotet.shtml
|
||||
@@ -53,6 +53,13 @@ MBC Behaviors
|
||||
|[Execution::Send Email (B0020)](../execution/send-email.md)|Gamut probes the infected system's SMTP port 25 by sending a test SMTP transaction to mail.ru and hotmail.com. [[1]](#1)|
|
||||
|[Impact::Spamming (B0039)](../impact/spamming.md)|If port 25 is open, the bot uses a spam template and email list to send spam. [[1]](#1)|
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
SHA256 Hashes
|
||||
- a56162bc623841102301df8e5c918f27fe8c2a58ae049d81c838fcf256654932
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/gamut-spambot-analysis/
|
||||
|
||||
<a name="2">[2]</a> https://any.run/report/a56162bc623841102301df8e5c918f27fe8c2a58ae049d81c838fcf256654932/1a6f6db3-83d5-442e-8f0d-42cfab2e0d34
|
||||
@@ -56,6 +56,11 @@ MBC Behaviors
|
||||
|---|---|
|
||||
|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|Geneio installs the browser extension ~/Library/Safari/Extensions/Omnibar.safariextz. It also creates the app files listed in the description above. [[1]](#1)|
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
SHA256 Hashes
|
||||
- 56b1d33fde65ab520a6c8afe9b3f304c50b581d3e46a9baa56fb9694d4d7effc
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://blog.malwarebytes.org/mac/2015/08/genieo-installer-tricks-keychain/
|
||||
|
||||
@@ -23,7 +23,7 @@
|
||||
</table>
|
||||
|
||||
|
||||
GotBotKR
|
||||
GoBotKR
|
||||
========
|
||||
Modified version of a publicly available backdoor name GoBot2. Modifications are mainly evasion techniques specific to South Korea. [[1]](#1)
|
||||
|
||||
@@ -70,12 +70,17 @@ MBC Behaviors
|
||||
---------
|
||||
|Name|Use|
|
||||
|---|---|
|
||||
|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|GotBotKR reinstalls its running instance if it is removed. [[1]](#1)|
|
||||
|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|GoBotKR reinstalls its running instance if it is removed. [[1]](#1)|
|
||||
|[Anti-Behavioral-Analysis::Detect Sandbox (B0007)](../anti-behavioral-analysis/sandbox-detection.md)|GoBotKR performs several checks on the compromised machine to avoid being emulated or executed in a sandbox. [[1]](#1)|
|
||||
|[Command and Control::Command and Control Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|GoBotKR receives data from the C2 [[1]](#1)|
|
||||
|[Impact::Denial of Service (B0033)](../impact/denial-of-service.md)|GoBotKR has been used to execute endpoint DDoS attacks – for example, TCP Flood or SYN Flood. [[1]](#1)|
|
||||
|[Impact::Resource Hijacking (B0018)](../impact/resource-hijacking.md)|GoBotKR can use the compromised computer’s network bandwidth to seed torrents or execute DDoS. [[1]](#1)|
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
SHA256 Hashes
|
||||
- 492e8ee240492768232b717a60a880f216fd936b6ed9f5b6f67fe83db3bbc7d4
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
|
||||
@@ -49,8 +49,16 @@ MBC Behaviors
|
||||
|[Anti-Behavioral Analysis::VM Detection::Moder Specs Check - Processor count (B0009.018)](../anti-behavioral-analysis/virtual-machine-detection.md)|Determines the machine to be a VM if the core count is 1 [[2]](#2)|
|
||||
|[Anti-Behavioral Analysis::VM Detection::Unique Hardware/Firmware Check - MAC Address (B0009.028)](../anti-behavioral-analysis/virtual-machine-detection.md)|Checks if the MAC address starts by a well-known hexadecimal number used by various VM developers [[2]](#2)|
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
SHA256 Hashes
|
||||
- c39270febb9097def21777c994d10738ba2a915c88f516fb1e896e5d7240cc0d
|
||||
- 71264d9c67800d3bedc6facb6915e855f7531c12445af58f47167e81c735c892
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://www.hackread.com/gravityrat-malware-evades-detection-targets-india/
|
||||
|
||||
<a name="2">[2]</a> https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html
|
||||
|
||||
<a name="3">[3]</a> https://securelist.com/gravityrat-the-spy-returns/99097/
|
||||
@@ -34,6 +34,11 @@ MBC Behaviors
|
||||
|[Anti-Static Analysis::Executable Code Obfuscation:API Hashing (B0032.001)](../anti-static-analysis/executable-code-obfuscation.md)|Malware uses API hashing method [[1]](#1)|
|
||||
|[Command and Control::Command and Control Communication::Receive Data (B0030.002)](../command-and-control/c2-communication.md)|Malware has capability to connect with C2 to download arbitrary code [[2]](#2)|
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
SHA256 Hashes
|
||||
- 1b17ce735512f3104557afe3becacd05ac802b2af79dab5bb1a7ac8d10dccffd
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://insights.sei.cmu.edu/blog/api-hashing-tool-imagine-that/
|
||||
|
||||
@@ -51,6 +51,11 @@ MBC Behaviors
|
||||
|---|---|
|
||||
|[Impact::Remote Access (B0022)](../impact/remote-access.md)|The malware acts as a backdoor [[1]](#1)|
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
SHA256 Hashes
|
||||
- 465d3aac3ca4daa9ad4de04fcb999f358396efd7abceed9701c9c28c23c126db
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/HUPIGON
|
||||
|
||||
@@ -54,6 +54,12 @@ MBC Behaviors
|
||||
|---|---|
|
||||
|[Defense Evasion::Alternative Installation Location::Registry Install (B0027.002)](../defense-evasion/alternative-installation-location.md)|Stores malware files in the Registry instead of the hard drive [[2]](#2)|
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
SHA256 Hashes
|
||||
- 15c237f6b74af2588b07912bf18e2734594251787871c9638104e4bf5de46589
|
||||
- bffe7ccbcf69e7c787ff10d1dc7dbf6044bffcb13b95d851f4a735917b3a6fdf
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://blog.malwarebytes.com/threat-analysis/2016/07/untangling-kovter/
|
||||
|
||||
@@ -41,6 +41,11 @@ MBC Behaviors
|
||||
|[Command and Control::Domain Name Generation (B0003)](../command-and-control/domain-name-generation.md)| Uses a domain name generator. [[1]](#1)|
|
||||
|[Anti-Behavioral Analysis::Memory Dump Evasion (B0006)](../anti-behavioral-analysis/memory-dump-evasion.md)|Dumping Kraken's c.dll module from the heap of its own process is tricky because its PE-header is wiped out. [[1]](#1)|
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
SHA256 Hashes
|
||||
- 466892a38785c1a499140d208a101f908e7c9589f126b87e9e20d8c916555306
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> http://blog.threatexpert.com/2008/04/kraken-changes-tactics.html
|
||||
|
||||
@@ -47,6 +47,11 @@ MBC Behaviors
|
||||
|---|---|
|
||||
|[Anti-Static Analysis::Executable Code Virtualization (B0008)](../anti-static-analysis/executable-code-virtualization.md)|Code virtualization is added to the Locky Bart binary using WPProtect. [[1]](#1)|
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
SHA256 Hashes
|
||||
- c285e376201e2941154ec1a9acd8658cd5e0ea975c694a3fe3e9a9897efc2680
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://blog.malwarebytes.com/threat-analysis/2017/01/locky-bart-ransomware-and-backend-server-analysis/
|
||||
|
||||
@@ -45,6 +45,12 @@ MBC Behaviors
|
||||
|[Impact::Manipulate Network Traffic (B0019)](../impact/manipulate-network-traffic.md)|Intercepts data coming into and going out of device [[1]](#1)|
|
||||
|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|Installs a backdoor [[1]](#1)|
|
||||
|[Execution::Send Poisoned Text Message (B0021)](../execution/send-poisoned-text-message.md)|Can send SMS messages [[2]](#2)|
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
SHA256 Hashes
|
||||
- 0432a460b1af4a31c0b0ab12106886ff9e5fd1b7a109c1a9e5ab29b4fafd6719
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://us.norton.com/internetsecurity-emerging-threats-mazar-bot-malware-invades-and-erases-android-devices.html
|
||||
|
||||
@@ -47,6 +47,11 @@ MBC Behaviors
|
||||
|[Execution::Conditional Execution (B0025)](../execution/conditional-execution.md)|Malware only proceeds if it detects the BIOS ROM is Award BIOS [[1]](#1)|
|
||||
|[Execution::Install Additional Program (B0023)](../execution/install-additional-program.md)|Malware contains a dropper that installs additional programs like Cbrom.exe [[1]](#1)|
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
SHA256 Hashes
|
||||
- 4968ae59a46b60c290cf5db8b3d6749df06ceb4be668009a609e1139fe91a9ee
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://www.webroot.com/blog/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/
|
||||
|
||||
@@ -55,6 +55,12 @@ MBC Behaviors
|
||||
|[Process::Micro-objective::Check Mutex (C0043)](../micro-behaviors/process/check-mutex.md)|Poison Ivy variant checks if the wireshark-is-running{} named mutex object exists [[3]](#3)|
|
||||
|[Anti-Behavioral Analysis::Debugger Detection::IsDebuggerPresent (B0001.008)](../anti-behavioral-analysis/debugger-detection.md)|Poison Ivy variant uses the IsDebuggerPresent API function call to check if the process is running in a debugger [[3]](#3)|
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
SHA256 Hashes
|
||||
- 84d90250568f26328394ac2941fe7be266d43b71309caf40eb8863b38a39a506
|
||||
- 4d43c64d776a52ac5a0831aa879305c0eabb452ac5131e1b381598ad7e83cc77
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/poison-ivy
|
||||
|
||||
@@ -42,6 +42,12 @@ MBC Behaviors
|
||||
|[Anti-Behavioral Analysis::Virtual Machine Detection (B0009)](../anti-behavioral-analysis/virtual-machine-detection.md)|Redhip detects VMWare, Virtual PC and Virtual Box. It also detects VM environments in general by considering timing lapses. [[1]](#1)|
|
||||
|[Anti-Behavioral Analysis::Debugger Detection (B0001)](../anti-behavioral-analysis/debugger-detection.md)|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFICE. [[1]](#1)|
|
||||
|[Anti-Behavioral Analysis::Debugger Evasion (B0002)](../anti-behavioral-analysis/debugger-evasion.md)|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFICE. [[1]](#1)|
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
SHA256 Hashes
|
||||
- 07b8f25e7b536f5b6f686c12d04edc37e11347c8acd5c53f98a174723078c365
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
|
||||
<a name="1">[1]</a> https://web.archive.org/web/20161025013916/https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
|
||||
@@ -63,7 +63,7 @@ MBC Behaviors
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
Sample Analysed (SHA256)
|
||||
SHA256 Hashes
|
||||
- 0d11a13f54d6003a51b77df355c6aa9b1d9867a5af7661745882b61d9b75bccf
|
||||
|
||||
Command-and-Control Servers
|
||||
|
||||
@@ -43,7 +43,7 @@ Enhanced ATT&CK Techniques
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
SHA256 Hash
|
||||
SHA256 Hashes
|
||||
- 0785bb93fdb219ea8cb1673de1166bea839da8ba6d7312284d2a08bd41e38cb9
|
||||
- 338fdf3626aa4a48a5972f291aacf3d6172dd920fe16ac4da4dd6c5b999d2f13
|
||||
- 3531bb1077c64840b9c95c45d382448abffa4f386ad88e125c96a38166832252
|
||||
|
||||
@@ -62,6 +62,8 @@ Indicators of Compromise
|
||||
- ~/Library/SPI/
|
||||
- ~/.mitmproxy/
|
||||
|
||||
SHA256 Hashes
|
||||
- Unavailable
|
||||
|
||||
|
||||
References
|
||||
|
||||
@@ -45,6 +45,11 @@ Enhanced ATT&CK Techniques
|
||||
|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|The wiper component of Shamoon creates a service to run the driver with the command: sc create hdv_725x type= kernel start= demand binpath= WINDOWS\hdv_725x.sys 2>&1 >nul and sends an additional reboot command after completion [[2]](#2)|
|
||||
|[Command and Control::Ingress Tool Transfer (E1105)](../command-and-control/ingress-tool-transfer.md)|Creates a folder on remote computers and then copies its executables (Shamoon and Filerase) into that directory [[3]](#3)|
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
SHA256 Hashes
|
||||
- c617120895646f73bc880c0aca18990deda3db9be03f6b3564013e26dedfa3f9
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://www.darkreading.com/attacks-breaches/disk-wiping-shamoon-malware-resurfaces-with-file-erasing-malware-in-tow
|
||||
|
||||
@@ -56,6 +56,11 @@ MBC Behaviors
|
||||
|[Micro-Objective::Process::Create Process::Create Process via WMI (C0017.002)](../micro-behaviors/process/create-process.md)|Stuxnet will use WMI operations with the explorere.exe token in order to copy itself and exscute on the remote share [[1]](#1)|
|
||||
|[Anti-Behavioral Analysis::Conditional Execution::Host Fingerprint Check (B0025.004)](../anti-behavioral-analysis/emulator-detection.md)|Stuxnet checks for specific operating systems on 32-bit machines, registry keys, and dates to profile a potential target machine before execution. If the conditions are not met to be considered a viable target, it will exit execution [[1]](#1)|
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
SHA256 Hashes
|
||||
- 1e7d6cb0b1c29bf2caeb6983da647eb253d4764415ae8dfc493a75053dffe85f
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
|
||||
|
||||
@@ -43,6 +43,11 @@ MBC Behaviors
|
||||
|[Micro-objective::Communication::Socket Communication::Send TCP Data (C0001.014)](../micro-behaviors/communication/socket-communication.md)|To initiate communication with the C2 server, a uniquely crafted TCP SYN packet is sent to port 80 of the "implanted" router [[1]](#1)|
|
||||
|[Defense Evasion::Alternative Installation Location::Fileless Malware (B0027.001)](../defense-evasion/alternative-installation-location.md)|100 memory-resident modules can be installed [[1]](#1)|
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
SHA256 Hashes
|
||||
- Unavailable
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://www.mandiant.com/resources/synful-knock-acis
|
||||
|
||||
@@ -50,6 +50,11 @@ MBC Behaviors
|
||||
|[Command and Control::Command and Control Communication::Send Data (B0030.001)](../command-and-control/c2-communication.md)|The malware sends data to C2 [[2]](#2)|
|
||||
|[Anti-Behavioral Analysis::Dynamic Analysis Evasion::Delayed Execution (B0003.003)](../anti-behavioral-analysis/dynamic-analysis-evasion.md)|The Terminator rat evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[1]](#1)|
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
SHA256 Hashes
|
||||
- 1f97d32674964528db46021a0466138dd01458bfa79f7450e2b222ae1de8ac1f
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://www.mandiant.com/resources/hot-knives-through-butter-evading-file-based-sandboxes
|
||||
|
||||
@@ -56,6 +56,9 @@ MBC Behaviors
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
SHA256 Hashes
|
||||
- a162bb9219a09b302b90bc6f908e117e3fb2c722560336d378fd76a8f22f78f8
|
||||
|
||||
MD5 Hashes
|
||||
- 28661ea73413822c3b5b7de1bef0b246
|
||||
- 218613f0f1d2780f08e754be9e6f8c64
|
||||
|
||||
+9
-11
@@ -59,17 +59,15 @@ MBC Behaviors
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
MD5 Hashes
|
||||
- d579d7a42ff140952da57264614c37bc
|
||||
- d8becbd6f188e3fb2c4d23a2d36d137b
|
||||
- 09ddd70517cb48a46d9f93644b29c72f
|
||||
- f70b295c6a5121b918682310ce0c2165
|
||||
- f80edbb0fcfe7cec17592f61a06e4df2
|
||||
- d8ede9e6c3a1a30398b0b98130ee3b38
|
||||
- ce8ec932be16b69ffa06626b3b423395
|
||||
- 6a541de84074a2c4ff99eb43252d9030
|
||||
- e0eb981ad6be0bd16246d5d442028687
|
||||
- 639c7239f40d95f677a99abb059e8338
|
||||
SHA256 Hashes
|
||||
- 5b875ecf0b7f67a4429aeaa841eddf8e6b58771e16dbdb43ad6918aa7a5b582d
|
||||
- ddc05b9f39f579f64742980980ca9820b83a243889bbc5baa37f5c2c1c4beb30
|
||||
- 41d05788d844b59f8eb79aeb2060dd5b7bdcad01e8d720f4b8b80d552e41cfe2
|
||||
- 2ac69633da711f244377483d99fac53089ec6614a61d8a1492a0e7228cbb8ffd
|
||||
- 5838582ea26312cc60b43da555189b439d3688597a705e3a52dc4d935517f69d
|
||||
- 5b34b3365eb6a6c700b391172849a2668d66a167669018ae3b9555bc2d1e54ab
|
||||
- ec05e37230e6534fa148b8e022f797ad0afe80f699fbd222a46672118663cf00
|
||||
- b748b61ff6c3ea0c64f2359c44e022c629378aab6d7377e64c6ad0dcc5f78746
|
||||
|
||||
IP Addresses
|
||||
- 59.188.12[.]123
|
||||
|
||||
@@ -57,9 +57,11 @@ MBC Behaviors
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
SHA256 Hashes
|
||||
- 6464cf93832a5188d102cce498b4f3be0525ea1b080fec9c4e12fae912984057
|
||||
- hxxp://deekayallday[.]com/data/office
|
||||
- 0b05fb5b97bfc3c82f46b8259a88ae656b1ad294e4c1324d8e8ffd59219005ac
|
||||
|
||||
URLS, IPs, and Domains
|
||||
- hxxp://62.138.9[.]11/30030u
|
||||
- hxxp://62.138.9[.]11/vnc32.dll
|
||||
- hxxp://62.138.9[.]11/vnc64.dll
|
||||
@@ -70,6 +72,7 @@ Indicators of Compromise
|
||||
- au-tdc[.]com
|
||||
- au-tda[.]com
|
||||
- 109.236.87[.]82:443
|
||||
- hxxp://deekayallday[.]com/data/office
|
||||
|
||||
|
||||
References
|
||||
|
||||
@@ -61,6 +61,12 @@ MBC Behaviors
|
||||
|[Anti-Behavioral Analysis::Emulator Evasion (B0005)](../anti-behavioral-analysis/emulator-evasion.md)|[[1]](#1)|
|
||||
|[Anti-Behavioral Analysis::Virtual Machine Detection (B0009)](../anti-behavioral-analysis/virtual-machine-detection.md)|WebCobra injects malicious code to svchost.exe and uses an infinite loop to check all open windows and to compare each window’s title bar text with a set of strings to determine whether it is running in an isolated, malware analysis environment. [[1]](#1)|
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
SHA256 Hashes
|
||||
- 5e14478931e31cf804e08a09e8dffd091db9abd684926792dbebea9b827c9f37
|
||||
|
||||
|
||||
References
|
||||
----------
|
||||
<a name="1">[1]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
|
||||
|
||||
@@ -52,6 +52,15 @@ MBC Behaviors
|
||||
|
||||
Indicators of Compromise
|
||||
------------------------
|
||||
SHA256 Hashes
|
||||
- 57cc101ee4a9f306236d1d4fb5ccb3bb96fa76210142a5ec483a49321d2bd603
|
||||
- 4938b9861b7c55fbbe47d2ba04e9aff2da186e282f1e9ff0a15bbb22a5f6e0e7
|
||||
- fc55c5ced1027b48885780c87980a286181d3639dfc97d03ebe04ec012a1b677
|
||||
- 5259854994945a165996d994e6484c1afc1c7e628cb5df2dc3750f4f9f92202e
|
||||
- 7714dbb85c5ebcd85cd1d93299479cff2cc82ad0ed11803c24c44106530d2e2f
|
||||
- ddd16577b458a5ec21ea0f57084033435a46f61dc5482f224c1fe54f47d295bc
|
||||
- 8fa135fc74583e05be208752e8ce191060b1617447815a007efac78662b425d0
|
||||
|
||||
C2 Server:
|
||||
- bb800.com
|
||||
- iosnoico.bb800[.]com: used to upload informati on, download confi gs and commands, downloadmalicious components
|
||||
@@ -59,18 +68,6 @@ C2 Server:
|
||||
- qvios.od.bb800[.]com: used to download main app
|
||||
- dp.bb800[.]com: used to download promoted iOS apps
|
||||
- iosads.cdn.bb800[.]com: used to download promoted iOS apps and malicious components
|
||||
- 57cc101ee4a9f306236d1d4fb 5ccb3bb96fa76210142a5ec483a49321d2bd603 ADPage
|
||||
- 4938b9861b7c55fb be47d2ba04e9aff 2da186e282f1e9ff 0a15bbb22a5f6e0e7 ADPage.ipa
|
||||
- fc55c5ced1027b48885780c87980a286181d3639dfc97d03ebe04ec012a1b677 DaPian
|
||||
- 5259854994945a165996d994e6484c1afc1c7e628cb5df2dc3750f4f9f92202e DaPian.ipa
|
||||
- 7714dbb85c5ebcd85cd1d93299479cff 2cc82ad0ed11803c24c44106530d2e2f HYQvod
|
||||
- ddd16577b458a5ec21ea0f57084033435a46f61dc5482f224c1fe54f47d295bc HYQvod.ipa
|
||||
- 8fa135fc74583e05be208752e8ce191060b1617447815a007efac78662b425d0 HYQvod_3.3.3
|
||||
- 526e1dc893629c00c017fb e62b53392cb26bc6b15947e7b8b7df10a62f40cbad HYQvod_3.3.3.ipa
|
||||
- 41176825ba0627f61981280b27689a0c5cc6bfb 310a408fa623515e6239b8647 NoIcon
|
||||
- 98e9e65d6e674620eccaf3d024af1e7b736cc889e94a698685623d146d4fb 15f NoIcon.ipa
|
||||
- e7f071929a4304447cf638057d9499df9970b2a3d53d328a609f191a4bc29ff d NoIconUpdate
|
||||
- 8873908061f9c8d563de26fe6fa671080a90a2d60f795cc0664ef686e1162955 NoIconUpdate.ipa
|
||||
|
||||
References
|
||||
----------
|
||||
|
||||
+3
-3
@@ -54,11 +54,11 @@ If lower level behaviors are not known, it may be appropriate to only reference
|
||||
|
||||
Because methods are specific to a behavior, they're always associated with a behavior and aren’t used on their own.
|
||||
|
||||
### <a name="gotbotkr"></a>Can malware behaviors identified via manual analysis map to multiple MBC behaviors, or should correspondence be one-to-one? ###
|
||||
### <a name="gobotkr"></a>Can malware behaviors identified via manual analysis map to multiple MBC behaviors, or should correspondence be one-to-one? ###
|
||||
|
||||
Each malware behavior identified during analysis and associated with a specific code snippet should map to a single MBC behavior. If multiple behaviors seem to apply, the reported behavior should be considered to see whether it can be broken into smaller components that lead to one-to-one mappings.
|
||||
|
||||
For example, a [GotBotKR](../xample-malware/gotbotkr.md) report reflecting manual analysis reads, "The malware installs two instances of itself on the system. The second instance (watchdog) monitors whether the first instance is still active and reinstalls it if it has been removed from the system" [[2]](#2). Initially, one might think this is a single behavior, but it can be broken apart and mapped into two behaviors:
|
||||
For example, a [GotBotKR](../xample-malware/gobotkr.md) report reflecting manual analysis reads, "The malware installs two instances of itself on the system. The second instance (watchdog) monitors whether the first instance is still active and reinstalls it if it has been removed from the system" [[2]](#2). Initially, one might think this is a single behavior, but it can be broken apart and mapped into two behaviors:
|
||||
|
||||
* [DISCOVERY::Process Discovery](https://attack.mitre.org/techniques/T1057/) ("monitors whether the first instance is still active")
|
||||
|
||||
@@ -72,7 +72,7 @@ Behaviors identified by automated tools are often intentionally broad to give an
|
||||
|
||||
### How are MBC behaviors, possibly at different levels of abstraction, associated? ###
|
||||
|
||||
MBC does not define relationships between behaviors, so association of behaviors must be done at the reporting level. The [GotBotKR](../xample-malware/gotbotkr.md) example [above](./gotbotkr) illustrates how two behaviors can be associated by the human-readable text: "The malware installs two instances of itself on the system. The second instance (watchdog) monitors whether the first instance is still active and reinstalls it if it has been removed from the system" [[2]](#2).
|
||||
MBC does not define relationships between behaviors, so association of behaviors must be done at the reporting level. The [GotBotKR](../xample-malware/gobotkr.md) example [above](./gobotkr) illustrates how two behaviors can be associated by the human-readable text: "The malware installs two instances of itself on the system. The second instance (watchdog) monitors whether the first instance is still active and reinstalls it if it has been removed from the system" [[2]](#2).
|
||||
|
||||
### How do I map an analysis product's output to MBC when I don't know the details behind the behavior indicators? ###
|
||||
|
||||
|
||||
Reference in New Issue
Block a user