admin/MBCProject-mbc-markdown
1
0
Fork 0
mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

Malware types (#140)

Browse Source 
* Create malware-types.md

* Update README.md

added link to malware type table.

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update geneio.md

* Update geneio.md

* Update searchawesome.md

* Update chopstick.md

* Update cozycar.md

* Update gobotkr.md

* Update heriplor.md

* Update hupigon.md

* Update synful-knock.md

* Update mebromi.md

* Update blackenergy.md

* Update cozycar.md

* Update cozycar.md

* Update drovorub.md

* Update evilbunny.md

* Update gamut.md

* Update gobotkr.md

* Update cozycar.md

* Update kovter.md

* Update kraken.md

* Update mazarbot.md

* Update blackenergy.md

* Update matanbuchus.md

* Update yispecter.md

* Update cozycar.md

* Update up007.md

* Update teardrop.md

* Update redhip.md

* Update malware-types.md

* Update rombertik.md

* Update snake.md

* Update snake.md

* Update dark-comet.md

* Update badusb.md

* Update dyepack.md

* Update conti.md

* Update cryptolocker.md

* Update cryptowall.md

* Update locky-bart.md

* Update netwalker.md

* Update samsam.md

* Update wannacry.md

* Update adwind-jrat.md

* Update electrorat.md

* Update gravity-rat.md

* Update poison-ivy.md

* Update terminator.md

* Update clipminer.md

* Update webcobra.md

* Update drovorub.md

* Update dark-comet.md

* Update attor.md

* Update geneio.md

* Update malware-types.md

* Update trickbot.md

* Update dark-comet.md

* Update dnschanger.md

* Update emotet.md

* Update kovter.md

* Update heriplor.md

* Update trickbot.md

* Update ursnif.md

* Update mazarbot.md

* Update shamoon.md

* Update bagle.md

* Update conficker.md

* Update stuxnet.md

* Update vobfus.md

* Newsletter, editing E1510, E1560 (#137) (#138)

* Adding Newsletter

* Create 12182023.md

* Update README.md

---------



* Update e1510 (#134)

* Update clipboard-modification.md

Update to account for updates to T1115.

* Update data-encrypted-for-impact.md

fix parentheses

* Update clipboard-modification.md

* Update data-encrypted-for-impact.md

* Update clipboard-modification.md

* Moving Archive Collected Data to collection, some description updates

* Updating Last Modified

---------

Co-authored-by: Ryan Xu <ryanxu@wustl.edu>

* Newsletter, editing E1510, E1560 (#137) (#139)

* Adding Newsletter

* Create 12182023.md

* Update README.md

---------



* Update e1510 (#134)

* Update clipboard-modification.md

Update to account for updates to T1115.

* Update data-encrypted-for-impact.md

fix parentheses

* Update clipboard-modification.md

* Update data-encrypted-for-impact.md

* Update clipboard-modification.md

* Moving Archive Collected Data to collection, some description updates

* Updating Last Modified

---------

Co-authored-by: Ryan Xu <ryanxu@wustl.edu>

---------

Co-authored-by: Ryan Xu <ryanxu@wustl.edu>
This commit is contained in:
Desiree Beck
2023-12-20 21:54:25 -05:00
committed by GitHub
parent a92e8ffdfd
commit 6ce7ebadf2
52 changed files with 255 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
xample-malware/README.md
+7 -3
View File
@@ -1,6 +1,6 @@
# Malware Corpus
The MBC malware corpus comprises a variety of malware where each entry is decomposed into behaviors that are mapped to ATT&CK and MBC. The mappings are based on open source malware analysis reports and are separated into three categories: "ATT&CK Techniques," "Enhanced ATT&CK Techniques," and "MBC Behaviors."
The MBC malware corpus comprises a variety of malware where each entry is decomposed into behaviors that are mapped to ATT&CK and MBC. The mappings are based on open source malware analysis reports and are separated into three categories: "ATT&CK Techniques," "Enhanced ATT&CK Techniques," and "MBC Behaviors."
**ATT&CK Techniques** - If a malware entry *is not* included in ATT&CK's software collection, then all ATT&CK techniques to which its malware behaviors map are listed. If a malware entry *is* included in ATT&CK's software collection, then the corresponding software page is referenced under "ATT&CK Techniques" (individual mappings *not* captured in ATT&CK are still listed). These techniques have T identifiers (e.g., T1012).
@@ -8,10 +8,14 @@ The MBC malware corpus comprises a variety of malware where each entry is decomp
**MBC Behaviors** - This section lists all MBC behaviors to which an entry's malware behaviors map. These techniques have B and C identifiers (e.g., B0032, C0010).
Please see Poison-Ivy [X0014](../xample-malware/poison-ivy.md) and Kovter [X0009](../xample-malware/kovter.md) for examples of malware samples included and *not* included in ATT&CK's collection, respectively.
### Notes
* Each entry is mapped to one or more [malware types](./malware-types.md).
Also, please see the [FAQ](../yfaq/README.md/#other) for information about malware entries that illustrate the use of MBC in [Attack Flow](https://mitre-engenuity.org/cybersecurity/center-for-threat-informed-defense/our-work/attack-flow/) and [CACAO](https://github.com/oasis-tcs/cacao).
* Poison-Ivy [X0014](../xample-malware/poison-ivy.md) and Kovter [X0009](../xample-malware/kovter.md) are examples of malware samples included and *not* included in ATT&CK's collection, respectively.
* The [FAQ](../yfaq/README.md/#other) includes information about the malware used to illustrate the use of MBC in [Attack Flow](https://mitre-engenuity.org/cybersecurity/center-for-threat-informed-defense/our-work/attack-flow/) and [CACAO](https://github.com/oasis-tcs/cacao).
## The List
* **Adwind jRAT** [X0048](../xample-malware/adwind-jrat.md)
* **Attor** [X0049](../xample-malware/attor.md)
* **BadUSB** [X0046](../xample-malware/badusb.md)
xample-malware/adwind-jrat.md
+5 -1
View File
@@ -4,6 +4,10 @@
<td><b>X0048</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Remote Access Trojan</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
@@ -37,4 +41,4 @@ See ATT&CK: [jRAT - Techniques Used](https://attack.mitre.org/software/S0283/).
## References
<a name="1">[1]</a> https://www.menlosecurity.com/blog/hiding-in-plain-sight-new-adwind-jrat-variant-uses-normal-java-commands-to-mask-its-behavior/
<a name="1">[1]</a> https://www.menlosecurity.com/blog/hiding-in-plain-sight-new-adwind-jrat-variant-uses-normal-java-commands-to-mask-its-behavior/
xample-malware/attor.md
+5 -1
View File
@@ -4,6 +4,10 @@
<td><b>X0049</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Spyware</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
@@ -46,4 +50,4 @@ SHA1 Hashes
## References
<a name="1">[1]</a> https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf
<a name="1">[1]</a> https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf
xample-malware/badusb.md
+4
View File
@@ -4,6 +4,10 @@
<td><b>X0046</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Other</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
xample-malware/bagle.md
+4
View File
@@ -4,6 +4,10 @@
<td><b>X0001</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Bagle</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
xample-malware/blackenergy.md
+4
View File
@@ -4,6 +4,10 @@
<td><b>X0002</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Bot/Botnet, DDoS</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
xample-malware/chopstick.md
+5 -1
View File
@@ -5,6 +5,10 @@
<td><b>X0035</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Backdoor</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>Xagent</b></td>
</tr>
@@ -55,4 +59,4 @@ SHA256 Hashes
## References
<a name="1">[1]</a> https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf
<a name="1">[1]</a> https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf
xample-malware/clipminer.md
+5 -1
View File
@@ -5,6 +5,10 @@
<td><b>X0038</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Resource Exploitation</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
@@ -59,4 +63,4 @@ SHA256 Hashes
## References
<a name="1">[1]</a> https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking
<a name="1">[1]</a> https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking
xample-malware/conficker.md
+4
View File
@@ -5,6 +5,10 @@
<td><b>X0003</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Worm</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>Downup, Downadup, Kido</b></td>
</tr>
xample-malware/conti.md
+4
View File
@@ -5,6 +5,10 @@
<td><b>X0050</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Ransomware</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
xample-malware/cozycar.md
+5 -1
View File
@@ -5,6 +5,10 @@
<td><b>X0034</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Backdoor, Bot/Botnet, Dropper</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
@@ -58,4 +62,4 @@ IP Addresses
## References
<a name="1">[1]</a> https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke/
<a name="1">[1]</a> https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke/
xample-malware/cryptolocker.md
+4
View File
@@ -4,6 +4,10 @@
<td><b>X0030</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Ransomware</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
xample-malware/cryptowall.md
+5 -1
View File
@@ -5,6 +5,10 @@
<td><b>X0029</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Ransomware</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
@@ -63,4 +67,4 @@ SHA256 Hashes
<a name="1">[1]</a> https://news.sophos.com/en-us/2015/12/17/the-current-state-of-ransomware-cryptowall/
<a name="2">[2]</a> https://www.secureworks.com/research/cryptowall-ransomware
<a name="2">[2]</a> https://www.secureworks.com/research/cryptowall-ransomware
xample-malware/dark-comet.md
+4
View File
@@ -4,6 +4,10 @@
<td><b>X0004</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Keylogger, Screen Capture, Trojan</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
xample-malware/dnschanger.md
+4
View File
@@ -4,6 +4,10 @@
<td><b>X0005</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Trojan</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
xample-malware/drovorub.md
+5 -1
View File
@@ -4,6 +4,10 @@
<td><b>X0045</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Bot/Botnet, Rootkit</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
@@ -45,4 +49,4 @@ SHA256 Hashes
## References
<a name="1">[1]</a> https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF
<a name="1">[1]</a> https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF
xample-malware/dyepack.md
+5 -1
View File
@@ -4,6 +4,10 @@
<td><b>X0042</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Other</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
@@ -33,4 +37,4 @@ DYEPACK is a malware suite that manipulates local information regarding SWIFT tr
## References
<a name="1">[1]</a> https://content.fireeye.com/apt/rpt-apt38
<a name="1">[1]</a> https://content.fireeye.com/apt/rpt-apt38
xample-malware/electrorat.md
+4
View File
@@ -4,6 +4,10 @@
<td><b>X0044</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Remote Access Trojan</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
xample-malware/emotet.md
+4
View File
@@ -4,6 +4,10 @@
<td><b>X0028</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Trojan (banking trojan)</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>Geodo</b></td>
</tr>
xample-malware/evilbunny.md
+5 -1
View File
@@ -5,6 +5,10 @@
<td><b>X0036</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Bot/Botnet</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
@@ -52,4 +56,4 @@ SHA256 Hashes
## References
<a name="1">[1]</a> https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/
<a name="1">[1]</a> https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/
xample-malware/gamut.md
+4
View File
@@ -4,6 +4,10 @@
<td><b>X0006</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Bot/Botnet (spambot)</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>Bobax</b></td>
</tr>
xample-malware/geneio.md
+5 -1
View File
@@ -5,6 +5,10 @@
<td><b>X0007</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Adware, Spyware</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
@@ -62,4 +66,4 @@ SHA256 Hashes
## References
<a name="1">[1]</a> https://blog.malwarebytes.org/mac/2015/08/genieo-installer-tricks-keychain/
<a name="1">[1]</a> https://blog.malwarebytes.org/mac/2015/08/genieo-installer-tricks-keychain/
xample-malware/gobotkr.md
+4
View File
@@ -4,6 +4,10 @@
<td><b>X0027</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Backdoor, Bot/Botnet</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
xample-malware/gravity-rat.md
+4
View File
@@ -4,6 +4,10 @@
<td><b>X0032</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Remote Access Trojan</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
xample-malware/heriplor.md
+4
View File
@@ -4,6 +4,10 @@
<td><b>X0026</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Backdoor, Trojan</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
xample-malware/hupigon.md
+4
View File
@@ -4,6 +4,10 @@
<td><b>X0008</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Backdoor</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>Delf, Emerleox, Logsnif, Graybird, Pcclient</b></td>
</tr>
xample-malware/kovter.md
+4
View File
@@ -4,6 +4,10 @@
<td><b>X0009</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Bot/Botnet (click-fraud), Trojan</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
xample-malware/kraken.md
+4
View File
@@ -4,6 +4,10 @@
<td><b>X0010</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Bot/Botnet</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>Bobax</b></td>
</tr>
xample-malware/locky-bart.md
+4
View File
@@ -4,6 +4,10 @@
<td><b>X0011</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Ransomware</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
xample-malware/malware-types.md
+34
View File
@@ -0,0 +1,34 @@
## Malware Types
Many of the types and descriptions were taken from the STIX 2.1 Malware Type open vocabulary [[1]](#1).
|Type|Description|Malware Corpus|
|----|-----------|--------------|
|**adware**|Any software that is funded by advertising. Adware may also gather sensitive user information from a system. [[1]](#1)|Geneio, SearchAwesome|
|**backdoor**|A malicious program that allows an attacker to perform actions on a remote system, such as transferring files, acquiring passwords, or executing arbitrary commands [[2]](#2).|CHOPSTICK, CozyCar, GoBotKR, Heriplor, Hupigon, SYNful Knock|
|**bootkit**|A malicious program that targets the Master Boot Record of the target computer. [[1]](#1)|Mebromi|
|**bot/botnet**|A program that resides on an infected system, communicating with and forming part of a botnet. The bot may be implanted by a worm or Trojan, which opens a backdoor. The bot then monitors the backdoor for further instructions. [[1]](#1)|BlackEnergy, CozyCar, Drovorub, EvilBunny, Gamut (spambot), GoBotKR, Kovter (click-fraud), Kraken, Mazar BOT|
|**ddos**|A program that is used to perform a distributed denial of service attack. [[1]](#1)|BlackEnergy|
|**downloader**|A small trojan file programmed to download and execute other files, usually more complex malware. [[1]](#1)|Matanbuchus, YiSpecter|
|**dropper**|A type of trojan that deposits an enclosed payload (generally, other malware) onto the target computer. [[1]](#1)|CozyCar, UP007, TEARDROP|
|**exploit-kit**|A software toolkit to target common vulnerabilities.||
|**info-stealer / uploader**|Steals and exfiltrates information.|Redhip, Romberik, Snake|
|**keylogger**|A type of malware that surreptitiously monitors keystrokes and either records them for later retrieval or sends them back to a central collection point.[[1]](#1)|Dark Comet, Snake|
|**other**|The malware doesn't fall into another catagory.|BadUSB, DYEPACK|
|**ransomware**|A type of malware that encrypts files on a victim's system, demanding payment of ransom in return for the access codes required to unlock files.[[1]](#1)|Conti, CryptoLocker, CryptoWall, Locky Bart, Netwalker, SamSam, WannaCry|
|**remote-access-trojan**|A remote access trojan program (or RAT), is a trojan horse capable of controlling a machine through commands issued by a remote attacker. [[1]](#1)|Adwind jRAT, ElectroRAT, GravityRAT, Poison Ivy, Terminator|
|**resource-exploitation**|A type of malware that steals a system's resources (e.g., CPU cycles), such as a malicious bitcoin miner.[[1]](#1)|Clipminer, WebCobra|
|**rogue-security-software**|A fake security product that demands money to clean phony infections. [[1]](#1)||
|**rootkit**|A type of malware that hides its files or processes from normal methods of monitoring in order to conceal its presence and activities. Rootkits can operate at a number of levels, from the application level — simply replacing or adjusting the settings of system software to prevent the display of certain information — through hooking certain functions or inserting modules or drivers into the operating system kernel, to the deeper level of firmware or virtualization rootkits, which are activated before the operating system and thus even harder to detect while the system is running. [[1]](#1)|Drovorub|
|**screen-capture**|A type of malware used to capture images from the target systems screen, used for exfiltration and command and control. [[1]](#1)|Dark Comet|
|**spyware**|Software that gathers information on a user's system without their knowledge and sends it to another party. Spyware is generally used to track activities for the purpose of delivering advertising. [[1]](#1)|Attor, Geneio, TrickBot|
|**trojan**|Any malicious computer program which is used to hack into a computer by misleading users of its true intent. [[1]](#1)|Dark Comet, DNSChanger, Emotet (banking-trojan), Kovter, Heriplor, Trickbot (banking-trojan), Ursnif (banking-trojan)|
|**virus**|A malicious computer program that replicates by reproducing itself or infecting other programs by modifying them. [[1]](#1)||
|**webshell**|A malicious script used by an attacker with the intent to escalate and maintain persistent access on an already compromised web application. [[1]](#1)||
|**wiper**|Malware with the primary aim to delete files or entire disks on a machine. [[1]](#1)|Mazar BOT, Shamoon|
|**worm**|A self-replicating, self-contained program that usually executes itself without user intervention. [[1]](#1)|Bagle, Conficker, Stuxnet, Vobfus|
## References
<a name="1">[1]</a> https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html
<a name="2">[2]</a> M. Souppaya and K. Scarfone, "Guide to Malware Incident Prevention and Handling for Desktops and Laptops", NIST Special Publication 800-83, 2013. [Online]. Available: https://csrc.nist.gov/publications/detail/sp/800-83/rev-1/final.
xample-malware/matanbuchus.md
+4
View File
@@ -5,6 +5,10 @@
<td><b>X0040</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Downloader</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
xample-malware/mazarbot.md
+4
View File
@@ -5,6 +5,10 @@
<td><b>X0012</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Bot/Botnet, Wiper</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
xample-malware/mebromi.md
+4
View File
@@ -4,6 +4,10 @@
<td><b>X0013</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Bootkit</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
xample-malware/netwalker.md
+5 -1
View File
@@ -5,6 +5,10 @@
<td><b>X0037</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Ransomware</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
@@ -47,4 +51,4 @@ SHA256 Hashes
## References
<a name="1">[1]</a> https://www.trendmicro.com/en_us/research/20/e/netwalker-fileless-ransomware-injected-via-reflective-loading.html
<a name="1">[1]</a> https://www.trendmicro.com/en_us/research/20/e/netwalker-fileless-ransomware-injected-via-reflective-loading.html
xample-malware/poison-ivy.md
+4
View File
@@ -4,6 +4,10 @@
<td><b>X0014</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Remote Access Trojan</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
xample-malware/redhip.md
+4
View File
@@ -4,6 +4,10 @@
<td><b>X0015</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Info-stealer/Uploader</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
xample-malware/rombertik.md
+4
View File
@@ -4,6 +4,10 @@
<td><b>X0031</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Info-stealer/Uploader</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
xample-malware/samsam.md
+4
View File
@@ -4,6 +4,10 @@
<td><b>X0016</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Ransomware</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>MSIL/Samas.A, Samas, Samsa</b></td>
</tr>
xample-malware/searchawesome.md
+4
View File
@@ -5,6 +5,10 @@
<td><b>X0017</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Adware</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
xample-malware/shamoon.md
+4
View File
@@ -4,6 +4,10 @@
<td><b>X0018</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Wiper</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
xample-malware/snake.md
+5 -1
View File
@@ -4,6 +4,10 @@
<td><b>X0047</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Info-stealer/Uploader, Keylogger</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
@@ -34,4 +38,4 @@ The Snake malware is an information-stealing malware that is implemented in the
## References
<a name="1">[1]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware
<a name="1">[1]</a> https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware
xample-malware/stuxnet.md
+5 -1
View File
@@ -4,6 +4,10 @@
<td><b>X0019</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Worm</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>Rootkit.Tmphider, W32.Temphid</b></td>
</tr>
@@ -76,4 +80,4 @@ SHA256 Hashes
<a name="1">[1]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
<a name="2">[2]</a> capa v4.0, analyzed at MITRE on 10/12/2022
<a name="2">[2]</a> capa v4.0, analyzed at MITRE on 10/12/2022
xample-malware/synful-knock.md
+4
View File
@@ -5,6 +5,10 @@
<td><b>X0020</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Backdoor</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
xample-malware/teardrop.md
+4
View File
@@ -5,6 +5,10 @@
<td><b>X0041</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Dropper</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
xample-malware/terminator.md
+4
View File
@@ -5,6 +5,10 @@
<td><b>X0021</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Remote Access Trojan</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
xample-malware/trickbot.md
+4
View File
@@ -4,6 +4,10 @@
<td><b>X0025</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Spyware, Trojan (banking trojan)</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
xample-malware/up007.md
+4
View File
@@ -4,6 +4,10 @@
<td><b>X0033</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Dropper</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
xample-malware/ursnif.md
+4
View File
@@ -4,6 +4,10 @@
<td><b>X0022</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Trojan (banking trojan)</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>Dreambot, Gozi</b></td>
</tr>
xample-malware/vobfus.md
+4
View File
@@ -5,6 +5,10 @@
<td><b>X0039</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Worm</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
xample-malware/wannacry.md
+5 -1
View File
@@ -4,6 +4,10 @@
<td><b>X0043</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Ransomware</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
@@ -56,4 +60,4 @@ MD5 Hashes
## References
<a name="1">[1]</a> https://www.mandiant.com/resources/blog/wannacry-malware-profile
<a name="1">[1]</a> https://www.mandiant.com/resources/blog/wannacry-malware-profile
xample-malware/webcobra.md
+4
View File
@@ -5,6 +5,10 @@
<td><b>X0023</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Resource Exploitation</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>
xample-malware/yispecter.md
+4
View File
@@ -5,6 +5,10 @@
<td><b>X0024</b></td>
</tr>
<tr>
<td><b>Type</b></td>
<td><b>Downloader</b></td>
</tr>
<tr>
<td><b>Aliases</b></td>
<td><b>None</b></td>
</tr>