diff --git a/xample-malware/README.md b/xample-malware/README.md index c636945..d18e47f 100644 --- a/xample-malware/README.md +++ b/xample-malware/README.md @@ -1,6 +1,6 @@ # Malware Corpus -The MBC malware corpus comprises a variety of malware where each entry is decomposed into behaviors that are mapped to ATT&CK and MBC. The mappings are based on open source malware analysis reports and are separated into three categories: "ATT&CK Techniques," "Enhanced ATT&CK Techniques," and "MBC Behaviors." +The MBC malware corpus comprises a variety of malware where each entry is decomposed into behaviors that are mapped to ATT&CK and MBC. The mappings are based on open source malware analysis reports and are separated into three categories: "ATT&CK Techniques," "Enhanced ATT&CK Techniques," and "MBC Behaviors." **ATT&CK Techniques** - If a malware entry *is not* included in ATT&CK's software collection, then all ATT&CK techniques to which its malware behaviors map are listed. If a malware entry *is* included in ATT&CK's software collection, then the corresponding software page is referenced under "ATT&CK Techniques" (individual mappings *not* captured in ATT&CK are still listed). These techniques have T identifiers (e.g., T1012). @@ -8,10 +8,14 @@ The MBC malware corpus comprises a variety of malware where each entry is decomp **MBC Behaviors** - This section lists all MBC behaviors to which an entry's malware behaviors map. These techniques have B and C identifiers (e.g., B0032, C0010). -Please see Poison-Ivy [X0014](../xample-malware/poison-ivy.md) and Kovter [X0009](../xample-malware/kovter.md) for examples of malware samples included and *not* included in ATT&CK's collection, respectively. +### Notes +* Each entry is mapped to one or more [malware types](./malware-types.md). -Also, please see the [FAQ](../yfaq/README.md/#other) for information about malware entries that illustrate the use of MBC in [Attack Flow](https://mitre-engenuity.org/cybersecurity/center-for-threat-informed-defense/our-work/attack-flow/) and [CACAO](https://github.com/oasis-tcs/cacao). +* Poison-Ivy [X0014](../xample-malware/poison-ivy.md) and Kovter [X0009](../xample-malware/kovter.md) are examples of malware samples included and *not* included in ATT&CK's collection, respectively. +* The [FAQ](../yfaq/README.md/#other) includes information about the malware used to illustrate the use of MBC in [Attack Flow](https://mitre-engenuity.org/cybersecurity/center-for-threat-informed-defense/our-work/attack-flow/) and [CACAO](https://github.com/oasis-tcs/cacao). + +## The List * **Adwind jRAT** [X0048](../xample-malware/adwind-jrat.md) * **Attor** [X0049](../xample-malware/attor.md) * **BadUSB** [X0046](../xample-malware/badusb.md) diff --git a/xample-malware/adwind-jrat.md b/xample-malware/adwind-jrat.md index 37edc19..b31a5f4 100644 --- a/xample-malware/adwind-jrat.md +++ b/xample-malware/adwind-jrat.md @@ -4,6 +4,10 @@ X0048 +Type +Remote Access Trojan + + Aliases None @@ -37,4 +41,4 @@ See ATT&CK: [jRAT - Techniques Used](https://attack.mitre.org/software/S0283/). ## References -[1] https://www.menlosecurity.com/blog/hiding-in-plain-sight-new-adwind-jrat-variant-uses-normal-java-commands-to-mask-its-behavior/ \ No newline at end of file +[1] https://www.menlosecurity.com/blog/hiding-in-plain-sight-new-adwind-jrat-variant-uses-normal-java-commands-to-mask-its-behavior/ diff --git a/xample-malware/attor.md b/xample-malware/attor.md index a76ffc2..dde1bb3 100644 --- a/xample-malware/attor.md +++ b/xample-malware/attor.md @@ -4,6 +4,10 @@ X0049 +Type +Spyware + + Aliases None @@ -46,4 +50,4 @@ SHA1 Hashes ## References -[1] https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf \ No newline at end of file +[1] https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf diff --git a/xample-malware/badusb.md b/xample-malware/badusb.md index ad32d55..889df1e 100644 --- a/xample-malware/badusb.md +++ b/xample-malware/badusb.md @@ -4,6 +4,10 @@ X0046 +Type +Other + + Aliases None diff --git a/xample-malware/bagle.md b/xample-malware/bagle.md index f1b90f3..ad753b3 100644 --- a/xample-malware/bagle.md +++ b/xample-malware/bagle.md @@ -4,6 +4,10 @@ X0001 +Type +Bagle + + Aliases None diff --git a/xample-malware/blackenergy.md b/xample-malware/blackenergy.md index c6e90b9..b2cf7f5 100644 --- a/xample-malware/blackenergy.md +++ b/xample-malware/blackenergy.md @@ -4,6 +4,10 @@ X0002 +Type +Bot/Botnet, DDoS + + Aliases None diff --git a/xample-malware/chopstick.md b/xample-malware/chopstick.md index dce72c1..c812a54 100644 --- a/xample-malware/chopstick.md +++ b/xample-malware/chopstick.md @@ -5,6 +5,10 @@ X0035 +Type +Backdoor + + Aliases Xagent @@ -55,4 +59,4 @@ SHA256 Hashes ## References -[1] https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf \ No newline at end of file +[1] https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf diff --git a/xample-malware/clipminer.md b/xample-malware/clipminer.md index f9311c9..b76d001 100644 --- a/xample-malware/clipminer.md +++ b/xample-malware/clipminer.md @@ -5,6 +5,10 @@ X0038 +Type +Resource Exploitation + + Aliases None @@ -59,4 +63,4 @@ SHA256 Hashes ## References -[1] https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking \ No newline at end of file +[1] https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking diff --git a/xample-malware/conficker.md b/xample-malware/conficker.md index 201f71b..3c81f64 100644 --- a/xample-malware/conficker.md +++ b/xample-malware/conficker.md @@ -5,6 +5,10 @@ X0003 +Type +Worm + + Aliases Downup, Downadup, Kido diff --git a/xample-malware/conti.md b/xample-malware/conti.md index e15afea..e87e86f 100644 --- a/xample-malware/conti.md +++ b/xample-malware/conti.md @@ -5,6 +5,10 @@ X0050 +Type +Ransomware + + Aliases None diff --git a/xample-malware/cozycar.md b/xample-malware/cozycar.md index 1762f34..ce31fb2 100644 --- a/xample-malware/cozycar.md +++ b/xample-malware/cozycar.md @@ -5,6 +5,10 @@ X0034 +Type +Backdoor, Bot/Botnet, Dropper + + Aliases None @@ -58,4 +62,4 @@ IP Addresses ## References -[1] https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke/ \ No newline at end of file +[1] https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke/ diff --git a/xample-malware/cryptolocker.md b/xample-malware/cryptolocker.md index 1a2cc07..8f879b4 100644 --- a/xample-malware/cryptolocker.md +++ b/xample-malware/cryptolocker.md @@ -4,6 +4,10 @@ X0030 +Type +Ransomware + + Aliases None diff --git a/xample-malware/cryptowall.md b/xample-malware/cryptowall.md index 303403c..a71f975 100644 --- a/xample-malware/cryptowall.md +++ b/xample-malware/cryptowall.md @@ -5,6 +5,10 @@ X0029 +Type +Ransomware + + Aliases None @@ -63,4 +67,4 @@ SHA256 Hashes [1] https://news.sophos.com/en-us/2015/12/17/the-current-state-of-ransomware-cryptowall/ -[2] https://www.secureworks.com/research/cryptowall-ransomware \ No newline at end of file +[2] https://www.secureworks.com/research/cryptowall-ransomware diff --git a/xample-malware/dark-comet.md b/xample-malware/dark-comet.md index 34c6682..73d1ec6 100644 --- a/xample-malware/dark-comet.md +++ b/xample-malware/dark-comet.md @@ -4,6 +4,10 @@ X0004 +Type +Keylogger, Screen Capture, Trojan + + Aliases None diff --git a/xample-malware/dnschanger.md b/xample-malware/dnschanger.md index df9e426..88eee5c 100644 --- a/xample-malware/dnschanger.md +++ b/xample-malware/dnschanger.md @@ -4,6 +4,10 @@ X0005 +Type +Trojan + + Aliases None diff --git a/xample-malware/drovorub.md b/xample-malware/drovorub.md index a2fc527..ee52666 100644 --- a/xample-malware/drovorub.md +++ b/xample-malware/drovorub.md @@ -4,6 +4,10 @@ X0045 +Type +Bot/Botnet, Rootkit + + Aliases None @@ -45,4 +49,4 @@ SHA256 Hashes ## References -[1] https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF \ No newline at end of file +[1] https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF diff --git a/xample-malware/dyepack.md b/xample-malware/dyepack.md index 27b75e2..688a5db 100644 --- a/xample-malware/dyepack.md +++ b/xample-malware/dyepack.md @@ -4,6 +4,10 @@ X0042 +Type +Other + + Aliases None @@ -33,4 +37,4 @@ DYEPACK is a malware suite that manipulates local information regarding SWIFT tr ## References -[1] https://content.fireeye.com/apt/rpt-apt38 \ No newline at end of file +[1] https://content.fireeye.com/apt/rpt-apt38 diff --git a/xample-malware/electrorat.md b/xample-malware/electrorat.md index 372fedf..15d910c 100644 --- a/xample-malware/electrorat.md +++ b/xample-malware/electrorat.md @@ -4,6 +4,10 @@ X0044 +Type +Remote Access Trojan + + Aliases None diff --git a/xample-malware/emotet.md b/xample-malware/emotet.md index 8bc8e56..01a6149 100644 --- a/xample-malware/emotet.md +++ b/xample-malware/emotet.md @@ -4,6 +4,10 @@ X0028 +Type +Trojan (banking trojan) + + Aliases Geodo diff --git a/xample-malware/evilbunny.md b/xample-malware/evilbunny.md index 4ccb774..c28bfd5 100644 --- a/xample-malware/evilbunny.md +++ b/xample-malware/evilbunny.md @@ -5,6 +5,10 @@ X0036 +Type +Bot/Botnet + + Aliases None @@ -52,4 +56,4 @@ SHA256 Hashes ## References -[1] https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/ \ No newline at end of file +[1] https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/ diff --git a/xample-malware/gamut.md b/xample-malware/gamut.md index eaeadc5..c66c08e 100644 --- a/xample-malware/gamut.md +++ b/xample-malware/gamut.md @@ -4,6 +4,10 @@ X0006 +Type +Bot/Botnet (spambot) + + Aliases Bobax diff --git a/xample-malware/geneio.md b/xample-malware/geneio.md index a81e0ee..30285e2 100644 --- a/xample-malware/geneio.md +++ b/xample-malware/geneio.md @@ -5,6 +5,10 @@ X0007 +Type +Adware, Spyware + + Aliases None @@ -62,4 +66,4 @@ SHA256 Hashes ## References -[1] https://blog.malwarebytes.org/mac/2015/08/genieo-installer-tricks-keychain/ \ No newline at end of file +[1] https://blog.malwarebytes.org/mac/2015/08/genieo-installer-tricks-keychain/ diff --git a/xample-malware/gobotkr.md b/xample-malware/gobotkr.md index 4ac37f0..b0b225b 100644 --- a/xample-malware/gobotkr.md +++ b/xample-malware/gobotkr.md @@ -4,6 +4,10 @@ X0027 +Type +Backdoor, Bot/Botnet + + Aliases None diff --git a/xample-malware/gravity-rat.md b/xample-malware/gravity-rat.md index 8304945..a481952 100644 --- a/xample-malware/gravity-rat.md +++ b/xample-malware/gravity-rat.md @@ -4,6 +4,10 @@ X0032 +Type +Remote Access Trojan + + Aliases None diff --git a/xample-malware/heriplor.md b/xample-malware/heriplor.md index 0dd003c..76e5484 100644 --- a/xample-malware/heriplor.md +++ b/xample-malware/heriplor.md @@ -4,6 +4,10 @@ X0026 +Type +Backdoor, Trojan + + Aliases None diff --git a/xample-malware/hupigon.md b/xample-malware/hupigon.md index 577831f..02d0e63 100644 --- a/xample-malware/hupigon.md +++ b/xample-malware/hupigon.md @@ -4,6 +4,10 @@ X0008 +Type +Backdoor + + Aliases Delf, Emerleox, Logsnif, Graybird, Pcclient diff --git a/xample-malware/kovter.md b/xample-malware/kovter.md index c041b55..0addfc4 100644 --- a/xample-malware/kovter.md +++ b/xample-malware/kovter.md @@ -4,6 +4,10 @@ X0009 +Type +Bot/Botnet (click-fraud), Trojan + + Aliases None diff --git a/xample-malware/kraken.md b/xample-malware/kraken.md index 7ba82df..5c3ad83 100644 --- a/xample-malware/kraken.md +++ b/xample-malware/kraken.md @@ -4,6 +4,10 @@ X0010 +Type +Bot/Botnet + + Aliases Bobax diff --git a/xample-malware/locky-bart.md b/xample-malware/locky-bart.md index 145335d..5716624 100644 --- a/xample-malware/locky-bart.md +++ b/xample-malware/locky-bart.md @@ -4,6 +4,10 @@ X0011 +Type +Ransomware + + Aliases None diff --git a/xample-malware/malware-types.md b/xample-malware/malware-types.md new file mode 100644 index 0000000..de98e6e --- /dev/null +++ b/xample-malware/malware-types.md @@ -0,0 +1,34 @@ +## Malware Types +Many of the types and descriptions were taken from the STIX 2.1 Malware Type open vocabulary [[1]](#1). + +|Type|Description|Malware Corpus| +|----|-----------|--------------| +|**adware**|Any software that is funded by advertising. Adware may also gather sensitive user information from a system. [[1]](#1)|Geneio, SearchAwesome| +|**backdoor**|A malicious program that allows an attacker to perform actions on a remote system, such as transferring files, acquiring passwords, or executing arbitrary commands [[2]](#2).|CHOPSTICK, CozyCar, GoBotKR, Heriplor, Hupigon, SYNful Knock| +|**bootkit**|A malicious program that targets the Master Boot Record of the target computer. [[1]](#1)|Mebromi| +|**bot/botnet**|A program that resides on an infected system, communicating with and forming part of a botnet. The bot may be implanted by a worm or Trojan, which opens a backdoor. The bot then monitors the backdoor for further instructions. [[1]](#1)|BlackEnergy, CozyCar, Drovorub, EvilBunny, Gamut (spambot), GoBotKR, Kovter (click-fraud), Kraken, Mazar BOT| +|**ddos**|A program that is used to perform a distributed denial of service attack. [[1]](#1)|BlackEnergy| +|**downloader**|A small trojan file programmed to download and execute other files, usually more complex malware. [[1]](#1)|Matanbuchus, YiSpecter| +|**dropper**|A type of trojan that deposits an enclosed payload (generally, other malware) onto the target computer. [[1]](#1)|CozyCar, UP007, TEARDROP| +|**exploit-kit**|A software toolkit to target common vulnerabilities.|| +|**info-stealer / uploader**|Steals and exfiltrates information.|Redhip, Romberik, Snake| +|**keylogger**|A type of malware that surreptitiously monitors keystrokes and either records them for later retrieval or sends them back to a central collection point.[[1]](#1)|Dark Comet, Snake| +|**other**|The malware doesn't fall into another catagory.|BadUSB, DYEPACK| +|**ransomware**|A type of malware that encrypts files on a victim's system, demanding payment of ransom in return for the access codes required to unlock files.[[1]](#1)|Conti, CryptoLocker, CryptoWall, Locky Bart, Netwalker, SamSam, WannaCry| +|**remote-access-trojan**|A remote access trojan program (or RAT), is a trojan horse capable of controlling a machine through commands issued by a remote attacker. [[1]](#1)|Adwind jRAT, ElectroRAT, GravityRAT, Poison Ivy, Terminator| +|**resource-exploitation**|A type of malware that steals a system's resources (e.g., CPU cycles), such as a malicious bitcoin miner.[[1]](#1)|Clipminer, WebCobra| +|**rogue-security-software**|A fake security product that demands money to clean phony infections. [[1]](#1)|| +|**rootkit**|A type of malware that hides its files or processes from normal methods of monitoring in order to conceal its presence and activities. Rootkits can operate at a number of levels, from the application level — simply replacing or adjusting the settings of system software to prevent the display of certain information — through hooking certain functions or inserting modules or drivers into the operating system kernel, to the deeper level of firmware or virtualization rootkits, which are activated before the operating system and thus even harder to detect while the system is running. [[1]](#1)|Drovorub| +|**screen-capture**|A type of malware used to capture images from the target systems screen, used for exfiltration and command and control. [[1]](#1)|Dark Comet| +|**spyware**|Software that gathers information on a user's system without their knowledge and sends it to another party. Spyware is generally used to track activities for the purpose of delivering advertising. [[1]](#1)|Attor, Geneio, TrickBot| +|**trojan**|Any malicious computer program which is used to hack into a computer by misleading users of its true intent. [[1]](#1)|Dark Comet, DNSChanger, Emotet (banking-trojan), Kovter, Heriplor, Trickbot (banking-trojan), Ursnif (banking-trojan)| +|**virus**|A malicious computer program that replicates by reproducing itself or infecting other programs by modifying them. [[1]](#1)|| +|**webshell**|A malicious script used by an attacker with the intent to escalate and maintain persistent access on an already compromised web application. [[1]](#1)|| +|**wiper**|Malware with the primary aim to delete files or entire disks on a machine. [[1]](#1)|Mazar BOT, Shamoon| +|**worm**|A self-replicating, self-contained program that usually executes itself without user intervention. [[1]](#1)|Bagle, Conficker, Stuxnet, Vobfus| + +## References + +[1] https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html + +[2] M. Souppaya and K. Scarfone, "Guide to Malware Incident Prevention and Handling for Desktops and Laptops", NIST Special Publication 800-83, 2013. [Online]. Available: https://csrc.nist.gov/publications/detail/sp/800-83/rev-1/final. diff --git a/xample-malware/matanbuchus.md b/xample-malware/matanbuchus.md index 4ac0951..1478f3c 100644 --- a/xample-malware/matanbuchus.md +++ b/xample-malware/matanbuchus.md @@ -5,6 +5,10 @@ X0040 +Type +Downloader + + Aliases None diff --git a/xample-malware/mazarbot.md b/xample-malware/mazarbot.md index 661a48b..1149b85 100644 --- a/xample-malware/mazarbot.md +++ b/xample-malware/mazarbot.md @@ -5,6 +5,10 @@ X0012 +Type +Bot/Botnet, Wiper + + Aliases None diff --git a/xample-malware/mebromi.md b/xample-malware/mebromi.md index 443faf0..db36ca6 100644 --- a/xample-malware/mebromi.md +++ b/xample-malware/mebromi.md @@ -4,6 +4,10 @@ X0013 +Type +Bootkit + + Aliases None diff --git a/xample-malware/netwalker.md b/xample-malware/netwalker.md index 7470430..3e391a8 100644 --- a/xample-malware/netwalker.md +++ b/xample-malware/netwalker.md @@ -5,6 +5,10 @@ X0037 +Type +Ransomware + + Aliases None @@ -47,4 +51,4 @@ SHA256 Hashes ## References -[1] https://www.trendmicro.com/en_us/research/20/e/netwalker-fileless-ransomware-injected-via-reflective-loading.html \ No newline at end of file +[1] https://www.trendmicro.com/en_us/research/20/e/netwalker-fileless-ransomware-injected-via-reflective-loading.html diff --git a/xample-malware/poison-ivy.md b/xample-malware/poison-ivy.md index 37877e1..b570f8b 100644 --- a/xample-malware/poison-ivy.md +++ b/xample-malware/poison-ivy.md @@ -4,6 +4,10 @@ X0014 +Type +Remote Access Trojan + + Aliases None diff --git a/xample-malware/redhip.md b/xample-malware/redhip.md index f9bebce..8d85e19 100644 --- a/xample-malware/redhip.md +++ b/xample-malware/redhip.md @@ -4,6 +4,10 @@ X0015 +Type +Info-stealer/Uploader + + Aliases None diff --git a/xample-malware/rombertik.md b/xample-malware/rombertik.md index 681b96e..8f45d5b 100644 --- a/xample-malware/rombertik.md +++ b/xample-malware/rombertik.md @@ -4,6 +4,10 @@ X0031 +Type +Info-stealer/Uploader + + Aliases None diff --git a/xample-malware/samsam.md b/xample-malware/samsam.md index eec4dd0..96c7cb7 100644 --- a/xample-malware/samsam.md +++ b/xample-malware/samsam.md @@ -4,6 +4,10 @@ X0016 +Type +Ransomware + + Aliases MSIL/Samas.A, Samas, Samsa diff --git a/xample-malware/searchawesome.md b/xample-malware/searchawesome.md index 4fcd7dc..49569a6 100644 --- a/xample-malware/searchawesome.md +++ b/xample-malware/searchawesome.md @@ -5,6 +5,10 @@ X0017 +Type +Adware + + Aliases None diff --git a/xample-malware/shamoon.md b/xample-malware/shamoon.md index cf1c1f0..4f68056 100644 --- a/xample-malware/shamoon.md +++ b/xample-malware/shamoon.md @@ -4,6 +4,10 @@ X0018 +Type +Wiper + + Aliases None diff --git a/xample-malware/snake.md b/xample-malware/snake.md index 149b675..83cc85a 100644 --- a/xample-malware/snake.md +++ b/xample-malware/snake.md @@ -4,6 +4,10 @@ X0047 +Type +Info-stealer/Uploader, Keylogger + + Aliases None @@ -34,4 +38,4 @@ The Snake malware is an information-stealing malware that is implemented in the ## References -[1] https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware \ No newline at end of file +[1] https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware diff --git a/xample-malware/stuxnet.md b/xample-malware/stuxnet.md index 30d87fa..1adad1b 100644 --- a/xample-malware/stuxnet.md +++ b/xample-malware/stuxnet.md @@ -4,6 +4,10 @@ X0019 +Type +Worm + + Aliases Rootkit.Tmphider, W32.Temphid @@ -76,4 +80,4 @@ SHA256 Hashes [1] https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en -[2] capa v4.0, analyzed at MITRE on 10/12/2022 \ No newline at end of file +[2] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/xample-malware/synful-knock.md b/xample-malware/synful-knock.md index e3affc4..dfb5d57 100644 --- a/xample-malware/synful-knock.md +++ b/xample-malware/synful-knock.md @@ -5,6 +5,10 @@ X0020 +Type +Backdoor + + Aliases None diff --git a/xample-malware/teardrop.md b/xample-malware/teardrop.md index f78bc5d..4ade4e2 100644 --- a/xample-malware/teardrop.md +++ b/xample-malware/teardrop.md @@ -5,6 +5,10 @@ X0041 +Type +Dropper + + Aliases None diff --git a/xample-malware/terminator.md b/xample-malware/terminator.md index fae9454..5e1bbf7 100644 --- a/xample-malware/terminator.md +++ b/xample-malware/terminator.md @@ -5,6 +5,10 @@ X0021 +Type +Remote Access Trojan + + Aliases None diff --git a/xample-malware/trickbot.md b/xample-malware/trickbot.md index 088f9cd..7bcb0fd 100644 --- a/xample-malware/trickbot.md +++ b/xample-malware/trickbot.md @@ -4,6 +4,10 @@ X0025 +Type +Spyware, Trojan (banking trojan) + + Aliases None diff --git a/xample-malware/up007.md b/xample-malware/up007.md index b90d750..55836b1 100644 --- a/xample-malware/up007.md +++ b/xample-malware/up007.md @@ -4,6 +4,10 @@ X0033 +Type +Dropper + + Aliases None diff --git a/xample-malware/ursnif.md b/xample-malware/ursnif.md index 4ab460c..5fa9112 100644 --- a/xample-malware/ursnif.md +++ b/xample-malware/ursnif.md @@ -4,6 +4,10 @@ X0022 +Type +Trojan (banking trojan) + + Aliases Dreambot, Gozi diff --git a/xample-malware/vobfus.md b/xample-malware/vobfus.md index aa68a7c..bbb0c61 100644 --- a/xample-malware/vobfus.md +++ b/xample-malware/vobfus.md @@ -5,6 +5,10 @@ X0039 +Type +Worm + + Aliases None diff --git a/xample-malware/wannacry.md b/xample-malware/wannacry.md index 7d26070..7a969db 100644 --- a/xample-malware/wannacry.md +++ b/xample-malware/wannacry.md @@ -4,6 +4,10 @@ X0043 +Type +Ransomware + + Aliases None @@ -56,4 +60,4 @@ MD5 Hashes ## References -[1] https://www.mandiant.com/resources/blog/wannacry-malware-profile \ No newline at end of file +[1] https://www.mandiant.com/resources/blog/wannacry-malware-profile diff --git a/xample-malware/webcobra.md b/xample-malware/webcobra.md index 744c512..fdeb6a7 100644 --- a/xample-malware/webcobra.md +++ b/xample-malware/webcobra.md @@ -5,6 +5,10 @@ X0023 +Type +Resource Exploitation + + Aliases None diff --git a/xample-malware/yispecter.md b/xample-malware/yispecter.md index 3f2d6ef..09c96b9 100644 --- a/xample-malware/yispecter.md +++ b/xample-malware/yispecter.md @@ -5,6 +5,10 @@ X0024 +Type +Downloader + + Aliases None