Lauren malware corpus (#81)

* updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated info * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * updated ID number * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos * fixed typos
2026-06-08 11:36:36 +00:00 · 2023-03-01 03:12:22 -05:00
parent 4c418892ee
commit 94fa3c86b8
149 changed files with 2089 additions and 1519 deletions
@@ -38,6 +38,26 @@ Malware has characteristics enabling it to evade capture from the infected syste

 |Name|ID|Description|
 |---|---|---|
-|**Encrypted Payloads**|B0036.002|Decryption key is stored external to the executable or never touches the disk.|
+|**Encrypted Payloads**|B0036.002|The decryption key is stored external to the executable or never touches the disk.|
 |**Memory-only Payload**|B0036.001|Malware is never written to disk (e.g., RAT plugins received from the controller are never written to disk).|
 |**Multiple Stages of Loaders**|B0036.003|Multiple stages of loaders are used with an encoded payload.|
+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Vobfus**](../xample-malware/vobfus.md)|2016|B0036.002|Vobfus is downloaded in an encrypted form then decrypted. [[1]](#1)|
+|[**TEARDROP**](../xample-malware/teardrop.md)|2018|B0036.001|TEARDROP loads its payload only into memory. [[2]](#2)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0036.001|The malware downloads multiple payloads (as files and DLLs) that are stored in a memory buffer. [[4]](#4)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0036.003|Matanbuchus consists of 2 loaders. [[3]](#3) [[4]](#4)|
+
+
+## References
+
+<a name="1">[1]</a> https://securitynews.sonicwall.com/xmlpost/revisiting-vobfus-worm-mar-8-2013/
+
+<a name="2">[2]</a> https://www.cisa.gov/uscert/ncas/analysis-reports/ar21-039b
+
+<a name="3">[3]</a> https://www.0ffset.net/reverse-engineering/matanbuchus-loader-analysis/
+
+<a name="4">[4]</a> https://www.cyberark.com/resources/threat-research-blog/inside-matanbuchus-a-quirky-loader
@@ -47,7 +47,7 @@ Details on methods of detecting debuggers are given in the references; many are
 |**CloseHandle**|B0001.003|(NtClose); If an invalid handle is passed to the CloseHandle function and a debugger is present, then an EXCEPTION_INVALID_HANDLE (0xC0000008) exception will be raised. [[7]](#7)|
 |**Debugger Artifacts**|B0001.004|Malware may detect a debugger by its artifact (window title, device driver, exports, etc.).|
 |**Hardware Breakpoints**|B0001.005|(SEH/GetThreadContext); Debug registers will indicate the presence of a debugger. See [[7]](#7) for details.|
-|**Interruption**|B0001.006|If an interruption is mishandled by the debugger, it can cause a single-byte instruction to be inadvertently skipped, which can be detected by malware. Examples include Interrupt 0x2d and Interrupt 1 [7].|
+|**Interruption**|B0001.006|If an interruption is mishandled by the debugger, it can cause a single-byte instruction to be inadvertently skipped, which can be detected by malware. Examples include Interrupt 0x2d and Interrupt 1 [[7]](#7).|
 |**IsDebuggerPresent**|B0001.008|The kernel32!IsDebuggerPresent API function call checks the PEB BeingDebugged flag to see if the calling process is being debugged. It returns 1 if the process is being debugged, 0 otherwise. This is one of the most common ways of debugger detection.|
 |**Memory Breakpoints**|B0001.009|(PAGE_GUARD); Guard pages trigger an exception the first time they are accessed and can be used to detect a debugger. See [[7]](#7) for details.|
 |**Memory Write Watching**|B0001.010|[[7]](#7)|
@@ -82,14 +82,24 @@ Details on methods of detecting debuggers are given in the references; many are

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Redhip**](../xample-malware/rebhip.md)|January 2011|B0001, B0001.035, B0001.032|Please see the Redhip malware page for details. [[4]](#4)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|B0001.006, B0001.008|Please see the Gamut malware page for details. [[8]](#8)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0001.016, B0001.038, B0001.032|Please see the Rombertik malware page for details. [[9]](#9)|
-|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|B0001.005, B0001.008|Please see the Poison-Ivy malware page for details. [[10]](#10)|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|B0001.032|Check for time delay via GetTickCount (This capa rule had 4 matches) [[11]](#11)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|B0001.034, B0001.025, B0001.032|Please see the Hupigon malware page for details. [[11]](#11)|
-|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|B0001.032|Check for time delay via GetTickCount (This capa rule had 1 match) [[11]](#11)|
-|[**Ursnif**](../xample-malware/ursnif.md)|2016|B0001.028|Manipulates TLS Callbacks while injecting to child process [[12]](#12)|
+|[**Redhip**](../xample-malware/redhip.md)|2011|--|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFTICE. [[4]](#4)|
+|[**Redhip**](../xample-malware/redhip.md)|2011|B0001.032|Redhip checks for a time delay using GetTickCount. [[15]](#15)|
+|[**Redhip**](../xample-malware/redhip.md)|2011|B0001.035|Redhip checks for PEB BeingDebugged flag. [[15]](#15)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|B0001.006|The malware detects debuggers using an INT 03h trap. [[8]](#8)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|B0001.008|The malware detects debuggers using IsDebuggerPresent. [[8]](#8)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0001.016|The malware calls the Windows API OutputDebugString function 335,000 times. [[9]](#9)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0001.032|The malware checks for a time delay via GetTickCount. [[15]](#15)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0001.038|An anti-analysis function within the packer is called to check the username and filename of the executing process for strings like “malwar”, “sampl”, “viru”, and “sandb”. [[9]](#9)|
+|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|B0001.005|Poison Ivy Variant checks for breakpoints and exits immediately if found. [[13]](#13)|
+|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|B0001.008|Poison Ivy uses the IsDebuggerPresent API function call to check if the process is running in a debugger. [[13]](#13)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0001.032|The malware calls GetTickCount64 to retrieve timestamp. Malware executes Sleep and Beep in a repeated loop for 10 times. [[11]](#11) [[12]](#12)|
+|[**Ursnif**](../xample-malware/ursnif.md)|2016|B0001.028|The malware manipulates TLS Callbacks while injecting to a child process. [[12]](#12)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|B0001.032|The malware checks for a time delay via GetTickCount. [[15]](#15)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|B0001.025|The malware checks for software breakpoints. [[15]](#15)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|B0001.032|The malware checks for a time delay via GetTickCount. [[15]](#15)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|B0001.034|The malware executes anti-debugging instructions. [[15]](#15)|
+|[**UP007**](../xample-malware/up007.md)|2016|B0001.032|The malware checks for a time delay via GetTickCount. [[15]](#15)|
+

 ## References

@@ -113,7 +123,12 @@ Details on methods of detecting debuggers are given in the references; many are

 <a name="10">[10]</a> https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf

-<a name="11">[11]</a> capa v4.0, analyzed at MITRE on 10/12/2022
+<a name="11">[11]</a> https://www.0ffset.net/reverse-engineering/matanbuchus-loader-analysis/

-<a name="12">[12]</a> https://www.fireeye.com/blog/threat-research/2017/11/ursnif-variant-malicious-tls-callback-technique.html
+<a name="12">[12]</a> https://www.cyberark.com/resources/threat-research-blog/inside-matanbuchus-a-quirky-loader

+<a name="13">[13]</a> https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-poison-ivy-variant
+
+<a name="14">[14]</a> https://www.fireeye.com/blog/threat-research/2017/11/ursnif-variant-malicious-tls-callback-technique.html
+
+<a name="15">[15]</a> capa v4.0, analyzed at MITRE on 10/12/2022
@@ -45,7 +45,7 @@ The related **Debugger Evasion ([T1622](https://attack.mitre.org/techniques/T162
 |**Block Interrupts**|B0002.001|Block interrupt (via hooking) 1 and/or 3 to prevent debuggers from working.|
 |**Break Point Clearing**|B0002.002|Intentionally clearing software or hardware breakpoints.|
 |**Byte Stealing**|B0002.003|Move or copy the first bytes / instructions of the original code elsewhere. AKA stolen bytes or code splicing. For example, a packer may incorporate the first few instructions of the original EntryPoint (EP) into its unpacking stub before the tail transition in order to confuse automated unpackers and novice analysts. This can make it harder for rebuilding and may bypass breakpoints if set prematurely.|
-|**Change SizeOfImage**|B0002.004|Changing this value during run time can prevent some debuggers from attaching. Also confuses some unpackers and dumpers.|
+|**Change SizeOfImage**|B0002.004|Changing this value during run time can prevent some debuggers from attaching and also confuses some unpackers and dumpers.|
 |**Code Integrity Check**|B0002.005|Check that the unpacking code is unmodified. Variation exists where unpacking code is part of the "key" used to unpack, therefore any Software Breakpoints during debugging causes unpacking to completely fail or result in malformed unpacked code.|
 |**Exception Misdirection**|B0002.006|Using exception handling (SEH) to cause flow of program to non-obvious paths.|
 |**Get Base Indirectly**|B0002.007|CALL to a POP; finds base of code or data, often the packed version of the code; also used often in obfuscated/packed shellcode.|
@@ -77,8 +77,11 @@ The related **Debugger Evasion ([T1622](https://attack.mitre.org/techniques/T162

 |Name|Date|Method|Description|
 |---|---|---|---|
-|**Fake Adobe Flash Update OS X**|February 2016|--|Malware contains code that manually detects a debugger [[2]](#2)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFICE. [[3]](#3)|
+|**Fake Adobe Flash Update OS X**|2016|--|Malware contains code that manually detects a debugger. [[2]](#2)|
+|**Dridex**|2015|--|[[3]](#3)|
+|[**Redhip**](../xample-malware/redhip.md)|2011|--|Redhip uses general approaches to detecting user level debuggers (e.g., Process Environment Block 'Being Debugged' field), as well as specific checks for kernel level debuggers like SOFTICE. [[6]](#6)|
+|[**Vobfus**](../xample-malware/vobfus.md)|2016|--|Vobfus uses GetModuleHandle API to check for the presence of a debugger. [[7]](#7)|
+

 ## References

@@ -86,7 +89,7 @@ The related **Debugger Evasion ([T1622](https://attack.mitre.org/techniques/T162

 <a name="2">[2]</a> https://www.synack.com/2016/02/17/analyzing-the-anti-analysis-logic-of-an-adware-installer/

-<a name="3">[3]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
+<a name="3">[3]</a> http://phishme.com/dridex-code-breaking-modify-the-malware-to-bypass-the-vm-bypass/

 <a name="4">[4]</a> http://antukh.com/blog/2015/01/19/malware-techniques-cheat-sheet/

@@ -94,3 +97,4 @@ The related **Debugger Evasion ([T1622](https://attack.mitre.org/techniques/T162

 <a name="6">[6]</a> https://web.archive.org/web/20161025013916/https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html

+<a name="7">[7]</a> https://securitynews.sonicwall.com/xmlpost/revisiting-vobfus-worm-mar-8-2013/
@@ -60,12 +60,14 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Terminator**](../xample-malware/terminator.md)|October 2013|B0003.003|The Terminator rat evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[3]](#3)|
+|[**Terminator**](../xample-malware/terminator.md)|2013|B0003.003|The Terminator RAT evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[3]](#3)|
 |**Nap**|2013|--|Trojan Nap (tied to the Kelihos Botnet) uses extended sleep calls to evade sandbox analysis. [[3]](#3)|
 |**Smokeloader**|2019|--|Smokeloader drops a copy of ntdll.dll to %APPDATA%\Local\Temp\ [[4]](#4)|
-|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|Evades dynamic analysis. [[2]](#2)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0003.002, B0003.011|Please see the Rombertik malware page for details. [[5]](#5)|
-|[**TrickBot**](../xample-malware/trickbot.md)|2016|B0003.012|Uses numerous printf loops to delay the execution process and overload the sandbox with junk data (API Hammering) [[6]](#6)|
+|[**WebCobra**](../xample-malware/webcobra.md)|2018|B0003.001|The malware loads ntdll.dll and user32.dll as data files and overwrites the first 8 bytes of those functions to avoid API hooking by security products. [[7]](#7)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0003.002|The malware stalls by writing a byte of random data to memory 960 million times which complicates analysis. It also calls specific Windows API functions. [[5]](#5)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0003.011|The malware computes a 32-bit hash of a resource in memory, and compares it to the PE Compile Timestamp of the unpacked sample. If the resource or compile time has been altered, the malware acts destructively. [[5]](#5)|
+|[**TrickBot**](../xample-malware/trickbot.md)|2016|B0003.012|The malware uses numerous printf loops to delay the execution process and overload the sandbox with junk data (API Hammering). [[6]](#6)|
+

 ## References

@@ -80,4 +82,3 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
 <a name="5">[5]</a> https://blogs.cisco.com/security/talos/rombertik

 <a name="6">[6]</a> https://www.joesecurity.org/blog/498839998833561473
-
@@ -49,6 +49,13 @@ Detects whether the malware instance is being executed inside an emulator. If so
 |---|---|---|
 |[check if process is running under wine](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-emulation/wine/check-if-process-is-running-under-wine.yml)|Emulator Detection (B0007)|GetModuleHandle, GetProcAddress|

+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Stuxnet checks for specific operating systems on 32-bit machines, registry keys, and dates to profile a potential target machine before execution. If the conditions are not met to be considered a viable target, it will exit execution. [[2]](#2)|
+
 ## References

 <a name="1">[1]</a> https://search.unprotect.it/map/sandbox-evasion/
@@ -43,7 +43,7 @@ Behaviors that obstruct analysis in an emulator.

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|Evades emulator-based analysis. [[1]](#1)|
+|[**WebCobra**](../xample-malware/webcobra.md)|2018|B0005.004|The malware evades emulator-based analysis by using an infinite loop to check all open windows and compare each window's title bar to a list of strings. [[1]](#1)|

 ## References

@@ -55,6 +55,7 @@ Malware hinders retrieval and/or discovery of the contents of the physical memor
 |---|---|---|---|
 |[**Kraken**](../xample-malware/kraken.md)|2008|--|Dumping Kraken's c.dll module from the heap of its own process is tricky because its PE-header is erased in memory. [[2]](#2)|

+
 ## Code Snippets

 ### B0006.011
@@ -55,11 +55,27 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|B0007.005|Redhip detects publicly available automated analysis workbenches (e.g., Joe Box) by considering OS product keys and special DLLs. [[1]](#1)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0007.010|The malware check for sandboxes that suppress errors returned from API routine calls the using ZwGetWriteWatch routine. [[2]](#2)|
-|[**Ursnif**](../xample-malware/ursnif.md)|2016|B0007.007|Ursnif uses malware macros to evade sandbox detection. [[6]](#6)|
-|[**EvilBunny**](../xample-malware/evilbunny.md)|2011|--|EvilBunny hooks time retrieval APIs and calls each API twice to calculate a delta. Execution aborts depending on the delta value [[4]](#4)|
-|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR performs several checks on the compromised machine to avoid being emulated or executed in a sandbox. [[5]](#5)|
+|[**Redhip**](../xample-malware/redhip.md)|2011|B0007.005|Redhip detects publicly available automated analysis workbenches (e.g., Joe Box) by considering OS product keys and special DLLs and checks for sandboxes and AV modules. [[1]](#1)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0007.010|The malware checks for sandboxes that suppress errors returned from API routine calls the using ZwGetWriteWatch routine. [[2]](#2)|
+|[**Terminator**](../xample-malware/terminator.md)|2013|--|The Terminator RAT evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [[4]](#4)|
+|[**Ursnif**](../xample-malware/ursnif.md)|2016|B0007.007|Ursnif uses malware macros to evade sandbox detection - checking whether the filename contains only hexadecimal characters before the extension. [[8]](#8)|
+|[**GotBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR performs several checks on the compromised machine to avoid being emulated or executed in a sandbox. [[5]](#5)|
+|[**EvilBunny**](../xample-malware/evilbunny.md)|2011|--|EvilBunny hooks time retrieval APIs and calls each API twice to calculate a delta. Execution aborts depending on the delta value. [[6]](#6)|
+|[**Vobfus**](../xample-malware/vobfus.md)|2016|--|Vobfus uses GetModuleHandle API to check for the presence of a sandbox. [[7]](#7)|
+
+
+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[check for microsoft office emulation](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-vm/vm-detection/check-for-microsoft-office-emulation.yml)|Sandbox Detection::Product Key/ID Testing (B0007.005)|CreateFile|
+|[check for sandbox and av modules](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml)|Sandbox Detection (B0007)|GetModuleHandle|
+
+|Tool: CAPE|Mapping|APIs|
+|---|---|---|
+|[antisandbox_joe_anubis_files.py](https://github.com/kevoreilly/community/blob/master/modules/signatures/antisandbox_joe_anubis_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
+|[antisandbox_cuckoo_files](https://github.com/kevoreilly/community/blob/master/modules/signatures/antisandbox_cuckoo_files.py)|Sandbox Detection::Check Files (B0007.002)|--|
+

 ## Code Snippets

@@ -105,9 +121,12 @@ mov     bl, 1

 <a name="3">[3]</a> https://github.com/LordNoteworthy/al-khaser

-<a name="4">[4]</a> https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/
+<a name="4">[4]</a> https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/pf/file/fireeye-hot-knives-through-butter.pdf

 <a name="5">[5]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/

-<a name="6">[6]</a> https://www.proofpoint.com/us/threat-insight/post/ursnif-banking-trojan-campaign-sandbox-evasion-techniques
+<a name="6">[6]</a> https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/

+<a name="7">[7]</a> https://securitynews.sonicwall.com/xmlpost/revisiting-vobfus-worm-mar-8-2013/
+
+<a name="8">[8]</a> https://www.proofpoint.com/us/threat-insight/post/ursnif-banking-trojan-campaign-sandbox-evasion-techniques
@@ -43,8 +43,8 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t
 |**Check File and Directory Artifacts**|B0009.001|Virtual machines create files on the file system (e.g., VMware creates files in the installation directory C:\Program Files\VMware\VMware Tools). Malware can check the different folders to find virtual machine artifacts (e.g., Virtualbox has the artifact VBoxMouse.sys). [[2]](#2)|
 |**Check Memory Artifacts**|B0009.002|VMware leaves many artifacts in memory. Some are critical processor structures, which, because they are either moved or changed on a virtual machine, leave recognizable footprints. Malware can search through physical memory for the strings VMware, commonly used to detect memory artifacts. [[2]](#2)|
 |**Check Named System Objects**|B0009.003|Virtual machines often include specific named system objects by default, such as Windows device drivers, which can be detected by testing for specific strings, whether found in the Windows registry or other places.|
-|**Check Processes**|B0009.004|The VMware Tools use processes like VMwareServices.exe or VMwareTray.exe, to perform actions on the virtual environment. Malware can list the process and searches for the VMware string. Process related to Virtualbox can be detected by malware by query the process list. [[2]](#2)|
-|**Check Registry Keys**|B0009.005|Virtual machines register artifacts in the registry, which can be detected by malware. For example, a search for "VMware" or "VBOX" in the registry might reveal keys that include information about a virtual hard drive, adapters, running services, or virtual mouse. [[2]](#2) Example registry key value artifacts include "HARDWARE\Description\System (SystemBiosVersion) (VBOX)" and "SYSTEM\ControlSet001\Control\SystemInformation (SystemManufacturer) (VMWARE)"; example registry key artifacts include "SOFTWARE\VMware, Inc.\VMware Tools (VMWARE)" and "SOFTWARE\Oracle\VirtualBox Guest Additions (VBOX)". [[5]](#5)|
+|**Check Processes**|B0009.004|The VMware Tools use processes like VMwareServices.exe or VMwareTray.exe, to perform actions on the virtual environment. Malware can list the processes and searches for the VMware string. Processes related to Virtualbox can be detected by the malware by querying the process list. [[2]](#2)|
+|**Check Registry Keys**|B0009.005|Virtual machines register artifacts in the registry, which can be detected by malware. For example, a search for "VMware" or "VBOX" in the registry might reveal keys that include information about a virtual hard drive, adapters, running services, or a virtual mouse. [[2]](#2) Example registry key value artifacts include "HARDWARE\Description\System (SystemBiosVersion) (VBOX)" and "SYSTEM\ControlSet001\Control\SystemInformation (SystemManufacturer) (VMWARE)"; example registry key artifacts include "SOFTWARE\VMware, Inc.\VMware Tools (VMWARE)" and "SOFTWARE\Oracle\VirtualBox Guest Additions (VBOX)". [[5]](#5)|
 |**Check Running Services**|B0009.006|VMwareService.exe runs the VMware Tools Service as a child of services.exe. It can be identified by listing services. [[2]](#2)|
 |**Check Software**|B0009.007|Malware may check software version; for example, to determine whether the software is relatively current.|
 |**Check Virtual Devices**|B0009.008|The presence of virtual devices can indicate a virtualized environment (e.g., "\\.\VBoxTrayIPC"). [[5]](#5)|
@@ -84,13 +84,26 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**GravityRAT**](../xample-malware/gravity-rat.md)|May 2018|B0009, B0009.024, B0009.023, B0009.018, B0009.028|Please see the GravityRAT malware page for details. [[3]](#3)|
-|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|WebCobra injects malicious code to svchost.exe and uses an infinite loop to check all open windows and to compare each window’s title bar text with a set of strings to determine whether it is running in an isolated, malware analysis environment [[4]](#4)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip detects VMWare, Virtual PC and Virtual Box. It also detects VM environments in general by considering timing lapses. [[1]](#1)|
-|[**Emotet**](../xample-malware/emotet.md)|2018|B0009.010|Emotet checks for various processes that are associated with various virtual machines by comparing hash values of the process names with the hash values of the list of running process names [[7]](#7)|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|B0009.012|Check for unmoving mouse cursor (This capa rule had 1 match) [[8]](#8)|
-|[**Ursnif**](../xample-malware/ursnif.md)|2016|B0009.004|Checks if there are virtual machine processes running (Vbox, vmware, etc) [[9]](#9)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0007.010, B0001.016, B0001.038|Please see the Rombertik malware page for details. [[10]](#10)|
+|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|GravityRAT checks system temperature by recording thermal readings for detecting VMs. Heat levels indicate whether the system is a VM. [[3]](#3)|
+|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|B0009.018|GravityRAT determines the machine is a VM if the core count is 1. [[3]](#3)|
+|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|B0009.023|GravityRAT checks if the manufacturer field in the Win32_Computer entry (in WMI) contains "Virtual," "Vmware," or "Virtualbox." [[3]](#3)|
+|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|B0009.024|GravityRAT creates a WMI request to identify the BIOS version. [[3]](#3)|
+|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|B0009.028|GravityRAT checks if the MAC address starts with a well-known hexadecimal number used by various VM developers. [[3]](#3)|
+|[**WebCobra**](../xample-malware/webcobra.md)|2018|B0009.022|WebCobra injects malicious code in to svchost.exe and uses an infinite loop to check all open windows and to compare each window’s title bar text with a set of strings to determine whether it is running in a VM. [[4]](#4)|
+|[**Redhip**](../xample-malware/redhip.md)|2011|--|Redhip detects VMWare, Virtual PC, and Virtual Box. It also detects VM environments in general by considering time lapses. [[6]](#6)|
+|[**Emotet**](../xample-malware/emotet.md)|2018|B0009.010|Emotet checks for various processes that are associated with various virtual machines by comparing hash values of the process names with the hash values of the list of running process names. [[7]](#7)|
+|[**Vobfus**](../xample-malware/vobfus.md)|2016|--|Vobfus checks for the presence of virtualization software by querying the system registry. [[8]](#8)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0009.003|Malware checks if it is running in a sandbox. If it is, the malware exits. [[9]](#9) [[10]](#10)|
+|[**Ursnif**](../xample-malware/ursnif.md)|2016|B0009.004|The malware checks if there are virtual machine processes running (Vbox, vmware, etc). [[11]](#11)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|B0009.012|The malware checks for an unmoving mouse cursor. [[12]](#12)|
+
+
+## Detection
+
+|Tool: capa|Mapping|APIs|
+|---|---|---|
+|[check if process is running under wine](https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-emulation/wine/check-if-process-is-running-under-wine.yml)|Emulator Detection (B0007)|GetModuleHandle, GetProcAddress|
+

 ## Code Snippets

@@ -135,7 +148,7 @@ jmp short loc_401CBB

 ## References

-<a name="1">[1]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
+<a name="1">[1]</a> https://web.archive.org/web/20161025013916/https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html

 <a name="2">[2]</a> https://search.unprotect.it/map/sandbox-evasion/

@@ -149,11 +162,12 @@ jmp short loc_401CBB

 <a name="7">[7]</a> https://securelist.com/the-banking-trojan-emotet-detailed-analysis/69560/

-<a name="8">[8]</a> capa v4.0, analyzed at MITRE on 10/12/2022
+<a name="8">[8]</a> https://securitynews.sonicwall.com/xmlpost/revisiting-vobfus-worm-mar-8-2013/

-<a name="9">[9]</a> https://www.proofpoint.com/us/threat-insight/post/ursnif-banking-trojan-campaign-sandbox-evasion-techniques
+<a name="9">[9]</a> https://www.0ffset.net/reverse-engineering/matanbuchus-loader-analysis/

-<a name="10">[10]</a> https://blogs.cisco.com/security/talos/rombertik
+<a name="10">[10]</a> https://www.cyberark.com/resources/threat-research-blog/inside-matanbuchus-a-quirky-loader

-<a name="11">[11]</a> https://web.archive.org/web/20161025013916/https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
+<a name="11">[11]</a> https://www.proofpoint.com/us/threat-insight/post/ursnif-banking-trojan-campaign-sandbox-evasion-techniques

+<a name="12">[12]</a> capa v4.0, analyzed at MITRE on 10/12/2022
@@ -48,9 +48,9 @@ Some methods apply to both types of disassemblers; others apply to one type and

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|B0012.001|Contain obfuscated stackstrings (This capa rule had 3 matches) [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|B0012.001|Contain obfuscated stackstrings (This capa rule had 1 match) [[6]](#6)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0012.001|Contain obfuscated stackstrings (This capa rule had 1 match) [[6]](#6)|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|B0012.001|BlackEnergy contains obfuscated stack strings. [[1]](#1) [[6]](#6)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|B0012.001|Hupigon contains obfuscated stack strings. [[6]](#6)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0012.001|Rombertik contains obfuscated stack strings. [[6]](#6)|

 ## References

@@ -33,7 +33,7 @@

 Executable code is obfuscated to hinder static code analysis. This behavior is specific to a malware sample's executable code (data and text sections). While the Executable Code Obfuscation behavior makes the analysis process more difficult, it does not cause incorrect or incomplete disassembly, which is how this behavior differs from the Disassembler Evasion behavior.

-For encryption and encoding characteristics of malware samples, as well as malware obfuscation behaviors related to non-malware-sample files and information, see **Obfuscated Files or Information ([E1027](../defense-evasion/obfuscated-files-or-information.md))**.
+For encryption and encoding characteristics of malware samples, as well as malware obfuscation behaviors related to non-malware sample files and information, see **Obfuscated Files or Information ([E1027](../defense-evasion/obfuscated-files-or-information.md))**.

 ## Methods

@@ -65,8 +65,16 @@ For encryption and encoding characteristics of malware samples, as well as malwa

 |Name|Date|Method|Description|
 |---|---|---|---|
+|[**Heriplor**](../xample-malware/heriplor.md)|2012|B0032.001|The Heriplor Trojan uses API Hashing. [[1]](#1)|
 |[**Emotet**](../xample-malware/emotet.md)|2018|B0032.007|Emotet macros are heavily obfuscated with junk functions and string substitutions. [[2]](#2)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0032.002|Most of the malware file consists of unnecessary code or unnecessary data [[1]](#1)|
+|[**Rombertik**](../anti-static-analysis/executable-code-obfuscation.md)|2015|B0032.002|Most of the malware file consists of unnecessary code or unnecessary data. [[4]](#4)|
+|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|B0032.017|Poison Ivy variant encrypts all its strings. [[6]](#6)|
+|[**SamSam**](../xample-malware/samsam.md)|2015|--|SamSam obfuscates functions, class names and strings, including the list of targeted file extensions, the help file contents and environment variables using DES encryption with a fixed hard-coded key and the IV. [[7]](#7)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|E1027.m01|The configuration data block is encoded with a NOT XOR 0xFF operation. [[8]](#8)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0032.001|The function to import APIs uses a hash value and the DLL name of the target API. The API address returned from the function is stored into a global variance. API calls are obfuscated in the same manner as the stack strings and are resolved dynamically as the malware needs to use them. The malware encodes data in a stack string and copies that data into a global character buffer as a form of string obfuscation. [[9]](#9) [[10]](#10)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0032.017|The malware encodes data in a stack string and copies that data into a global character buffer as a form of string obfuscation. Different techniques are used to encrypt and obfuscate strings. Strings are dynamically decrypted when the malware needs to use them. [[9]](#9) [[10]](#10)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0032.009|The malware has 4 different export functions. [[9]](#9) [[10]](#10)|
+

 ## Code Snippets

@@ -139,3 +147,16 @@ jmp short loc_401326

 <a name="3">[3]</a> Rob Simmons, "Comparing Malicious Files," BSides, 2019. http://www.irongeek.com/i.php?page=videos/bsidescharm2019/2-04-comparing-malicious-files-robert-simmons

+<a name="4">[4]</a> https://blogs.cisco.com/security/talos/rombertik
+
+<a name="5">[5]</a> https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality
+
+<a name="6">[6]</a> https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf
+
+<a name="7">[7]</a> https://blog.talosintelligence.com/2018/01/samsam-evolution-continues-netting-over.html
+
+<a name="8">[8]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
+
+<a name="9">[9]</a> https://www.0ffset.net/reverse-engineering/matanbuchus-loader-analysis/
+
+<a name="10">[10]</a> https://www.cyberark.com/resources/threat-research-blog/inside-matanbuchus-a-quirky-loader
@@ -46,7 +46,7 @@ Virtualized code is a software protection technique. Themida is a commercial too

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Locky Bart**](../xample-malware/locky-bart.md)|January 2017|--|Code virtualization is added to the Locky Bart binary using WPProtect. [[2]](#2)|
+|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Code virtualization is added to the Locky Bart binary using WPProtect. [[2]](#2)|

 ## References

@@ -57,12 +57,13 @@ This description refines the ATT&CK **Obfuscated Files or Information: Software

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip samples are packed with different custom packers. [[3]](#3)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|--|The malware comes packed by a crypter/FUD [[4]](#4)|
-|[**Conficker**](../xample-malware/conficker.md)|2008|F0001.008|Conficker is propagated as a DLL which has been backed using the UPX packer [[5]](#5)|
-|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|Has a custom packer to obfuscate itself  [[7]](#7)|
-|[**Emotet**](../xample-malware/emotet.md)|2018|F0001.005|Emotet uses custom packers which first decrypt the loaders and the loaders decrypt and load Emotet's main payloads [[8]](#8)|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Has the option to compress its payload using UPX or MPRESS  [[6]](#6)|
+|[**Redhip**](../xample-malware/redhip.md)|2011|--|Redhip samples are packed with different custom packers. [[3]](#3)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|--|The malware comes packed by a crypter/FUD. [[4]](#4)|
+|[**Conficker**](../xample-malware/conficker.md)|2008|F0001.008|Conficker is propagated as a DLL which has been backed using the UPX packer. [[5]](#5)|
+|[**DarkComet**](../xample-malware/dark-comet.md)|2008|--|DarkComet has the option to compress its payload using UPX or MPRESS.  [[6]](#6)|
+|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|The malware has a custom packer to obfuscate itself. [[7]](#7)|
+|[**Emotet**](../xample-malware/emotet.md)|2018|F0001.005|Emotet uses custom packers which first decrypt the loaders and the loaders decrypt and load Emotet's main payloads. [[8]](#8)|
+

 ## References

@@ -70,7 +71,7 @@ This description refines the ATT&CK **Obfuscated Files or Information: Software

 <a name="2">[2]</a> Jiang Ming et al, Towards Paving the Way for Large-Scale Windows Malware Analysis: Generic Binary Unpacking with Orders-of-Magnitude Performance Boost, October 2018, https://dl.acm.org/citation.cfm?id=3243771.

-<a name="3">[3]</a> https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
+<a name="3">[3]</a> https://web.archive.org/web/20161025013916/https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html

 <a name="4">[4]</a> https://www.bleepingcomputer.com/virus-removal/remove-kovter-trojan

@@ -82,7 +83,3 @@ This description refines the ATT&CK **Obfuscated Files or Information: Software

 <a name="8">[8]</a> https://documents.trendmicro.com/assets/white_papers/ExploringEmotetsActivities_Final.pdf

-<a name="9">[9]</a> https://blog.malwarebytes.com/threat-analysis/2016/07/untangling-kovter/
-
-<a name="10">[10]</a> https://web.archive.org/web/20161025013916/https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html
-
@@ -42,10 +42,11 @@ See ATT&CK: **Input Capture ([T1056](https://attack.mitre.org/techniques/T1056),

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|The malware injects itself into a browser and captures user input data [[1]](#1)|
-|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|Injects HTML into browser session to collect sensitive online banking information when the victim performs their online banking  [[2]](#2)|
-|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|--|Can capture audio and video  [[4]](#4)|
-|[**Clipminer**](../xample-malware/clipminer.md)|2011|--|Clipminer monitors keyboard and mouse activity to determine if the machine is in use [[3]](#3)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|The malware injects itself into a browser and captures user input data. [[1]](#1)|
+|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|The malware injects HTML into a browser session to collect sensitive online banking information when the victim performs their online banking. [[2]](#2)|
+|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|Poison Ivy can capture audio and video. [[4]](#4)|
+|[**Clipminer**](../xample-malware/clipminer.md)|2011|--|Clipminer monitors keyboard and mouse activity to determine if the machine is in use. [[5]](#5)|
+

 ## References

@@ -44,16 +44,20 @@ See ATT&CK: **Input Capture: Keylogging ([T1056.001](https://attack.mitre.org/te

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|F0002, F0002.002|Please see the Hupigon malware page for details. [[1]](#1)|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|Keylogger plugin allows for collection of keystrokes [[3]](#3)|
-|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|--|Can capture keystrokes  [[5]](#5)|
-|[**CHOPSTICK**](../xample-malware/chopstick.md)|2015|--|CHOPSTICK collects user keystrokes [[6]](#6)|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|F0002, F0002.002|Please see the Dark Comet malware page for details. [[4]](#4)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|F0002.002|Log keystrokes via polling (This capa rule had 1 match) [[7]](#7)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|F0002.001, F0002.002|Please see the Redhip malware page for details. [[7]](#7)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|F0002.002|Log keystrokes via polling (This capa rule had 7 matches) [[7]](#7)|
-|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|--|The malware logs keystrokes to a file  [[2]](#2)|
-|[**Ursnif**](../xample-malware/ursnif.md)|2016|F0002.002|Log keystrokes via polling (This capa rule had 1 match) [[7]](#7)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Certain variants of the malware may have keylogging functionality. [[1]](#1)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|F0002.002|Malware logs keystrokes via polling. [[9]](#9)|
+|[**UP007**](../xample-malware/up007.md)|2016|--|The malware logs keystrokes to a file. [[2]](#2)|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|BlackEnergy's keylogger plugin allows for the collection of keystrokes. [[3]](#3)|
+|[**DarkComet**](../xample-malware/dark-comet.md)|2008|--|DarkComet can capture keystrokes.  [[4]](#4)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|F0002.002|Malware logs keystrokes via polling. [[9]](#9)|
+|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|Poison Ivy can capture keystrokes.  [[5]](#5)|
+|[**CHOPSTICK**](../xample-malware/chopstick.md)|2015|--|CHOPSTICK collects user keystrokes. [[6]](#6)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|F0002.002|Malware logs keystrokes via polling. [[9]](#9)|
+|[**Redhip**](../xample-malware/redhip.md)|2011|F0002.001|Malware logs keystrokes via application hook. [[9]](#9)|
+|[**Redhip**](../xample-malware/redhip.md)|2011|F0002.002|Malware logs keystrokes via polling. [[9]](#9)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|F0002.002|Malware logs keystrokes via polling. [[9]](#9)|
+|[**Ursnif**](../xample-malware/ursnif.md)|2016|F0002.002|Malware logs keystrokes via polling. [[9]](#9)|
+

 ## References

@@ -73,3 +77,5 @@ See ATT&CK: **Input Capture: Keylogging ([T1056.001](https://attack.mitre.org/te

 <a name="8">[8]</a> https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf

+<a name="9">[9]</a> capa v4.0, analyzed at MITRE on 10/12/2022
+
@@ -43,13 +43,14 @@ See ATT&CK: **Screen Capture ([T1113](https://attack.mitre.org/techniques/T1113/

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--| GoBotKR is capable of capturing screenshots. [[1]](#1)|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|Screenshot plugin allows for collection of screenshots  [[2]](#2)|
-|[**CHOPSTICK**](../xample-malware/chopstick.md)|2015|--|CHOPSTICK takes snapshots of deskop and window contents [[4]](#4)|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|E1113, E1113.m01|Please see the Dark Comet malware page for details. [[3]](#3)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|E1113.m01|Capture screenshot (This capa rule had 2 matches) [[5]](#5)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|E1113.m01|Capture screenshot (This capa rule had 1 match) [[5]](#5)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|E1113.m01|Capture screenshot (This capa rule had 2 matches) [[5]](#5)|
+|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR is capable of capturing screenshots. [[1]](#1)|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|BlackEnergy's screenshot plugin allows for collection of screenshots. [[2]](#2)|
+|[**DarkComet**](../xample-malware/dark-comet.md)|2008|E1113.m01|DarkComet can take screenshots of the victim's computer. [[3]](#3) [[5]](#5)|
+|[**CHOPSTICK**](../xample-malware/chopstick.md)|2015|--|CHOPSTICK takes snapshots of deskop and window contents. [[4]](#4)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|E1113.m01|Malware captures screenshots. [[5]](#5)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|E1113.m01|Malware captures screenshots. [[5]](#5)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|E1113.m01|Malware captures screenshots. [[5]](#5)|
+

 ## References

@@ -53,31 +53,44 @@ As "server" and "client" are confusing terminology, we use the terms "controller
 |**Send Heartbeat**|B0030.007|Heartbeat sent.|
 |**Send System Information**|B0030.006|Implant sends system information.|
 |**Server to Client File Transfer**|B0030.003|File is transferred from controller to implant.|
-|**Start Interactive Shell**|B0030.016|Start an interactive shell using a built-in program (e.g. cmd.exe, PowerShell, bash). This is often implemented with polling the network connection from the controller for text commands to redirect to the shell's stdin and polling the shell's stdout and stderr to redirect over the network to the controller. This differs from Execute Shell Command because the shell process runs across multiple iterations of the recv-command(s)-send-result loop.|
+|**Start Interactive Shell**|B0030.016|Starts an interactive shell using a built-in program (e.g. cmd.exe, PowerShell, bash). This is often implemented with polling the network connection from the controller for text commands to redirect to the shell's stdin and polling the shell's stdout and stderr to redirect over the network to the controller. This differs from Execute Shell Command because the shell process runs across multiple iterations of the recv-command(s)-send-result loop.|


 ## Use in Malware

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**CryptoWall**](../xample-malware/cryptowall.md)|2014|B0030.001, B0030.002|Please see the CryptoWall malware page for details. [[1]](#1)|
-|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|B0030.002|GoBotKR receives data from the C2 [[2]](#2)|
-|[**Terminator**](../xample-malware/terminator.md)|2013|B0030.001|The malware sends data to C2 [[3]](#3)|
-|[**YiSpecter**](../xample-malware/yispecter.md)|2015|B0030.006|Connects to the command and control server using HTTP to send device information [[5]](#5)|
-|[**Ursnif**](../xample-malware/ursnif.md)|2016|B0030.011|Ursnif variant Dreambot authenticates and encrypts traffic to C2 server using TOR [[6]](#6)|
-|[**Emotet**](../xample-malware/emotet.md)|2018|B0030.010|New email addresses are collected automatically from the victim's address books [[7]](#7)|
-|[**CHOPSTICK**](../xample-malware/chopstick.md)|2015|B0030.001|CHOPSTICK sends data to the C2 server using HTTP POST requests [[8]](#8)|
-|[**CozyCar**](../xample-malware/cozycar.md)|2010|--|CozyCar communicates with a C2 server [[9]](#9)|
-|[**EvilBunny**](../xample-malware/evilbunny.md)|2011|--|EvilBunny communicates C2 via HTTP [[10]](#10)|
-|[**Clipminer**](../xample-malware/clipminer.md)|2011|--|Clipminer communicates to a Tor Onion Service via HTTP [[11]](#11)|
-|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|B0030.001, B0030.002, B0030.011|Please see the CryptoLocker malware page for details. [[12]](#12)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|B0030.002|The malware receives data from C2 [[13]](#13)|
-|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|B0030.002|Receive data (This capa rule had 1 match) [[14]](#14)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|B0030.002, B0030.001|Please see the Hupigon malware page for details. [[14]](#14)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|B0030.002, B0030.001|Please see the Kovter malware page for details. [[14]](#14)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0030.001, B0030.002|Please see the Rombertik malware page for details. [[15]](#15)|
-|[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|B0030.002| The malware receives data from the C2 server. [[16]](#16)|
-|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|B0030.002, B0030.001|Please see the UP007 Malware Family malware page for details. [[4]](#4)|
+|[**CryptoWall**](../xample-malware/cryptowall.md)|2014|B0030.001|The malware sends a hash value generated from system information. [[1]](#1)|
+|[**CryptoWall**](../xample-malware/cryptowall.md)|2014|B0030.002|The malware receives a public key from the C2. [[1]](#1)|
+|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|B0030.001|The malware sends a hash value generated from system information. [[14]](#14)|
+|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|B0030.002|The malware receives a public key from the C2. [[14]](#14)|
+|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|B0030.011|The malware sends a phone-home message with encryption to start. [[14]](#14)|
+|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|B0030.002|GoBotKR receives data from the C2. [[2]](#2) [[19]](#19)|
+|[**Terminator**](../xample-malware/terminator.md)|2013|B0030.001|The malware sends data to the C2. [[3]](#3)|
+|[**UP007**](../xample-malware/up007.md)|2016|B0030.001|The malware sends hardened HTTP headers disguised as Microsoft Update traffic. [[4]](#4)|
+|[**UP007**](../xample-malware/up007.md)|2016|B0030.002|The malware receives payloads. [[4]](#4)|
+|[**YiSpecter**](../xample-malware/yispecter.md)|2015|B0030.006|The malware connects to the C2 server using HTTP to send device information. [[5]](#5)|
+|[**Ursnif**](../xample-malware/ursnif.md)|2016|B0030.011|Ursnif variant Dreambot authenticates and encrypts traffic to the C2 server using TOR. [[6]](#6)|
+|[**Emotet**](../xample-malware/emotet.md)|2018|B0030.010|New email addresses are collected automatically from the victim's address books. [[7]](#7)|
+|[**CHOPSTICK**](../xample-malware/chopstick.md)|2015|B0030.001|CHOPSTICK sends data to the C2 server using HTTP POST requests. [[8]](#8)|
+|[**CozyCar**](../xample-malware/cozycar.md)|2010|--|CozyCar communicates with a C2 server. [[9]](#9)|
+|[**EvilBunny**](../xample-malware/evilbunny.md)|2011|--|EvilBunny communicates C2 via HTTP. [[10]](#10)|
+|[**Clipminer**](../xample-malware/clipminer.md)|2011|--|Clipminer communicates to a Tor Onion Service via HTTP. [[11]](#11)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0030.001|The malware sends collected data about the system to C2 server. [[12]](#12) [[13]](#13)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0030.002|The C2 server returns Base64 encoded data containing the information about the next command for the loader. [[12]](#12) [[13]](#13)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0030.013|The payload is run by explorer.exe. [[12]](#12) [[13]](#13)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|B0030.002|Gamut receives data from the C2. [[15]](#15)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|B0030.003|The malware receives files from the C2. [[15]](#15)|
+|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|B0030.002|GravityRAT receives data from the C2.  [[19]](#19)|
+|[**Heriplor**](../xample-malware/heriplor.md)|2012|B0030.002|Heriplor malware has a capability to connect with a C2 to download arbitrary code. [[16]](#16)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0030.001|The malware sends data to the C2. [[17]](#17) [[19]](#19)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0030.002|The malware receives data from the C2. [[19]](#19)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|BB0030.001|The malware sends data to the C2. [[19]](#19)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|B0030.002|The malware receives data from the C2. [[19]](#19)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|B0030.001|The malware sends data to the C2. [[19]](#19)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|B0030.002|The malware receives data from the C2. [[19]](#19)|
+|[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|B0030.002|The malware receives data from the C2 server. [[18]](#18)|
+

 ## Code Snippets

@@ -126,15 +139,18 @@ jmp short loc_4019A2

 <a name="11">[11]</a> https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking

-<a name="12">[12]</a> https://www.secureworks.com/research/cryptolocker-ransomware
+<a name="12">[12]</a> https://www.0ffset.net/reverse-engineering/matanbuchus-loader-analysis/

-<a name="13">[13]</a> https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/gamut-spambot-analysis/
+<a name="13">[13]</a> https://www.cyberark.com/resources/threat-research-blog/inside-matanbuchus-a-quirky-loader

-<a name="14">[14]</a> capa v4.0, analyzed at MITRE on 10/12/2022
+<a name="14">[14]</a> https://www.secureworks.com/research/cryptolocker-ransomware

-<a name="15">[15]</a> https://blogs.cisco.com/security/talos/rombertik
+<a name="15">[15]</a> https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/gamut-spambot-analysis/

-<a name="16">[16]</a> https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/
+<a name="16">[16]</a> https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_heriplor.a

-<a name="17">[17]</a> https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke/
+<a name="17">[17]</a> https://blogs.cisco.com/security/talos/rombertik

+<a name="18">[18]</a> https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/
+
+<a name="19">[19]</a> capa v4.0, analyzed at MITRE on 10/12/2022
@@ -36,11 +36,11 @@ The related **Dynamic Resolution: Domain Generation Algorithms ([T1568.002](http

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Kraken**](../xample-malware/kraken.md)|April 2008|--|Kraken uses a domain generating algorithm to provide new domains. [[2]](#2)|
-|[**Conficker**](../xample-malware/conficker.md)|November 2008|--|Conficker uses a domain name generator. [[3]](#3)|
-|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|The malware sends a hash value generated from system information [[4]](#4)|
-|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|Ursnif has used a Domain name generation algorithm in the past [[5]](#5)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|B0030.001|The malware sends data to the C2 [[6]](#6)|
+|[**Kraken**](../xample-malware/kraken.md)|2008|--|Kraken uses a domain generating algorithm to provide new domains. [[2]](#2)|
+|[**Conficker**](../xample-malware/conficker.md)|2008|--|Conficker uses a domain name generator seeded by the current date to ensure that every copy of the virus generates the same names on their respective days. [[3]](#3)|
+|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|The malware uses an internal domain generation algorithm. [[4]](#4)|
+|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|Previous interations of Ursnif have used a Domain Name Generation algorithm. [[5]](#5)|
+

 ## References

@@ -54,5 +54,3 @@ The related **Dynamic Resolution: Domain Generation Algorithms ([T1568.002](http

 <a name="5">[5]</a> https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality

-<a name="6">[6]</a> https://blogs.cisco.com/security/talos/rombertik
-
@@ -38,26 +38,36 @@ See ATT&CK: **Ingress Tool Transfer ([T1105](https://attack.mitre.org/techniques

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Creates a folder on remote computers and then copies its executables (Shamoon and Filerase) into that directory  [[2]](#2)|
-|[**CozyCar**](../xample-malware/cozycar.md)|2010|--|CozyCar requests a file using SSL to a C2 domain [[3]](#3)|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Can download files from remote repository upon instruction  [[1]](#1)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|--|The malware receives files from C2 [[4]](#4)|
-|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR can download additional files and update itself. [[5]](#5)|
-|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|--|The malware downloads files from C2 [[6]](#6)|
+|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|After the Poison Ivy implant is running on the target machine, the attacker can use a Windows GUI controller to control the target computer. [[1]](#1)|
+|[**DarkComet**](../xample-malware/dark-comet.md)|2008|--|DarkComet can download files from a remote repository upon instruction. [[2]](#2)|
+|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon creates a folder on remote computers and then copies its executables (Shamoon and Filerase) into that directory. [[3]](#3)|
+|[**CozyCar**](../xample-malware/cozycar.md)|2010|--|CozyCar requests a file using SSL to a C2 domain. [[4]](#4)|
+|[**Vobfus**](../xample-malware/vobfus.md)|2016|--|Vobfus downloads its latest version from a remote server. [[5]](#5)|
+|[**TEARDROP**](../xample-malware/teardrop.md)|2018|--|TEARDROP executes the decrypted, embedded code buffer, which is a Cobalt Strike RAT. [[6]](#6)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|--|Malware downloads DLLs from the hardcoded URL/remote server. [[7]](#7) [[8]](#8)|
+|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR can download additional files and update itself. [[9]](#9)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut receives files from the C2. [[10]](#10)|
+|[**UP007**](../xample-malware/up007.md)|2016|--|UP007 downloads files from the C2. [[10]](#10)|
+

 ## References

-<a name="1">[1]</a> https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/
+<a name="1">[1]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy

-<a name="2">[2]</a> https://www.mcafee.com/blogs/other-blogs/mcafee-labs/shamoon-attackers-employ-new-tool-kit-to-wipe-infected-systems/
+<a name="2">[2]</a> https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/

-<a name="3">[3]</a> https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke
+<a name="3">[3]</a> https://www.mcafee.com/blogs/other-blogs/mcafee-labs/shamoon-attackers-employ-new-tool-kit-to-wipe-infected-systems/

-<a name="4">[4]</a> https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/gamut-spambot-analysis/
+<a name="4">[4]</a> https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke

-<a name="5">[5]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
+<a name="5">[5]</a> https://securitynews.sonicwall.com/xmlpost/revisiting-vobfus-worm-mar-8-2013/

-<a name="6">[6]</a> https://citizenlab.ca/2016/04/between-hong-kong-and-burma/
+<a name="6">[6]</a> https://www.cisa.gov/uscert/ncas/analysis-reports/ar21-039b

-<a name="7">[7]</a> https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke/
+<a name="7">[7]</a> https://www.0ffset.net/reverse-engineering/matanbuchus-loader-analysis/

+<a name="8">[8]</a> https://www.cyberark.com/resources/threat-research-blog/inside-matanbuchus-a-quirky-loader
+
+<a name="9">[9]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
+
+<a name="10">[10]</a> https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/gamut-spambot-analysis/
@@ -28,7 +28,7 @@

 # Alternative Installation Location

-Malware may install itself not as a file on the hard drive. [[1]](#1)
+Malware may install itself in areas other than the hard drive. [[1]](#1)

 ## Methods
 
@@ -41,8 +41,9 @@ Malware may install itself not as a file on the hard drive. [[1]](#1)

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Kovter**](../xample-malware/kovter.md)|2016|B0027.002|Stores malware files in the Registry instead of the hard drive. [[1]](#1)|
-|[**SYNful Knock**](../xample-malware/synful-knock.md)|2015|B0027.001|100 memory-resident modules can be installed  [[2]](#2)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|B0027.002|Kovter stores malware files in the Registry instead of on the hard drive. [[1]](#1)|
+|[**SYNful Knock**](../xample-malware/synful-knock.md)|2015|B0027.001|100 memory-resident modules can be installed. [[2]](#2)|
+

 ## References

@@ -36,8 +36,9 @@ The MBC also associates the Bootkit behavior with Defense Evasion because the ma

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|An MBR bootkit and a BIOS bootkit targeting Award BIOS. [[1]](#1)|
-|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|Can implement malicious code into firmware, allowing read, write, and/or erasure of the UEFI/BIOS firmware  [[2]](#2)|
+|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|The malware is an MBR bootkit and a BIOS bootkit targeting Award BIOS. [[1]](#1)|
+|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|The malware can implement malicious code into firmware, allowing read, write, and/or erasure of the UEFI/BIOS firmware. [[2]](#24)|
+

 ## References

@@ -52,8 +52,11 @@ See ATT&CK: **Impair Defenses: Disable or Modify Tools ([T1562.001](https://atta

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|Loads ntdll.dll and user32.dll as data files in memory and overwrites the first 8 bytes of those functions, which unhooks the APIs. [[1]](#1)|
-|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|Prevents the infected system from installing anti-virus software updates. [[2]](#2)|
+|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|Most security products hook some APIs to monitor the behavior of malware. To avoid being identified by this technique, WebCobra loads ntdll.dll and user32.dll as data files in memory and overwrites the first 8 bytes of those functions, which unhooks the APIs. [[1]](#1)|
+|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|The malware terminates the following anti-malware services: Window Defender, MBamService (Malwarebytes), SAVService (Sophos AV). [[6]](#6)|
+|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|DNSChanger prevents the infected system from installing anti-virus software updates. [[2]](#2)|
+|[**Vobfus**](../xample-malware/vobfus.md)|2016|--|Vobfus uses GetModuleHandle API to check for the presence of Avast Antivirus. [[5]](#5)|
+

 ## References

@@ -65,3 +68,7 @@ See ATT&CK: **Impair Defenses: Disable or Modify Tools ([T1562.001](https://atta

 <a name="4">[4]</a> Carl Petty, Red Canary, 3/3/2020. Online: https://redcanary.com/blog/heavens-gate-technique-on-linux/

+<a name="5">[5]</a> https://securitynews.sonicwall.com/xmlpost/revisiting-vobfus-worm-mar-8-2013/
+
+<a name="6">[6]</a> https://www.trendmicro.com/en_us/research/18/k/trickbot-shows-off-new-trick-password-grabber-module.html
+
@@ -47,8 +47,12 @@ See ATT&CK: **Hide Artifacts: Hidden Files and Directories ([T1564.001](https://
 |Name|Date|Method|Description|
 |---|---|---|---|
 |[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--| GoBotKR stores itself in a file with Hidden and System attributes. [[1]](#1)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|F0005.004|Modifies target files' time to August 2012 as an antiforensic trick  [[2]](#2)|
-|[**CHOPSTICK**](../xample-malware/chopstick.md)|2015|--|CHOPSTICK creates a hidden file for temporary storage [[3]](#3)|
+|[**Shamoon**](../xample-malware/shamoon.md)|2012|F0005.004|Malware modifies target files' time to August 2012 as an antiforensic trick. [[2]](#2)|
+|[**CHOPSTICK**](../xample-malware/chopstick.md)|2015|--|CHOPSTICK creates a hidden file for temporary storage. [[3]](#3)|
+|[**Vobfus**](../xample-malware/vobfus.md)|2016|F0005.002|Vobfus is located on external drives or network shares and attaches itself to ZIP and RAR files, other removable drives, and network shares. Vobfus hides folders on the external drive and drops an executable with the same name and a disguised folder icon. [[4]](#4)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|F0005.002|Malware looks for a specific folder on the victim. If the folder doesn't exist, the malware creates the folder on the victim by calling CreateDirectoryA and downloads the remote file into the new folder. [[5]](#5) [[6]](#6)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|F0005.001|The malware also appends the filename and extension .ocx to the ProgramData folder path. [[5]](#5) [[6]](#6)|
+

 ## References

@@ -58,3 +62,8 @@ See ATT&CK: **Hide Artifacts: Hidden Files and Directories ([T1564.001](https://

 <a name="3">[3]</a> https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf

+<a name="4">[4]</a> https://securitynews.sonicwall.com/xmlpost/revisiting-vobfus-worm-mar-8-2013/
+
+<a name="5">[5]</a> https://www.0ffset.net/reverse-engineering/matanbuchus-loader-analysis/
+
+<a name="6">[6]</a> https://www.cyberark.com/resources/threat-research-blog/inside-matanbuchus-a-quirky-loader
@@ -47,8 +47,8 @@ See ATT&CK: **Hide Artifacts ([T1564](https://attack.mitre.org/techniques/T1564/

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**YiSpecter**](../xample-malware/yispecter.md)|2015|--|Hides icons from iOS's SpringBoard as well as use the same name and logos of system apps to trick iOS power users [[1]](#1)|
-|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Stuxnet intercepts IRP requests (reads, writes) to devices (NFTS, FAT, CD-ROM). It monitors directory control IRPs, in particular directory query notifications such that when an application requests the list of files, it returns a Stuxnet-specified subset of the true items. These filters hide the files used by Stuxnet to spread through removalbe drives  [[2]](#2)|
+|[**YiSpecter**](../xample-malware/yispecter.md)|2015|--|The malware hides icons from iOS's SpringBoard as well as use the same name and logos of system apps to trick iOS power users. [[1]](#1)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Stuxnet intercepts IRP requests (reads, writes) to devices (NFTS, FAT, CD-ROM). It monitors directory control IRPs, in particular directory query notifications, such that when an application requests the list of files, it returns a Stuxnet-specified subset of the true items. These filters hide the files used by Stuxnet to spread through removable drives.  [[2]](#2)|

 ## References

@@ -58,12 +58,14 @@ See ATT&CK: **Hijack Execution Flow ([T1574](https://attack.mitre.org/techniques

 |Name|Date|Method|Description|
 |---|---|---|---|
-|**Kronos**|June 2014|--|Kronos hooks the API of processes to prevent detection. [[6]](#6)|
-|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|Hooks various DLL exported functions when the component is loaded in their respective Browser application process is running to monitor network traffic [[7]](#7)|
-|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|F0015.006|	Abuses Microsoft's Dynamic Data Exchange (DDE) protocol  [[8]](#8)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|F0015.006|Escalates privilege by impersonating the token. First uses LogonUser and ImpersonateLoggedOnUser, then ImpersonateNamedPipeClient. [[10]](#10)|
-|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|F0015.003, F0015.007|Please see the Stuxnet malware page for details. [[11]](#11)|
-|[**SYNful Knock**](../xample-malware/synful-knock.md)|2015|--|Hooks IOS functions to call and initialize the malware  [[9]](#9)|
+|**Kronos**|2014|--|Kronos hooks the API of processes to prevent detection. [[6]](#6)|
+|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|The malware hooks various DLL exported functions when the DLL component is loaded into their respective browser application to monitor network traffic. [[7]](#7)|
+|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|F0015.006|GravityRAT abuses Microsoft's Dynamic Data Exchange (DDE) protocol. [[8]](#8)|
+|[**SYNful Knock**](../xample-malware/synful-knock.md)|2015|--|SYNful Knock hooks iOS functions to call and initialize the malware. [[9]](#9)|
+|[**Shamoon**](../xample-malware/shamoon.md)|2012|F0015.006|Malware escalates privileges by impersonating the token through using LogonUser and ImpersonateLoggedOnUser then ImpersonateNamedPipeClient. [[10]](#10)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|F0015.003|Stuxnet hooks ntdll.dll to monitor for requests to load specially crafted file names which are mapped to a location specified by Stuxnet. [[11]](#11)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|F0015.007|WTR4141.tmp hooks APIs from kernel32.dll and ntdll.dll and replaces the original code for these functions with code that checks for files with properties pertaining to Stuxnet files. If a request is made to list a file with the specified properties, the response from these APIs is altered to state that the file does not exist, thereby hiding all files with these properties. [[11]](#11)|
+

 ## References

@@ -43,10 +43,11 @@ See ATT&CK: **Impair Defenses: Indicator Blocking ([T1562.006](https://attack.mi

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|Clears windows event logs and removes the watermark associated with enabling the TESTSIGNING boot configuration option by removing the relevent strings in the user32.dll.mui of the system  [[1]](#1)|
-|[**Conficker**](../xample-malware/conficker.md)|2008|--|Terminates various services related to system security and Windows and prevents network access to various websites related to antivirus software  [[2]](#2)|
-|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|Terminates the following anti-malware services: Window Defender, MBamService (Malwarebytes), SAVService (Sophos AV) [[4]](#4)|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Can disable security center functions like anti-virus and firewall [[3]](#3)|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|The malware clears windows event logs and removes the watermark associated with enabling the TESTSIGNING boot configuration option by removing the relevent strings in the user32.dll.mui of the system. [[1]](#1)|
+|[**Conficker**](../xample-malware/conficker.md)|2008|--|The malware terminates various services related to system security and Windows and prevents network access to various websites related to antivirus software. [[2]](#2)|
+|[**DarkComet**](../xample-malware/dark-comet.md)|2008|--|The malware can disable security center functions like anti-virus and firewall. [[3]](#3)|
+|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|TrickBot terminates the following anti-malware services: Window Defender, MBamService (Malwarebytes), SAVService (Sophos AV). [[4]](#4)|
+

 ## References

@@ -34,12 +34,12 @@ Malware may install malicious configuration settings or may modify existing conf

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|Configures the system to the TESTSIGNING boot configuration option to load its unsigned driver component [[1]](#1)|
-|[**YiSpecter**](../xample-malware/yispecter.md)|2015|--|Changes iOS Safari's default configuration [[2]](#2)|
+|[**Black Energy**](../xample-malware/blackenergy.md)|2007|--|Malware configures the system to the TESTSIGNING boot configuration option to load its unsigned driver component. [[1]](#1)|
+|[**YiSpecter**](../xample-malware/yispecter.md)|2015|--|The malware changes iOS Safari's default configuration. [[2]](#2)|
+

 ## References

 <a name="1">[1]</a> https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf

 <a name="2">[2]</a> http://researchcenter.paloaltonetworks.com/2015/10/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/
-
@@ -38,16 +38,17 @@ See ATT&CK: **Modify Registry ([T1112](https://attack.mitre.org/techniques/T1112
 |Name|Date|Method|Description|
 |---|---|---|---|
 |[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR can modify registry keys to disable Task Manager, Registry Editor and Command Prompt. [[2]](#2)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|The malware adds many entries to the registry [[3]](#3)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|--|The malware adds a registry key [[4]](#4)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|--|The malware modifies the registry during execution [[5]](#5)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Disables remote user account control by enabling the registry key LocalAccountTokenFilterPolicy  [[6]](#6)|
-|[**CHOPSTICK**](../xample-malware/chopstick.md)|2015|--|CHOPSTICK may encrypt and store configuration data inside a registry key [[7]](#7)|
-|[**Clipminer**](../xample-malware/clipminer.md)|2011|--|Clipminer edits the registry [[1]](#1)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|The malware adds many entries to the registry. [[3]](#3)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|--|The malware adds a registry key. [[4]](#4)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|--|The malware modifies the registry during execution. [[5]](#5)|
+|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon disables remote user account control by enabling the registry key LocalAccountTokenFilterPolicy. [[6]](#6)|
+|[**CHOPSTICK**](../xample-malware/chopstick.md)|2015|--|CHOPSTICK may encrypt and store configuration data inside a registry key. [[7]](#7)|
+|[**Clipminer**](../xample-malware/clipminer.md)|2011|--|Clipminer edits the registry. [[8]](#8)|
+

 ## References

-<a name="1">[1]</a> https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking
+<a name="1">[1]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy

 <a name="2">[2]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/

@@ -61,5 +62,5 @@ See ATT&CK: **Modify Registry ([T1112](https://attack.mitre.org/techniques/T1112

 <a name="7">[7]</a> https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf

-<a name="8">[8]</a> https://labs.vipre.com/analysis-of-kovter-a-very-clever-piece-of-malware/#:~:text=Kovter%20copies%20the%20fileless%20persistence,written%20on%20to%20the%20filesystem.
+<a name="8">[8]</a> https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking

@@ -60,28 +60,32 @@ Instead of being listed alphabetically, methods have been grouped to better faci

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**TrickBot**](../xample-malware/trickbot.md)|2016|E1027.m02|Trojan spyware program that has mainly been used for targeting banking sites. [[4]](#4)|
-|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|Obfuscates files. [[5]](#5)|
+|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|Malware obfuscates files.[[8]](#8)|
+|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|The dropped file is password-protected. Once unzipped, the file contains a DLL file to decrypt the second file (a bin file with an encrypted malicious payload). [[7]](#7)|
 |[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR uses base64 to obfuscate strings, commands and files. [[1]](#1)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|--|The malware will use a key to decrypt text from a URL to create more malicious code [[2]](#2)|
-|[**Netwalker**](../xample-malware/netwalker.md)|2020|--|Netwalker is obfuscated with several layers of encoding, obfuscation, and encryption techniques such as base64, hexademcimal, and XOR [[3]](#3)|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|E1027.m05|Encrypt data using RC4 via WinAPI (This capa rule had 1 match) [[7]](#7)|
-|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|E1027.m02|Encode data using XOR (This capa rule had 1 match) [[7]](#7)|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|E1027.m02|Encode data using XOR (This capa rule had 13 matches) [[7]](#7)|
-|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|E1027.m02|Encode data using XOR (This capa rule had 1 match) [[7]](#7)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|E1027.m02|Encode data using XOR (This capa rule had 1 match) [[7]](#7)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|E1027.m02, E1027.m05|Please see the Hupigon malware page for details. [[7]](#7)|
-|[**Kraken**](../xample-malware/kraken.md)|2008|E1027.m02|Encode data using XOR (This capa rule had 2 matches) [[7]](#7)|
-|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|E1027.m02|Encode data using XOR (This capa rule had 4 matches) [[7]](#7)|
-|[**Mebromi**](../xample-malware/mebromi.md)|2011|E1027.m02|Encode data using XOR (This capa rule had 2 matches) [[7]](#7)|
-|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|E1027.m07|Poison Ivy variant encrypts all its strings [[6]](#6)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|E1027.m02|Encode data using XOR (This capa rule had 1 match) [[7]](#7)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|E1027.m02|Encode data using XOR (This capa rule had 5 matches) [[7]](#7)|
-|[**SamSam**](../xample-malware/samsam.md)|2015|E1027.m07|SamSam obfuscates functions, class names and strings, including the list of targeted file extensions, the help file contents and environment variables using DES encryption with a fixed hard-coded key and the IV  [[8]](#8)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|E1027.m02|Encode data using XOR (This capa rule had 1 match) [[7]](#7)|
-|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|E1027.m01, E1027.m02|Please see the Stuxnet malware page for details. [[9]](#9)|
-|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|E1027.m02|Encode data using XOR (This capa rule had 13 matches) [[7]](#7)|
-|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|Creates an encrypted Registry key called TorClient to store its data [[10]](#10)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|--|The malware will use a key to decrypt text from a URL to create more malicious code. [[2]](#2)|
+|[**Netwalker**](../xample-malware/netwalker.md)|2020|--|Netwalker is obfuscated with several layers of encoding, obfuscation, and encryption techniques such as Base64, hexademcimal, and XOR. [[3]](#3)|
+|[**TEARDROP**](../xample-malware/teardrop.md)|2018|E1027.m05|TEARDROP decrypts an embedded code buffer using an XOR-based stream cipher. [[4]](#4)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|E1027.m01|The configuration data block is encoded with a NOT XOR 0xFF operation. [[5]](#5)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|E1027.m02|Stuxnet encodes data using XOR. [[9]](#9)|
+|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|The malware creates an encrypted Registry key called TorClient to store its data. [[6]](#6)|
+|[**TrickBot**](../xample-malware/trickbot.md)|2016|E1027.m02|TrickBot encodes data using XOR. [[9]](#9)|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|E1027.m05|BlackEnergy encrypts data using RC4 via WinAPI. [[9]](#9)|
+|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|E1027.m02|CryptoLocker encodes data using XOR. [[9]](#9)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|E1027.m02|Dark Comet encodes data using XOR. [[9]](#9)|
+|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|E1027.m02|DNSChanger encodes data using XOR. [[9]](#9)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|E1027.m02|Gamut encodes data using XOR. [[9]](#9)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|E1027.m02|Hupigon encodes data using XOR. [[9]](#9)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|E1027.m05|Hupigon encrypts data using DES. [[9]](#9)|
+|[**Kraken**](../xample-malware/kraken.md)|2008|E1027.m02|Kraken encodes data using XOR. [[9]](#9)|
+|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|E1027.m02|Locky Bart encodes data using XOR. [[9]](#9)|
+|[**Mebromi**](../xample-malware/mebromi.md)|2011|E1027.m02|Mebromi encodes data using XOR. [[9]](#9)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|E1027.m02|Redhip encodes data using XOR. [[9]](#9)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|E1027.m02|Rombertik encodes data using XOR. [[9]](#9)|
+|[**SamSam**](../xample-malware/samsam.md)|2015|E1027.m07|SamSam obfuscates functions, class names and strings, including the list of targeted file extensions, the help file contents and environment variables using DES encryption with a fixed hard-coded key and the IV. [[10]](#10)|
+|[**Shamoon**](../xample-malware/shamoon.md)|2012|E1027.m02|Shamoon encodes data using XOR. [[9]](#9)|
+|[**UP007**](../xample-malware/up007.md)|2016|E1027.m02|The malware encodes data using XOR. [[9]](#9)|
+

 ## References

@@ -91,19 +95,16 @@ Instead of being listed alphabetically, methods have been grouped to better faci

 <a name="3">[3]</a> https://www.trendmicro.com/en_us/research/20/e/netwalker-fileless-ransomware-injected-via-reflective-loading.html

-<a name="4">[4]</a> https://www.trendmicro.com/en_us/research/18/k/trickbot-shows-off-new-trick-password-grabber-module.html
+<a name="4">[4]</a> https://www.cisa.gov/uscert/ncas/analysis-reports/ar21-039b

-<a name="5">[5]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
+<a name="5">[5]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en

-<a name="6">[6]</a> https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-poison-ivy-variant
+<a name="6">[6]</a> https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality

-<a name="7">[7]</a> capa v4.0, analyzed at MITRE on 10/12/2022
+<a name="7">[7]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/

-<a name="8">[8]</a> https://blog.talosintelligence.com/2018/01/samsam-evolution-continues-netting-over.html
+<a name="8">[8]</a> https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf

-<a name="9">[9]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
-
-<a name="10">[10]</a> https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality
-
-<a name="11">[11]</a> https://blog.malwarebytes.com/threat-analysis/2016/07/untangling-kovter/
+<a name="9">[9]</a> capa v4.0, analyzed at MITRE on 10/12/2022

+<a name="10">[10]</a> https://blog.talosintelligence.com/2018/01/samsam-evolution-continues-netting-over.html
@@ -28,7 +28,7 @@

 # Polymorphic Code

-Polymorphic code, a file with the same functionality but different execution, is created, often on the fly, making it difficult to detect. This behavior includes metamorphic code where the code is changed (not just executed differently), but with the behavior the same. Polymorphic Code behavior is typically identified through analysis of related samples.
+Polymorphic code, a file with the same functionality but different execution, is created, often on the fly, making it difficult to detect. This behavior includes metamorphic code where the code is changed (not just executed differently), but with the behavior the same. Polymorphic code behavior is typically identified through analysis of related samples.

 ## Methods

@@ -42,7 +42,7 @@ Polymorphic code, a file with the same functionality but different execution, is

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**EvilBunny**](../xample-malware/evilbunny.md)|2011|--|EvilBunny utilizes Lua scripts to exhibit polymorphism [[2]](#2)|
+|[**EvilBunny**](../xample-malware/evilbunny.md)|2011|--|EvilBunny utilizes Lua scripts to exhibit polymorphism. [[2]](#2)|

 ## References

@@ -34,12 +34,12 @@ See ATT&CK: **Process Injection ([T1055](https://attack.mitre.org/techniques/T10

 |ID|ATT&CK Sub-Technique|Notes|
 |---|---|---|
-|E1055.001|Dynamic-link Library Injection|Malware creates a thread using CreateRemoteThread (or NtCreateThreadEx, RtlCreateUserThread) and LoadLibrary. The path to the malware's malicious dynamic-link library (DLL) is written in the virtual address space of another process; the malware ensures the remote process loads it by creating a remote thread in the target process. This is one of the most common process injection methods. Called *Classic DLL Injection via CreateRemoteThread and LoadLibrary* in [[1]](#1).|
-|E1055.002|Portable Executable Injection|Malware copies its malicious code into an existing open process and causes it to execute via shellcode or by calling CreateRemoteThread (instead of passing the address of the LoadLibrary). Called *Portable Executable Injection* in [[1]](#1).|
-|E1055.003|Thread Execution Hijacking|Malware targets an existing thread of a process, avoiding noisy process or thread creations operations. Called *Thread Execution Hijacking* in [[1]](#1).|
-|E1055.004|Asynchronous Procedure Call|Malware may leverage Asynchronous Procedure Calls (APC) to force another thread to execute its code by attaching it to the APC Queue of the target thread (using QueueUserAPC / NtQueueApcThread); also called AtomBombing [[3]](#3). Called *APC Injection and AtomBombing* in [[1]](#1).|
-|E1055.011|Extra Window Memory Injection|Malware may inject into Explorer tray window’s extra window memory. Called *Extra Window Memory Injection* in [[1]](#1).|
-|E1055.012|Process Hollowing|Instead of injecting code into a program, malware can upmap (hollow out) legitimate code from memory of a target process, overwriting it with a malicious executable. Called *Process Hollowing* in [[1]](#1).|
+|E1055.001|Dynamic-link Library Injection|Malware creates a thread using CreateRemoteThread (or NtCreateThreadEx, RtlCreateUserThread) and LoadLibrary. The path to the malware's malicious dynamic-link library (DLL) is written in the virtual address space of another process; the malware ensures the remote process loads it by creating a remote thread in the target process. This is one of the most common process injection methods, called *Classic DLL Injection via CreateRemoteThread and LoadLibrary* in [[1]](#1).|
+|E1055.002|Portable Executable Injection|Malware copies its malicious code into an existing open process and causes it to execute via shellcode or by calling CreateRemoteThread (instead of passing the address of the LoadLibrary), called *Portable Executable Injection* in [[1]](#1).|
+|E1055.003|Thread Execution Hijacking|Malware targets an existing thread of a process, avoiding noisy process or thread creations operations, called *Thread Execution Hijacking* in [[1]](#1).|
+|E1055.004|Asynchronous Procedure Call|Malware may leverage Asynchronous Procedure Calls (APC) to force another thread to execute its code by attaching it to the APC Queue of the target thread (using QueueUserAPC / NtQueueApcThread), called AtomBombing [[3]](#3), also called *APC Injection and AtomBombing* in [[1]](#1).|
+|E1055.011|Extra Window Memory Injection|Malware may inject into Explorer tray window’s extra window memory, called *Extra Window Memory Injection* in [[1]](#1).|
+|E1055.012|Process Hollowing|Instead of injecting code into a program, malware can upmap (hollow out) legitimate code from memory of a target process, overwriting it with a malicious executable, called *Process Hollowing* in [[1]](#1).|

 Methods not captured by ATT&CK Process Injection sub-techniques are listed below. Note that IAT hooking and inline hooking (aka userland rootkits) are defined as methods under the [Hijack Execution Flow](../defense-evasion/hijack-execution-flow.md) behavior.

@@ -57,20 +57,23 @@ Methods not captured by ATT&CK Process Injection sub-techniques are listed below

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|Trojan spyware program that has mainly been used for targeting banking sites. [[11]](#11)|
-|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|--|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[2]](#2)|
-|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|Injects minor code into a running process. [[12]](#12)|
-|[**CryptoWall**](../xample-malware/cryptowall.md)|2014|--|The malware injects code into a new svchost process [[6]](#6)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|E1055, E1055.012|Please see the Hupigon malware page for details. [[7]](#7)|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|E1055.m05|Bypasses UAC using a Shim Database instructing SndVol.exe to execute cmd.exe instead, allowing for elevated execution  [[8]](#8)|
-|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|E1055.001, E1055.m05|Please see the Stuxnet malware page for details. [[9]](#9)|
-|[**Netwalker**](../xample-malware/netwalker.md)|2020|E1055.001|Netwalker uses reflective DLL loading to inject from memory [[10]](#10)|
-|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|--|The malware loads multiple DLLs into memory [[4]](#4)|
-|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|Attach user process memory (This capa rule had 1 match) [[13]](#13)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|E1055.003|Inject thread (This capa rule had 1 match) [[13]](#13)|
+|[**UP007**](../xample-malware/up007.md)|2016|E1055.001|The malware loads multiple DLLs into memory. [[4]](#4)|
+|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|The malware injects itself into svchost.exe. [[11]](#11)|
+|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|Poison Ivy code is injected into explorer.exe. [[2]](#2)|
+|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|The malware injects miner code into a running process. [[12]](#12)|
+|[**CryptoWall**](../xample-malware/cryptowall.md)|2014|--|The malware injects code into a new svchost process. [[6]](#6)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|The malware injects itself into processes such as cmd.exe and notepad.exe [[7]](#7)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|E1055.012|The malware uses process replacement. [[13]](#13)|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|E1055.m05|BlackEnergy bypasses UAC using a Shim Database instructing SndVol.exe to execute cmd.exe instead, allowing for elevated execution. [[8]](#8)|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|BlackEnergy injects its dll component into svchost.exe. [[8]](#8)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|E1055.001|Stuxnet injects the entire DLL into another process and then just calls the particular export. [[9]](#9)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|E1055.m02|Stuxnet uses Mrxcls.sys driver for persistence. It is registered as a boot start service by creating the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxCIs\"ImagePath" = "%System%\drivers\mrxcls.sys". [[9]](#9)|
+|[**Netwalker**](../xample-malware/netwalker.md)|2020|E1055.001|Netwalker uses reflective DLL loading to inject from memory. [[10]](#10)|
+|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|The malware can attach user process memory. [[13]](#13)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|E1055.003|The malware can inject threads. [[13]](#13)|
+

 ## References
-
 <a name="1">[1]</a> Ashkan Hosseini, *Ten Process Injection Techniques: A Technical Survey of Common and Trending Process Injection Techniques*, July 2017. https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process

 <a name="2">[2]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy
@@ -91,13 +94,8 @@ Methods not captured by ATT&CK Process Injection sub-techniques are listed below

 <a name="10">[10]</a> https://www.trendmicro.com/en_us/research/20/e/netwalker-fileless-ransomware-injected-via-reflective-loading.html

-<a name="11">[11]</a> https://www.trendmicro.com/en_us/research/18/k/trickbot-shows-off-new-trick-password-grabber-module.html
+<a name="11">[11]</a> https://www.cybereason.com/blog/research/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware

 <a name="12">[12]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/

 <a name="13">[13]</a> capa v4.0, analyzed at MITRE on 10/12/2022
-
-<a name="14">[14]</a> https://www.cybereason.com/blog/research/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
-
-<a name="15">[15]</a> https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf
-
@@ -33,16 +33,16 @@ Behaviors of a rootkit: "A rootkit is a collection of computer software, typical

 See ATT&CK: **Rootkit ([T1014](https://attack.mitre.org/techniques/T1014/))**.

-Rootkits may hide artifacts (kernel modules, services, threads, userspace libraries), prevent actions (API unhooking (prevents API hooks installed by the malware instance from being removed), file access (prevents access to the file system, including specific files and/or directories associated with the malware instance), file deletion (prevents files and/or directories associated with the malware instance from being deleted), memory access (prevents access to system memory where the malware instance stores code or data), native API hooking (prevents other software from hooking native system APIs), registry access (prevents access to the Windows registry, either entire registry or particular registry keys/values), registry deletion (prevents deletion of registry keys and/or values associated with the malware instance).
+Rootkits may hide artifacts (kernel modules, services, threads, userspace libraries), prevent actions, API unhooking (prevents API hooks installed by the malware instance from being removed), file access (prevents access to the file system, including specific files and/or directories associated with the malware instance), file deletion (prevents files and/or directories associated with the malware instance from being deleted), memory access (prevents access to system memory where the malware instance stores code or data), native API hooking (prevents other software from hooking native system APIs), registry access (prevents access to the Windows registry, either entire registry or particular registry keys/values), and registry deletion (prevents deletion of registry keys and/or values associated with the malware instance).

 ## Methods

 |Name|ID|Description|
 |---|---|---|
 |**Application Rootkit**|E1014.m12|Application rootkits operate by exchanging standard application files with rootkit files, or changing applications by injecting code or patching.|
-|**Bootloader**|E1014.m13|A bootloader rootkit modifies the bootloader, enabling activation before the operating system is started. Also known as a Bootkit. See ATT&CK: [Bootkit](https://attack.mitre.org/techniques/T1542/003/).|
+|**Bootloader**|E1014.m13|A bootloader rootkit modifies the bootloader, enabling activation before the operating system is started, also known as a Bootkit. See ATT&CK: [Bootkit](https://attack.mitre.org/techniques/T1542/003/).|
 |**Hardware/Firmware Rootkit**|E1014.m14|A firmware rootkit compromises hardware (e.g. network card, hard drive), system BIOS, UEFI firmware. LoJack is the first in-the-wild UEFI rootkit. See ATT&CK: [System Firmware](https://attack.mitre.org/techniques/T1542/001/).|
-|**Hypervisor/Virtualized Rootkit**|E1014.m15|A hypervisor (virtualized) rootkit hosts the target operating system as a virtual machine, enabling interception of all hardware calls. Also called, virtual-machine-based rootkit (VMBR).|
+|**Hypervisor/Virtualized Rootkit**|E1014.m15|A hypervisor (virtualized) rootkit hosts the target operating system as a virtual machine, enabling interception of all hardware calls, also called a virtual-machine-based rootkit (VMBR).|
 |**Kernel Mode Rootkit**|E1014.m16|Rootkit operates by adding or replacing code in OS, device drivers, loadable kernel modules (LKM). Related to ATT&CK: [Kernel Modules and Extensions](https://attack.mitre.org/techniques/T1547/006/)|
 |**Memory Rootkit**|E1014.m17|A memory rootkit hids in RAM. Behaviors may include methods to prevent memory access. The lifespan of a memory rootkit is short because it disappears after a system reboot.|

@@ -50,8 +50,16 @@ Rootkits may hide artifacts (kernel modules, services, threads, userspace librar

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--| Certain variants of the malware may have rootkit functionality [[3]](#3)|
-|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|E1014.m17|Stuxnet registers custom resource drives signed with a legitimate Realtek digital certificate  [[4]](#4)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon has certain variants that may have rootkit functionality. [[3]](#3)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|E1014.m16|Stuxnet registers custom resource drives signed with a legitimate Realtek digital certificate. [[4]](#4)|
+
+
+## Detection
+
+Rootkits can be detected by detecting primary rootkit behaviors: Hide Artifacts, Impair Defenses, and Highjack Execution Flow. Hidden artifacts include kernel modules (hides use of kernel modules used by the malware instance), services (hides any system services that the malware instance creates or injects itself into), threads (hides one or more threads that belong to the malware instance), and userspace libraries (hides use of userspace libraries used by the malware instance). 
+
+Rootkits can also be detected via memory dump analysis or virtual machine introspection.
+

 ## References

@@ -46,15 +46,15 @@ See ATT&CK: **Indicator Removal on Host: Uninstall Malicious Application ([T1630

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Terminator**](../xample-malware/terminator.md)|2013|F0007.001|Evades sandboxes by terminating and removing itself (DW20.exe) after installation. [[1]](#1)|
-|[**CozyCar**](../xample-malware/cozycar.md)|2010|--|CozyCar has a dll file that serves as a cleanup mechanism for its dropped binary [[2]](#2)|
-|[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|The malware will monitor if a specific file gets deleted, and then will delete itself. [[3]](#3)|
+|[**Terminator**](../xample-malware/terminator.md)|2013|F0007.001|The RAT evades sandboxes by terminating and removing itself (DW20.exe) after installation. [[1]](#1)|
+|[**CozyCar**](../xample-malware/cozycar.md)|2010|--|CozyCar has a dll file that serves as a cleanup mechanism for its dropped binary. [[2]](#2)|
+|[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|The malware will monitor if a specific file gets deleted and then will delete itself. [[3]](#3)|
+

 ## References

-<a name="1">[1]</a> https://www.mandiant.com/resources/hot-knives-through-butter-evading-file-based-sandboxes
+<a name="1">[1]</a> https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2013/FireEye-Terminator_RAT.pdf

-<a name="2">[2]</a> https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke/
+<a name="2">[2]</a> https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke

 <a name="3">[3]</a> https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/
-
@@ -40,19 +40,22 @@ This behavior corresponds to simple, general discovery of analysis tools. Behavi
 |**Known Window**|B0013.009|Malware may detect an analysis tool via the presence of a known window.|
 |**Known Windows Class Name**|B0013.010|Running program windows are checked to see if any windows class name contains a string indicating that an analysis tool is running. For example, 'WinDbgFrameClass' is Windbg main window’s class name. [2]|
 |**Process detection**|B0013.001|Malware can scan for the process name associated with common analysis tools.|
-|**Process detection - Debuggers**|B0013.002|Malware can scan for the process name associated with common analysis tools. OllyDBG / ImmunityDebugger / WinDbg / IDA Pro|
-|**Process detection - PCAP Utilities**|B0013.004|Malware can scan for the process name associated with common analysis tools. Wireshark / Dumpcap|
-|**Process detection - PE Utilities**|B0013.006|Malware can scan for the process name associated with common analysis tools. ImportREC / PETools / LordPE|
-|**Process detection - Process Utilities**|B0013.005|Malware can scan for the process name associated with common analysis tools. ProcessHacker / SysAnalyzer / HookExplorer / SysInspector|
-|**Process detection - Sandboxes**|B0013.007|Malware can scan for the process name associated with common analysis tools. Joe Sandbox, etc.|
-|**Process detection - SysInternals Suite Tools**|B0013.003|Malware can scan for the process name associated with common analysis tools. Process Explorer / Process Monitor / Regmon / Filemon, TCPView, Autoruns|
+|**Process detection - Debuggers**|B0013.002|Malware can scan for the process name associated with common analysis tools - OllyDBG / ImmunityDebugger / WinDbg / IDA Pro.|
+|**Process detection - PCAP Utilities**|B0013.004|Malware can scan for the process name associated with common analysis tools - Wireshark / Dumpcap.|
+|**Process detection - PE Utilities**|B0013.006|Malware can scan for the process name associated with common analysis tools - ImportREC / PETools / LordPE.|
+|**Process detection - Process Utilities**|B0013.005|Malware can scan for the process name associated with common analysis tools - ProcessHacker / SysAnalyzer / HookExplorer / SysInspector.|
+|**Process detection - Sandboxes**|B0013.007|Malware can scan for the process name associated with common analysis tools - Joe Sandbox, etc.|
+|**Process detection - SysInternals Suite Tools**|B0013.003|Malware can scan for the process name associated with common analysis tools - Process Explorer / Process Monitor / Regmon / Filemon, TCPView, Autoruns.|

 ## Use in Malware

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Emotet**](../xample-malware/emotet.md)|2018|B0013.002|If it recieves a response from the c2 server stating a debugging-related tool is in the list of running processes, it recieves an "upgrade" command which calls the ShellExecuteW function and exits [[1]](#1)|
-|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|B0013, B0013.010|Please see the Poison-Ivy malware page for details. [[2]](#2)|
+|[**Emotet**](../xample-malware/emotet.md)|2018|B0013.002|If Emotet receives a response from the C2 server stating a debugging-related tool is in the list of running processes, it recieves an "upgrade" command which calls the ShellExecuteW function and exits. [[1]](#1)|
+|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|Poison Ivy Variant runs a threat to check if any analysis tools are running by creating specially named pipes that are created by various analysis tools. If one of the named pipes cannot be created, it means one of the analysis tools is running. [[2]](#2) [[3]](#3)|
+|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|B0013.010|Poison Ivy goes through all the running program windows to check if any Windows class name contains a special string to determine if an analysis tool is running. [[2]](#2) [[3]](#3)|
+|[**WebCobra**](../xample-malware/webcobra.md)|2018|B0013.004|When infecting a x64 architecture system, the malware terminates if Wireshark is running on the system. [[4]](#4)|
+

 ## References

@@ -60,3 +63,6 @@ This behavior corresponds to simple, general discovery of analysis tools. Behavi

 <a name="2">[2]</a> https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf

+<a name="3">[3]</a> https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-poison-ivy-variant
+
+<a name="4">[4]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
@@ -39,12 +39,12 @@ Malware may attempt to get a listing of open application windows.

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|E1010.m01|Get graphical window text (This capa rule had 2 matches) [[1]](#1)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|E1010.m01|Get graphical window text (This capa rule had 1 match) [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|E1010.m01|Get graphical window text (This capa rule had 1 match) [[1]](#1)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|E1010.m01|Get graphical window text (This capa rule had 2 matches) [[1]](#1)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|E1010.m01|Get graphical window text (This capa rule had 2 matches) [[1]](#1)|
-|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|E1010.m01|Get graphical window text (This capa rule had 1 match) [[1]](#1)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|E1010.m01|DarkComet gets graphical window texts. [[1]](#1)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|E1010.m01|Gamut gets graphical window texts. [[1]](#1)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|E1010.m01|Hupigon gets graphical window texts. [[1]](#1)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|E1010.m01|Kovter gets graphical window texts. [[1]](#1)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|E1010.m01|Rombertik gets graphical window texts. [[1]](#1)|
+|[**UP007**](../xample-malware/up007.md)|2016|E1010.m01|UP007 gets graphical window text. [[1]](#1)|

 ## References

@@ -41,17 +41,17 @@ Malware may inspect code or enumerate aspects.

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|B0046.001|Enumerate PE sections (This capa rule had 1 match) [[1]](#1)|
-|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|B0046.001|Enumerate PE sections (This capa rule had 1 match) [[1]](#1)|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|B0046.001|Enumerate PE sections (This capa rule had 3 matches) [[1]](#1)|
-|[**Emotet**](../xample-malware/emotet.md)|2018|B0046.001|Enumerate pe sections (this capa rule had 1 match) [[1]](#1)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|B0046.001|Enumerate PE sections (This capa rule had 1 match) [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|B0046.001|Enumerate PE sections (This capa rule had 3 matches) [[1]](#1)|
-|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|B0046.001|Enumerate PE sections (This capa rule had 2 matches) [[1]](#1)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|B0046.002|Inspect section memory permissions (This capa rule had 1 match) [[1]](#1)|
-|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|B0046.001|Enumerate PE sections (This capa rule had 1 match) [[1]](#1)|
-|[**TrickBot**](../xample-malware/trickbot.md)|2016|B0046.002|Inspect section memory permissions (This capa rule had 2 matches) [[1]](#1)|
-|[**Ursnif**](../xample-malware/ursnif.md)|2016|B0046.001|Enumerate PE sections (This capa rule had 1 match) [[1]](#1)|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|B0046.001|BlackEnergy enumerates PE sections. [[1]](#1)|
+|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|B0046.001|CryptoLocker enumerates PE sections. [[1]](#1)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|B0046.001|DarkComet enumerates PE sections. [[1]](#1)|
+|[**Emotet**](../xample-malware/emotet.md)|2018|B0046.001|Emotet enumerates PE sections. [[1]](#1)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|B0046.001|Gamut enumerates PE sections. [[1]](#1)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|B0046.001|Hupigon enumerates PE sections. [[1]](#1)|
+|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|B0046.001|Locky Bart enumerates PE sections. [[1]](#1)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|B0046.002|Redhip inspects section memory permissions. [[1]](#1)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|B0046.001|Stuxnet enumerates PE sections. [[1]](#1)|
+|[**TrickBot**](../xample-malware/trickbot.md)|2016|B0046.002|TrickBot inspects section memory permissions. [[1]](#1)|
+|[**Ursnif**](../xample-malware/ursnif.md)|2016|B0046.001|Ursnif enumerates PE sections. [[1]](#1)|

 ## References

@@ -41,23 +41,27 @@ Malware may enumerate files and directories or may search for specific files or

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**CryptoWall**](../xample-malware/cryptowall.md)|2014|--|The malware searches for user files before encrypting them [[1]](#1)|
-|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|The malware searches for user files before encrypting them [[2]](#2)|
-|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|Collects local files with specified file extensions and information from the victim's machine [[3]](#3)|
-|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|Enumerate files on windows (This capa rule had 3 matches) [[4]](#4)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|E1083, E1083.m01|Please see the Hupigon malware page for details. [[4]](#4)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|E1083.m01|Access the Windows event log (This capa rule had 2 matches) [[4]](#4)|
-|[**SamSam**](../xample-malware/samsam.md)|2015|--|Enumerate files on windows (This capa rule had 1 match) [[4]](#4)|
-|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|--|Enumerate files on windows (This capa rule had 1 match) [[4]](#4)|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|Get common file path (This capa rule had 3 matches) [[4]](#4)|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Get file version info (This capa rule had 1 match) [[4]](#4)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|--|Get common file path (This capa rule had 5 matches) [[4]](#4)|
-|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|Check if file exists (This capa rule had 1 match) [[4]](#4)|
-|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Get file size (This capa rule had 1 match) [[4]](#4)|
-|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Get file size (This capa rule had 1 match) [[4]](#4)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Get file size (This capa rule had 3 matches) [[4]](#4)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Get file version info (This capa rule had 1 match) [[4]](#4)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Get common file path (This capa rule had 1 match) [[4]](#4)|
+|[**CryptoWall**](../xample-malware/cryptowall.md)|2014|--|The malware searches for user files before encrypting them. [[1]](#1)|
+|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|The malware searches for user files before encrypting them. [[2]](#2)|
+|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|The malware collects machine information and local files with specified file extensions. [[3]](#3)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|--|Malware verifies that the folder from the first stage loader exists on the system. The malware also checks for the path for the Opera web browser. If it exists, the malware exits. [[4]](#4) [[5]](#5)|
+|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|GravityRAT enumerates files on Windows. [[6]](#6)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon enumerates files recursively. [[6]](#6)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|E1083.m01|Hupigon accesses the Windows event log. [[6]](#6)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter gets file version info. [[6]](#6)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|E1083.m01|Kovter accesses the Windows event log. [[6]](#6)|
+|[**SamSam**](../xample-malware/samsam.md)|2015|--|SamSam enumerates files on Windows. [[6]](#6)|
+|[**UP007**](../xample-malware/up007.md)|2016|--|The malware enumerates files on Windows. [[6]](#6)|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|The malware gets the common file path. [[6]](#6)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|The malware gets file version info. [[6]](#6)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut gets the common file path. [[6]](#6)|
+|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR checks if a file exists. [[6]](#6)|
+|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|The malware gets a file size. [[6]](#6)|
+|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Mebromi gets a file size. [[6]](#6)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip gets a file size. [[6]](#6)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|The malware gets the file version info. [[6]](#6)|
+|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon gets a common file path. [[6]](#6)|
+

 ## References

@@ -67,5 +71,8 @@ Malware may enumerate files and directories or may search for specific files or

 <a name="3">[3]</a> https://www.securityartwork.es/wp-content/uploads/2017/07/Trickbot-report-S2-Grupo.pdf

-<a name="4">[4]</a> capa v4.0, analyzed at MITRE on 10/12/2022
+<a name="4">[4]</a> https://www.0ffset.net/reverse-engineering/matanbuchus-loader-analysis/

+<a name="5">[5]</a> https://www.cyberark.com/resources/threat-research-blog/inside-matanbuchus-a-quirky-loader
+
+<a name="6">[6]</a> capa v4.0, analyzed at MITRE on 10/12/2022
@@ -42,24 +42,26 @@ See ATT&CK: **System Information Discovery ([T1082](https://attack.mitre.org/tec

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|Trojan spyware program that has mainly been used for targeting banking sites. [[7]](#7)|
-|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|Learns about the system so it can drop compatible miner software. [[8]](#8)|
-|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|Uses windows command prompt commands to gather system info, task list, installed drivers, and installed programs  [[1]](#1)|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|Uses Systeminfo to gather OS version, system configuration, BIOS, the motherboard, and processor [ [[2]](#2)|
-|[**Emotet**](../xample-malware/emotet.md)|2018|--|Collects information related to OS, processes, and sometimes mail client information and sends it to c2 [[4]](#4)|
-|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Gathers information (OS version, workgroup status, computer name, domain/workgroup name, file name of infected project file) about each computer in the net to spread itself  [[5]](#5)|
-|[**CHOPSTICK**](../xample-malware/chopstick.md)|2015|--|CHOPSTICK collects information from the host including Windows version, CPU architecture, and UAC settings [[6]](#6)|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Can collect information about the compter, resources, and operating system version  [[3]](#3)|
-|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|Query environment variable (This capa rule had 1 match) [[9]](#9)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|--|Query environment variable (This capa rule had 1 match) [[9]](#9)|
-|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR uses wmic, systeminfo and ver commands to collect information about the system and the installed software. [[10]](#10)query environment variable (This capa rule had 2 matches) [[9]](#9)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Query environment variable (This capa rule had 1 match) [[9]](#9)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|--|Get disk information (This capa rule had 1 match) [[9]](#9)|
-|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Check OS version (This capa rule had 1 match) [[9]](#9)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Check OS version (This capa rule had 1 match) [[9]](#9)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Get disk size (This capa rule had 1 match) [[9]](#9)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Get hostname (This capa rule had 1 match) [[9]](#9)|
-|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|--|Query environment variable (This capa rule had 1 match) [[9]](#9)|
+|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|The malware can collect information about the computer, resources, services, installed programs, firmware, and operating system versions. [[7]](#7)|
+|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|Malware learns about the system so it can drop compatible miner software. [[8]](#8)|
+|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|Malware uses Window's command prompt commands to gather system info, task list, installed drivers, and installed programs.  [[1]](#1)|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|Malware uses Systeminfo to gather OS version, system configuration, BIOS, the motherboard, and processor. [[2]](#2)|
+|[**DarkComet**](../xample-malware/darkcomet.md)|2008|--|Malware can collect information about the computer, resources, and operating system version.  [[3]](#3)|
+|[**Emotet**](../xample-malware/emotet.md)|2018|--|Emotet collects information related to OS, processes, and sometimes mail client information and sends it to C2. [[4]](#4)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Malware gathers information (OS version, workgroup status, computer name, domain/workgroup name, file name of infected project file) about each computer in the network to spread itself. [[5]](#5)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Stuxnet checks OS version. [[5]](#5)|
+|[**CHOPSTICK**](../xample-malware/chopstick.md)|2015|--|CHOPSTICK collects information from the host including Windows version, CPU architecture, and UAC settings. [[6]](#6)|
+|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|The malware queries environment variables. [[9]](#9)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|--|The malware queries environment variables. [[9]](#9)|
+|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR uses wmic, systeminfo and ver commands to collect information about the system and the installed software and queries environment variables. [[9]](#9) [[10]](#10)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon queries environment variables. [[9]](#9)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter gets disk information. [[9]](#9)|
+|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Mebromi checks OS version. [[9]](#9)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip checks the OS version. [[9]](#9)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Rombertik gets the disk size. [[9]](#9)|
+|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon gets the hostname. [[9]](#9)|
+|[**UP007**](../xample-malware/up007.md)|2016|--|The malware queries environment variables. [[9]](#9)|
+

 ## References

@@ -75,13 +77,10 @@ See ATT&CK: **System Information Discovery ([T1082](https://attack.mitre.org/tec

 <a name="6">[6]</a> https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf

-<a name="7">[7]</a> https://www.trendmicro.com/en_us/research/18/k/trickbot-shows-off-new-trick-password-grabber-module.html
+<a name="7">[7]</a> https://www.securityartwork.es/wp-content/uploads/2017/07/Trickbot-report-S2-Grupo.pdf

 <a name="8">[8]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/

 <a name="9">[9]</a> capa v4.0, analyzed at MITRE on 10/12/2022

 <a name="10">[10]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
-
-<a name="11">[11]</a> https://www.securityartwork.es/wp-content/uploads/2017/07/Trickbot-report-S2-Grupo.pdf
-
@@ -33,7 +33,7 @@

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Find taskbar (This capa rule had 1 match) [[1]](#1)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip finds taskbars. [[1]](#1)|

 ## References

@@ -36,25 +36,26 @@ See ATT&CK: **Command and Scripting Interpreter ([T1059](https://attack.mitre.or

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|--|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|
-|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|From the command line, drops and unzips a password-protected Cabinet archive file. [[1]](#1)|
+|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|After the Poison Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[1]](#1)|
+|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|From the command line, the malware drops and unzips a password-protected Cabinet archive file. [[1]](#1)|
 |[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR uses cmd.exe to execute commands. [[2]](#2)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|--|The malware executes malicious javascript and powershell [[3]](#3)|
-|[**SamSam**](../xample-malware/samsam.md)|2015|--|SamSam uses a batch file for executing the malware and deleting certain components   [[4]](#4)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|The wiper component of Shamoon creates a service to run the driver with the command: sc create hdv_725x type= kernel start= demand binpath= WINDOWS\hdv_725x.sys 2>&1 >nul and sends an additional reboot command after completion [[5]](#5)|
-|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Stuxnet will store and execute SQL code that will extract and execute Stuxnet from the saved CAB file using xp_cmdshell  [[6]](#6)|
-|[**EvilBunny**](../xample-malware/evilbunny.md)|2011|--|EvilBunny executes Lua scripts [[7]](#7)|
-|[**Netwalker**](../xample-malware/netwalker.md)|2020|--|Netwalker is written and executed in Powershell [[8]](#8)|
-|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|Accept command line arguments (This capa rule had 2 matches) [[9]](#9)|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Accept command line arguments (This capa rule had 2 matches) [[9]](#9)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|--|Accept command line arguments (This capa rule had 1 match) [[9]](#9)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Accept command line arguments (This capa rule had 2 matches) [[9]](#9)|
-|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Accept command line arguments (This capa rule had 1 match) [[9]](#9)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Accept command line arguments (This capa rule had 1 match) [[9]](#9)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Accept command line arguments (This capa rule had 1 match) [[9]](#9)|
-|[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|The malware installs a script to inject JavaScript script and modify web traffic. [[10]](#10)|
-|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|Accept command line arguments (This capa rule had 1 match) [[9]](#9)|
-|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|--|Accept command line arguments (This capa rule had 1 match) [[9]](#9)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|--|The malware executes malicious javascript and powershell. [[3]](#3)|
+|[**SamSam**](../xample-malware/samsam.md)|2015|--|SamSam uses a batch file for executing the malware and deleting certain components. [[4]](#4)|
+|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|The wiper component of Shamoon creates a service to run the driver with the command: sc create hdv_725x type= kernel start= demand binpath= WINDOWS\hdv_725x.sys 2>&1 >nul and sends an additional reboot command after completion. Shamoon also accepts command line arguments.[[5]](#5)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Stuxnet will store and execute SQL code that will extract and execute Stuxnet from the saved CAB file using xp_cmdshell. [[6]](#6)|
+|[**EvilBunny**](../xample-malware/evilbunny.md)|2011|--|EvilBunny executes Lua scripts. [[7]](#7)|
+|[**Netwalker**](../xample-malware/netwalker.md)|2020|--|Netwalker is written and executed in Powershell. [[8]](#8)|
+|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|The malware accepts command line arguments. [[9]](#9)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|The malware accepts command line arguments. [[9]](#9)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut accepts command line arguments. [[9]](#9)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon accepts command line arguments. [[9]](#9)|
+|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Mebromi accepts command line arguments. [[9]](#9)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip accepts command line arguments. [[9]](#9)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|The malware accepts command line arguments. [[9]](#9)|
+|[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|The malware installs a script to inject a JavaScript script and modify web traffic. [[10]](#10)|
+|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|TrickBot accepts command line arguments. [[9]](#9)|
+|[**UP007**](../xample-malware/up007.md)|2016|--|The malware accepts command line arguments. [[9]](#9)|
+

 ## References

@@ -32,11 +32,11 @@

 # Conditional Execution

-Malware checks system environment conditions or characteristics to determine execution path. For example, malware may not run or be dormant unless system conditions are right, or file that is dropped may vary according to execution environment. Conditional execution in malware happens autonomously, not because of an attacker's command.
+Malware checks system environment conditions or characteristics to determine execution path. For example, malware may not run or be dormant unless system conditions are right, or a file that is dropped may vary according to the execution environment. Conditional execution in malware happens autonomously, not because of an attacker's command.

 This behavior is related to the **Dynamic Analysis Evasion ([B0003](../anti-behavioral-analysis/dynamic-analysis-evasion.md))** behavior that obstructs dynamic analysis in a sandbox, emulator, or virtual machine.

-Some aspects of this Conditional Execution behavior are related to the [Execution Guardrails (T1480)](https://attack.mitre.org/techniques/T1480) ATT&CK technique; however the ATT&CK technique is not focused on anti-behavioral analysis behaviors.
+Some aspects of this Conditional Execution behavior are related to the [Execution Guardrails (T1480)](https://attack.mitre.org/techniques/T1480) ATT&CK technique; however, the ATT&CK technique is not focused on anti-behavioral analysis behaviors.

 ## Methods

@@ -45,23 +45,25 @@ Some aspects of this Conditional Execution behavior are related to the [Executio
 |**Deposited Keys**|B0025.008|Parts of the code and/or data is encrypted or otherwise relies on data external to the file itself. For example, malware that contains code that is encrypted with a key that is downloaded from a server; malware that only runs if certain other software is installed on the system. Also see Environmental Keys Method.|
 |**Environmental Keys**|B0025.002|Malware reads certain attributes of the system (BIOS version string, hostname, MAC address, etc.) and encrypts/decrypts portions of its code or data using those attributes as input, thus preventing itself from being run on an unintended system (e.g., sandbox, emulator, etc.). Also see Deposited Keys Method. The subsequently defined ATT&CK sub-technique [Execution Guardrails: Environmental Keying (T1480.001)](https://attack.mitre.org/techniques/T1480/001/) is related to this MBC method. |
 |**GetVolumeInformation**|B0025.003|This Windows API call is used to get the GUID on a system drive. Malware compares it to a previous (targeted) GUID value and only executes maliciously if they match. This behavior can be mitigated in non-automated analysis environments.|
-|**Host Fingerprint Check**|B0025.004|Compare a previously computed host fingerprint(e.g., based on installed applications) to the current system's to determine if the malware instance is still executing on the same system. If not, execution stops, making debugging or sandbox analysis more difficult.|
+|**Host Fingerprint Check**|B0025.004|Compare a previously computed host fingerprint (e.g., based on installed applications) to the current system's to determine if the malware instance is still executing on the same system. If not, execution stops, making debugging or sandbox analysis more difficult.|
 |**Runs as Service**|B0025.007|The malware must be run as a service, which can make behavioral analysis and debugging more difficult. The service may be set up by the malware. Alternatively, the malware may not contain any code to create a new service or modify an existing service, in which case, the service may be set up by another program or manually. [[2]](#2)|
 |**Secure Triggers**|B0025.005|Code and/or data is encrypted until the underlying system satisfies a preselected condition unknown to the analyst (this is a form of Deposited Keys).|
 |**Suicide Exit**|B0025.001|Malware terminates its execution based on a trigger condition or value (or because it has completed).|
-|**Token Check**|B0025.006|Presence check to allow the program to run (ex: dongle, CD/DVD, key, file, network, etc.). If the token is specific to a hardware element (ex: disk, OS, CPU, NIC MAC, etc.), it is considered fingerprinting.|
+|**Token Check**|B0025.006|A token's presence is checked to allow the program to run (ex: dongle, CD/DVD, key, file, network, etc.). If the token is specific to a hardware element (ex: disk, OS, CPU, NIC MAC, etc.), it is considered fingerprinting.|

 ## Use in Malware

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|Drops either Cryptonight or Claymore's Zcash miner, depending on system architecture. [[1]](#1)|
-|[**Conficker**](../xample-malware/conficker.md)|2008|B0025, B0025.001|Please see the Conficker malware page for details. [[5]](#5)|
-|[**Ursnif**](../xample-malware/ursnif.md)|2016|B0025.004|Macros check if there are at least 50 running processes with a graphical interface, check if a list of blacklisted processes are running, and checks if the application is running in Australia and is NOT affiliated with a select group of networks (Security Research, Hospitals, Universities, Veterans, etc.) [[3]](#3)|
-|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Malware only proceeds if it detects the BIOS ROM is Award BIOS [[4]](#4)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|B0025.007|Run as service (This capa rule had 1 match) [[6]](#6)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|B0025.007|Run as service (This capa rule had 1 match) [[6]](#6)|
-|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|B0025.004|Stuxnet checks for specific operating systems on 32-bit machines, registry keys, and dates to profile a potential target machine before execution. If the conditions are not met to be considered a viable target, it will exit execution  [[7]](#7)|
+|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|The malware executes differently depending on whether it's running on an x86 or x64 system. [[1]](#1)|
+|[**Conficker**](../xample-malware/conficker.md)|2008|--|Conficker A variant has a routine that causes the process to suicide exit if the keyboard language is set to Ukranian. [[5]](#5)|
+|[**Conficker**](../xample-malware/conficker.md)|2008|B0025.001|Conficker B variant has significantly more suicide logic embedded in its code and employs anti-debugging features to avoid reverse engineering attempts. [[5]](#5)|
+|[**Ursnif**](../xample-malware/ursnif.md)|2016|B0025.004|Macros check if there are at least 50 running processes with a graphical interface, check if a list of blacklisted processes are running, and checks if the application is running in Australia and is NOT affiliated with a select group of networks (Security Research, Hospitals, Universities, Veterans, etc.). [[3]](#3)|
+|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Malware only proceeds if it detects the BIOS ROM is Award BIOS. [[4]](#4)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|B0025.004|Stuxnet checks for specific operating systems on 32-bit machines, registry keys, and dates to profile a potential target machine before execution. If the conditions are not met to be considered a viable target, it will exit execution. [[6]](#6)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|B0025.007|Hupigon can run as a service. [[7]](#7)|
+|[**Shamoon**](../xample-malware/shamoon.md)|2012|B0025.007|Shamoon can run as a service. [[7]](#7)|
+

 ## References

@@ -73,9 +75,9 @@ Some aspects of this Conditional Execution behavior are related to the [Executio

 <a name="4">[4]</a> https://www.webroot.com/blog/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/

-<a name="5">[5]</a> https://en.wikipedia.org/wiki/Conficker
+<a name="5">[5]</a> http://www.csl.sri.com/users/vinod/papers/Conficker/

-<a name="6">[6]</a> capa v4.0, analyzed at MITRE on 10/12/2022
+<a name="6">[6]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en

-<a name="7">[7]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
+<a name="7">[7]</a> capa v4.0, analyzed at MITRE on 10/12/2022

@@ -28,4 +28,4 @@

 # Execution Dependency

-Software may require certain run-time or library dependencies consistent with normal software development and deployment. For example, software may require the presence of a .NET or Java runtime or to be run by a webserver that supports PHP. Unlike in **Conditional Execution ([B0025](../execution/conditional-execution.md))** this dependency is not because of an explicit check coded into the malware by the author.
+Software may require certain run-time or library dependencies consistent with normal software development and deployment. For example, software may require the presence of a .NET or Java runtime or to be run by a webserver that supports PHP. Unlike in **Conditional Execution ([B0025](../execution/conditional-execution.md))**, this dependency is not because of an explicit check coded into the malware by the author.
@@ -41,8 +41,8 @@ See ATT&CK: **Exploitation for Client Execution ([T1203](https://attack.mitre.or
 |Name|ID|Description|
 |---|---|---|
 |**File Transfer Protocol (FTP) Servers**|E1203.m03|Malware leverages an FTP server.|
-|**Java-based Web Servers**|E1203.m02||
-|**Red Hat JBoss Enterprise Products**|E1203.m04||
+|**Java-based Web Servers**|E1203.m02|Malware leverages a Java-based web server.|
+|**Red Hat JBoss Enterprise Products**|E1203.m04|Malware leverages JBoss Enterprise products.|
 |**Remote Desktop Protocols**|E1203.m01|RDP is used by malware.|
 |**Sysinternals**|E1203.m05|Sysinternals tools are used for additional command line functionality.|
 |**Windows Utilities**|E1203.m06|One or more Windows utilities are used.|
@@ -30,25 +30,28 @@

 Installs another, different program on the system. The additional program can be any secondary module; examples include backdoors, malicious drivers, kernel modules, and OS X Apps. 

-Malware that installs another component is called a "dropper." If the code is contained in the malware, it's a "single stage" dropper; "two stage" droppers download the code from a remote location (the associated download behavior is covered by the **Ingress Tool Transfer ([E1105](../command-and-control/ingress-tool-transfer.md))** behavior.
+Malware that installs another component is called a "dropper." If the code is contained in the malware, it's a "single stage" dropper; "two stage" droppers download the code from a remote location (the associated download behavior is covered by **Ingress Tool Transfer ([E1105](../command-and-control/ingress-tool-transfer.md))**).

 ## Use in Malware

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**WebCobra**](../xample-malware/webcobra.md)|November 2018|--|Drops software to mine for cryptocurrency. [[1]](#1)|
-|[**Geneio**](../xample-malware/geneio.md)|August 2015|--|Geneio installs the browser extension ~/Library/Safari/Extensions/Omnibar.safariextz. It also creates app files. [[7]](#7)|
+|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|The malware downloads and executes Claymore's Zcash miner from a remote server. [[1]](#1)|
+|[**Geneio**](../xample-malware/geneio.md)|2015|--|Malware tricks OS X keychain to create application files. Malware also installs the browser extension Omnibar.safariextz. [[10]](#10)|
 |[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR reinstalls its running instance if it is removed. [[3]](#3)|
-|[**MazarBot**](../xample-malware/mazarbot.md)|2016|--|Installs a backdoor. [[8]](#8)|
-|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Malware contains a dropper that installs additional programs like Cbrom.exe. [[9]](#9)|
-|[**YiSpecter**](../xample-malware/yispecter.md)|2015|--|Can download and install arbitrary iOS apps. [[10]](#10)|
-|[**CozyCar**](../xample-malware/cozycar.md)|2010|--|Upon execution, CozyCar drops a decoy file and a secondary dropper [[5]](#5)|
-|[**Clipminer**](../xample-malware/clipminer.md)|2011|--|Clipminer drops a file masquerading as a Control Panel (CPL) file [[6]](#6)|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Contain an embedded PE file (This capa rule had 1 match) [[11]](#11)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|--|Contain an embedded PE file (This capa rule had 1 match) [[11]](#11)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Contain an embedded PE file (This capa rule had 1 match) [[11]](#11)|
+|[**MazarBot**](../xample-malware/mazarbot.md)|2016|--|MazarBot installs a backdoor. [[14]](#14)|
+|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Malware contains a dropper that installs additional programs like Cbrom.exe. [[11]](#11)|
+|[**YiSpecter**](../xample-malware/yispecter.md)|2015|--|The malware can download and install arbitrary iOS apps. [[13]](#13)|
+|[**UP007**](../xample-malware/up007.md)|2016|--|The malware is a dropper that creates multiple files. [[4]](#4)|
+|[**CozyCar**](../xample-malware/cozycar.md)|2010|--|Upon execution, CozyCar drops a decoy file and a secondary dropper. [[5]](#5)|
+|[**Clipminer**](../xample-malware/clipminer.md)|2011|--|Clipminer drops a file masquerading as a Control Panel (CPL) file. [[6]](#6)|
+|[**Vobfus**](../xample-malware/vobfus.md)|2016|--|Vobfus downloads malware from other malware families. [[7]](#7)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|--|Malware drops the first loader which is responsible for loading the main loader into memory. [[8]](#8) [[9]](#9)|
 |[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|The malware installs an open-source program called mitmproxy. [[12]](#12)|
-|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|--|The malware is a dropper that creates multiple files [[4]](#4)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|The malware contains an embedded PE file. [[15]](#15)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut contains an embedded PE file. [[15]](#15)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip contains an embedded PE file. [[15]](#15)|
+

 ## References

@@ -64,17 +67,20 @@ Malware that installs another component is called a "dropper." If the code is co

 <a name="6">[6]</a> https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking

-<a name="7">[7]</a> https://blog.malwarebytes.org/mac/2015/08/genieo-installer-tricks-keychain/
+<a name="7">[7]</a> https://securitynews.sonicwall.com/xmlpost/revisiting-vobfus-worm-mar-8-2013/

-<a name="8">[8]</a> https://us.norton.com/internetsecurity-emerging-threats-mazar-bot-malware-invades-and-erases-android-devices.html
+<a name="8">[8]</a> https://www.0ffset.net/reverse-engineering/matanbuchus-loader-analysis/

-<a name="9">[9]</a> https://www.webroot.com/blog/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/
+<a name="9">[9]</a> https://www.cyberark.com/resources/threat-research-blog/inside-matanbuchus-a-quirky-loader

-<a name="10">[10]</a> http://researchcenter.paloaltonetworks.com/2015/10/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/
+<a name="10">[10]</a> https://blog.malwarebytes.org/mac/2015/08/genieo-installer-tricks-keychain/

-<a name="11">[11]</a> capa v4.0, analyzed at MITRE on 10/12/2022
+<a name="11">[11]</a> https://www.webroot.com/blog/2011/09/13/mebromi-the-first-bios-rootkit-in-the-wild/

 <a name="12">[12]</a> https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/

-<a name="13">[13]</a> https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke/
+<a name="13">[13]</a> http://researchcenter.paloaltonetworks.com/2015/10/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/

+<a name="14">[14]</a> https://us.norton.com/internetsecurity-emerging-threats-mazar-bot-malware-invades-and-erases-android-devices.html
+
+<a name="15">[15]</a> capa v4.0, analyzed at MITRE on 10/12/2022
@@ -55,9 +55,12 @@ Autonomous behaviors - those done by the malware without an active attacker - sh

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|Commands sent by a remote user can archive/upload files, capture screenshots, clear cookies, download execute other files, list running processes, reboot the affected system, steal certificates and cookies, update/download a configuration file, upload a log file which contains stolen information  [[1]](#1)|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|Infected bots receive commands from botmaster to load plugins associated with botmaster's goals [[2]](#2)|
-|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|Receives various commands from c2 server.  [[3]](#3)|
+|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|The malware commands sent by a remote user can archive/upload files, capture screenshots, clear cookies, download/execute other files, list running processes, reboot the affected system, steal certificates and cookies, update/download a configuration file, and upload a log file which contains stolen information. [[1]](#1)|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|Infected bots receive commands from the botmaster to load plugins associated with botmaster's goals. [[2]](#2)|
+|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|The malware receives various commands from the C2 server. [[3]](#3)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0011.005|The malware sleeps if it fails to send collected data or execute its commands. [[4]](#4) [[5]](#5)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|B0011.006|The malware loader can uninstall itself from the victim computer. [[4]](#4) [[5]](#5)|
+

 ## References

@@ -67,3 +70,6 @@ Autonomous behaviors - those done by the malware without an active attacker - sh

 <a name="3">[3]</a> https://www.cybereason.com/blog/research/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware

+<a name="4">[4]</a> https://www.0ffset.net/reverse-engineering/matanbuchus-loader-analysis/
+
+<a name="5">[5]</a> https://www.cyberark.com/resources/threat-research-blog/inside-matanbuchus-a-quirky-loader
@@ -38,7 +38,8 @@ This behavior is related to the **Phishing ([T1566](https://attack.mitre.org/tec
 |---|---|---|---|
 |[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut probes the infected system's SMTP port 25 by sending a test SMTP transaction to mail.ru and hotmail.com. If port 25 is open, the bot requests the spam template and email list, which it uses to send spam. [[1]](#1)|
 |[**Bagle**](../xample-malware/bagle.md)|2004|--|Bagle uses its own SMTP engine to mass-mail itself as an attachment from an infected computer. [[2]](#2)|
-|[**Emotet**](../xample-malware/emotet.md)|2018|--|Spam email with the Emotet loader is sent automatically [[3]](#3)|
+|[**Emotet**](../xample-malware/emotet.md)|2018|--|Spam email with the Emotet loader is sent automatically. [[3]](#3)|
+

 ## References

@@ -48,5 +49,3 @@ This behavior is related to the **Phishing ([T1566](https://attack.mitre.org/tec

 <a name="3">[3]</a> https://securelist.com/the-banking-trojan-emotet-detailed-analysis/69560/

-<a name="4">[4]</a> https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/gamut-spambot-analysis/
-
@@ -37,10 +37,12 @@ See ATT&CK Technique: **User Execution ([T1204](https://attack.mitre.org/techniq
 |Name|Date|Method|Description|
 |---|---|---|---|
 |[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--| GoBotKR makes their malware look like the torrent content that the user intended to download, in order to entice a user to click on it. [[1]](#1)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|The malware relies on a victim to execute itself [[2]](#2)|
-|[**Terminator**](../xample-malware/terminator.md)|2013|--|The malware relies on user interaction to execute [[3]](#3)|
-|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|The malware relies on victims to execute [[5]](#5)|
-|[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|A user must execute the malicious program. [[4]](#4)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|The malware relies on a victim to execute itself. [[2]](#2)|
+|[**Terminator**](../xample-malware/terminator.md)|2013|--|The malware relies on user interaction to execute. [[3]](#3)|
+|[**Vobfus**](../xample-malware/vobfus.md)|2016|--|The malware relies on user interaction to run the executable. [[4]](#4)|
+|[**CryptoLocker**](../xample-malware/vobfus.md)|2013|--|The malware relies on victims to execute. [[4]](#4)|
+|[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|The user opens a disk image file which invisibly installs its components. [[6]](#6)|
+

 ## References

@@ -50,9 +52,8 @@ See ATT&CK Technique: **User Execution ([T1204](https://attack.mitre.org/techniq

 <a name="3">[3]</a> https://www.mandiant.com/resources/hot-knives-through-butter-evading-file-based-sandboxes

-<a name="4">[4]</a> https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/
+<a name="4">[4]</a> https://securitynews.sonicwall.com/xmlpost/revisiting-vobfus-worm-mar-8-2013/

 <a name="5">[5]</a> https://www.secureworks.com/research/cryptolocker-ransomware

-<a name="6">[6]</a> https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2013/FireEye-Terminator_RAT.pdf
-
+<a name="6">[6]</a> https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/
@@ -48,8 +48,10 @@ See ATT&CK Technique: **Archive Collected Data ([T1560](https://attack.mitre.org

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**TrickBot**](../xample-malware/trickbot.md)|2016|E1560.m02|Uses a custom crypter leveraging Microsoft's CryptoAPI to encrypt C2 traffic. C2 update responses seem to have been digitally signed using bcrypt  [[1]](#1)|
-|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|E1560.m04|Exfiltrated payloads are XORed with a static 31-byte long byte string found inside Stuxnet and hexified in order to be passed on as an ASCII data parameter in an HTTP request to the C2 servers  [[2]](#2)|
+|[**TrickBot**](../xample-malware/trickbot.md)|2016|E1560.m02|The malware uses a custom crypter leveraging Microsoft's CryptoAPI to encrypt C2 traffic. C2 update responses seem to have been digitally signed using bcrypt. [[1]](#1)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|E1560.m04|Exfiltrated payloads are XORed with a static 31-byte long byte string found inside Stuxnet and hexified in order to be passed on as an ASCII data parameter in an HTTP request to the C2 servers. [[2]](#2)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|E1560.m03|Malware sends data as a Base64 string of JSON. [[3]](#3) [[4]](#4)|
+

 ## References

@@ -57,3 +59,6 @@ See ATT&CK Technique: **Archive Collected Data ([T1560](https://attack.mitre.org

 <a name="2">[2]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en

+<a name="3">[3]</a> https://www.0ffset.net/reverse-engineering/matanbuchus-loader-analysis/
+
+<a name="4">[4]</a> https://www.cyberark.com/resources/threat-research-blog/inside-matanbuchus-a-quirky-loader
@@ -38,11 +38,12 @@ ATT&CK defines Clipboard Modification as a Mobile technique (Android platform).

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Clipminer**](../xample-malware/clipminer.md)|2011|--|Clipminer monitors the clipboard for cryptocurrency addresses and replaces them with ones controlled by the adversary [[1]](#1)|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Write clipboard data (This capa rule had 4 matches) [[2]](#2)|
-|[**Emotet**](../xample-malware/emotet.md)|2018|--|Write clipboard data (this capa rule had 1 match) [[2]](#2)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Replace clipboard data (This capa rule had 1 match) [[2]](#2)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Replace clipboard data (This capa rule had 1 match) [[2]](#2)|
+|[**Clipminer**](../xample-malware/clipminer.md)|2011|--|Clipminer monitors the clipboard for cryptocurrency addresses and replaces them with ones controlled by the adversary. [[1]](#1)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|The malware writes clipboard data.  [[2]](#2)|
+|[**Emotet**](../xample-malware/emotet.md)|2018|--|Emotet writes clipboard data. [[2]](#2)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon replaces clipboard data. [[2]](#2)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|The malware replaces clipboard data. [[2]](#2)|
+

 ## References

@@ -48,11 +48,12 @@ See ATT&CK: **Data Destruction ([T1485](https://attack.mitre.org/techniques/T148

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|A 2018 variant includes a component that erases files and then wipes the master boot record, preventing file recovery. [[1]](#1)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|If a specific anti-analysis check fails, the malware will overwrite the Master Boot Record or the User's home folder [[2]](#2)|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|BlackEnergy 2 variant contains a Destroy plugin that destroys data stored on victim hard drives by overwriting file contents  [[3]](#3)|
-|[**Conficker**](../xample-malware/conficker.md)|2008|--|Resets system restore points and deletes backup files [[4]](#4)|
-|[**MazarBot**](../xample-malware/mazarbot.md)|2016|--|Can erase phone data  [[5]](#5)|
+|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|A 2018 variant includes a component that erases files and then wipes the Master Boot Record (MBR), preventing file recovery. [[1]](#1)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|If a specific anti-analysis check fails, the malware will overwrite the Master Boot Record or the user's home folder. [[2]](#2)|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|BlackEnergy 2 variant contains a Destroy plugin that destroys data stored on victim hard drives by overwriting file contents.  [[3]](#3)|
+|[**Conficker**](../xample-malware/conficker.md)|2008|--|Conficker resets system restore points and deletes backup files. [[4]](#4)|
+|[**MazarBot**](../xample-malware/mazarbot.md)|2016|--|MazarBot can erase phone data. [[5]](#5)|
+

 ## References

@@ -46,11 +46,12 @@ See ATT&CK: **Data Encrypted for Impact ([T1486](https://attack.mitre.org/techni

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**CryptoWall**](../xample-malware/cryptowall.md)|2014|E1486.001|The malware launches Internet Explorer to show ransom notes [[1]](#1)|
-|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|E1486.001|The malware launches Internet Explorer to show ransom notes [[2]](#2)|
-|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Encrypts files for ransom without any connection to the Internet [[3]](#3)|
-|[**SamSam**](../xample-malware/samsam.md)|2015|--|SamSam encrypts data to hold for ransom [[4]](#4)|
-|[**Netwalker**](../xample-malware/netwalker.md)|2020|--|Netwalker encrypts files for ransom [[5]](#5)|
+|[**CryptoWall**](../xample-malware/cryptowall.md)|2014|E1486.001|The malware launches Internet Explorer to show ransom notes. [[1]](#1)|
+|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|E1486.001|The malware launches Internet Explorer to show ransom notes. [[2]](#2)|
+|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Locky Bart encrypts files for ransom without any connection to the Internet. [[3]](#3)|
+|[**SamSam**](../xample-malware/samsam.md)|2015|--|SamSam encrypts data to hold for ransom. [[4]](#4)|
+|[**Netwalker**](../xample-malware/netwalker.md)|2020|--|Netwalker encrypts files for ransom. [[5]](#5)|
+

 ## References

@@ -42,7 +42,7 @@ The related **Network Denial of Service ([T1498](https://attack.mitre.org/techni

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|October 2007|--|Launches distributed denial of service attacks that can target more than one IP address per hostname. [[1]](#1)|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|BlackEnergy launches distributed denial of service attacks that can target more than one IP address per hostname. [[1]](#1)|
 |[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR has been used to execute endpoint DDoS attacks – for example, TCP Flood or SYN Flood. [[2]](#2)|

 ## References
@@ -51,5 +51,3 @@ The related **Network Denial of Service ([T1498](https://attack.mitre.org/techni

 <a name="2">[2]</a> https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/

-<a name="3">[3]</a> https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf
-
@@ -32,7 +32,7 @@

 # Destroy Hardware

-Destroys a physical piece of hardware. For example, malware may cause hardware to overheat.
+Malware destroys a physical piece of hardware. For example, malware may cause hardware to overheat.

 ## Use in Malware

@@ -33,13 +33,13 @@

 Malware may erase the content of storage devices. This behavior is different than **Data Destruction ([E1485](../impact/data-destruction.md))** because sections of the disk are erased rather than individual files.

-This description refines the ATT&CK **Disk Wipe ([T1203](https://attack.mitre.org/techniques/T1561/)**] sub-technique.
+This description refines the ATT&CK **Disk Wipe ([T1203](https://attack.mitre.org/techniques/T1561/)**) sub-technique.

 ## Use in Malware

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|An overwrite component will overwrite the MBR so that the compromised computer can no longer start  [[1]](#1)|
+|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|An overwrite component will overwrite the MBR so that the compromised computer can no longer start. [[1]](#1)|

 ## References

@@ -36,6 +36,14 @@ An Exploit Kit is a toolkit that exploits vulnerabilities in software to deliver

 See related ATT&CK Technique: **Exploit Public-Facing Application ([T1190](https://attack.mitre.org/techniques/T1190))**, which relates to Initial Access. Under the Impact objective, exploit behaviors are considered more broadly in MBC.

+
+## Use in Malware
+
+|Name|Date|Method|Description|
+|---|---|---|---|
+|[**Ursnif**](../xample-malware/ursnif.md)|2016|--|Ursnif is sometimes delivered via exploit kit. [[1]](#1)|
+
+
 ## References

 <a name="1">[1]</a> https://www.cyber.nj.gov/threat-profiles/trojan-variants/ursnif
@@ -45,9 +45,10 @@ Malware may generate traffic from the victim system such as clicks of advertisin

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**DNSChanger**](../xample-malware/dnschanger.md)|November 2011|--|Alters DNS server settings to route to a rogue DNS server for the purpose of click hijacking. [[1]](#1)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|--|Performs click-fraud. [[3]](#3)|
-|[**YiSpecter**](../xample-malware/yispecter.md)|2015|E1643.m02|Displays brief advertisements whenever the user opens applications on their phone [[4]](#4)|
+|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|E1643.m02|Malware alters DNS server settings to route to a rogue DNS server for the purpose of click hijacking. [[1]](#1)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter performs click-fraud. [[4]](#4)|
+|[**YiSpecter**](../xample-malware/yispecter.md)|2015|E1643.m02|The malware displays brief advertisements whenever the user opens applications on their phone. [[5]](#5)|
+

 ## References

@@ -62,4 +63,3 @@ Malware may generate traffic from the victim system such as clicks of advertisin
 <a name="5">[5]</a> https://blog.malwarebytes.com/threat-analysis/2016/07/untangling-kovter/

 <a name="6">[6]</a> https://www.huffingtonpost.com/2011/11/09/click-hijack-hackers-online-ad-scam_n_1084497.html
-
@@ -32,7 +32,7 @@

 # Manipulate Network Traffic

-Malware intercepts and manipulates network traffic, typically accessing or modifying data, going to or originating from the system on which the malware instance is executing. Also known as a Man-in-the-Middle attack.
+Malware intercepts and manipulates network traffic, typically accessing or modifying data, going to or originating from the system on which the malware instance is executing, also known as a Man-in-the-Middle attack.

 The related **Data Manipulation: Transmitted Data Manipulation ([T1565.002](https://attack.mitre.org/techniques/T1565/002/))** ATT&CK sub-technique was defined subsequent to this MBC behavior.

@@ -40,12 +40,12 @@ The related **Data Manipulation: Transmitted Data Manipulation ([T1565.002](http

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|Intercepts encrypted web traffic to inject adds. [[1]](#1)|
-|[**MazarBot**](../xample-malware/mazarbot.md)|2016|--|Intercepts data coming into and going out of device. [[2]](#2)|
+|[**SearchAwesome**](../xample-malware/searchawesome.md)|2018|--|SearchAwesome adware intercepts encrypted web traffic to inject ads. [[1]](#1)|
+|[**MazarBot**](../xample-malware/mazarbot.md)|2016|--|MazarBot intercepts data coming into and going out of the device. [[2]](#2)|
+

 ## References

 <a name="1">[1]</a> https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/

 <a name="2">[2]</a> https://us.norton.com/internetsecurity-emerging-threats-mazar-bot-malware-invades-and-erases-android-devices.html
-
@@ -48,9 +48,10 @@ Note that the **Ingress Tool Transfer ([T1105](https://attack.mitre.org/techniqu

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|--|After the Poison-Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[2]](#2)|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Allows an attacker to control the system via a GUI [[3]](#3)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|The malware acts as a backdoor [[4]](#4)|
+|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|After the Poison Ivy server is running on the target machine, the attacker can use a Windows GUI client to control the target computer. [[2]](#2)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet allows an attacker to control the system via a GUI. [[3]](#3)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|The malware acts as a backdoor. [[4]](#4)|
+

 ## References

@@ -62,5 +63,3 @@ Note that the **Ingress Tool Transfer ([T1105](https://attack.mitre.org/techniqu

 <a name="4">[4]</a> https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/HUPIGON

-<a name="5">[5]</a> https://www.cyber.nj.gov/threat-center/threat-profiles/trojan-variants/poison-ivy
-
@@ -32,7 +32,7 @@

 # Resource Hijacking

-Uses system resources for other purposes; as a result, the system may not be available for intended uses.
+Malware uses system resources for other purposes; as a result, the system may not be available for intended uses.

 The related **Resource Hijacking ([T1496](https://attack.mitre.org/techniques/T1496/))** ATT&CK technique was defined subsequent to this MBC behavior.

@@ -47,10 +47,11 @@ The related **Resource Hijacking ([T1496](https://attack.mitre.org/techniques/T1

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**WebCobra**](../xample-malware/webcobra.md)|2018|--|Drops software to mine for cryptocurrency. [[1]](#1)|
-|**Adylkuzz**|May 2017|--|Consumes system resources to mine for cryptocurrency. [[2]](#2)|
+|[**WebCobra**](../xample-malware/webcobra.md)|2018|B0018.002|The malware drops software that mines for cryptocurrency, depending on the system architecture. If the system has x86 architecture, the malware drops Cryptonight miner. If the system has x64 architecture, the malware drops Claymore's Zcash miner. [[1]](#1)|
+|[**Adylkuzz**]|2017|--|Malware consumes system resources to mine for cryptocurrency. [[2]](#2)|
 |[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR can use the compromised computer’s network bandwidth to seed torrents or execute DDoS. [[3]](#3)|
-|[**Clipminer**](../xample-malware/clipminer.md)|2011|--|Clipminer uses sytem resources to mine for cryptocurrency [[4]](#4)|
+|[**Clipminer**](../xample-malware/clipminer.md)|2011|--|Clipminer uses sytem resources to mine for cryptocurrency. [[4]](#4)|
+

 ## References

@@ -38,7 +38,7 @@ Malware may use a victim machine to create and send spam.

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**TrickBot**](../xample-malware/trickbot.md)|2019|--|TrickBot was observed infecting computers to steal email passwords and address books to spread malicious emails. [[1]](#1)|
+|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|In July 2019, TrickBot was observed infecting computers to steal email passwords and address books to spread malicious emails. [[1]](#1)|
 |[**Gamut**](../xample-malware/gamut.md)|2014|--|If port 25 is open, the bot uses a spam template and email list to send spam. [[2]](#2)|

 ## References
@@ -28,7 +28,7 @@

 # Supply Chain Compromise

-The supply chain may be compromised to enable initial malware infection. MBC objectives don't encompass initial infection, but the malware-related methods are listed below supplement the information available defined in ATT&CK and allow for lateral movement: **Supply Chain Compromise ([T1195](https://attack.mitre.org/techniques/T1195/), [T1474](https://attack.mitre.org/techniques/T1474/))**.  
+The supply chain may be compromised to enable initial malware infection. MBC objectives don't encompass initial infection, but the malware-related methods listed below supplement the information available and defined in ATT&CK and allow for lateral movement: **Supply Chain Compromise ([T1195](https://attack.mitre.org/techniques/T1195/), [T1474](https://attack.mitre.org/techniques/T1474/))**.  

 ## Methods

@@ -41,9 +41,14 @@ The supply chain may be compromised to enable initial malware infection. MBC obj

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**YiSpecter**](../xample-malware/yispecter.md)|October 2015|E1195.m02, E1195.m01|Please see the YiSpecter malware page for details. [[1]](#1)|
+|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|TrickBot comes with a signed downloader component. [[2]](#2)|
+|[**YiSpecter**](../xample-malware/yispecter.md)|2015|E1195.m01|YiSpecter's malicious apps were signed with three iOS enterprise certificates issued by Apple so they can be installed as enterprise apps on non-jailbroken iOS devices via in-house distribution. [[1]](#1)|
+|[**YiSpecter**](../xample-malware/yispecter.md)|2015|E1195.m02|Within the malware, use of the private API allows installation of malicious apps and uninstallation of legitimate apps without user notification. [[1]](#1)|
+

 ## References

 <a name="1">[1]</a> http://researchcenter.paloaltonetworks.com/2015/10/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/

+<a name="2">[2]</a> https://eclypsium.com/wp-content/uploads/2020/12/TrickBot-Now-Offers-TrickBoot-Persist-Brick-Profit.pdf
+
@@ -44,8 +44,8 @@ The DNS Communication micro-behavior focuses on DNS communication.

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0011.001|Resolve DNS (This capa rule had 1 match) [[1]](#1)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|C0011.001|Resolve DNS (This capa rule had 1 match) [[1]](#1)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0011.001|Hupigon resolves DNS. [[1]](#1)|
+|[**Shamoon**](../xample-malware/shamoon.md)|2012|C0011.001|Shamoon resolves DNS. [[1]](#1)|

 ## References

@@ -53,17 +53,20 @@ Instead of being listed alphabetically, methods have been grouped to better faci
 |**Read Header**|C0002.014|HTTP read header.|
 |**IWebBrowser**|C0002.010|The IWebBrowser interface exposes methods and properties implemented by the WebBrowser control or implemented by an instance of the InternetExplorer application. Specific methods and properties can be captured: e.g., COMMUNICATION::HTTP Communication::IWebBrowser.get_Document.|
 |**WinHTTP**|C0002.008|An HTTP request is made via the Windows HTTP Services (WinHTTP) application programming interface (API).|
-|**WinINet**|C0002.007|A HTTP request is made via the Windows Internet (WinINet) application programming interface (API). A specific function can be specified as a method on the [WinInet](../communication/wininet.md) microbehavior.|
+|**WinINet**|C0002.007|A HTTP request is made via the Windows Internet (WinINet) application programming interface (API). A specific function can be specified as a method on the [WinInet](../communication/wininet.md) micro-behavior.|
+

 ## Use in Malware

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0002.011, C0002.010|Please see the BlackEnergy malware page for details. [[1]](#1)|
-|[**Emotet**](../xample-malware/emotet.md)|2018|C0002.012|Create http request (this capa rule had 1 match) [[1]](#1)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|C0002.009, C0002.012|Please see the Kovter malware page for details. [[1]](#1)|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0002.010|The malware initializes IWebBrowser2. [[1]](#1)|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0002.011|The malware extracts the HTTP body. [[1]](#1)|
+|[**Emotet**](../xample-malware/emotet.md)|2018|C0002.012|The malware creates a HTTP request. [[1]](#1)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|C0002.009|Kovter connects to a HTTP server. [[1]](#1)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|C0002.012|Kovter creates a HTTP request. [[1]](#1)|
+

 ## References

 <a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
-
@@ -44,7 +44,7 @@ The Interprocess Communication micro-behavior focuses on interprocess communicat
 |Name|Date|Method|Description|
 |---|---|---|---|
 |[**Hupigon**](../xample-malware/hupigon.md)|2013|C0003.001, C0003.004|Please see the Hupigon malware page for details. [[1]](#1)|
-|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|C0003.004|Write pipe (This capa rule had 1 match) [[1]](#1)|
+|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|C0003.004|Poison Ivy writes pipes. [[1]](#1)|

 ## References

@@ -35,4 +35,4 @@ This micro-behavior focuses on SMTP communication.
 |Name|ID|Description|
 |---|---|---|
 |**Request**|C0012.002|Makes SMTP request.|
-|**Server Connect**|C0012.001|Connects to an smtp server.|
+|**Server Connect**|C0012.001|Connects to an SMTP server.|
@@ -59,10 +59,11 @@ Instead of being listed alphabetically, methods have been grouped to better faci

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0001.010|Create UDP socket (This capa rule had 1 match) [[2]](#2)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|C0001.011|Create TCP socket (This capa rule had 1 match) [[2]](#2)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|C0001.009|Initialize Winsock library (This capa rule had 1 match) [[2]](#2)|
-|[**SYNful Knock**](../xample-malware/synful-knock.md)|2015|C0001.014|To initiate communication with the C2 server, a uniquely crafted TCP SYN packet is sent to port 80 of the "implanted" router  [[1]](#1)|
+|[**SYNful Knock**](../../xample-malware/synful-knock.md)|2015|C0001.014|SYNful Knock initiates communication with the C2 server via a uniquely crafted TCP SYN packet sent to port 80 of the "implanted" router. [[1]](#1)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0001.010|Hupigon creates a UDP socket. [[2]](#2)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|C0001.011|Rombertik creates a TCP socket. [[2]](#2)|
+|[**Shamoon**](../xample-malware/shamoon.md)|2012|C0001.009|Shamoon initializes a Winsock library. [[2]](#2)|
+

 ## References

@@ -45,10 +45,13 @@ Malware may use a cryptographic hash.

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0029, C0029.001, C0029.002|Please see the BlackEnergy malware page for details. [[1]](#1)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|--|Hash data via WinCrypt (This capa rule had 22 matches) [[1]](#1)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|C0029, C0029.002|Please see the Redhip malware page for details. [[1]](#1)|
-|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|C0029.002|Hash data using SHA1 (This capa rule had 1 match) [[1]](#1)|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|BlackEnergy hashes data via WinCrypt. [[1]](#1)|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0029.001|BlackEnergy hashes data with MD5. [[1]](#1)|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0029.002|BlackEnergy hashes data using SHA1. [[1]](#1)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter hashes data via WinCrypt. [[1]](#1)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip hashes data via WinCrypt. [[1]](#1)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|C0029.002|Redhip hashes data using SHA1. [[1]](#1)|
+|[**UP007**](../xample-malware/up007.md)|2016|C0029.002|UP007 hashes data using SHA1. [[1]](#1)|

 ## References

@@ -54,7 +54,7 @@ Malware may decrypt data.

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|Encrypt or decrypt via WinCrypt (This capa rule had 1 match) [[1]](#1)|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|BlackEnergy encrypts or decrypts via WinCrypt. [[1]](#1)|
 |[**Kovter**](../xample-malware/kovter.md)|2016|--|Encrypt or decrypt via WinCrypt (This capa rule had 1 match) [[1]](#1)|

 ## Code Snippets
@@ -54,19 +54,22 @@ Malware may encrypt data.

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**TrickBot**](../../xample-malware/trickbot.md)|2016|C0027.001|Uses an AES CBC (256 bits) encryption algorithm for its loader and configuration files  [[1]](#1)|
-|[**GravityRAT**](../../xample-malware/gravity-rat.md)|2018|C0027.001|	GravityRat v3 supports file AES file encryption  [[3]](#3)|
-|[**Poison-Ivy**](../../xample-malware/poison-ivy.md)|2005|C0027.003|Poison Ivy's custom network protocol over TCP is encrypted using Camellia cipher with a 256-bit key  [[4]](#4)|
-|[**CHOPSTICK**](../xample-malware/chopstick.md)|2015|C0027.009|CHOPSTICK encrypts the configuration block using RC4 encryption [[5]](#5)|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0027.009|Encrypt data using RC4 via WinAPI (This capa rule had 1 match) [[6]](#6)|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|C0027.009|Encrypt data using RC4 PRGA (This capa rule had 3 matches) [[6]](#6)|
-|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|C0027.009|Encrypt data using RC4 PRGA (This capa rule had 1 match) [[6]](#6)|
-|[**Emotet**](../xample-malware/emotet.md)|2018|C0027.011, C0027.009|Please see the Emotet malware page for details. [[2]](#2)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0027.004|Encrypt data using DES (This capa rule had 1 match) [[6]](#6)|
-|[**Kraken**](../xample-malware/kraken.md)|2008|C0027.009|Encrypt data using RC4 PRGA (This capa rule had 2 matches) [[6]](#6)|
-|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|C0027.009|Encrypt data using RC4 PRGA (This capa rule had 1 match) [[6]](#6)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Encrypt data using DPAPI (This capa rule had 6 matches) [[6]](#6)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|C0027.009|Encrypt data using RC4 PRGA (This capa rule had 1 match) [[6]](#6)|
+|[**TrickBot**](../../xample-malware/trickbot.md)|2016|C0027.001|The malware uses an AES CBC (256 bits) encryption algorithm for its loader and configuration files. [[1]](#1)|
+|[**Emotet**](../xample-malware/emotet.md)|2018|C0027.009|Emotet encrypts data using RC4 PRGA. [[8]](#8)|
+|[**Emotet**](../../xample-malware/emotet.md)|2018|C0027.011|Emotet uses RSA to encrypt network traffic to its C2. [[2]](#2)|
+|[**GravityRAT**](../../xample-malware/gravity-rat.md)|2018|C0027.001|GravityRat v3 supports file AES file encryption. [[3]](#3)|
+|[**Poison Ivy**](../../xample-malware/poison-ivy.md)|2005|C0027.003|Poison Ivy's custom network protocol over TCP is encrypted using Camellia cipher with a 256-bit key. [[4]](#4)|
+|[**CHOPSTICK**](../xample-malware/chopstick.md)|2015|C0027.009|CHOPSTICK encrypts the configuration block using RC4 encryption. [[5]](#5)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|C0027.009|The malware decrypts inner configurations stored in the binary. The malware also encrypts the value of each JSON key with RC4 and encodes the value with Base64. [[6]](#6) [[7]](#7)|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0027.009|BlackEnergy encrypts data using RC4 via WinAPI. [[8]](#8)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|C0027.009|Dark Comet encrypts data using RC4 PRGA. [[8]](#8)|
+|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|C0027.009|DNSChanger encrypts data using RC4 PRGA. [[8]](#8)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0027.004|Hupigon encrypts data using DES. [[8]](#8)|
+|[**Kraken**](../xample-malware/kraken.md)|2008|C0027.009|Kraken encrypts data using RC4 PRGA. [[8]](#8)|
+|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|C0027.009|Locky Bart encrypts data using RC4 PRGA. [[8]](#8)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip encrypts data using DPAPI. [[8]](#8)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|C0027.009|Rombertik encrypts data using RC4 PRGA. [[8]](#8)|
+

 ## Code Snippets

@@ -139,5 +142,8 @@ retn

 <a name="5">[5]</a> https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf

-<a name="6">[6]</a> capa v4.0, analyzed at MITRE on 10/12/2022
+<a name="6">[6]</a> https://www.0ffset.net/reverse-engineering/matanbuchus-loader-analysis/

+<a name="7">[7]</a> https://www.cyberark.com/resources/threat-research-blog/inside-matanbuchus-a-quirky-loader
+
+<a name="8">[8]</a> capa v4.0, analyzed at MITRE on 10/12/2022
@@ -30,6 +30,7 @@

 Malware may import, generate, or otherwise use an encryption key. 

+
 ## Methods

 |Name|ID|Description|
@@ -37,14 +38,16 @@ Malware may import, generate, or otherwise use an encryption key.
 |**Import Public Key**|C0028.001|Malware imports a public key.|
 |**RC4 KSA**|C0028.002|Malware uses the RC4 Key Scheduling Algorithm (KSA).|

+
 ## Use in Malware

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|Create new key via CryptAcquireContext (This capa rule had 1 match) [[1]](#1)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|--|Create new key via CryptAcquireContext (This capa rule had 1 match) [[1]](#1)|
-|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Create new key via CryptAcquireContext (This capa rule had 1 match) [[1]](#1)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|C0028.002|Encrypt data using RC4 KSA (This capa rule had 1 match) [[1]](#1)|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|BlackEnergy creates new key via CryptAcquireContext. [[1]](#1)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter creates a new key via CryptAcquireContext. [[1]](#1)|
+|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Locky Bart creates a new key via CryptAcquireContext. [[1]](#1)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|C0028.002|Rombertik encrypts data using RC4 KSA. [[1]](#1)|
+

 ## References

@@ -28,7 +28,7 @@

 # Generate Pseudo-random Sequence

-The Generate Pseudo-random Sequence microbehavior can be used for a number of purposes. The methods below include specific functions, as well as pseudorandom number generators (PRNG).
+The Generate Pseudo-random Sequence micro-behavior can be used for a number of purposes. The methods below include specific functions, as well as pseudo-random number generators (PRNG).

 ## Methods

@@ -43,7 +43,7 @@ The Generate Pseudo-random Sequence microbehavior can be used for a number of pu

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0021.003|Generate random numbers via WinAPI (This capa rule had 1 match) [[1]](#1)|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0021.003|BlackEnergy generates random numbers via WinAPI. [[1]](#1)|
 |[**Locky Bart**](../xample-malware/locky-bart.md)|2017|C0021.003|Generate random numbers via WinAPI (This capa rule had 1 match) [[1]](#1)|

 ## References
@@ -28,15 +28,16 @@

 # Check String

-Malware may check a string for some characteristics, such as being ascii content; credit card number; or length.
+Malware may check a string for some characteristics, such as being ASCII content, credit card number, or length.
+

 ## Use in Malware

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Reference Base64 string (This capa rule had 1 match) [[1]](#1)|
+|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Locky Bart references Base64 strings. [[1]](#1)|
+

 ## References

 <a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
-
@@ -30,6 +30,7 @@

 Malware may derive a checksum from some block of data. The checksum is often used for data validation.

+
 ## Methods

 |Name|ID|Description|
@@ -39,14 +40,16 @@ Malware may derive a checksum from some block of data. The checksum is often use
 |**CRC32**|C0032.001|Malware computes a CRC32 checksum.|
 |**Luhn**|C0032.002|Malware uses Luhn algorithm, often to validate identification numbers (e.g, credit card number).| 

+
 ## Use in Malware

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|C0032.001|Hash data with CRC32 (This capa rule had 5 matches) [[1]](#1)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|C0032.001|Hash data with CRC32 (This capa rule had 1 match) [[1]](#1)|
-|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|C0032.001|Hash data with CRC32 (This capa rule had 2 matches) [[1]](#1)|
-|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|C0032.001|Hash data with CRC32 (This capa rule had 1 match) [[1]](#1)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|C0032.001|Dark Comet hashes data with CRC32. [[1]](#1)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|C0032.001|Gamut hashes data with CRC32. [[1]](#1)|
+|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|C0032.001|Locky Bart hashes data with CRC32. [[1]](#1)|
+|[**UP007**](../xample-malware/up007.md)|2016|C0032.001|UP007 hashes data with CRC32. [[1]](#1)|
+

 ## References

@@ -33,7 +33,7 @@

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Linked against ZLIB (This capa rule had 1 match) [[1]](#1)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|DarkComet linked against ZLIB. [[1]](#1)|
 |[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Linked against ZLIB (This capa rule had 1 match) [[1]](#1)|

 ## References
@@ -34,5 +34,5 @@ Malware may decode data.

 |Name|ID|Description|
 |---|---|---|
-|**Base64**|C0053.001|Malware may decode data using Base64.|
-|**XOR**|C0053.002|Malware may use xor to decode data.|
+|**Base64**|C0053.001|Malware may decode data using base64.|
+|**XOR**|C0053.002|Malware may use XOR to decode data.|
@@ -42,7 +42,7 @@ Malware may decompress data.

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Bagle**](../xample-malware/bagle.md)|2004|C0025.003|Decompress data using aPLib (This capa rule had 1 match) [[1]](#1)|
+|[**Bagle**](../xample-malware/bagle.md)|2004|C0025.003|Bagle decompresses data using aPLib. [[1]](#1)|

 ## References

@@ -35,28 +35,28 @@ Malware may encode data.
 |Name|ID|Description|
 |---|---|---|
 |**Base64**|C0026.001|Malware may encode data using Base64.|
-|**XOR**|C0026.002|Malware may use xor to encode data.|
+|**XOR**|C0026.002|Malware may use XOR to encode data.|
+

 ## Use in Malware

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|C0026.002|Encode data using XOR (This capa rule had 1 match) [[1]](#1)|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|C0026.002|Encode data using XOR (This capa rule had 13 matches) [[1]](#1)|
-|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|C0026.002|Encode data using XOR (This capa rule had 1 match) [[1]](#1)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|C0026.002|Encode data using XOR (This capa rule had 1 match) [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0026.002|Encode data using XOR (This capa rule had 8 matches) [[1]](#1)|
-|[**Kraken**](../xample-malware/kraken.md)|2008|C0026.002|Encode data using XOR (This capa rule had 2 matches) [[1]](#1)|
-|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|C0026.002|Encode data using XOR (This capa rule had 4 matches) [[1]](#1)|
-|[**Mebromi**](../xample-malware/mebromi.md)|2011|C0026.002|Encode data using XOR (This capa rule had 2 matches) [[1]](#1)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|C0026.002|Encode data using XOR (This capa rule had 1 match) [[1]](#1)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|C0026.002|Encode data using XOR (This capa rule had 5 matches) [[1]](#1)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|C0026.002|Encode data using XOR (This capa rule had 1 match) [[1]](#1)|
-|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|C0026.002|Encode data using XOR (This capa rule had 3 matches) [[1]](#1)|
-|[**TrickBot**](../xample-malware/trickbot.md)|2016|C0026.002|Encode data using XOR (This capa rule had 2 matches) [[1]](#1)|
-|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|C0026.002|Encode data using XOR (This capa rule had 13 matches) [[1]](#1)|
+|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|C0026.002|CryptoLocker encodes data using XOR. [[1]](#1)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|C0026.002|Dark Comet encodes data using XOR. [[1]](#1)|
+|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|C0026.002|DNSChanger encodes data using XOR. [[1]](#1)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|C0026.002|Gamut encodes data using XOR. [[1]](#1)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0026.002|Hupigon encodes data using XOR. [[1]](#1)|
+|[**Kraken**](../xample-malware/kraken.md)|2008|C0026.002|Kraken encodes data using XOR. [[1]](#1)|
+|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|C0026.002|Locky Bart encodes data using XOR. [[1]](#1)|
+|[**Mebromi**](../xample-malware/mebromi.md)|2011|C0026.002|Mebromi encodes data using XOR. [[1]](#1)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|C0026.002|Redhip encodes data using XOR. [[1]](#1)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|C0026.002|Rombertik encodes data using XOR. [[1]](#1)|
+|[**Shamoon**](../xample-malware/shamoon.md)|2012|C0026.002|Shamoon encodes data using XOR. [[1]](#1)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|C0026.002|Stuxnet encodes data using XOR. [[1]](#1)|
+|[**TrickBot**](../xample-malware/trickbot.md)|2016|C0026.002|TrickBot encodes data using XOR. [[1]](#1)|
+|[**UP007**](../xample-malware/up007.md)|2016|C0026.002|The malware encodes data using XOR. [[1]](#1)|

 ## References

 <a name="1">[1]</a> capa v4.0, analyzed at MITRE on 10/12/2022
-
@@ -28,4 +28,4 @@

 # Use Constant

-Malware may manipulate or use a constant value, for example as part of a larger string used by some function.
+Malware may manipulate or use a constant value; for example, as part of a larger string used by some function.
@@ -33,12 +33,12 @@

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|Copy file (This capa rule had 1 match) [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Copy file (This capa rule had 1 match) [[1]](#1)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|--|Copy file (This capa rule had 5 matches) [[1]](#1)|
-|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Copy file (This capa rule had 2 matches) [[1]](#1)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Copy file (This capa rule had 2 matches) [[1]](#1)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Copy file (This capa rule had 2 matches) [[1]](#1)|
+|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR copies files. [[1]](#1)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon copies files. [[1]](#1)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter copies files. [[1]](#1)|
+|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Mebromi copies files. [[1]](#1)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip copies files. [[1]](#1)|
+|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon copies files. [[1]](#1)|

 ## References

@@ -33,13 +33,13 @@

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Gamut**](../xample-malware/gamut.md)|2014|--|Create directory (This capa rule had 1 match) [[1]](#1)|
-|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|Create directory (This capa rule had 1 match) [[1]](#1)|
-|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|Create directory (This capa rule had 1 match) [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Create directory (This capa rule had 1 match) [[1]](#1)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|--|Create directory (This capa rule had 14 matches) [[1]](#1)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Create directory (This capa rule had 1 match) [[1]](#1)|
-|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|--|Create directory (This capa rule had 1 match) [[1]](#1)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut creates directories. [[1]](#1)|
+|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR creates directories. [[1]](#1)|
+|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|GravityRAT creates directories. [[1]](#1)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon creates directories. [[1]](#1)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter creates directories. [[1]](#1)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip creates directories. [[1]](#1)|
+|[**UP007**](../xample-malware/up007.md)|2016|--|UP007 creates directories. [[1]](#1)|

 ## References

@@ -33,7 +33,7 @@

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Gamut**](../xample-malware/gamut.md)|2014|--|Delete directory (This capa rule had 1 match) [[1]](#1)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut deletes directories. [[1]](#1)|
 |[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Delete directory (This capa rule had 1 match) [[1]](#1)|
 |[**Kovter**](../xample-malware/kovter.md)|2016|--|Delete directory (This capa rule had 4 matches) [[1]](#1)|

@@ -33,19 +33,19 @@

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Delete file (This capa rule had 1 match) [[1]](#1)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|--|Delete file (This capa rule had 4 matches) [[1]](#1)|
-|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|Delete file (This capa rule had 1 match) [[1]](#1)|
-|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|Delete file (This capa rule had 1 match) [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Delete file (This capa rule had 1 match) [[1]](#1)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|--|Delete file (This capa rule had 2 matches) [[1]](#1)|
-|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Delete file (This capa rule had 5 matches) [[1]](#1)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Delete file (This capa rule had 2 matches) [[1]](#1)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Delete file (This capa rule had 1 match) [[1]](#1)|
-|[**SamSam**](../xample-malware/samsam.md)|2015|--|Delete file (This capa rule had 1 match) [[1]](#1)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Delete file (This capa rule had 6 matches) [[1]](#1)|
-|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Delete file (This capa rule had 1 match) [[1]](#1)|
-|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|--|Delete file (This capa rule had 2 matches) [[1]](#1)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet deletes files. [[1]](#1)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut deletes files. [[1]](#1)|
+|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR deletes files. [[1]](#1)|
+|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|GravityRAT deletes files. [[1]](#1)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon deletes files. [[1]](#1)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter deletes files. [[1]](#1)|
+|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Mebromi deletes files. [[1]](#1)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip deletes files. [[1]](#1)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Rombertik deletes files. [[1]](#1)|
+|[**SamSam**](../xample-malware/samsam.md)|2015|--|SamSam deletes files. [[1]](#1)|
+|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon deletes files. [[1]](#1)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Stuxnet deletes files. [[1]](#1)|
+|[**UP007**](../xample-malware/up007.md)|2016|--|UP007 deletes files. [[1]](#1)|

 ## References

@@ -33,12 +33,12 @@

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Get file attributes (This capa rule had 2 matches) [[1]](#1)|
-|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|Get file attributes (This capa rule had 1 match) [[1]](#1)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|--|Get file attributes (This capa rule had 10 matches) [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Get file attributes (This capa rule had 3 matches) [[1]](#1)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Get file attributes (This capa rule had 2 matches) [[1]](#1)|
-|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|--|Get file attributes (This capa rule had 7 matches) [[1]](#1)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet gets file attributes. [[1]](#1)|
+|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|DNSChanger gets file attributes. [[1]](#1)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut gets file attributes. [[1]](#1)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon gets file attributes. [[1]](#1)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip gets file attributes. [[1]](#1)|
+|[**UP007**](../xample-malware/up007.md)|2016|--|UP007 gets file attributes. [[1]](#1)|

 ## References

@@ -33,12 +33,12 @@

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Gamut**](../xample-malware/gamut.md)|2014|--|Move file (This capa rule had 1 match) [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Move file (This capa rule had 1 match) [[1]](#1)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|--|Move file (This capa rule had 24 matches) [[1]](#1)|
-|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Move file (This capa rule had 2 matches) [[1]](#1)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Move file (This capa rule had 2 matches) [[1]](#1)|
-|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|--|Move file (This capa rule had 2 matches) [[1]](#1)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut moves files. [[1]](#1)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon moves files. [[1]](#1)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter moves files. [[1]](#1)|
+|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Mebromi moves files. [[1]](#1)|
+|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon moves files. [[1]](#1)|
+|[**UP007**](../xample-malware/up007.md)|2016|--|UP007 moves files. [[1]](#1)|

 ## References

@@ -33,20 +33,20 @@

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Read file on Windows (This capa rule had 7 matches) [[1]](#1)|
-|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|Read file on Windows (This capa rule had 3 matches) [[1]](#1)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|--|Read file on Windows (This capa rule had 2 matches) [[1]](#1)|
-|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|Read file on Windows (This capa rule had 9 matches) [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Read file on Windows (This capa rule had 1 match) [[1]](#1)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|--|Read file on Windows (This capa rule had 4 matches) [[1]](#1)|
-|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Read file on Windows (This capa rule had 2 matches) [[1]](#1)|
-|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Read file on Windows (This capa rule had 1 match) [[1]](#1)|
-|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|--|Read file on Windows (This capa rule had 1 match) [[1]](#1)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Read file on Windows (This capa rule had 3 matches) [[1]](#1)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Read file on Windows (This capa rule had 3 matches) [[1]](#1)|
-|[**SamSam**](../xample-malware/samsam.md)|2015|--|Read file on Windows (This capa rule had 1 match) [[1]](#1)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Read file on Windows (This capa rule had 1 match) [[1]](#1)|
-|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|--|Read file on Windows (This capa rule had 1 match) [[1]](#1)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet reads files on Windows. [[1]](#1)|
+|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|DNSChanger reads files on Windows. [[1]](#1)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut reads files on Windows. [[1]](#1)|
+|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|GravityRAT reads files on Windows. [[1]](#1)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon reads files on Windows. [[1]](#1)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter reads files on Windows. [[1]](#1)|
+|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Locky Bart reads files on Windows. [[1]](#1)|
+|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Mebromi reads files on Windows. [[1]](#1)|
+|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|Poison Ivy reads files on Windows. [[1]](#1)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip reads files on Windows. [[1]](#1)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Rombertik reads files on Windows. [[1]](#1)|
+|[**SamSam**](../xample-malware/samsam.md)|2015|--|SamSam reads files on Windows. [[1]](#1)|
+|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon reads files on Windows. [[1]](#1)|
+|[**UP007**](../xample-malware/up007.md)|2016|--|UP007 reads files on Windows. [[1]](#1)|

 ## References

@@ -33,12 +33,12 @@

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|Set file attributes (This capa rule had 1 match) [[1]](#1)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|--|Set file attributes (This capa rule had 2 matches) [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Set file attributes (This capa rule had 1 match) [[1]](#1)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|--|Set file attributes (This capa rule had 3 matches) [[1]](#1)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Set file attributes (This capa rule had 1 match) [[1]](#1)|
-|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|--|Set file attributes (This capa rule had 4 matches) [[1]](#1)|
+|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|DNSChanger sets file attributes. [[1]](#1)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut sets file attributes. [[1]](#1)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon sets file attributes. [[1]](#1)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter sets file attributes. [[1]](#1)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip sets file attributes. [[1]](#1)|
+|[**UP007**](../xample-malware/up007.md)|2016|--|UP007 sets file attributes. [[1]](#1)|

 ## References

@@ -33,18 +33,18 @@

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|Writes Fileon Windows (This capa rule had 1 match) [[1]](#1)|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Writes Fileon Windows (This capa rule had 5 matches) [[1]](#1)|
-|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|Writes Fileon Windows (This capa rule had 2 matches) [[1]](#1)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|--|Writes file on Windows (This capa rule had 3 matches) [[1]](#1)|
-|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|Write file on Windows (This capa rule had 7 matches) [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Write file on Windows (This capa rule had 4 matches) [[1]](#1)|
-|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Write file on Windows (This capa rule had 3 matches) [[1]](#1)|
-|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|--|Write file on Windows (This capa rule had 1 match) [[1]](#1)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Write file on Windows (This capa rule had 1 match) [[1]](#1)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Write file on Windows (This capa rule had 4 matches) [[1]](#1)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Write file on Windows (This capa rule had 1 match) [[1]](#1)|
-|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|--|Write file on Windows (This capa rule had 1 match) [[1]](#1)|
+|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|CryptoLocker writes Fileon Windows. [[1]](#1)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet writes Fileon Windows. [[1]](#1)|
+|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|DNSChanger writes Fileon Windows. [[1]](#1)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut writes files on Windows. [[1]](#1)|
+|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|GravityRAT writes files on Windows. [[1]](#1)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon writes files on Windows. [[1]](#1)|
+|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Locky Bart writes files on Windows. [[1]](#1)|
+|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|Poison Ivy writes files on Windows. [[1]](#1)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip writes files on Windows. [[1]](#1)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Rombertik writes files on Windows. [[1]](#1)|
+|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon writes files on Windows. [[1]](#1)|
+|[**UP007**](../xample-malware/up007.md)|2016|--|UP007 writes files on Windows. [[1]](#1)|

 ## References

@@ -34,15 +34,15 @@ Malware allocates memory, often to unpack itself.

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|Allocate RWX memory (This capa rule had 1 match) [[1]](#1)|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Allocate RWX memory (This capa rule had 1 match) [[1]](#1)|
-|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|Allocate RWX memory (This capa rule had 2 matches) [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Allocate RWX memory (This capa rule had 4 matches) [[1]](#1)|
-|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Allocate RWX memory (This capa rule had 1 match) [[1]](#1)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Spawn thread to RWX shellcode (This capa rule had 1 match) [[1]](#1)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Allocate RWX memory (This capa rule had 2 matches) [[1]](#1)|
-|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Allocate RWX memory (This capa rule had 1 match) [[1]](#1)|
-|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|Allocate RWX memory (This capa rule had 7 matches) [[1]](#1)|
+|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|CryptoLocker allocates RWX memory. [[1]](#1)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet allocates RWX memory. [[1]](#1)|
+|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|--|DNSChanger allocates RWX memory. [[1]](#1)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon allocates RWX memory. [[1]](#1)|
+|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Mebromi allocates RWX memory. [[1]](#1)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip spawns threads to RWX shellcode. [[1]](#1)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Rombertik allocates RWX memory. [[1]](#1)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Stuxnet allocates RWX memory. [[1]](#1)|
+|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|TrickBot allocates RWX memory. [[1]](#1)|

 ## References

@@ -28,7 +28,7 @@

 # Change Memory Protection

-Malware may change memory protection. For example, read-write memory may be changed to read-execute. Changing memory protection may exploits (e.g., bypass Data Execution Prevention).
+Malware may change memory protection. For example, read-write memory may be changed to read-execute. Changing memory protection may allow exploits (e.g., bypass Data Execution Prevention).

 ## Methods

@@ -42,8 +42,9 @@ Malware may change memory protection. For example, read-write memory may be chan

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Ursnif**](../../xample-malware/ursnif.md)|2016|--|Changes the PE header of the child process to enable write access to that page, writes 18 bytes of buffer at offset 0x40 from the start of svchost.exe process executable in the target child process. Then changes the region protection back to "read only" to avoid suspicion  [[1]](#1)|
-|[**SYNful Knock**](../xample-malware/synful-knock.md)|2015|--|Modifies the translation lookaside buffer (TLB) Read/Write attributes  [[2]](#2)|
+|[**Ursnif**](../../xample-malware/ursnif.md)|2016|--|The malware changes the PE header of the child process to enable write access to that page and writes 18 bytes of buffer at offset 0x40 from the start of svchost.exe in the target child process. The region protection is changed back to "read only" to avoid suspicion. [[1]](#1)|
+|[**SYNful Knock**](../../xample-malware/synful-knock.md)|2015|--|SYNful Knock modifies the translation lookaside buffer (TLB) Read/Write attributes. [[2]](#2)|
+

 ## References

@@ -35,7 +35,7 @@ Malware may overflow the buffer for various purposes.

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Conficker**](../../xample-malware/conficker.md)|2008|--|Variants A, B, C, and E exploit a vulnerability in the Server Service on Windows computers in which an already compromised computer sends a specially-crafted RPC request to force a buffer overflow and execute shellcode on the target computer  [[1]](#1)|
+|[**Conficker**](../../xample-malware/conficker.md)|2008|--|Variants A, B, C, and E exploit a vulnerability in the Server Service on Windows computers in which an already compromised computer sends a specially-crafted RPC request to force a buffer overflow and execute shellcode on the target computer. [[1]](#1)|

 ## References

@@ -40,8 +40,8 @@ Malware modifies environment variables.

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Kovter**](../xample-malware/kovter.md)|2016|C0034.001|Set environment variable (This capa rule had 3 matches) [[1]](#1)|
-|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|C0034.001|Set environment variable (This capa rule had 1 match) [[1]](#1)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|C0034.001|Kovter sets environment variables. [[1]](#1)|
+|[**UP007**](../xample-malware/up007.md)|2016|C0034.001|UP007 sets environment variables. [[1]](#1)|

 ## References

@@ -46,19 +46,40 @@ Malware modifies the registry.

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0036.005, C0036.006|Please see the BlackEnergy malware page for details. [[1]](#1)|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|C0036.002, C0036.007, C0036.005, C0036.006, C0036.001|Please see the Dark Comet malware page for details. [[1]](#1)|
-|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|C0036.006, C0036.001|Please see the DNSChanger malware page for details. [[1]](#1)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|C0036.002, C0036.007, C0036.005, C0036.006, C0036.001|Please see the Gamut malware page for details. [[1]](#1)|
-|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|C0036.006|Query or enumerate registry value (This capa rule had 1 match) [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0036.002, C0036.007, C0036.005, C0036.006, C0036.001|Please see the Hupigon malware page for details. [[1]](#1)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|C0036.004, C0036.006|Please see the Kovter malware page for details. [[1]](#1)|
-|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|C0036.001|Set registry value (This capa rule had 1 match) [[1]](#1)|
-|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|C0036.006|Query or enumerate registry value (This capa rule had 1 match) [[1]](#1)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|C0036.002, C0036.006, C0036.001|Please see the Redhip malware page for details. [[1]](#1)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|C0036.002, C0036.006, C0036.001|Please see the Rombertik malware page for details. [[1]](#1)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|C0036.007, C0036.006|Please see the Shamoon malware page for details. [[1]](#1)|
-|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|C0036.006, C0036.001|Please see the UP007 Malware Family malware page for details. [[1]](#1)|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0036.005|BlackEnergy queries or enumerates a registry key. [[1]](#1)|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|C0036.006|BlackEnergy queries or enumerates a registry value. [[1]](#1)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|C0036.001|Dark Comet sets registry values. [[1]](#1)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|C0036.002|Dark Comet deletes registry keys. [[1]](#1)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|C0036.005|Dark Comet queries or enumerates registry keys. [[1]](#1)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|C0036.006|Dark Comet queries or enumerates registry values. [[1]](#1)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|C0036.007|Dark Comet deletes registry values. [[1]](#1)|
+|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|C0036.001|DNSChanger sets registry keys. [[1]](#1)|
+|[**DNSChanger**](../xample-malware/dnschanger.md)|2011|C0036.006|DNSChanger queries or enumerates registry values. [[1]](#1)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|C0036.001|Gamut sets registry values. [[1]](#1)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|C0036.002|Gamut deletes registry keys. [[1]](#1)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|C0036.005|Gamut queries or enumerates registry keys. [[1]](#1)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|C0036.006|Gamut queries or enumerates registry values. [[1]](#1)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|C0036.007|Gamut deletes registry values. [[1]](#1)|
+|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|C0036.006|GoBotKR queries or enumerates registry values. [[1]](#1)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0036.001|Hupigon sets registry values. [[1]](#1)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0036.002|Hupigon deletes registry keys. [[1]](#1)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0036.005|Hupigon queries or enumerates registry keys. [[1]](#1)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0036.006|Hupigon queries or enumerates registry values. [[1]](#1)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|C0036.007|Hupigon deletes registry values. [[1]](#1)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|C0036.004|Kovter creates or opens registry keys. [[1]](#1)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|C0036.006|Kovter queries or enumerates registry values. [[1]](#1)|
+|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|C0036.001|Locky Bart sets registry values. [[1]](#1)|
+|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|C0036.006|Poison Ivy queries or enumerates registry values. [[1]](#1)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|C0036.001|Redhip set registry values. [[1]](#1)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|C0036.002|Redhip deletes registry keys. [[1]](#1)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|C0036.006|Redhip queries or enumerates registry values. [[1]](#1)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|C0036.001|Rombertik sets registry values. [[1]](#1)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|C0036.002|Rombertik deletes registry keys. [[1]](#1)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|C0036.006|Rombertik queries or enumerates registry values. [[1]](#1)|
+|[**Shamoon**](../xample-malware/shamoon.md)|2012|C0036.006|Shamoon queries or enumerates registry values. [[1]](#1)|
+|[**Shamoon**](../xample-malware/shamoon.md)|2012|C0036.007|Shamoon deletes registry values. [[1]](#1)|
+|[**UP007**](../xample-malware/up007.md)|2016|C0036.001|UP007 sets registry values. [[1]](#1)|
+|[**UP007**](../xample-malware/up007.md)|2016|C0036.006|UP007 queries or enumerates registry values. [[1]](#1)|

 ## References

@@ -35,8 +35,8 @@ Malware allocates thread local storage.

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Kovter**](../xample-malware/kovter.md)|2016|--|Allocate thread local storage (This capa rule had 3 matches) [[1]](#1)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Allocate thread local storage (This capa rule had 1 match) [[1]](#1)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter allocates thread local storage. [[1]](#1)|
+|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon allocates thread local storage. [[1]](#1)|

 ## References

@@ -34,11 +34,13 @@ Malware checks a mutex.

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|--|Poison Ivy variant checks if the wireshark-is-running{} named mutex object exists [[1]](#1)|
+|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|Poison Ivy variant checks if the wireshark-is-running{} named mutex object exists. [[1]](#1)|
+|[**Matanbuchus**](../xample-malware/matanbuchus.md)|2021|--|Malware checks if multiple instances of the same mutex is running. If multiple instances are running, the malware exits. [[2]](#2) [[3]](#3)|

 ## References

 <a name="1">[1]</a> https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf

-<a name="2">[2]</a> https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-poison-ivy-variant
+<a name="2">[2]</a> https://www.0ffset.net/reverse-engineering/matanbuchus-loader-analysis/

+<a name="3">[3]</a> https://www.cyberark.com/resources/threat-research-blog/inside-matanbuchus-a-quirky-loader
@@ -34,12 +34,13 @@ Malware creates a mutex.

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Poison-Ivy**](../xample-malware/poison-ivy.md)|2005|--|Poison Ivy has a default process mutex, but can be altered at build time [2] [[1]](#1)|
-|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Creates global mutexes signal that rootkit installation has occurred successfully  [[2]](#2)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Create mutex (This capa rule had 1 match) [[3]](#3)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|--|Create mutex (This capa rule had 2 matches) [[3]](#3)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Create mutex (This capa rule had 1 match) [[3]](#3)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Create mutex (This capa rule had 1 match) [[3]](#3)|
+|[**Poison Ivy**](../xample-malware/poison-ivy.md)|2005|--|Poison Ivy has a default process mutex, but can be altered at build time. [[1]](#1)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|--|Malware creates global mutexes that signal rootkit installation has occurred successfully. [[2]](#2)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon creates a mutex. [[3]](#3)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter creates a mutex. [[3]](#3)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip creates a mutex. [[3]](#3)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Rombertik creates a mutex. [[3]](#3)|
+

 ## References

@@ -48,6 +49,3 @@ Malware creates a mutex.
 <a name="2">[2]</a> https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en

 <a name="3">[3]</a> capa v4.0, analyzed at MITRE on 10/12/2022
-
-<a name="4">[4]</a> https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-poison-ivy-variant
-
@@ -43,18 +43,21 @@ Malware creates a process.

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|C0017.002|Stuxnet will use WMI operations with the explorere.exe token in order to copy itself and exscute on the remote share  [[1]](#1)|
-|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|Create process on Windows (This capa rule had 2 matches) [[2]](#2)|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Create process on Windows (This capa rule had 6 matches) [[2]](#2)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|--|Create process on Windows (This capa rule had 4 matches) [[2]](#2)|
-|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|Create process on Windows (This capa rule had 4 matches) [[2]](#2)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Create process on Windows (This capa rule had 9 matches) [[2]](#2)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|--|Create process on Windows (This capa rule had 22 matches) [[2]](#2)|
-|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Create process on Windows (This capa rule had 1 match) [[2]](#2)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|C0017, C0017.003|Please see the Redhip malware page for details. [[2]](#2)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Create process on Windows (This capa rule had 2 matches) [[2]](#2)|
-|[**TrickBot**](../xample-malware/trickbot.md)|2016|C0017, C0017.003|Please see the TrickBot malware page for details. [[2]](#2)|
-|[**UP007 Malware Family**](../xample-malware/up007.md)|2016|--|Create process on Windows (This capa rule had 3 matches) [[2]](#2)|
+|[**Stuxnet**](../xample-malware/stuxnet.md)|2010|C0017.002|Stuxnet will use WMI operations with the explorer.exe token in order to copy itself and execute on the remote share. [[1]](#1)|
+|[**BlackEnergy**](../xample-malware/blackenergy.md)|2007|--|BlackEnergy creates a process on Windows. [[2]](#2)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet creates a process on Windows. [[2]](#2)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut creates a process on Windows. [[2]](#2)|
+|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR creates a process on Windows. [[2]](#2)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon creates a process on Windows. [[2]](#2)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter creates a process on Windows. [[2]](#2)|
+|[**Mebromi**](../xample-malware/mebromi.md)|2011|--|Mebromi creates a process on Windows. [[2]](#2)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip creates a process on Windows. [[2]](#2)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|C0017.003|Redhip creates a suspended process. [[2]](#2)|
+|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon creates a process on Windows. [[2]](#2)|
+|[**TrickBot**](../xample-malware/trickbot.md)|2016|--|TrickBot creates a process on Windows. [[2]](#2)|
+|[**TrickBot**](../xample-malware/trickbot.md)|2016|C0017.003|TrickBot creates a suspended process. [[2]](#2)|
+|[**UP007**](../xample-malware/up007.md)|2016|--|The malware creates a process on Windows. [[2]](#2)|
+

 ## References

@@ -33,12 +33,12 @@

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Create thread (This capa rule had 3 matches) [[1]](#1)|
-|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|Create thread (This capa rule had 2 matches) [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Create thread (This capa rule had 6 matches) [[1]](#1)|
-|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Create thread (This capa rule had 1 match) [[1]](#1)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Create thread (This capa rule had 1 match) [[1]](#1)|
-|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Create thread (This capa rule had 2 matches) [[1]](#1)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet creates a thread. [[1]](#1)|
+|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR creates a thread. [[1]](#1)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon creates a thread. [[1]](#1)|
+|[**Locky Bart**](../xample-malware/locky-bart.md)|2017|--|Locky Bart creates a thread. [[1]](#1)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Rombertik creates a thread. [[1]](#1)|
+|[**Shamoon**](../xample-malware/shamoon.md)|2012|--|Shamoon creates a thread. [[1]](#1)|

 ## References

@@ -33,8 +33,8 @@

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|Resume thread (This capa rule had 1 match) [[1]](#1)|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Resume thread (This capa rule had 2 matches) [[1]](#1)|
+|[**CryptoLocker**](../xample-malware/cryptolocker.md)|2013|--|CryptoLocker resumes thread. [[1]](#1)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet resumes a thread. [[1]](#1)|

 ## References

@@ -35,12 +35,12 @@ Malware allocates thread local storage.

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Set thread local storage value (This capa rule had 1 match) [[1]](#1)|
-|[**Gamut**](../xample-malware/gamut.md)|2014|--|Set thread local storage value (This capa rule had 1 match) [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Set thread local storage value (This capa rule had 1 match) [[1]](#1)|
-|[**Kovter**](../xample-malware/kovter.md)|2016|--|Set thread local storage value (This capa rule had 3 matches) [[1]](#1)|
-|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Set thread local storage value (This capa rule had 1 match) [[1]](#1)|
-|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Set thread local storage value (This capa rule had 1 match) [[1]](#1)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet sets thread local storage values. [[1]](#1)|
+|[**Gamut**](../xample-malware/gamut.md)|2014|--|Gamut sets thread local storage values. [[1]](#1)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon sets thread local storage values. [[1]](#1)|
+|[**Kovter**](../xample-malware/kovter.md)|2016|--|Kovter sets thread local storage values. [[1]](#1)|
+|[**Redhip**](../xample-malware/rebhip.md)|2011|--|Redhip sets thread local storage values. [[1]](#1)|
+|[**Rombertik**](../xample-malware/rombertik.md)|2015|--|Rombertik sets thread local storage values. [[1]](#1)|

 ## References

@@ -33,10 +33,10 @@

 |Name|Date|Method|Description|
 |---|---|---|---|
-|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Suspend thread (This capa rule had 1 match) [[1]](#1)|
-|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|Suspend thread (This capa rule had 2 matches) [[1]](#1)|
-|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|Suspend thread (This capa rule had 6 matches) [[1]](#1)|
-|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Suspend thread (This capa rule had 1 match) [[1]](#1)|
+|[**Dark Comet**](../xample-malware/dark-comet.md)|2008|--|Dark Comet suspends threads. [[1]](#1)|
+|[**GoBotKR**](../xample-malware/gobotkr.md)|2019|--|GoBotKR suspends threads. [[1]](#1)|
+|[**GravityRAT**](../xample-malware/gravity-rat.md)|2018|--|GravityRAT suspends threads. [[1]](#1)|
+|[**Hupigon**](../xample-malware/hupigon.md)|2013|--|Hupigon suspends threads. [[1]](#1)|

 ## References

--- a/Show More
+++ b/Show More