diff --git a/anti-behavioral-analysis/debugger-evasion.md b/anti-behavioral-analysis/debugger-evasion.md index aa98c68..2916ec1 100644 --- a/anti-behavioral-analysis/debugger-evasion.md +++ b/anti-behavioral-analysis/debugger-evasion.md @@ -91,7 +91,7 @@ The related **Debugger Evasion ([T1622](https://attack.mitre.org/techniques/T162 [3] http://phishme.com/dridex-code-breaking-modify-the-malware-to-bypass-the-vm-bypass/ -[4] http://antukh.com/blog/2015/01/19/malware-techniques-cheat-sheet/ +[4] https://antukh.com/blog/2015/01/19/malware-techniques-cheat-sheet/ [5] https://search.unprotect.it/map/ diff --git a/anti-behavioral-analysis/dynamic-analysis-evasion.md b/anti-behavioral-analysis/dynamic-analysis-evasion.md index 59fe8b5..20fa949 100644 --- a/anti-behavioral-analysis/dynamic-analysis-evasion.md +++ b/anti-behavioral-analysis/dynamic-analysis-evasion.md @@ -71,9 +71,9 @@ The related **Virtualization/Sandbox Evasion ([T1497](https://attack.mitre.org/t ## References -[1] http://joe4security.blogspot.com/2013/06/overloading-sandboxes-new-generic.html +[1] https://joesecurity.org/blog/43104088277279070 -[2] https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/ +[2] https://www.mcafee.com/blogs/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/ [3] https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/pf/file/fireeye-hot-knives-through-butter.pdf diff --git a/anti-behavioral-analysis/emulator-evasion.md b/anti-behavioral-analysis/emulator-evasion.md index 28db62b..8a793e0 100644 --- a/anti-behavioral-analysis/emulator-evasion.md +++ b/anti-behavioral-analysis/emulator-evasion.md @@ -47,5 +47,5 @@ Behaviors that obstruct analysis in an emulator. ## References -[1] https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/ +[1] https://www.mcafee.com/blogs/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/ diff --git a/anti-behavioral-analysis/memory-dump-evasion.md b/anti-behavioral-analysis/memory-dump-evasion.md index ced3305..d2b47ce 100644 --- a/anti-behavioral-analysis/memory-dump-evasion.md +++ b/anti-behavioral-analysis/memory-dump-evasion.md @@ -108,7 +108,7 @@ jmp short loc_401326 [2] http://blog.threatexpert.com/2008/04/kraken-changes-tactics.html -[3] http://waleedassar.blogspot.com/search/label/anti-dump +[3] https://waleedassar.blogspot.com/search/label/anti-dump [4] https://www.gironsec.com/code/packers.pdf diff --git a/anti-behavioral-analysis/virtual-machine-detection.md b/anti-behavioral-analysis/virtual-machine-detection.md index 7c94074..b8c4efa 100644 --- a/anti-behavioral-analysis/virtual-machine-detection.md +++ b/anti-behavioral-analysis/virtual-machine-detection.md @@ -154,11 +154,11 @@ jmp short loc_401CBB [3] https://www.hackread.com/gravityrat-malware-evades-detection-targets-india/ -[4] https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/ +[4] https://www.mcafee.com/blogs/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/ [5] https://github.com/LordNoteworthy/al-khaser -[6] https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html +[6] https://web.archive.org/web/20161025013916/https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html [7] https://securelist.com/the-banking-trojan-emotet-detailed-analysis/69560/ diff --git a/anti-static-analysis/call-graph-generation-evasion.md b/anti-static-analysis/call-graph-generation-evasion.md index 23dcaab..f153434 100644 --- a/anti-static-analysis/call-graph-generation-evasion.md +++ b/anti-static-analysis/call-graph-generation-evasion.md @@ -49,4 +49,4 @@ Malware code evades accurate call graph generation during disassembly. Call grap [3] http://fumalwareanalysis.blogspot.com/2012/01/malware-analysis-tutorial-10-tricks-for.html -[4] S. Shang, N. Zheng, J. Xu, M. Xu, H. Zhang, "Detecting Malware Variants via Function-call Graph Similarity," IEEE 2010 5th International Conference on Malicious and Unwanted Software, 2010. http://seclab.hdu.edu.cn/static/uploads/paper/10-05.pdf +[4] S. Shang, N. Zheng, J. Xu, M. Xu, H. Zhang, "Detecting Malware Variants via Function-call Graph Similarity," IEEE 2010 5th International Conference on Malicious and Unwanted Software, 2010. https://seclab.hdu.edu.cn/static/uploads/paper/10-05.pdf diff --git a/anti-static-analysis/disassembler-evasion.md b/anti-static-analysis/disassembler-evasion.md index bf0cd14..e7fc696 100644 --- a/anti-static-analysis/disassembler-evasion.md +++ b/anti-static-analysis/disassembler-evasion.md @@ -54,15 +54,15 @@ Some methods apply to both types of disassemblers; others apply to one type and ## References -[1] http://staff.ustc.edu.cn/~bjhua/courses/security/2014/readings/anti-disas.pdf +[1] https://staff.ustc.edu.cn/~bjhua/courses/security/2014/readings/anti-disas.pdf -[2] http://www.kernelhacking.com/rodrigo/docs/blackhat2012-paper.pdf +[2] https://www.kernelhacking.com/rodrigo/docs/blackhat2012-paper.pdf [3] https://isc.sans.edu/diary/Malicious+VBA+Office+Document+Without+Source+Code/24870 [4] https://boingboing.net/2019/05/05/p-code-r-us.html -[5] https://www.ndss-symposium.org/wp-content/uploads/2020/04/bar2020-23004-paper.pd +[5] https://www.ndss-symposium.org/wp-content/uploads/2020/04/bar2020-23004-paper.pdf [6] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/anti-static-analysis/executable-code-obfuscation.md b/anti-static-analysis/executable-code-obfuscation.md index 64ad71b..377d10f 100644 --- a/anti-static-analysis/executable-code-obfuscation.md +++ b/anti-static-analysis/executable-code-obfuscation.md @@ -143,7 +143,7 @@ jmp short loc_401326 [1] https://blogs.cisco.com/security/talos/rombertik -[2] https://cofense.com/recent-geodo-malware-campaigns-feature-heavily-obfuscated-macros/ +[2] https://cofense.com/blog/recent-geodo-malware-campaigns-feature-heavily-obfuscated-macros/ [3] Rob Simmons, "Comparing Malicious Files," BSides, 2019. http://www.irongeek.com/i.php?page=videos/bsidescharm2019/2-04-comparing-malicious-files-robert-simmons diff --git a/anti-static-analysis/software-packing.md b/anti-static-analysis/software-packing.md index d9d64e0..9e198dd 100644 --- a/anti-static-analysis/software-packing.md +++ b/anti-static-analysis/software-packing.md @@ -69,7 +69,7 @@ This description refines the ATT&CK **Obfuscated Files or Information: Software [1] Ange Albertini, Packers, 5 April 2010, https://gironsec.com/code/packers.pdf -[2] Jiang Ming et al, Towards Paving the Way for Large-Scale Windows Malware Analysis: Generic Binary Unpacking with Orders-of-Magnitude Performance Boost, October 2018, https://dl.acm.org/citation.cfm?id=3243771. +[2] Jiang Ming et al, Towards Paving the Way for Large-Scale Windows Malware Analysis: Generic Binary Unpacking with Orders-of-Magnitude Performance Boost, October 2018, https://dl.acm.org/citation.cfm?id=3243771 [3] https://web.archive.org/web/20161025013916/https://www.fireeye.com/blog/threat-research/2011/01/the-dead-giveaways-of-vm-aware-malware.html diff --git a/command-and-control/c2-communication.md b/command-and-control/c2-communication.md index e9faa90..6e286b0 100644 --- a/command-and-control/c2-communication.md +++ b/command-and-control/c2-communication.md @@ -125,7 +125,7 @@ jmp short loc_4019A2 [4] https://citizenlab.ca/2016/04/between-hong-kong-and-burma/ -[5] http://researchcenter.paloaltonetworks.com/2015/10/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/ +[5] https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/ [6] https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality @@ -135,7 +135,7 @@ jmp short loc_4019A2 [9] https://unit42.paloaltonetworks.com/tracking-minidionis-cozycars-new-ride-is-related-to-seaduke -[10] https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/ +[10]https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/ [11] https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking diff --git a/defense-evasion/disable-or-evade-security-tools.md b/defense-evasion/disable-or-evade-security-tools.md index 15971d9..bec4065 100644 --- a/defense-evasion/disable-or-evade-security-tools.md +++ b/defense-evasion/disable-or-evade-security-tools.md @@ -60,11 +60,11 @@ See ATT&CK: **Impair Defenses: Disable or Modify Tools ([T1562.001](https://atta ## References -[1] https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/ +[1] https://www.mcafee.com/blogs/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/ [2] https://www.huffingtonpost.com/2011/11/09/click-hijack-hackers-online-ad-scam_n_1084497.html -[3] Alexander Adamov, Stealthy WastedLocker: eluding behavior blockers, but not only. Online: https://vblocalhost.com/conference/presentations/stealthy-wastedlocker-eluding-behaviour-blockers-but-not-only/ +[3] Alexander Adamov, Stealthy WastedLocker: eluding behavior blockers, but not only. Online: https://vb2020.vblocalhost.com/conference/presentations/stealthy-wastedlocker-eluding-behaviour-blockers-but-not-only/ [4] Carl Petty, Red Canary, 3/3/2020. Online: https://redcanary.com/blog/heavens-gate-technique-on-linux/ diff --git a/defense-evasion/hide-artifacts.md b/defense-evasion/hide-artifacts.md index 55499bd..d30a23b 100644 --- a/defense-evasion/hide-artifacts.md +++ b/defense-evasion/hide-artifacts.md @@ -52,7 +52,7 @@ See ATT&CK: **Hide Artifacts ([T1564](https://attack.mitre.org/techniques/T1564/ ## References -[1] http://researchcenter.paloaltonetworks.com/2015/10/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/ +[1] https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/ [2] https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en diff --git a/defense-evasion/install-insecure-or-malicious-configuration.md b/defense-evasion/install-insecure-or-malicious-configuration.md index 9da0a72..d094a58 100644 --- a/defense-evasion/install-insecure-or-malicious-configuration.md +++ b/defense-evasion/install-insecure-or-malicious-configuration.md @@ -42,4 +42,4 @@ Malware may install malicious configuration settings or may modify existing conf [1] https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf -[2] http://researchcenter.paloaltonetworks.com/2015/10/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/ +[2] https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/ diff --git a/defense-evasion/obfuscated-files-or-information.md b/defense-evasion/obfuscated-files-or-information.md index 4144aaa..46c8051 100644 --- a/defense-evasion/obfuscated-files-or-information.md +++ b/defense-evasion/obfuscated-files-or-information.md @@ -101,7 +101,7 @@ Instead of being listed alphabetically, methods have been grouped to better faci [6] https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality -[7] https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/ +[7] https://www.mcafee.com/blogs/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/ [8] https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf diff --git a/defense-evasion/process-injection.md b/defense-evasion/process-injection.md index 3d65c5b..26e7ff0 100644 --- a/defense-evasion/process-injection.md +++ b/defense-evasion/process-injection.md @@ -96,6 +96,6 @@ Methods not captured by ATT&CK Process Injection sub-techniques are listed below [11] https://www.cybereason.com/blog/research/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware -[12] https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/ +[12] https://www.mcafee.com/blogs/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/ [13] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/discovery/system-information-discovery.md b/discovery/system-information-discovery.md index 6e8a4e4..9523011 100644 --- a/discovery/system-information-discovery.md +++ b/discovery/system-information-discovery.md @@ -79,7 +79,7 @@ See ATT&CK: **System Information Discovery ([T1082](https://attack.mitre.org/tec [7] https://www.securityartwork.es/wp-content/uploads/2017/07/Trickbot-report-S2-Grupo.pdf -[8] https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/ +[8] https://www.mcafee.com/blogs/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/ [9] capa v4.0, analyzed at MITRE on 10/12/2022 diff --git a/execution/command-and-scripting-interpreter.md b/execution/command-and-scripting-interpreter.md index 822b25e..09bb9e7 100644 --- a/execution/command-and-scripting-interpreter.md +++ b/execution/command-and-scripting-interpreter.md @@ -79,7 +79,7 @@ See ATT&CK: **Command and Scripting Interpreter ([T1059](https://attack.mitre.or [10] https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/ -[11] https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/ +[11] https://www.mcafee.com/blogs/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/ [12] https://blog.malwarebytes.com/threat-analysis/2016/07/untangling-kovter/ diff --git a/execution/conditional-execution.md b/execution/conditional-execution.md index cc5c3cc..b869afd 100644 --- a/execution/conditional-execution.md +++ b/execution/conditional-execution.md @@ -67,7 +67,7 @@ Some aspects of this Conditional Execution behavior are related to the [Executio ## References -[1] https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/ +[1] https://www.mcafee.com/blogs/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/ [2] https://reverseengineering.stackexchange.com/questions/2019/debugging-malware-that-will-only-run-as-a-service diff --git a/execution/install-additional-program.md b/execution/install-additional-program.md index 2c88aba..e1d7ca0 100644 --- a/execution/install-additional-program.md +++ b/execution/install-additional-program.md @@ -79,7 +79,7 @@ Malware that installs another component is called a "dropper." If the code is co [12] https://blog.malwarebytes.com/threat-analysis/2018/10/mac-malware-intercepts-encrypted-web-traffic-for-ad-injection/ -[13] http://researchcenter.paloaltonetworks.com/2015/10/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/ +[13] https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/ [14] https://us.norton.com/internetsecurity-emerging-threats-mazar-bot-malware-invades-and-erases-android-devices.html diff --git a/impact/data-destruction.md b/impact/data-destruction.md index e40d258..d2f35ed 100644 --- a/impact/data-destruction.md +++ b/impact/data-destruction.md @@ -57,7 +57,7 @@ See ATT&CK: **Data Destruction ([T1485](https://attack.mitre.org/techniques/T148 ## References -[1] http://www.darkreading.com/attacks-breaches/disk-wiping-shamoon-malware-resurfaces-with-file-erasing-malware-in-tow/d/d-id/1333509 +[1] https://www.darkreading.com/attacks-breaches/disk-wiping-shamoon-malware-resurfaces-with-file-erasing-malware-in-tow/d/d-id/1333509 [2] https://blogs.cisco.com/security/talos/rombertik diff --git a/impact/data-encrypted-for-impact.md b/impact/data-encrypted-for-impact.md index 88e30af..0f33219 100644 --- a/impact/data-encrypted-for-impact.md +++ b/impact/data-encrypted-for-impact.md @@ -55,7 +55,7 @@ See ATT&CK: **Data Encrypted for Impact ([T1486](https://attack.mitre.org/techni ## References -[1] http://www.secureworks.com/cyber-threat-intelligence/threats/cryptowall-ransomware/ +[1] https://www.secureworks.com/research/cryptowall-ransomware [2] https://www.secureworks.com/research/cryptolocker-ransomware diff --git a/impact/denial-of-service.md b/impact/denial-of-service.md index 1dea5d3..0f7cca5 100644 --- a/impact/denial-of-service.md +++ b/impact/denial-of-service.md @@ -47,7 +47,7 @@ The related **Network Denial of Service ([T1498](https://attack.mitre.org/techni ## References -[1] http://atlas-public.ec2.arbor.net/docs/BlackEnergy+DDoS+Bot+Analysis.pdf +[1] http://pds15.egloos.com/pds/201001/01/66/BlackEnergy_DDoS_Bot_Analysis.pdf [2] https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/ diff --git a/impact/destroy-hardware.md b/impact/destroy-hardware.md index 387a9f1..3def1b3 100644 --- a/impact/destroy-hardware.md +++ b/impact/destroy-hardware.md @@ -42,7 +42,7 @@ Malware destroys a physical piece of hardware. For example, malware may cause ha ## References -[1] https://www.bbc.com/timelines/zc6fbk7 +[1] https://www.langner.com/wp-content/uploads/2017/03/to-kill-a-centrifuge.pdf [2] https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en diff --git a/impact/generate-traffic-from-victim.md b/impact/generate-traffic-from-victim.md index 1a48a5a..7c0be1a 100644 --- a/impact/generate-traffic-from-victim.md +++ b/impact/generate-traffic-from-victim.md @@ -58,7 +58,7 @@ Malware may generate traffic from the victim system such as clicks of advertisin [3] https://www.bleepingcomputer.com/virus-removal/remove-kovter-trojan -[4] http://researchcenter.paloaltonetworks.com/2015/10/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/ +[4] https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/ [5] https://blog.malwarebytes.com/threat-analysis/2016/07/untangling-kovter/ diff --git a/impact/resource-hijacking.md b/impact/resource-hijacking.md index dad4eb2..163ca45 100644 --- a/impact/resource-hijacking.md +++ b/impact/resource-hijacking.md @@ -55,7 +55,7 @@ The related **Resource Hijacking ([T1496](https://attack.mitre.org/techniques/T1 ## References -[1] https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/ +[1] https://www.mcafee.com/blogs/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/ [2] https://blog.trendmicro.com/trendlabs-security-intelligence/wannacry-uiwix-ransomware-monero-mining-malware-follow-suit/ diff --git a/lateral-movement/supply-chain-compromise.md b/lateral-movement/supply-chain-compromise.md index 54b6a6c..4ec26a2 100644 --- a/lateral-movement/supply-chain-compromise.md +++ b/lateral-movement/supply-chain-compromise.md @@ -48,7 +48,7 @@ The supply chain may be compromised to enable initial malware infection. MBC obj ## References -[1] http://researchcenter.paloaltonetworks.com/2015/10/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/ +[1] https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/ [2] https://eclypsium.com/wp-content/uploads/2020/12/TrickBot-Now-Offers-TrickBoot-Persist-Brick-Profit.pdf diff --git a/persistence/component-firmware.md b/persistence/component-firmware.md index bd0b1d7..931ea21 100644 --- a/persistence/component-firmware.md +++ b/persistence/component-firmware.md @@ -55,7 +55,7 @@ See ATT&CK: **Pre-OS Boot: Component Firmware ([T1542.002](https://attack.mitre. [2] https://www.fireeye.com/blog/threat-research/2015/09/synful_knock_-_acis.html -[3] http://researchcenter.paloaltonetworks.com/2015/10/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/ +[3] https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/ [4] https://www.mandiant.com/resources/synful-knock-acis diff --git a/persistence/modify-existing-service.md b/persistence/modify-existing-service.md index df908fb..bba5ad8 100644 --- a/persistence/modify-existing-service.md +++ b/persistence/modify-existing-service.md @@ -47,7 +47,7 @@ See ATT&CK: **Create or Modify System Process::Windows Service ([T1543.003](http [1] https://www.cyber.nj.gov/threat-profiles/trojan-variants/poison-ivy -[2] http://researchcenter.paloaltonetworks.com/2015/10/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/ +[2] https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/ [3] https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf diff --git a/persistence/registry-run-keys-startup-folder.md b/persistence/registry-run-keys-startup-folder.md index 4bf56a3..1eef4df 100644 --- a/persistence/registry-run-keys-startup-folder.md +++ b/persistence/registry-run-keys-startup-folder.md @@ -81,7 +81,7 @@ See ATT&CK: **Boot or Logon Autostart Execution: Registry Run Keys / Startup Fol [12] https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/ -[13] https://cofense.com/recent-geodo-malware-campaigns-feature-heavily-obfuscated-macros/ +[13] https://cofense.com/blog/recent-geodo-malware-campaigns-feature-heavily-obfuscated-macros/ [14] https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/WORM_BAGLE.U/ diff --git a/xample-malware/emotet.md b/xample-malware/emotet.md index 98279aa..f82fade 100644 --- a/xample-malware/emotet.md +++ b/xample-malware/emotet.md @@ -64,7 +64,7 @@ SHA256 Hashes ## References -[1] https://cofense.com/recent-geodo-malware-campaigns-feature-heavily-obfuscated-macros/ +[1] https://cofense.com/blog/recent-geodo-malware-campaigns-feature-heavily-obfuscated-macros/ [2] https://documents.trendmicro.com/assets/white_papers/ExploringEmotetsActivities_Final.pdf diff --git a/xample-malware/webcobra.md b/xample-malware/webcobra.md index 415d2fc..a7a9037 100644 --- a/xample-malware/webcobra.md +++ b/xample-malware/webcobra.md @@ -72,6 +72,6 @@ SHA256 Hashes ## References -[1] https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/ +[1] https://www.mcafee.com/blogs/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/ [2] https://www.forbes.com/sites/rachelwolfson/2018/11/13/cryptojacking-on-the-rise-webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/#16f5542cc336 diff --git a/xample-malware/yispecter.md b/xample-malware/yispecter.md index 84e9b05..36289f6 100644 --- a/xample-malware/yispecter.md +++ b/xample-malware/yispecter.md @@ -72,4 +72,4 @@ C2 Server: ## References -[1] http://researchcenter.paloaltonetworks.com/2015/10/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/ +[1] https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/