admin/MBCProject-mbc-markdown
1
0
Fork 0
mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

Small behavior name fixes

Browse Source
This commit is contained in:
Patrick Copeland
2020-01-03 13:37:34 -05:00
parent 9ab86b2280
commit e5bee93e0b
2 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
xample-malware/trickbot.md
+2 -2
View File
@@ -17,12 +17,12 @@ Behaviors
|---------------------|-------------------------------------------------------|
|[Account Discovery](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/account-discover.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
|[Commonly Used Port](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/common-port.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
|[Credentials from Web Browsers](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/credentials-in-web-browsers.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
|[Credentials in Web Browsers](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/credentials-in-web-browsers.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
|[Credentials in Files](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/credentials-in-files.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
|[Credentials in Registry](https://github.com/MBCProject/mbc-markdown/blob/master/credential-access/credentials-in-registry.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
|[Custom Cryptographic Protocol](https://github.com/MBCProject/mbc-markdown/blob/master/command-and-control/custom-crypto-protocol.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
|[Data from Local System](https://github.com/MBCProject/mbc-markdown/blob/master/collection/data-local-system.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
|[Deobsfuscate/Decode Files or Information](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/deobfuscate-files.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
|[Deobfuscate/Decode Files or Information](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/deobfuscate-files.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
|[Disabling Security Tools](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/disable-security-tools.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
|[Domain Trust Discovery](https://github.com/MBCProject/mbc-markdown/blob/master/discovery/domain-trust-discover.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
|[Email Collection](https://github.com/MBCProject/mbc-markdown/blob/master/collection/email-collect.md)|See ATT&CK: [TrickBot - Techniques Used](https://attack.mitre.org/software/S0266/)|
xample-malware/webcobra.md
+5 -5
View File
@@ -23,18 +23,18 @@ Behaviors
|[Command-Line Interface](https://github.com/MBCProject/mbc-markdown/blob/master/execution/command-line.md) | From the command line, drops and unzips a password-protected Cabinet archive file. [[1]](#1) |
|[Install Additional Program](https://github.com/MBCProject/mbc-markdown/blob/master/execution/install-prog.md)| Downloads and executes Claymore's Zcash miner from a remote server. [[1]](#1) |
|[Conditional Execution](https://github.com/MBCProject/mbc-markdown/blob/master/execution/conditional-execute.md) | Executes differently depending on whether it's running on an x86 or x64 system. [[1]](#1) |
|[Hijack System Resources](https://github.com/MBCProject/mbc-markdown/blob/master/impact/hijack-sys-resources.md)| Drops software that mines for cryptocurrency: Cryptonight or Claymore's Zcash miner, depending on system architecture. [[1]](#1)|
|[Resource Hijacking](https://github.com/MBCProject/mbc-markdown/blob/master/impact/hijack-sys-resources.md)| Drops software that mines for cryptocurrency: Cryptonight or Claymore's Zcash miner, depending on system architecture. [[1]](#1)|
|[Dynamic Analysis Evasion](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/evade-dynamic-analysis.md) | [[1]](#1)|
|[Emulator Evasion](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/evade-emulator.md) | [[1]](#1)|
|[Virtual Machine Detection](https://github.com/MBCProject/mbc-markdown/blob/master/anti-behavioral-analysis/detect-vm.md) | [[1]](#1)|
|[Deobfuscate/Decode File or Information](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/deobfuscate-files.md) | [[1]](#1)|
|[Obfuscate Files or Information](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/obfuscate-files.md) | [[1]](#1)|
|[Deobfuscate/Decode Files or Information](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/deobfuscate-files.md) | [[1]](#1)|
|[Obfuscated Files or Information](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/obfuscate-files.md) | [[1]](#1)|
|[File Deletion](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/file-deletion.md) | [[1]](#1)|
|[Process Injection](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/process-inject.md)| Injects miner code into a running process.|
|[Disable Security Tools](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/disable-security-tools.md) | Most security products hook some APIs to monitor the behavior of malware. To avoid being found by this technique, WebCobra loads ntdll.dll and user32.dll as data files in memory and overwrites the first 8 bytes of those functions, which unhooks the APIs. [[1]](#1)|
|[Disabling Security Tools](https://github.com/MBCProject/mbc-markdown/blob/master/defense-evasion/disable-security-tools.md) | Most security products hook some APIs to monitor the behavior of malware. To avoid being found by this technique, WebCobra loads ntdll.dll and user32.dll as data files in memory and overwrites the first 8 bytes of those functions, which unhooks the APIs. [[1]](#1)|
References
----------
<a name="1">[1]</a> https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
<a name="2">[2]</a> https://www.forbes.com/sites/rachelwolfson/2018/11/13/cryptojacking-on-the-rise-webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/#16f5542cc336
<a name="2">[2]</a> https://www.forbes.com/sites/rachelwolfson/2018/11/13/cryptojacking-on-the-rise-webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/#16f5542cc336