mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
brightmt
084ba830d3
* Update self-deletion.md Added CAPA rule "self delete using alternate data streams" (https://github.com/mandiant/capa-rules/blob/v7.1.0/anti-analysis/anti-forensic/self-deletion/self-delete-using-alternate-data-streams.yml) * Update obfuscated-files-or-information.md added new CAPA rule "encrypt data using RC4 via SystemFunction033" https://github.com/mandiant/capa-rules/blob/v7.1.0/data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-systemfunction033.yml * Update disk-wipe.md Added capa rule "https://github.com/mandiant/capa-rules/blob/v7.1.0/impact/wipe-disk/delete-drive-layout-via-ioctl.yml" https://github.com/mandiant/capa-rules/blob/v7.1.0/impact/wipe-disk/delete-drive-layout-via-ioctl.yml * Update system-information-discovery.md Added new CAPA rule "get disk information via IOCTL" https://github.com/mandiant/capa-rules/blob/v7.1.0/nursery/get-disk-information-via-ioctl.yml * Update system-information-discovery.md Added new CAPA rule "get volume information via IOCTL" https://github.com/mandiant/capa-rules/blob/v7.1.0/nursery/get-volume-information-via-ioctl.yml * Update dns-communication.md Removed duplication in APIs in "Resolve DNS" CAPA rule * Update socket-communication.md Updated APIs for "create raw socket" CAPA rule * Update socket-communication.md Updated APIs on CAPA rule "get socket status" * Update socket-communication.md Updated CAPA rule "initialize Winsock library" * Update socket-communication.md Updated API listing on CAPA rule "receive data on socket" * Update socket-communication.md Updated API listing for "send data on socket" CAPA rule * Update socket-communication.md Update APIs for CAPA rule "set socket configuration" * Update socket-communication.md Updated CAPA rule "connect tcp socket" to add APIs * Update socket-communication.md Added APIs to CAPA rule "create tcp socket" * Update socket-communication.md Added APIs to "create UDP socket" CAPA rule * Update encrypt-data.md Added new APIs to "encrypt data using DPAPI" CAPA rule * Update install-driver.md Added APIs to CAPA rule "install driver" * Update set-file-attributes.md Added APIs to CAPA rule "change file permissions on Linux" * Update writes-file.md Updated APIs for CAPA rule "write file on linux" * Update system-information-discovery.md Removed API from CAPA rule "get disk size" to align with published CAPA rule in v. 7.1 * Update create-process.md Added API to "create process on linux" CAPA rule * Update hijack-execution-flow.md Added API calls to CAPA rule "execute shellcode via Windows callback function" * Update self-deletion.md Changed link to master * Update obfuscated-files-or-information.md Changed rule link to release to point to master * Update system-information-discovery.md Removed nursery rules * Update disk-wipe.md Updated link to master branch * Update socket-communication.md Checked for correct socket listings under the APIs
16 KiB
16 KiB
| ID | E1027 |
| Objective(s) | Anti-Static Analysis, Defense Evasion |
| Related ATT&CK Techniques | Obfuscated Files or Information (T1027, T1406) |
| Anti-Analysis Type | Evasion |
| Version | 2.2 |
| Created | 1 August 2019 |
| Last Modified | 27 April 2024 |
Obfuscated Files or Information
Malware may make files or information difficult to discover or analyze by encoding, encrypting, or otherwise obfuscating the content. In addition, a malware sample itself can be encoded or encrypted (i.e., encoding/encryption is a code characteristic).
A related MBC behavior (code characteristic), associated explicitly with executable code and making its analysis more difficult, is Executable Code Obfuscation (B0032).
Another related MBC behavior (code characteristic), is Software Packing (F0001) which has methods capturing specific packers and types of compression.
See ATT&CK: Obfuscated Files or Information (T1027, T1406).
Instead of being listed alphabetically, methods have been grouped to better faciliate labeling and mapping.
Methods
| Name | ID | Description |
|---|---|---|
| Encoding | E1027.m01 | A malware sample, file, or other information is encoded. This method is related to the subsequently defined ATT&CK sub-technique Encrypted/Encoded File (T1027.013). |
| Encoding - Custom Algorithm | E1027.m03 | A custom algorithm is used to encode a malware sample, file or other information. This method is related to Unprotect technique U0702. |
| Encoding - Standard Algorithm | E1027.m02 | A standard algorithm (e.g., base64) is used to encode a malware sample, file, or other information. This method is related to Unprotect technique U0701 and U0706. |
| Encryption | E1027.m04 | A malware sample, file, or other information is encrypted. This method is related to Unprotect technique U0703 and to the subsequently defined ATT&CK sub-technique Encrypted/Encoded File (T1027.013). |
| Encryption - Custom Algorithm | E1027.m08 | A custom algorithm is used to encrypt a malware sample, file, or other information. |
| Encryption - Standard Algorithm | E1027.m05 | A standard algorithm (e.g., Rijndael/AES, DES, RC4) is used to encrypt a malware sample, file, or other information. This method is related to Unprotect technique U0701. |
| Encryption of Code | E1027.m06 | A file's executable code is encrypted, but not necessarily the file's data. |
| Encryption of Data | E1027.m07 | A file's data is encrypted, but not necessarily the file's code. |
Use in Malware
| Name | Date | Method | Description |
|---|---|---|---|
| Poison Ivy | 2005 | -- | Malware obfuscates files.[8] |
| WebCobra | 2018 | -- | The dropped file is password-protected. Once unzipped, the file contains a DLL file to decrypt the second file (a bin file with an encrypted malicious payload). [7] |
| GoBotKR | 2019 | -- | GoBotKR uses base64 to obfuscate strings, commands and files. [1] |
| Kovter | 2016 | -- | The malware will use a key to decrypt text from a URL to create more malicious code. [2] |
| Netwalker | 2020 | -- | Netwalker is obfuscated with several layers of encoding, obfuscation, and encryption techniques such as Base64, hexademcimal, and XOR. [3] |
| TEARDROP | 2018 | E1027.m05 | TEARDROP decrypts an embedded code buffer using an XOR-based stream cipher. [4] |
| Stuxnet | 2010 | E1027.m01 | The configuration data block is encoded with a NOT XOR 0xFF operation. [5] |
| Stuxnet | 2010 | E1027.m02 | Stuxnet encodes data using XOR. [9] |
| Ursnif | 2016 | -- | The malware creates an encrypted Registry key called TorClient to store its data. [6] |
| TrickBot | 2016 | E1027.m02 | TrickBot encodes data using XOR. [9] |
| BlackEnergy | 2007 | E1027.m05 | BlackEnergy encrypts data using RC4 via WinAPI. [9] |
| CryptoLocker | 2013 | E1027.m02 | CryptoLocker encodes data using XOR. [9] |
| Dark Comet | 2008 | E1027.m02 | Dark Comet encodes data using XOR. [9] |
| DNSChanger | 2011 | E1027.m02 | DNSChanger encodes data using XOR. [9] |
| Gamut | 2014 | E1027.m02 | Gamut encodes data using XOR. [9] |
| Hupigon | 2013 | E1027.m02 | Hupigon encodes data using XOR. [9] |
| Hupigon | 2013 | E1027.m05 | Hupigon encrypts data using DES. [9] |
| Kraken | 2008 | E1027.m02 | Kraken encodes data using XOR. [9] |
| Locky Bart | 2017 | E1027.m02 | Locky Bart encodes data using XOR. [9] |
| Mebromi | 2011 | E1027.m02 | Mebromi encodes data using XOR. [9] |
| Redhip | 2011 | E1027.m02 | Redhip encodes data using XOR. [9] |
| Rombertik | 2015 | E1027.m02 | Rombertik encodes data using XOR. [9] |
| SamSam | 2015 | E1027.m07 | SamSam obfuscates functions, class names and strings, including the list of targeted file extensions, the help file contents and environment variables using DES encryption with a fixed hard-coded key and the IV. [10] |
| Shamoon | 2012 | E1027.m02 | Shamoon encodes data using XOR. [9] |
| UP007 | 2016 | E1027.m02 | The malware encodes data using XOR. [9] |
Detection
| Tool: capa | Mapping | APIs |
|---|---|---|
| encrypt data using memfrob from glibc | Obfuscated Files or Information::Encryption (E1027.m04) | memfrob |
| encrypt data using XXTEA | Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05) | -- |
| encrypt data using HC-128 | Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05) | -- |
| encrypt data using HC-128 via WolfSSL | Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05) | -- |
| encrypt data using RC6 | Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05) | -- |
| encrypt data using twofish | Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05) | -- |
| encrypt data using AES MixColumns step | Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05) | -- |
| encrypt data using AES via WinAPI | Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05) | CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt |
| encrypt data using AES via .NET | Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05) | -- |
| manually build AES constants | Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05) | -- |
| encrypt data using Sosemanuk | Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05) | -- |
| encrypt data using XTEA | Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05) | -- |
| encrypt data using Camellia | Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05) | -- |
| encrypt data using vest | Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05) | -- |
| encrypt data using DES | Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05) | -- |
| encrypt data using DES via WinAPI | Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05) | CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt |
| encrypt data using RC4 with custom key via WinAPI | Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05) | CryptImportKey, CryptAcquireContext, CryptEncrypt |
| encrypt data using RC4 via SystemFunction033 | Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05) | SystemFunction033 |
| encrypt data using RC4 via WinAPI | Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05) | CryptGenKey, CryptDeriveKey, CryptImportKey, CryptAcquireContext, CryptEncrypt, CryptDecrypt |
| encrypt data using skipjack | Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05) | -- |
| encrypt data using blowfish | Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05) | -- |
| decrypt data using TEA | Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05) | -- |
| encrypt data using TEA | Obfuscated Files or Information::Encryption-Standard Algorithm (E1027.m05) | -- |
| encode data using XOR | Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02) | -- |
| encode data using Base64 | Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02) | System.Convert::ToBase64String, System.Convert::ToBase64CharArray, System.Convert::TryToBase64Chars |
| decode data using Base64 via dword translation table | Obfuscated Files or Information::Encoding-Standard Algorithm (E1027.m02) | -- |
| resolve function by Brute Ratel Badger hash | Obfuscated Files or Information (E1027) | -- |
| Tool: CAPE | Mapping | APIs |
|---|---|---|
| compression | Obfuscated Files or Information (E1027) | RtlDecompressBuffer |
| decryption | Obfuscated Files or Information (E1027) | CryptDecrypt |
| cmdline_obfuscation | Obfuscated Files or Information (E1027) | -- |
| dotnet_code_compile | Obfuscated Files or Information (E1027) | NtWriteFile, CreateProcessInternalA, NtCreateUserProcess, CreateProcessInternalW |
E1027.m02 Snippet
Obfuscated Files or Information::Encoding-Standard Algorithm
SHA256: 5fb7f3fac0a9b9ab243ee642a0775500c524166ef075035c9510ccbab76ad633 Location: 0x10001060mov eax, dword ptr [esi + 0x38] xor dword ptr [esi + 0xd0], eax mov eax, dword ptr [esi + 0xf0] add eax, 0xfff5b6c8 add eax, ecx mov ecx, dword ptr [esi + 0x8c] add dword ptr [esi + 0xc0], eax mov eax, dword ptr [esi + 0x54] xor dword ptr [ecx + edx*0x1], eax ; perform encryption operation add edx, 0x4 ; adjust edx to next location to encrypt mov eax, dword ptr [esi + 0x90] add dword ptr [esi + 0x54], eax mov ecx, dword ptr [esi + 0xe8] mov eax, ecx xor eax, 0xa4937 add dword ptr [esi + 0x68], eax mov eax, dword ptr [esi + 0xa4] xor eax, 0x4 sub dword ptr [esi + 0x60], eax cmp edx, 0x36c8 ; perform comparison to check if all data encrypted jl lab_10001060 ; jump to first line of sample
References
[1] https://www.welivesecurity.com/2019/07/08/south-korean-users-backdoor-torrents/
[2] https://www.bleepingcomputer.com/virus-removal/remove-kovter-trojan
[3] https://www.trendmicro.com/en_us/research/20/e/netwalker-fileless-ransomware-injected-via-reflective-loading.html
[4] https://www.cisa.gov/uscert/ncas/analysis-reports/ar21-039b
[5] https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en
[6] https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality
[7] https://www.mcafee.com/blogs/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
[8] https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf
[9] capa v4.0, analyzed at MITRE on 10/12/2022
[10] https://blog.talosintelligence.com/2018/01/samsam-evolution-continues-netting-over.html