mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
brightmt
6933d9e896
* Update snake.md Updated malware behaviors and descriptions. * Update snake.md Divided table to split out enhanced techniques * Update software-packing.md Added Snake * Update self-deletion.md Added Snake * Update system-information-discovery.md Added Snake * Update keylogging.md Added Snake * Update screen-capture.md * Update decode-data.md Added Snake * Update decrypt-data.md Added Snake * Update copy-file.md Added Snake * Update create-file.md Added Snake * Update delete-file.md * Update crypto-library.md Added Snake * Update crypto-library.md --------- Co-authored-by: Desiree Beck <dbeck@mitre.org>
1.8 KiB
1.8 KiB
| ID | C0059 |
| Objective(s) | Cryptography |
| Related ATT&CK Techniques | None |
| Version | 2.0 |
| Created | 17 January 2021 |
| Last Modified | 5 December 2023 |
Crypto Library
Malware uses a crypto library.
Methods
| Name | ID | Description |
|---|---|---|
| API Call | C0059.001 | Malware uses crypto API calls. |
| Static Public Library | C0059.002 | A public crypto library is embedded in the code. |
Use in Malware
| Name | Date | Method | Description |
|---|---|---|---|
| Snake | 2004 | C0059.001 | Snake uses API calls to interface with cryptographic libraries. [1] |
Detection
| Tool: capa | Mapping | APIs |
|---|---|---|
| linked against Crypto++ | Crypto Library (C0059) | -- |
| linked against wolfCrypt | Crypto Library (C0059) | -- |
| linked against OpenSSL | Crypto Library (C0059) | -- |
| linked against PolarSSL/mbed TLS | Crypto Library (C0059) | -- |
| linked against wolfSSL | Crypto Library (C0059) | -- |
References
[1] https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware