brightmt
6933d9e896
* Update snake.md Updated malware behaviors and descriptions. * Update snake.md Divided table to split out enhanced techniques * Update software-packing.md Added Snake * Update self-deletion.md Added Snake * Update system-information-discovery.md Added Snake * Update keylogging.md Added Snake * Update screen-capture.md * Update decode-data.md Added Snake * Update decrypt-data.md Added Snake * Update copy-file.md Added Snake * Update create-file.md Added Snake * Update delete-file.md * Update crypto-library.md Added Snake * Update crypto-library.md --------- Co-authored-by: Desiree Beck <dbeck@mitre.org>
Malware Corpus
The MBC malware corpus comprises a variety of malware where each entry is decomposed into behaviors that are mapped to ATT&CK and MBC. The mappings are based on open source malware analysis reports and are separated into three categories: "ATT&CK Techniques," "Enhanced ATT&CK Techniques," and "MBC Behaviors."
ATT&CK Techniques - If a malware entry is not included in ATT&CK's software collection, then all ATT&CK techniques to which its malware behaviors map are listed. If a malware entry is included in ATT&CK's software collection, then the corresponding software page is referenced under "ATT&CK Techniques" (individual mappings not captured in ATT&CK are still listed). These techniques have T identifiers (e.g., T1012).
Enhanced ATT&CK Techniques - Any ATT&CK techniques that would be listed under "ATT&CK Techniques" but have been enhanced in MBC are listed in this section instead. These techniques have E and F identifiers (e.g., E1560, F0008).
MBC Behaviors - This section lists all MBC behaviors to which an entry's malware behaviors map. These techniques have B and C identifiers (e.g., B0032, C0010).
Notes
-
Each entry is mapped to one or more malware types.
-
Poison-Ivy X0014 and Kovter X0009 are examples of malware samples included and not included in ATT&CK's collection, respectively.
-
The FAQ includes information about the malware used to illustrate the use of MBC in Attack Flow and CACAO.
The List
- Adwind jRAT X0048
- Attor X0049
- BadUSB X0046
- Bagle X0001
- Black Energy X0002
- Chopstick X0035
- Clipminer X0038
- Conficker X0003
- Conti X0050
- CozyCar X0034
- CryptoLocker X0030
- CryptoWall X0029
- Dark Comet X0004
- DNSChanger X0005
- Drovorub X0045
- DYEPACK X0042
- ElectroRAT X0044
- Emotet X0028
- EvilBunny X0036
- Gamut X0006
- Geneio X0007
- GoBotKR X0027
- GravityRAT X0032
- Heriplor X0026
- Hupigon X0008
- Kovter X0009
- Kraken X0010
- Locky Bart X0011
- Matanbuchus X0040
- Mazarbot X0012
- Mebromi X0013
- Netwalker X0037
- Poison-Ivy X0014
- Redhip X0015
- Rombertik X0031
- SamSam X0016
- SearchAwesome X0017
- Shamoon X0018
- Snake X0047
- Stuxnet X0019
- SYNful Knock X0020
- TEARDROP X0041
- Terminator X0021
- TrickBot X0025
- UP007 X0033
- Ursnif X0022
- Vobfus X0039
- WannaCry X0043
- WebCobra X0023
- YiSpecter X0024