mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00

Files

T

Desiree Beck 6ce7ebadf2 Malware types (#140 )

* Create malware-types.md

* Update README.md

added link to malware type table.

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update geneio.md

* Update geneio.md

* Update searchawesome.md

* Update chopstick.md

* Update cozycar.md

* Update gobotkr.md

* Update heriplor.md

* Update hupigon.md

* Update synful-knock.md

* Update mebromi.md

* Update blackenergy.md

* Update cozycar.md

* Update cozycar.md

* Update drovorub.md

* Update evilbunny.md

* Update gamut.md

* Update gobotkr.md

* Update cozycar.md

* Update kovter.md

* Update kraken.md

* Update mazarbot.md

* Update blackenergy.md

* Update matanbuchus.md

* Update yispecter.md

* Update cozycar.md

* Update up007.md

* Update teardrop.md

* Update redhip.md

* Update malware-types.md

* Update rombertik.md

* Update snake.md

* Update snake.md

* Update dark-comet.md

* Update badusb.md

* Update dyepack.md

* Update conti.md

* Update cryptolocker.md

* Update cryptowall.md

* Update locky-bart.md

* Update netwalker.md

* Update samsam.md

* Update wannacry.md

* Update adwind-jrat.md

* Update electrorat.md

* Update gravity-rat.md

* Update poison-ivy.md

* Update terminator.md

* Update clipminer.md

* Update webcobra.md

* Update drovorub.md

* Update dark-comet.md

* Update attor.md

* Update geneio.md

* Update malware-types.md

* Update trickbot.md

* Update dark-comet.md

* Update dnschanger.md

* Update emotet.md

* Update kovter.md

* Update heriplor.md

* Update trickbot.md

* Update ursnif.md

* Update mazarbot.md

* Update shamoon.md

* Update bagle.md

* Update conficker.md

* Update stuxnet.md

* Update vobfus.md

* Newsletter, editing E1510, E1560 (#137) (#138)

* Adding Newsletter

* Create 12182023.md

* Update README.md

---------



* Update e1510 (#134)

* Update clipboard-modification.md

Update to account for updates to T1115.

* Update data-encrypted-for-impact.md

fix parentheses

* Update clipboard-modification.md

* Update data-encrypted-for-impact.md

* Update clipboard-modification.md

* Moving Archive Collected Data to collection, some description updates

* Updating Last Modified

---------

Co-authored-by: Ryan Xu <ryanxu@wustl.edu>

* Newsletter, editing E1510, E1560 (#137) (#139)

* Adding Newsletter

* Create 12182023.md

* Update README.md

---------



* Update e1510 (#134)

* Update clipboard-modification.md

Update to account for updates to T1115.

* Update data-encrypted-for-impact.md

fix parentheses

* Update clipboard-modification.md

* Update data-encrypted-for-impact.md

* Update clipboard-modification.md

* Moving Archive Collected Data to collection, some description updates

* Updating Last Modified

---------

Co-authored-by: Ryan Xu <ryanxu@wustl.edu>

---------

Co-authored-by: Ryan Xu <ryanxu@wustl.edu>

2023-12-20 21:54:25 -05:00

3.1 KiB

Raw Permalink Blame History

ID	X0044
Type	Remote Access Trojan
Aliases	None
Platforms	Windows, Linux, macOS
Year	2020
Associated ATT&CK Software	None

ElectroRAT

ElectroRAT is used to steal cryptocurrency from wallets.

ATT&CK Techniques

Name	Use
Execution::User Execution (T1204)	ElectroRat makes the user execute the malware. [1]
Command and Control::Web Service (T1102)	EletroRat uses HTTP for C&C and exfiltration. [1]
Execution::Command and Scripting Interpreter (T1059)	ElectroRat uses Python to embed additional binares. [1]
Discovery::System Information Discovery (T1082)	ElectroRat detects the OS to determine which plugins to download. [1]
Persistence::Boot or Logon Autostart Execution (T1547)	ElectroRat enables auto start on bootup. [1]

Enhanced ATT&CK Techniques

Name	Use
Collection::Input Capture (E1056)	ElectroRat monitors keyboard and mouse activity to determine whether the machine is in use. [1]
Discovery::File and Directory Discovery (E1083)	ElectroRat looks for wallets to steal cryptocurrency [1]

MBC Behaviors

Name	Use
Execution::Install Additional Program (B0023)	Upon execution, ElectroRat downloads additional executables. [1]
Collection::Cryptocurrency (B0028)	ElectroRat examines the disk for cryptocurrency addresses and keys to steal money from a wallet. It compromises multiple currencies, including Monaro, Doegecoin, Ethereum, Litecoin, and Bitcoin. [1]
Command and Control::C2 Communication (B0030)	ElectroRat communicates to a Pastebin site via HTTP. [1]

Indicators of Compromise

Command-and-Control Servers

193.38.55.131
193.38.55.4
213.226.100.140
kintum.io
daopoker.com
jamm.to
pastebin.com/raw/r12wBrC7
pastebin.com/raw/DF8Gikrk
pastebin.com/raw/bfQiiqyv
pastebin.com/raw/UbTZx6kd
pastebin.com/raw/U45SvK4K
pastebin.com/raw/zrZA4L3e

SHA256 Hashes

170cb5ea1a6b4af3c27358ba267a1309ed5118481619fc874f717262cb91fb77
881be95a9632fa44deeeca23e4e19390d600ad817b2f66671d3f21453a16c7b7
e9b83d5cdefd4486b32a927d7505cdeebb43e6977759ba069d9373e46ca7d0f2
e547872761d81c3afc9c2a42cac3931e2a1defc2c56a0a3c57b28ea91e7686cd
17b0b1a9271683f30e5bfd92eec9c0a917755f54060ef40d9bd0f12e927f540f
5c884be3635eb55ce02e141d6fb07f760b6dbcace54f2217c69f287292ce59f6

References

[1] https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/

3.1 KiB Raw Permalink Blame History