mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00

Files

T

Desiree Beck 6ce7ebadf2 Malware types (#140 )

* Create malware-types.md

* Update README.md

added link to malware type table.

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update geneio.md

* Update geneio.md

* Update searchawesome.md

* Update chopstick.md

* Update cozycar.md

* Update gobotkr.md

* Update heriplor.md

* Update hupigon.md

* Update synful-knock.md

* Update mebromi.md

* Update blackenergy.md

* Update cozycar.md

* Update cozycar.md

* Update drovorub.md

* Update evilbunny.md

* Update gamut.md

* Update gobotkr.md

* Update cozycar.md

* Update kovter.md

* Update kraken.md

* Update mazarbot.md

* Update blackenergy.md

* Update matanbuchus.md

* Update yispecter.md

* Update cozycar.md

* Update up007.md

* Update teardrop.md

* Update redhip.md

* Update malware-types.md

* Update rombertik.md

* Update snake.md

* Update snake.md

* Update dark-comet.md

* Update badusb.md

* Update dyepack.md

* Update conti.md

* Update cryptolocker.md

* Update cryptowall.md

* Update locky-bart.md

* Update netwalker.md

* Update samsam.md

* Update wannacry.md

* Update adwind-jrat.md

* Update electrorat.md

* Update gravity-rat.md

* Update poison-ivy.md

* Update terminator.md

* Update clipminer.md

* Update webcobra.md

* Update drovorub.md

* Update dark-comet.md

* Update attor.md

* Update geneio.md

* Update malware-types.md

* Update trickbot.md

* Update dark-comet.md

* Update dnschanger.md

* Update emotet.md

* Update kovter.md

* Update heriplor.md

* Update trickbot.md

* Update ursnif.md

* Update mazarbot.md

* Update shamoon.md

* Update bagle.md

* Update conficker.md

* Update stuxnet.md

* Update vobfus.md

* Newsletter, editing E1510, E1560 (#137) (#138)

* Adding Newsletter

* Create 12182023.md

* Update README.md

---------



* Update e1510 (#134)

* Update clipboard-modification.md

Update to account for updates to T1115.

* Update data-encrypted-for-impact.md

fix parentheses

* Update clipboard-modification.md

* Update data-encrypted-for-impact.md

* Update clipboard-modification.md

* Moving Archive Collected Data to collection, some description updates

* Updating Last Modified

---------

Co-authored-by: Ryan Xu <ryanxu@wustl.edu>

* Newsletter, editing E1510, E1560 (#137) (#139)

* Adding Newsletter

* Create 12182023.md

* Update README.md

---------



* Update e1510 (#134)

* Update clipboard-modification.md

Update to account for updates to T1115.

* Update data-encrypted-for-impact.md

fix parentheses

* Update clipboard-modification.md

* Update data-encrypted-for-impact.md

* Update clipboard-modification.md

* Moving Archive Collected Data to collection, some description updates

* Updating Last Modified

---------

Co-authored-by: Ryan Xu <ryanxu@wustl.edu>

---------

Co-authored-by: Ryan Xu <ryanxu@wustl.edu>

2023-12-20 21:54:25 -05:00

2.0 KiB

Raw Permalink Blame History

ID	X0007
Type	Adware, Spyware
Aliases	None
Platforms	OS X
Year	2015
Associated ATT&CK Software	None

Geneio

Geneio is a byproduct of the DYLD_PRINT_TIFILE vulnerability. Geneio can gain access to the MAC Keychain and persist until removed by the user. When the program is executed, it creates the following files:

/Application/Genieo.app
/Applications/Uninstall Genieo.app
~/Library/Application Support/com.genieoinnovation.Installer/Completer.app
~/Library/LaunchAgents/com.genieo.completer.download.plist
~/Library/LaunchAgents/com.genieo.completer.update.plist
~/Library/Safari/Extensions/Omnibar.safariextz
~/Library/Application Support/Genieo/
/tmp/GenieoInstall.dmg
/tmp/tmpinstallmc.dmg

Next, the program changes the default search engine and homepage to the domain search.genieo.com.

The program then installs the browser extension ~/Library/Safari/Extensions/Omnibar.safariextz.

When the user inputs a search query, it will appear to be carried out using Google Search, but the results will be from genieo.com.

ATT&CK Techniques

Name	Use
Persistence::Browser Extensions (T1176)	Geneio installs Safari Extensions that are adware. [1]

MBC Behaviors

Name	Use
Execution::Install Additional Program (B0023)	Malware tricks OS X keychain to create application files. Geneio installs the browser extension ~/Library/Safari/Extensions/Omnibar.safariextz. It also creates the app files listed in the description above. [1]

Indicators of Compromise

SHA256 Hashes

56b1d33fde65ab520a6c8afe9b3f304c50b581d3e46a9baa56fb9694d4d7effc

References

[1] https://blog.malwarebytes.org/mac/2015/08/genieo-installer-tricks-keychain/

2.0 KiB Raw Permalink Blame History