mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
Desiree Beck
6ce7ebadf2
* Create malware-types.md * Update README.md added link to malware type table. * Update malware-types.md * Update malware-types.md * Update malware-types.md * Update malware-types.md * Update malware-types.md * Update malware-types.md * Update geneio.md * Update geneio.md * Update searchawesome.md * Update chopstick.md * Update cozycar.md * Update gobotkr.md * Update heriplor.md * Update hupigon.md * Update synful-knock.md * Update mebromi.md * Update blackenergy.md * Update cozycar.md * Update cozycar.md * Update drovorub.md * Update evilbunny.md * Update gamut.md * Update gobotkr.md * Update cozycar.md * Update kovter.md * Update kraken.md * Update mazarbot.md * Update blackenergy.md * Update matanbuchus.md * Update yispecter.md * Update cozycar.md * Update up007.md * Update teardrop.md * Update redhip.md * Update malware-types.md * Update rombertik.md * Update snake.md * Update snake.md * Update dark-comet.md * Update badusb.md * Update dyepack.md * Update conti.md * Update cryptolocker.md * Update cryptowall.md * Update locky-bart.md * Update netwalker.md * Update samsam.md * Update wannacry.md * Update adwind-jrat.md * Update electrorat.md * Update gravity-rat.md * Update poison-ivy.md * Update terminator.md * Update clipminer.md * Update webcobra.md * Update drovorub.md * Update dark-comet.md * Update attor.md * Update geneio.md * Update malware-types.md * Update trickbot.md * Update dark-comet.md * Update dnschanger.md * Update emotet.md * Update kovter.md * Update heriplor.md * Update trickbot.md * Update ursnif.md * Update mazarbot.md * Update shamoon.md * Update bagle.md * Update conficker.md * Update stuxnet.md * Update vobfus.md * Newsletter, editing E1510, E1560 (#137) (#138) * Adding Newsletter * Create 12182023.md * Update README.md --------- * Update e1510 (#134) * Update clipboard-modification.md Update to account for updates to T1115. * Update data-encrypted-for-impact.md fix parentheses * Update clipboard-modification.md * Update data-encrypted-for-impact.md * Update clipboard-modification.md * Moving Archive Collected Data to collection, some description updates * Updating Last Modified --------- Co-authored-by: Ryan Xu <ryanxu@wustl.edu> * Newsletter, editing E1510, E1560 (#137) (#139) * Adding Newsletter * Create 12182023.md * Update README.md --------- * Update e1510 (#134) * Update clipboard-modification.md Update to account for updates to T1115. * Update data-encrypted-for-impact.md fix parentheses * Update clipboard-modification.md * Update data-encrypted-for-impact.md * Update clipboard-modification.md * Moving Archive Collected Data to collection, some description updates * Updating Last Modified --------- Co-authored-by: Ryan Xu <ryanxu@wustl.edu> --------- Co-authored-by: Ryan Xu <ryanxu@wustl.edu>
55 lines
1.7 KiB
Markdown
55 lines
1.7 KiB
Markdown
|
|
<table>
|
|
<tr>
|
|
<td><b>ID</b></td>
|
|
<td><b>X0037</b></td>
|
|
</tr>
|
|
<tr>
|
|
<td><b>Type</b></td>
|
|
<td><b>Ransomware</b></td>
|
|
</tr>
|
|
<tr>
|
|
<td><b>Aliases</b></td>
|
|
<td><b>None</b></td>
|
|
</tr>
|
|
<tr>
|
|
<td><b>Platforms</b></td>
|
|
<td><b>Windows</b></td>
|
|
</tr>
|
|
<tr>
|
|
<td><b>Year</b></td>
|
|
<td><b>2020</b></td>
|
|
</tr>
|
|
<tr>
|
|
<td><b>Associated ATT&CK Software</b></td>
|
|
<td><b><a href="https://attack.mitre.org/software/S0457/">Netwalker</a></b></td>
|
|
</tr>
|
|
</table>
|
|
|
|
|
|
# Netwalker
|
|
|
|
Fileless ransomware written in PowerShell and executed directly in memory.
|
|
|
|
## ATT&CK Techniques
|
|
|
|
See ATT&CK: [Netwalker - Techniques Used](https://attack.mitre.org/software/S0457/).
|
|
|
|
## Enhanced ATT&CK Techniques
|
|
|
|
|Name|Use|
|
|
|---|---|
|
|
|[Execution::Command and Scripting Interpreter (E1059)](../execution/command-and-scripting-interpreter.md)|Netwalker is written and executed in Powershell. [[1]](#1)|
|
|
|[Defense Evasion::Obfuscated Files or Information (E1027)](../defense-evasion/obfuscated-files-or-information.md)|Netwalker is obfuscated with several layers of encoding, obfuscation, and encryption techniques such as Base64, hexademcimal, and XOR. [[1]](#1)|
|
|
|[Defense Evasion::Process Injection::Dynamic-link Library Injection (E1055.001)](../defense-evasion/process-injection.md)|Netwalker uses reflective DLL loading to inject from memory. [[1]](#1)|
|
|
|[Impact::Data Encrypted for Impact (E1486)](../impact/data-encrypted-for-impact.md)|Netwalker encrypts files for ransom. [[1]](#1)|
|
|
|
|
## Indicators of Compromise
|
|
|
|
SHA256 Hashes
|
|
- f4656a9af30e98ed2103194f798fa00fd1686618e3e62fba6b15c9959135b7be
|
|
|
|
## References
|
|
|
|
<a name="1">[1]</a> https://www.trendmicro.com/en_us/research/20/e/netwalker-fileless-ransomware-injected-via-reflective-loading.html
|