mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00

Files

T

Desiree Beck 6ce7ebadf2 Malware types (#140 )

* Create malware-types.md

* Update README.md

added link to malware type table.

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update geneio.md

* Update geneio.md

* Update searchawesome.md

* Update chopstick.md

* Update cozycar.md

* Update gobotkr.md

* Update heriplor.md

* Update hupigon.md

* Update synful-knock.md

* Update mebromi.md

* Update blackenergy.md

* Update cozycar.md

* Update cozycar.md

* Update drovorub.md

* Update evilbunny.md

* Update gamut.md

* Update gobotkr.md

* Update cozycar.md

* Update kovter.md

* Update kraken.md

* Update mazarbot.md

* Update blackenergy.md

* Update matanbuchus.md

* Update yispecter.md

* Update cozycar.md

* Update up007.md

* Update teardrop.md

* Update redhip.md

* Update malware-types.md

* Update rombertik.md

* Update snake.md

* Update snake.md

* Update dark-comet.md

* Update badusb.md

* Update dyepack.md

* Update conti.md

* Update cryptolocker.md

* Update cryptowall.md

* Update locky-bart.md

* Update netwalker.md

* Update samsam.md

* Update wannacry.md

* Update adwind-jrat.md

* Update electrorat.md

* Update gravity-rat.md

* Update poison-ivy.md

* Update terminator.md

* Update clipminer.md

* Update webcobra.md

* Update drovorub.md

* Update dark-comet.md

* Update attor.md

* Update geneio.md

* Update malware-types.md

* Update trickbot.md

* Update dark-comet.md

* Update dnschanger.md

* Update emotet.md

* Update kovter.md

* Update heriplor.md

* Update trickbot.md

* Update ursnif.md

* Update mazarbot.md

* Update shamoon.md

* Update bagle.md

* Update conficker.md

* Update stuxnet.md

* Update vobfus.md

* Newsletter, editing E1510, E1560 (#137) (#138)

* Adding Newsletter

* Create 12182023.md

* Update README.md

---------



* Update e1510 (#134)

* Update clipboard-modification.md

Update to account for updates to T1115.

* Update data-encrypted-for-impact.md

fix parentheses

* Update clipboard-modification.md

* Update data-encrypted-for-impact.md

* Update clipboard-modification.md

* Moving Archive Collected Data to collection, some description updates

* Updating Last Modified

---------

Co-authored-by: Ryan Xu <ryanxu@wustl.edu>

* Newsletter, editing E1510, E1560 (#137) (#139)

* Adding Newsletter

* Create 12182023.md

* Update README.md

---------



* Update e1510 (#134)

* Update clipboard-modification.md

Update to account for updates to T1115.

* Update data-encrypted-for-impact.md

fix parentheses

* Update clipboard-modification.md

* Update data-encrypted-for-impact.md

* Update clipboard-modification.md

* Moving Archive Collected Data to collection, some description updates

* Updating Last Modified

---------

Co-authored-by: Ryan Xu <ryanxu@wustl.edu>

---------

Co-authored-by: Ryan Xu <ryanxu@wustl.edu>

2023-12-20 21:54:25 -05:00

6.0 KiB

Raw Permalink Blame History

ID	X0022
Type	Trojan (banking trojan)
Aliases	Dreambot, Gozi
Platforms	Windows
Year	2016
Associated ATT&CK Software	Ursnif

Ursnif

Ursnif is a variant of Gozi. It is a banking trojan that uses malware macros to evade sandbox detection.

ATT&CK Techniques

Name	Use
Discovery::System Location Discovery::System Language Discovery (T1614.001)	Ursnif gets keyboard layouts. [6]

See ATT&CK: Ursnif - Techniques Used.

Enhanced ATT&CK Techniques

Name	Use
Persistance::Registry Run Keys / Startup Folder (F0012)	The malware adds registry entries to ensure automatic execution at system startup. [4]
Defense Evasion::Hijack Execution Flow (F0015)	The malware hooks various DLL exported functions when the DLL component is loaded into their respective browser application to monitor network traffic. [4]
Discovery::System Information Discovery (E1082)	The malware uses Window's command prompt commands to gather system info, task list, installed drivers, and installed programs. [4]
Collection::Input Capture (E1056)	The malware injects HTML into a browser session to collect sensitive online banking information when the victim performs their online banking. [5]
Defense Evasion::Obfuscated Files or Information (E1027)	The malware creates an encrypted Registry key called TorClient to store its data. [2]
Impact::Exploit Kit (E1190)	Ursnif is sometimes delivered via exploit kit. [7]
Collection::Keylogging::Polling (F0002.002)	Ursnif logs keystrokes via polling. [6]

MBC Behaviors

Name	Use
Anti-Behavioral Analysis::Sandbox Detection::Self Check (B0007.007)	Ursnif uses malware macros to evade sandbox detection - checking whether the filename contains only hexadecimal characters before the extension. [1]
Execution::Conditional Execution (B0025.004)	Macros check if there are at least 50 running processes with a graphical interface, check if a list of blacklisted processes are running, and checks if the application is running in Australia and is NOT affiliated with a select group of networks (Security Research, Hospitals, Universities, Veterans, etc.). [1]
Anti-Behavioral Analysis::Virtual Machine Detection::Check Processes (B0009.004)	The malware checks if there are virtual machine processes running (Vbox, vmware, etc). [1]
Command and Control::Domain Name Generation (B0031)	Previous interations of Ursnif have used a Domain Name Generation algorithm. [2]
Command and Control::C2 Communication::Authenticate (B0030.011)	Ursnif variant Dreambot authenticates and encrypts traffic to the C2 server using TOR. [2]
Anti-Behavioral Analysis::Debugger Detection::TLS Callbacks (B0001.028)	The malware manipulates TLS Callbacks while injecting into a child process. [3]
Memory::Change Memory Protection (C0008)	The malware changes the PE header of the child process to enable write access to that page and writes 18 bytes of buffer at offset 0x40 from the start of svchost.exe in the target child process. The region protection is changed back to "read only" to avoid suspicion. [3]
Execution::Remote Commands (B0011)	The malware commands sent by a remote user can archive/upload files, capture screenshots, clear cookies, download and execute other files, list running processes, reboot the affected system, steal certificates and cookies, update/download a configuration file, and upload a log file which contains stolen information. [5]
Discovery::Code Discovery::Enumerate PE Sections (B0046.001)	Ursnif enumerates PE sections. [6]