mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00

Files

T

Desiree Beck 6ce7ebadf2 Malware types (#140 )

* Create malware-types.md

* Update README.md

added link to malware type table.

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update geneio.md

* Update geneio.md

* Update searchawesome.md

* Update chopstick.md

* Update cozycar.md

* Update gobotkr.md

* Update heriplor.md

* Update hupigon.md

* Update synful-knock.md

* Update mebromi.md

* Update blackenergy.md

* Update cozycar.md

* Update cozycar.md

* Update drovorub.md

* Update evilbunny.md

* Update gamut.md

* Update gobotkr.md

* Update cozycar.md

* Update kovter.md

* Update kraken.md

* Update mazarbot.md

* Update blackenergy.md

* Update matanbuchus.md

* Update yispecter.md

* Update cozycar.md

* Update up007.md

* Update teardrop.md

* Update redhip.md

* Update malware-types.md

* Update rombertik.md

* Update snake.md

* Update snake.md

* Update dark-comet.md

* Update badusb.md

* Update dyepack.md

* Update conti.md

* Update cryptolocker.md

* Update cryptowall.md

* Update locky-bart.md

* Update netwalker.md

* Update samsam.md

* Update wannacry.md

* Update adwind-jrat.md

* Update electrorat.md

* Update gravity-rat.md

* Update poison-ivy.md

* Update terminator.md

* Update clipminer.md

* Update webcobra.md

* Update drovorub.md

* Update dark-comet.md

* Update attor.md

* Update geneio.md

* Update malware-types.md

* Update trickbot.md

* Update dark-comet.md

* Update dnschanger.md

* Update emotet.md

* Update kovter.md

* Update heriplor.md

* Update trickbot.md

* Update ursnif.md

* Update mazarbot.md

* Update shamoon.md

* Update bagle.md

* Update conficker.md

* Update stuxnet.md

* Update vobfus.md

* Newsletter, editing E1510, E1560 (#137) (#138)

* Adding Newsletter

* Create 12182023.md

* Update README.md

---------



* Update e1510 (#134)

* Update clipboard-modification.md

Update to account for updates to T1115.

* Update data-encrypted-for-impact.md

fix parentheses

* Update clipboard-modification.md

* Update data-encrypted-for-impact.md

* Update clipboard-modification.md

* Moving Archive Collected Data to collection, some description updates

* Updating Last Modified

---------

Co-authored-by: Ryan Xu <ryanxu@wustl.edu>

* Newsletter, editing E1510, E1560 (#137) (#139)

* Adding Newsletter

* Create 12182023.md

* Update README.md

---------



* Update e1510 (#134)

* Update clipboard-modification.md

Update to account for updates to T1115.

* Update data-encrypted-for-impact.md

fix parentheses

* Update clipboard-modification.md

* Update data-encrypted-for-impact.md

* Update clipboard-modification.md

* Moving Archive Collected Data to collection, some description updates

* Updating Last Modified

---------

Co-authored-by: Ryan Xu <ryanxu@wustl.edu>

---------

Co-authored-by: Ryan Xu <ryanxu@wustl.edu>

2023-12-20 21:54:25 -05:00

4.0 KiB

Raw Permalink Blame History

ID	X0024
Type	Downloader
Aliases	None
Platforms	iOS
Year	2015
Associated ATT&CK Software	YiSpecter

YiSpecter

YiSpecter is an Apple iOS malware that can download, install and launch arbitrary iOS apps, replace existing apps with the downloads, hijack other apps’ execution to display advertisements, change Safari’s default search engine, bookmark and open pages, and upload device information to a C2 server. It uses tricks to hide its icons from iOS’s SpringBoard, which prevents the user from finding and deleting it. The components also use the same name and logos of system apps to trick iOS power users. [1]

ATT&CK Techniques

See ATT&CK: YiSpecter - Techniques Used.

Enhanced ATT&CK Techniques

Name	Use
Defense Evasion::Hide Artifacts (E1564)	The malware hides icons from iOS's SpringBoard and use the same name and logos of system apps to trick iOS power users. [1]
Persistence::Modify Existing Service (F0011)	The malware hijacks other installed applications' launch routines to use "ADPage" (an installed malicious app) to display advertisements. [1]
Lateral Movement::Supply Chain Compromise::Exploit Private APIs (E1195.m02)	Within the malware, the private API allows installation of malicious apps and uninstallation of legitimate apps without user notification. [1]
Lateral Movement::Supply Chain Compromise::Abuse Enterprise Certificates (E1195.m01)	YiSpecter's malicious apps were signed with three iOS enterprise certificates issued by Apple so they can be installed as enterprise apps on non-jailbroken iOS devices via in-house distribution. [1]
Impact::Generate Traffic from Victim::Advertisement Replacement Fraud (E1643.m02)	The malware displays brief advertisements whenever the user opens applications on their phone. [1]

MBC Behaviors

Name	Use
Execution::Install Additional Program (B0023)	The malware can download and install arbitrary iOS apps. [1]
Command and Control::C2 Communication::Send System Information (B0030.006)	The malware connects to the C2 server using HTTP to send device information. [1]
Defense Evasion::Install Insecure or Malicious Configuration (B0047)	The malware changes iOS Safari's default configuration. [1]

Indicators of Compromise

SHA256 Hashes

57cc101ee4a9f306236d1d4fb5ccb3bb96fa76210142a5ec483a49321d2bd603
4938b9861b7c55fbbe47d2ba04e9aff2da186e282f1e9ff0a15bbb22a5f6e0e7
fc55c5ced1027b48885780c87980a286181d3639dfc97d03ebe04ec012a1b677
5259854994945a165996d994e6484c1afc1c7e628cb5df2dc3750f4f9f92202e
7714dbb85c5ebcd85cd1d93299479cff2cc82ad0ed11803c24c44106530d2e2f
ddd16577b458a5ec21ea0f57084033435a46f61dc5482f224c1fe54f47d295bc
8fa135fc74583e05be208752e8ce191060b1617447815a007efac78662b425d0

C2 Server:

bb800.com
iosnoico.bb800[.]com: used to upload informati on, download confi gs and commands, downloadmalicious components
qvod.bb800[.]com: used to download main app
qvios.od.bb800[.]com: used to download main app
dp.bb800[.]com: used to download promoted iOS apps
iosads.cdn.bb800[.]com: used to download promoted iOS apps and malicious components

References

[1] https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/

4.0 KiB Raw Permalink Blame History Unescape Escape