mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
Ryan Xu
275c8feec3
* New malware examples (#103) * fix typos * add new Use in Malware entries to behaviors * new corpus entries * remove extraneous ref * restore original IDs * fix typos * Update registry.md (#101) Update C0036.001 per "Registry micro-behavior" Discussion. * Update registry.md (#102) Update C0036.001 per "Registry micro-behavior" Discussion. * correct modified date * fix PR comments on formatting * Editing references (#104) --------- Co-authored-by: Desiree Beck <dbeck@mitre.org>
1.2 KiB
1.2 KiB
| ID | B0044 |
| Objective(s) | Execution |
| Related ATT&CK Techniques | None |
| Version | 2.1 |
| Created | 20 April 2021 |
| Last Modified | 3 June 2023 |
Execution Dependency
Software may require certain run-time or library dependencies consistent with normal software development and deployment. For example, software may require the presence of a .NET or Java runtime or to be run by a webserver that supports PHP. Unlike in Conditional Execution (B0025), this dependency is not because of an explicit check coded into the malware by the author.
Use in Malware
| Name | Date | Method | Description |
|---|---|---|---|
| Adwind jRAT | 2019 | -- | Adwind jRAT uses standard Java commands to mask its behavior. [1] |
References
[1] https://www.menlosecurity.com/blog/hiding-in-plain-sight-new-adwind-jrat-variant-uses-normal-java-commands-to-mask-its-behavior/