mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00

Files

T

Desiree Beck 6ce7ebadf2 Malware types (#140 )

* Create malware-types.md

* Update README.md

added link to malware type table.

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update geneio.md

* Update geneio.md

* Update searchawesome.md

* Update chopstick.md

* Update cozycar.md

* Update gobotkr.md

* Update heriplor.md

* Update hupigon.md

* Update synful-knock.md

* Update mebromi.md

* Update blackenergy.md

* Update cozycar.md

* Update cozycar.md

* Update drovorub.md

* Update evilbunny.md

* Update gamut.md

* Update gobotkr.md

* Update cozycar.md

* Update kovter.md

* Update kraken.md

* Update mazarbot.md

* Update blackenergy.md

* Update matanbuchus.md

* Update yispecter.md

* Update cozycar.md

* Update up007.md

* Update teardrop.md

* Update redhip.md

* Update malware-types.md

* Update rombertik.md

* Update snake.md

* Update snake.md

* Update dark-comet.md

* Update badusb.md

* Update dyepack.md

* Update conti.md

* Update cryptolocker.md

* Update cryptowall.md

* Update locky-bart.md

* Update netwalker.md

* Update samsam.md

* Update wannacry.md

* Update adwind-jrat.md

* Update electrorat.md

* Update gravity-rat.md

* Update poison-ivy.md

* Update terminator.md

* Update clipminer.md

* Update webcobra.md

* Update drovorub.md

* Update dark-comet.md

* Update attor.md

* Update geneio.md

* Update malware-types.md

* Update trickbot.md

* Update dark-comet.md

* Update dnschanger.md

* Update emotet.md

* Update kovter.md

* Update heriplor.md

* Update trickbot.md

* Update ursnif.md

* Update mazarbot.md

* Update shamoon.md

* Update bagle.md

* Update conficker.md

* Update stuxnet.md

* Update vobfus.md

* Newsletter, editing E1510, E1560 (#137) (#138)

* Adding Newsletter

* Create 12182023.md

* Update README.md

---------



* Update e1510 (#134)

* Update clipboard-modification.md

Update to account for updates to T1115.

* Update data-encrypted-for-impact.md

fix parentheses

* Update clipboard-modification.md

* Update data-encrypted-for-impact.md

* Update clipboard-modification.md

* Moving Archive Collected Data to collection, some description updates

* Updating Last Modified

---------

Co-authored-by: Ryan Xu <ryanxu@wustl.edu>

* Newsletter, editing E1510, E1560 (#137) (#139)

* Adding Newsletter

* Create 12182023.md

* Update README.md

---------



* Update e1510 (#134)

* Update clipboard-modification.md

Update to account for updates to T1115.

* Update data-encrypted-for-impact.md

fix parentheses

* Update clipboard-modification.md

* Update data-encrypted-for-impact.md

* Update clipboard-modification.md

* Moving Archive Collected Data to collection, some description updates

* Updating Last Modified

---------

Co-authored-by: Ryan Xu <ryanxu@wustl.edu>

---------

Co-authored-by: Ryan Xu <ryanxu@wustl.edu>

2023-12-20 21:54:25 -05:00

4.1 KiB

Raw Blame History

ID	X0032
Type	Remote Access Trojan
Aliases	None
Platforms	Windows
Year	2018
Associated ATT&CK Software	GravityRAT

GravityRAT

GravityRAT evades detection by checking current CPU temperature.

ATT&CK Techniques

Name	Use
Discovery::Account Discovery (T1087)	GravityRAT gets session user name. [4]

See ATT&CK: GravityRAT - Techniques Used.

Enhanced ATT&CK Techniques

Name	Use
Defense Evasion::Hijack Execution Flow::Abuse Windows Function Calls (F0015.006)	GravityRAT abuses Microsoft's Dynamic Data Exchange (DDE) protocol. [2]
Discovery::File and Directory Discovery (E1083)	GravityRAT enumerates files on Windows. [4]

MBC Behaviors

Name	Use
Anti-Behavioral Analysis::Virtual Machine Detection (B0009)	The malware checks the system temperature by recording thermal readings for detecting VMs. Heat levels indicate whether the system is a VM. [1]
Anti-Behavioral Analysis::Virtual Machine Detection::Unique Hardware/Firmware Check - BIOS (B0009.024)	The malware creates a WMI request to identify the BIOS version. [1]
Cryptography::Encrypt Data::AES (C0027.001)	GravityRAT v3 supports AES file encryption. [2]
Anti-Behavioral Analysis::Virtual Machine Detection::Unique Hardware/Firmware Check (B0009.023)	The malware checks if the manufacturer field in the Win32_Computer entry (in WMI) contains "Virtual", "Vmware", or "Virtualbox." [2]
Anti-Behavioral Analysis::Virtual Machine Detection::Modern Specs Check - Processor count (B0009.018)	GravityRAT determines the machine to be a VM if the core count is 1. [2]
Anti-Behavioral Analysis::Virtual Machine Detection::Unique Hardware/Firmware Check - MAC Address (B0009.028)	GravityRAT checks if the MAC address starts with a well-known hexadecimal number used by various VM developer. [2]
Command And Control::C2 Communication::Receive Data (B0030.002)	GravityRAT receives data. [4]
File System::Create Directory (C0046)	GravityRAT creates directories. [4]
File System::Delete File (C0047)	GravityRAT deletes files. [4]
File System::Read File (C0051)	GravityRAT reads files on Windows. [4]
File System::Write File (C0052)	GravityRAT writes files on Windows. [4]
Process::Suspend Thread (C0055)	GravityRAT suspends threads. [4]
Process::Terminate Process (C0018)	GravityRAT terminates processes. [4]

Indicators of Compromise

SHA256 Hashes

c39270febb9097def21777c994d10738ba2a915c88f516fb1e896e5d7240cc0d
71264d9c67800d3bedc6facb6915e855f7531c12445af58f47167e81c735c892
99dd67915566c0951b78d323bb066eb5b130cc7ebd6355ec0338469876503f90

References

[1] https://www.hackread.com/gravityrat-malware-evades-detection-targets-india/

[2] https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html

[3] https://securelist.com/gravityrat-the-spy-returns/99097/

[4] capa v4.0, analyzed at MITRE on 10/12/2022

4.1 KiB Raw Blame History