mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00

Files

T

Desiree Beck 6ce7ebadf2 Malware types (#140 )

* Create malware-types.md

* Update README.md

added link to malware type table.

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update geneio.md

* Update geneio.md

* Update searchawesome.md

* Update chopstick.md

* Update cozycar.md

* Update gobotkr.md

* Update heriplor.md

* Update hupigon.md

* Update synful-knock.md

* Update mebromi.md

* Update blackenergy.md

* Update cozycar.md

* Update cozycar.md

* Update drovorub.md

* Update evilbunny.md

* Update gamut.md

* Update gobotkr.md

* Update cozycar.md

* Update kovter.md

* Update kraken.md

* Update mazarbot.md

* Update blackenergy.md

* Update matanbuchus.md

* Update yispecter.md

* Update cozycar.md

* Update up007.md

* Update teardrop.md

* Update redhip.md

* Update malware-types.md

* Update rombertik.md

* Update snake.md

* Update snake.md

* Update dark-comet.md

* Update badusb.md

* Update dyepack.md

* Update conti.md

* Update cryptolocker.md

* Update cryptowall.md

* Update locky-bart.md

* Update netwalker.md

* Update samsam.md

* Update wannacry.md

* Update adwind-jrat.md

* Update electrorat.md

* Update gravity-rat.md

* Update poison-ivy.md

* Update terminator.md

* Update clipminer.md

* Update webcobra.md

* Update drovorub.md

* Update dark-comet.md

* Update attor.md

* Update geneio.md

* Update malware-types.md

* Update trickbot.md

* Update dark-comet.md

* Update dnschanger.md

* Update emotet.md

* Update kovter.md

* Update heriplor.md

* Update trickbot.md

* Update ursnif.md

* Update mazarbot.md

* Update shamoon.md

* Update bagle.md

* Update conficker.md

* Update stuxnet.md

* Update vobfus.md

* Newsletter, editing E1510, E1560 (#137) (#138)

* Adding Newsletter

* Create 12182023.md

* Update README.md

---------



* Update e1510 (#134)

* Update clipboard-modification.md

Update to account for updates to T1115.

* Update data-encrypted-for-impact.md

fix parentheses

* Update clipboard-modification.md

* Update data-encrypted-for-impact.md

* Update clipboard-modification.md

* Moving Archive Collected Data to collection, some description updates

* Updating Last Modified

---------

Co-authored-by: Ryan Xu <ryanxu@wustl.edu>

* Newsletter, editing E1510, E1560 (#137) (#139)

* Adding Newsletter

* Create 12182023.md

* Update README.md

---------



* Update e1510 (#134)

* Update clipboard-modification.md

Update to account for updates to T1115.

* Update data-encrypted-for-impact.md

fix parentheses

* Update clipboard-modification.md

* Update data-encrypted-for-impact.md

* Update clipboard-modification.md

* Moving Archive Collected Data to collection, some description updates

* Updating Last Modified

---------

Co-authored-by: Ryan Xu <ryanxu@wustl.edu>

---------

Co-authored-by: Ryan Xu <ryanxu@wustl.edu>

2023-12-20 21:54:25 -05:00

3.6 KiB

Raw Blame History

ID	X0039
Type	Worm
Aliases	None
Platforms	Windows
Year	2016
Associated ATT&CK Software	None

Vobfus

Vobfus is a Visual Basic worm that spreads across removable media and network shares. Vobfus can also download and execute additional binaries from other malware families.

ATT&CK Techniques

Name	Use
Lateral Movement::Lateral Tool Transfer (T1570)	Vobfus drops copies of itself to any external drives or network shares attached to the infected system. [1]

Enhanced ATT&CK Techniques

Name	Use
Command and Control::Ingress Tool Transfer (E1105)	Vobfus downloads the latest version of itself from a remote server. [1]
Persistence::Registry Run Keys/Startup Folder (F0012)	Vobfus adds registry keys to enable startup after reboot. [1]
Defense Evasion::Hidden Files and Directories::Location (F0005.002)	Vobfus is located on external drives or network shares and attaches itself to any ZIP or RAR files, removable drives, and network shares. The malware hides all folders in the external drive and drops an executable with the same name and a disguished folder icon. [1]
Execution::User Execution (E1204)	The malware relies on user interaction to run the executable. [1]
Defense Evasion::Disable or Evade Security Tools (F0004)	Vobfus uses GetModuleHandle API call to check for presence of Avast Antivirus. [1]
Persistence::Modify Existing Service (F0011)	Vobfus disables Windows AutoUpdate on the infected system. The malware patches the first byte of TerminateProcess and TerminateThread API with C3 (RET Instruction) to prevent any external processes from terminating the running instance of the malware. [1]

MBC Behaviors

Name	Use
Anti-Behavioral Analysis::Capture Evasion::Encrypted Payloads (B0036.002)	Vobfus is downloaded in encrypted form and then decrypted. [1]
Execution::Install Additional Program (B0023)	Vobfus downloads other malware family executables. [1]
Anti-Behavioral Analysis::Debugger Evasion (B0002)	Vobfus uses GetModuleHandle API to check for the presence of a debugger. [1]
Anti-Behavioral Analysis::Sandbox Detection (B0007)	Vobfus uses GetModuleHandle API to check for the presence of a sandbox. [1]
Anti-Behavioral Analysis::Virtual Machine Detection (B0009)	Vobfus checks for the presence of virtualization software, such as VMware, VirtualBox, and QEMU, by querying the system registry. [1]

Indicators of Compromise

Download locations

%USERPROFILE%muoeyus.exe
%USERPROFILE%vuvuv.exe
%USERPROFILE%3s8.exe
%TEMP%2724921.exe

Potential File Names

Passwords.exe
Porn.exe
Secret.exe
Sexy.exe
x.mpeg [0 byte File]
Autorun.inf
Muoeyus.exe

References

[1] https://securitynews.sonicwall.com/xmlpost/revisiting-vobfus-worm-mar-8-2013/

3.6 KiB Raw Blame History