Desiree Beck
4ff8c3a316
* Changing conti name * Mbc 3 (#125) * update version number * update links * update version number * update version number * update version number * 2.3 to main in matrix * link fix * v3 faq update --------- Co-authored-by: ryan <ryanxu@wustl.edu> --------- Co-authored-by: ryan <ryanxu@wustl.edu>
Malware Corpus
The MBC malware corpus comprises a variety of malware where each entry is decomposed into behaviors that are mapped to ATT&CK and MBC. The mappings are based on open source malware analysis reports and are separated into three categories: "ATT&CK Techniques," "Enhanced ATT&CK Techniques," and "MBC Behaviors."
ATT&CK Techniques - If a malware entry is not included in ATT&CK's software collection, then all ATT&CK techniques to which its malware behaviors map are listed. If a malware entry is included in ATT&CK's software collection, then the corresponding software page is referenced under "ATT&CK Techniques" (individual mappings not captured in ATT&CK are still listed). These techniques have T identifiers (e.g., T1012).
Enhanced ATT&CK Techniques - Any ATT&CK techniques that would be listed under "ATT&CK Techniques" but have been enhanced in MBC are listed in this section instead. These techniques have E and F identifiers (e.g., E1560, F0008).
MBC Behaviors - This section lists all MBC behaviors to which an entry's malware behaviors map. These techniques have B and C identifiers (e.g., B0032, C0010).
Please see Poison-Ivy X0014 and Kovter X0009 for examples of malware samples included and not included in ATT&CK's collection, respectively.
Also, please see the FAQ for information about malware entries that illustrate the use of MBC in Attack Flow and CACAO.
- Adwind jRAT X0048
- Attor X0049
- BadUSB X0046
- Bagle X0001
- Black Energy X0002
- Chopstick X0035
- Clipminer X0038
- Conficker X0003
- Conti X0050
- CozyCar X0034
- CryptoLocker X0030
- CryptoWall X0029
- Dark Comet X0004
- DNSChanger X0005
- Drovorub X0045
- DYEPACK X0042
- ElectroRAT X0044
- Emotet X0028
- EvilBunny X0036
- Gamut X0006
- Geneio X0007
- GoBotKR X0027
- GravityRAT X0032
- Heriplor X0026
- Hupigon X0008
- Kovter X0009
- Kraken X0010
- Locky Bart X0011
- Matanbuchus X0040
- Mazarbot X0012
- Mebromi X0013
- Netwalker X0037
- Poison-Ivy X0014
- Redhip X0015
- Rombertik X0031
- SamSam X0016
- SearchAwesome X0017
- Shamoon X0018
- Snake X0047
- Stuxnet X0019
- SYNful Knock X0020
- TEARDROP X0041
- Terminator X0021
- TrickBot X0025
- UP007 X0033
- Ursnif X0022
- Vobfus X0039
- WannaCry X0043
- WebCobra X0023
- YiSpecter X0024