mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
Ryan Xu
275c8feec3
* New malware examples (#103) * fix typos * add new Use in Malware entries to behaviors * new corpus entries * remove extraneous ref * restore original IDs * fix typos * Update registry.md (#101) Update C0036.001 per "Registry micro-behavior" Discussion. * Update registry.md (#102) Update C0036.001 per "Registry micro-behavior" Discussion. * correct modified date * fix PR comments on formatting * Editing references (#104) --------- Co-authored-by: Desiree Beck <dbeck@mitre.org>
2.3 KiB
2.3 KiB
| ID | X0021 |
| Aliases | None |
| Platforms | Windows |
| Year | 2013 |
| Associated ATT&CK Software | None |
Terminator
Terminator is a remote access tool (RAT).
ATT&CK Techniques
| Name | Use |
|---|---|
| Defense Evasion::Virtualization/Sandbox Evasion::User Activity Based Checks (T1497) | The Terminator RAT evades sandboxes by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [2] |
Enhanced ATT&CK Techniques
| Name | Use |
|---|---|
| Defense Evasion::Self Deletion (F0007.001) | The RAT evades sandboxes by terminating and removing itself (DW20.exe) after installation. [2] |
| Persistence::Registry Run Keys / Startup Folder (F0012) | The RAT sets "2019" as a Windows' startup folder by modifying a registry value. [1] |
| Execution::User Execution (E1204) | The malware relies on user interaction to execute. [2] |
MBC Behaviors
| Name | Use |
|---|---|
| Command and Control::C2 Communication::Send Data (B0030.001) | The malware sends data to the C2. [2] |
| Anti-Behavioral Analysis::Dynamic Analysis Evasion::Delayed Execution (B0003.003) | The Terminator RAT evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [1] |
| Anti-Behavioral Analysis::Sandbox Detection (B0007) | The Terminator RAT evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [1] |
Indicators of Compromise
SHA256 Hashes
- 1f97d32674964528db46021a0466138dd01458bfa79f7450e2b222ae1de8ac1f
References
[1] https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/pf/file/fireeye-hot-knives-through-butter.pdf
[2] https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2013/FireEye-Terminator_RAT.pdf