mirror of https://github.com/MBCProject/mbc-markdown synced 2026-06-08 11:36:36 +00:00

Files

T

Desiree Beck 6ce7ebadf2 Malware types (#140 )

* Create malware-types.md

* Update README.md

added link to malware type table.

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update malware-types.md

* Update geneio.md

* Update geneio.md

* Update searchawesome.md

* Update chopstick.md

* Update cozycar.md

* Update gobotkr.md

* Update heriplor.md

* Update hupigon.md

* Update synful-knock.md

* Update mebromi.md

* Update blackenergy.md

* Update cozycar.md

* Update cozycar.md

* Update drovorub.md

* Update evilbunny.md

* Update gamut.md

* Update gobotkr.md

* Update cozycar.md

* Update kovter.md

* Update kraken.md

* Update mazarbot.md

* Update blackenergy.md

* Update matanbuchus.md

* Update yispecter.md

* Update cozycar.md

* Update up007.md

* Update teardrop.md

* Update redhip.md

* Update malware-types.md

* Update rombertik.md

* Update snake.md

* Update snake.md

* Update dark-comet.md

* Update badusb.md

* Update dyepack.md

* Update conti.md

* Update cryptolocker.md

* Update cryptowall.md

* Update locky-bart.md

* Update netwalker.md

* Update samsam.md

* Update wannacry.md

* Update adwind-jrat.md

* Update electrorat.md

* Update gravity-rat.md

* Update poison-ivy.md

* Update terminator.md

* Update clipminer.md

* Update webcobra.md

* Update drovorub.md

* Update dark-comet.md

* Update attor.md

* Update geneio.md

* Update malware-types.md

* Update trickbot.md

* Update dark-comet.md

* Update dnschanger.md

* Update emotet.md

* Update kovter.md

* Update heriplor.md

* Update trickbot.md

* Update ursnif.md

* Update mazarbot.md

* Update shamoon.md

* Update bagle.md

* Update conficker.md

* Update stuxnet.md

* Update vobfus.md

* Newsletter, editing E1510, E1560 (#137) (#138)

* Adding Newsletter

* Create 12182023.md

* Update README.md

---------



* Update e1510 (#134)

* Update clipboard-modification.md

Update to account for updates to T1115.

* Update data-encrypted-for-impact.md

fix parentheses

* Update clipboard-modification.md

* Update data-encrypted-for-impact.md

* Update clipboard-modification.md

* Moving Archive Collected Data to collection, some description updates

* Updating Last Modified

---------

Co-authored-by: Ryan Xu <ryanxu@wustl.edu>

* Newsletter, editing E1510, E1560 (#137) (#139)

* Adding Newsletter

* Create 12182023.md

* Update README.md

---------



* Update e1510 (#134)

* Update clipboard-modification.md

Update to account for updates to T1115.

* Update data-encrypted-for-impact.md

fix parentheses

* Update clipboard-modification.md

* Update data-encrypted-for-impact.md

* Update clipboard-modification.md

* Moving Archive Collected Data to collection, some description updates

* Updating Last Modified

---------

Co-authored-by: Ryan Xu <ryanxu@wustl.edu>

---------

Co-authored-by: Ryan Xu <ryanxu@wustl.edu>

2023-12-20 21:54:25 -05:00

3.0 KiB

Raw Permalink Blame History

ID	X0003
Type	Worm
Aliases	Downup, Downadup, Kido
Platforms	Windows
Year	2008
Associated ATT&CK Software	None

Conficker

A worm targeting Microsoft Windows operations systems.

Enhanced ATT&CK Techniques

Name	Use
Persistence::Registry Run Keys / Startup Folder (F0012)	To start itself at system boot, the virus saves a copy of its DLL form to a random filename in the Windows system folder, then adds registry keys to have svchost.exe invoke that DLL as an invisible network service. [1]
Persistence::Modify Existing Service (F0011)	The malware copies itself into the $systemroot%\system32 directory and registers as a service. [1]
Defense Evasion::Indicator Blocking (F0006)	The malware terminates various services related to system security and Windows and prevents network access to various websites related to antivirus software. [1]
Impact::Data Destruction (E1485)	The malware resets system restore points and deletes backup files. [1]
Anti-Static Analysis::Software Packing::UPX (F0001.008)	Conficker is propagated as a DLL which has been backed using the UPX packer. [2]

MBC Behaviors

Name	Use
Command and Control::Domain Name Generation (B0031)	Conficker uses a domain name generator seeded by the current date to ensure that every copy of the virus generates the same names on their respective days. [1]
Execution::Conditional Execution (B0025)	Conficker A variant has a routine that causes the process to suicide exit if the keyboard language layout is set to Ukranian. [1]
Memory::Overflow Buffer (C0010)	Variants A, B, C, and E exploit a vulnerability in the Server Service on Windows computers in which an already compromised computer sends a specially-crafted RPC request to force a buffer overflow and execute shellcode on the target computer. [1]
Execution::Conditional Execution::Suicide Exit (B0025.001)	Conficker B variant has significantly more suicide logic embedded in its code and employs anti-debugging features to avoid reverse engineering attempts. [2]

Indicators of Compromise

SHA256 Hashes

1192482f9f8f87a01977b4dd3e185d4b60319175b789b3e7a60ad6554c120a0d

References

[1] https://en.wikipedia.org/wiki/Conficker

[2] http://www.csl.sri.com/users/vinod/papers/Conficker/

3.0 KiB Raw Permalink Blame History