MISP
/
misp-galaxy
mirror of https://github.com/MISP/misp-galaxy
2
0
Fork 0
Code Issues Releases Wiki Activity
misp-galaxy/clusters/mitre-mobile-attack-malware...

968 lines
35 KiB
JSON
Raw Blame History

This file contains ambiguous Unicode characters!

This file contains ambiguous Unicode characters that may be confused with others in your current locale. If your use case is intentional and legitimate, you can safely ignore this warning. Use the Escape button to highlight these characters.

{
"authors": [
"MITRE"
],
"category": "tool",
"description": "Name of ATT&CK software",
"name": "Mobile Attack - Malware",
"source": "https://github.com/mitre/cti",
"type": "mitre-mobile-attack-malware",
"uuid": "04a165aa-1708-11e8-b2da-c7d7625f4a4f",
"values": [
{
"description": "AndroRAT \"allows a third party to control the device and collect information such as contacts, call logs, text messages, device location, and audio from the microphone. It is now used maliciously by other actors.\" (Citation: Lookout-EnterpriseApps)\n\nAliases: AndroRAT",
"meta": {
"external_id": "MOB-S0008",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0008",
"https://blog.lookout.com/blog/2016/05/25/spoofed-apps/"
],
"synonyms": [
"AndroRAT"
]
},
"related": [
{
"dest-uuid": "80447111-8085-40a4-a052-420926091ac6",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "e8b4e1ec-8e3b-484c-9038-4459b1ed8060",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "a3dad2be-ce62-4440-953b-00fbce7aba93",
"value": "AndroRAT - MOB-S0008"
},
{
"description": "Android malware described by Kaspersky (Citation: Kaspersky-MobileMalware).\n\nAliases: Trojan-SMS.AndroidOS.Agent.ao",
"meta": {
"external_id": "MOB-S0023",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0023",
"https://securelist.com/analysis/kaspersky-security-bulletin/58335/mobile-malware-evolution-2013/"
],
"synonyms": [
"Trojan-SMS.AndroidOS.Agent.ao"
]
},
"related": [
{
"dest-uuid": "6a3f6490-9c44-40de-b059-e5940f246673",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "a1867c56-8c86-455a-96ad-b0d5f7e2bc17",
"value": "Trojan-SMS.AndroidOS.Agent.ao - MOB-S0023"
},
{
"description": "DualToy is Windows malware that installs malicious applications onto Android and iOS devices connected over USB (Citation: PaloAlto-DualToy).\n\nAliases: DualToy",
"meta": {
"external_id": "MOB-S0031",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0031"
],
"synonyms": [
"DualToy"
]
},
"related": [
{
"dest-uuid": "8269e779-db23-4c94-aafb-36ee94879417",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "667e5707-3843-4da8-bd34-88b922526f0d",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "507fe748-5e4a-4b45-9e9f-8b1115f4e878",
"value": "DualToy - MOB-S0031"
},
{
"description": "On jailbroken iOS devices, (Citation: KeyRaider) steals Apple account credentials and other data. It \"also has built-in functionality to hold iOS devices for ransom.\" (Citation: KeyRaider)\n\nAliases: (Citation: KeyRaider)",
"meta": {
"external_id": "MOB-S0004",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0004",
"http://researchcenter.paloaltonetworks.com/2015/08/keyraider-ios-malware-steals-over-225000-apple-accounts-to-create-free-app-utopia/"
],
"synonyms": [
"KeyRaider"
]
},
"related": [
{
"dest-uuid": "3b0b604f-10db-41a0-b54c-493124d455b9",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "3bc1f0ad-ef11-4afc-83c0-fcffe08d4e50",
"value": "KeyRaider - MOB-S0004"
},
{
"description": "Brain Test is a family of Android malware described by CheckPoint (Citation: CheckPoint-BrainTest) and Lookout (Citation: Lookout-BrainTest).\n\nAliases: BrainTest",
"meta": {
"external_id": "MOB-S0009",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0009",
"http://blog.checkpoint.com/2015/09/21/braintest-a-new-level-of-sophistication-in-mobile-malware/",
"https://blog.lookout.com/blog/2016/01/06/brain-test-re-emerges/"
],
"synonyms": [
"BrainTest"
]
},
"related": [
{
"dest-uuid": "6c49d50f-494d-4150-b774-a655022d20a6",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "e13d084c-382f-40fd-aa9a-98d69e20301e",
"value": "BrainTest - MOB-S0009"
},
{
"description": "Lookout states that some variants of the Shedun, Shuanet, and ShiftyBug/Kemoge Android malware families \"have 71 percent to 82 percent code similarity\" (Citation: Lookout-Adware), even though they \"don’t believe these apps were all created by the same author or group\".\n\nAliases: Shedun, Shuanet, ShiftyBug, Kemoge",
"meta": {
"external_id": "MOB-S0010",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0010",
"https://blog.lookout.com/blog/2015/11/04/trojanized-adware/"
],
"synonyms": [
"Shedun",
"Shuanet",
"ShiftyBug",
"Kemoge"
]
},
"related": [
{
"dest-uuid": "0c769e82-df28-4f65-97f5-7f3d88488f2e",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "a93ccb8f-3996-42e2-b7c7-bb599d4e205f",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "c80a6bef-b3ce-44d0-b113-946e93124898",
"value": "Shedun - MOB-S0010"
},
{
"description": "Android malware family analyzed by Trend Micro (Citation: TrendMicro-DressCode)\n\nAliases: DressCode",
"meta": {
"external_id": "MOB-S0016",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0016",
"http://blog.trendmicro.com/trendlabs-security-intelligence/dresscode-potential-impact-enterprises/"
],
"synonyms": [
"DressCode"
]
},
"related": [
{
"dest-uuid": "22379609-a99f-4a01-bd7e-70f3e105859d",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "ff742eeb-1f90-4f5a-8b92-9d40fffd99ca",
"value": "DressCode - MOB-S0016"
},
{
"description": "Adups, software pre-installed onto Android devices including those made by BLU Products, reportedly transmitted sensitive data to a Chinese server. The capability was reportedly designed \"to help a Chinese phone manufacturer monitor user behavior\" and \"was not intended for American phones\". (Citation: NYTimes-BackDoor) (Citation: BankInfoSecurity-BackDoor).\n\nAliases: Adups",
"meta": {
"external_id": "MOB-S0025",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0025",
"https://www.nytimes.com/2016/11/16/us/politics/china-phones-software-security.html",
"http://www.bankinfosecurity.com/did-chinese-spyware-linger-in-us-phones-a-9534"
],
"synonyms": [
"Adups"
]
},
"related": [
{
"dest-uuid": "99e6295e-741b-4857-b6e5-64989eb039b4",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "f6ac21b6-2592-400c-8472-10d0e2f1bfaf",
"value": "Adups - MOB-S0025"
},
{
"description": "Discovered by Lookout (Citation: Lookout-Pegasus) and Citizen Lab (Citation: PegasusCitizenLab), Pegasus escalates privileges on iOS devices and uses its privileged access to collect a variety of sensitive information.\n\nAliases: Pegasus",
"meta": {
"external_id": "MOB-S0005",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0005",
"https://info.lookout.com/rs/051-ESQ-475/images/lookout-pegasus-technical-analysis.pdf",
"https://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/"
],
"synonyms": [
"Pegasus"
]
},
"related": [
{
"dest-uuid": "9d7c772b-43f1-49cf-bc70-7a7cd2ed34c8",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "52acea22-7d88-433c-99e6-8fef1657e3ad",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "e8b4e1ec-8e3b-484c-9038-4459b1ed8060",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "33d9d91d-aad9-49d5-a516-220ce101ac8a",
"value": "Pegasus - MOB-S0005"
},
{
"description": "RuMMS is a family of Android malware (Citation: FireEye-RuMMS).\n\nAliases: RuMMS",
"meta": {
"external_id": "MOB-S0029",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0029",
"https://www.fireeye.com/blog/threat-research/2016/04/rumms-android-malware.html"
],
"synonyms": [
"RuMMS"
]
},
"related": [
{
"dest-uuid": "d4536441-1bcc-49fa-80ae-a596ed3f7ffd",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "936be60d-90eb-4c36-9247-4b31128432c4",
"value": "RuMMS - MOB-S0029"
},
{
"description": "HummingBad is a family of Android malware that generates fraudulent advertising revenue and has the ability to obtain root access on older, vulnerable versions of Android (Citation: ArsTechnica-HummingBad).\n\nAliases: HummingBad",
"meta": {
"external_id": "MOB-S0038",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0038",
"http://arstechnica.com/security/2016/07/virulent-auto-rooting-malware-takes-control-of-10-million-android-devices/"
],
"synonyms": [
"HummingBad"
]
},
"related": [
{
"dest-uuid": "f5cacc72-f02a-42d1-a020-7a59650086bb",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "f981d199-2720-467e-9dc9-eea04dbe05cf",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "c8770c81-c29f-40d2-a140-38544206b2b4",
"value": "HummingBad - MOB-S0038"
},
{
"description": "Android malware described by Kaspersky (Citation: Kaspersky-MobileMalware).\n\nAliases: Trojan-SMS.AndroidOS.OpFake.a",
"meta": {
"external_id": "MOB-S0024",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0024",
"https://securelist.com/analysis/kaspersky-security-bulletin/58335/mobile-malware-evolution-2013/"
],
"synonyms": [
"Trojan-SMS.AndroidOS.OpFake.a"
]
},
"related": [
{
"dest-uuid": "6a3f6490-9c44-40de-b059-e5940f246673",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "d89c132d-7752-4c7f-9372-954a71522985",
"value": "Trojan-SMS.AndroidOS.OpFake.a - MOB-S0024"
},
{
"description": "Android malware family analyzed by Lookout (Citation: Lookout-Dendroid).\n\nAliases: Dendroid",
"meta": {
"external_id": "MOB-S0017",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0017",
"https://blog.lookout.com/blog/2014/03/06/dendroid/"
],
"synonyms": [
"Dendroid"
]
},
"related": [
{
"dest-uuid": "ea3a8c25-4adb-4538-bf11-55259bdba15f",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "6683aa0c-d98a-4f5b-ac57-ca7e9934a760",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "317a2c10-d489-431e-b6b2-f0251fddc88e",
"value": "Dendroid - MOB-S0017"
},
{
"description": "Android malware analyzed by Scandinavian security group CSIS as described in a Tripwire post (Citation: Tripwire-MazarBOT).\n\nAliases: MazarBOT",
"meta": {
"external_id": "MOB-S0019",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0019",
"https://www.tripwire.com/state-of-security/security-data-protection/android-malware-sms/"
],
"synonyms": [
"MazarBOT"
]
},
"related": [
{
"dest-uuid": "e8b4e1ec-8e3b-484c-9038-4459b1ed8060",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "5ddf81ea-2c06-497b-8c30-5f1ab89a40f9",
"value": "MazarBOT - MOB-S0019"
},
{
"description": "The (Citation: Gooligan) malware family, revealed by Check Point, runs privilege escalation exploits on Android devices and then uses its escalated privileges to steal \"authentication tokens that can be used to access data from Google Play, Gmail, Google Photos, Google Docs, G Suite, Google Drive, and more.\" (Citation: Gooligan)\n\nGoogle (Citation: Ludwig-GhostPush) and LookoutLookout- (Citation: Gooligan) describe (Citation: Gooligan) as part of the Ghost Push Android malware family.\n\nAliases: (Citation: Gooligan)",
"meta": {
"external_id": "MOB-S0006",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0006",
"http://blog.checkpoint.com/2016/11/30/1-million-google-accounts-breached-gooligan/",
"https://plus.google.com/+AdrianLudwig/posts/GXzJ8vaAFsi"
],
"synonyms": [
"Gooligan"
]
},
"related": [
{
"dest-uuid": "702055ac-4e54-4ae9-9527-e23a38e0b160",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "20d56cd6-8dff-4871-9889-d32d254816de",
"value": "Gooligan - MOB-S0006"
},
{
"description": "OldBoot is a family of Android malware described in a report from The Hacker News (Citation: HackerNews-OldBoot).\n\nAliases: OldBoot",
"meta": {
"external_id": "MOB-S0001",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0001",
"http://thehackernews.com/2014/01/first-widely-distributed-android.html"
],
"synonyms": [
"OldBoot"
]
},
"related": [
{
"dest-uuid": "46d818a5-67fa-4585-a7fc-ecf15376c8d5",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "2074b2ad-612e-4758-adce-7901c1b49bbc",
"value": "OldBoot - MOB-S0001"
},
{
"description": "WireLurker is a family of macOS malware that targets iOS devices connected over USB (Citation: PaloAlto-WireLurker).\n\nAliases: WireLurker",
"meta": {
"external_id": "MOB-S0028",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0028"
],
"synonyms": [
"WireLurker"
]
},
"related": [
{
"dest-uuid": "bc32df24-8e80-44bc-80b0-6a4d55661aa5",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "d13fa042-8f26-44e1-a2a8-af0bf8e2ac9a",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "326eaf7b-5784-4f08-8fc2-61fd5d5bc5fb",
"value": "WireLurker - MOB-S0028"
},
{
"description": "Android remote access trojan (RAT) that has been observed to pose as legitimate applications including the Super Mario Run (Citation: Zscaler-SuperMarioRun) and Pokemon GO games (Citation: Proofpoint-Droidjack).\n\nAliases: DroidJack RAT",
"meta": {
"external_id": "MOB-S0036",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0036",
"https://www.zscaler.com/blogs/research/super-mario-run-malware-2-–-droidjack-rat",
"https://www.proofpoint.com/us/threat-insight/post/droidjack-uses-side-load-backdoored-pokemon-go-android-app"
],
"synonyms": [
"DroidJack RAT"
]
},
"related": [
{
"dest-uuid": "a93ccb8f-3996-42e2-b7c7-bb599d4e205f",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "05c4f87c-be8f-46ea-8d9a-2a0aad8f52c1",
"value": "DroidJack RAT - MOB-S0036"
},
{
"description": "The HummingWhale Android malware family \"includes new virtual machine techniques that allow the malware to perform ad fraud better than ever\". (Citation: ArsTechnica-HummingWhale)\n\nAliases: HummingWhale",
"meta": {
"external_id": "MOB-S0037",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0037",
"http://arstechnica.com/security/2017/01/virulent-android-malware-returns-gets-2-million-downloads-on-google-play/"
],
"synonyms": [
"HummingWhale"
]
},
"related": [
{
"dest-uuid": "f981d199-2720-467e-9dc9-eea04dbe05cf",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "6447e3a1-ef4d-44b1-99d5-6b1c4888674f",
"value": "HummingWhale - MOB-S0037"
},
{
"description": "ANDROIDOS_ANSERVER.A is Android malware novel for using encrypted content within a blog site for command and control (Citation: TrendMicro-Anserver).\n\nAliases: ANDROIDOS_ANSERVER.A",
"meta": {
"external_id": "MOB-S0026",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0026",
"http://blog.trendmicro.com/trendlabs-security-intelligence/android-malware-uses-blog-posts-as-cc/"
],
"synonyms": [
"ANDROIDOS_ANSERVER.A"
]
},
"related": [
{
"dest-uuid": "6a3f6490-9c44-40de-b059-e5940f246673",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "4bf6ba32-4165-42c1-b911-9c36165891c8",
"value": "ANDROIDOS_ANSERVER.A - MOB-S0026"
},
{
"description": "Android malware described by Kaspersky (Citation: Kaspersky-MobileMalware).\n\nAliases: Trojan-SMS.AndroidOS.FakeInst.a",
"meta": {
"external_id": "MOB-S0022",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0022",
"https://securelist.com/analysis/kaspersky-security-bulletin/58335/mobile-malware-evolution-2013/"
],
"synonyms": [
"Trojan-SMS.AndroidOS.FakeInst.a"
]
},
"related": [
{
"dest-uuid": "6a3f6490-9c44-40de-b059-e5940f246673",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "28e39395-91e7-4f02-b694-5e079c964da9",
"value": "Trojan-SMS.AndroidOS.FakeInst.a - MOB-S0022"
},
{
"description": "Android malware family analyzed by Lookout (Citation: Lookout-NotCompatible)\n\nAliases: NotCompatible",
"meta": {
"external_id": "MOB-S0015",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0015",
"https://blog.lookout.com/blog/2014/11/19/notcompatible/"
],
"synonyms": [
"NotCompatible"
]
},
"related": [
{
"dest-uuid": "22379609-a99f-4a01-bd7e-70f3e105859d",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "23040c15-e7d8-47b5-8c16-8fd3e0e297fe",
"value": "NotCompatible - MOB-S0015"
},
{
"description": "The X-Agent Android malware was placed in a repackaged version of a Ukrainian artillery targeting application. The malware reportedly retrieved general location data for where it was used and hence the potential location of Ukrainian artillery (Citation: CrowdStrike-Android).\n\nAliases: X-Agent",
"meta": {
"external_id": "MOB-S0030",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0030",
"https://www.crowdstrike.com/wp-content/brochures/FancyBearTracksUkrainianArtillery.pdf"
],
"synonyms": [
"X-Agent"
]
},
"related": [
{
"dest-uuid": "ccd61dfc-b03f-4689-8c18-7c97eab08472",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "0a32ceea-fa66-47ab-8bde-150dbd6d2e40",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "3e2c99f9-66cd-48be-86e9-d7c1c164d87c",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "0a7d9d22-a26d-4a2b-ab9b-b296176c3ecf",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "a93ccb8f-3996-42e2-b7c7-bb599d4e205f",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "56660521-6db4-4e5a-a927-464f22954b7c",
"value": "X-Agent - MOB-S0030"
},
{
"description": "Twitoor is a family of Android malware described by ESET (Citation: ESET-Twitoor).\n\nAliases: Twitoor",
"meta": {
"external_id": "MOB-S0018",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0018",
"http://www.welivesecurity.com/2016/08/24/first-twitter-controlled-android-botnet-discovered/"
],
"synonyms": [
"Twitoor"
]
},
"related": [
{
"dest-uuid": "6a3f6490-9c44-40de-b059-e5940f246673",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "41e3fd01-7b83-471f-835d-d2b1dc9a770c",
"value": "Twitoor - MOB-S0018"
},
{
"description": "OBAD is a family of Android malware (Citation: TrendMicro-Obad).\n\nAliases: OBAD",
"meta": {
"external_id": "MOB-S0002",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0002",
"http://blog.trendmicro.com/trendlabs-security-intelligence/cybercriminals-improve-android-malware-stealth-routines-with-obad/"
],
"synonyms": [
"OBAD"
]
},
"related": [
{
"dest-uuid": "d13fa042-8f26-44e1-a2a8-af0bf8e2ac9a",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "ca4f63b9-a358-4214-bb26-8c912318cfde",
"value": "OBAD - MOB-S0002"
},
{
"description": "As reported by Kaspersky (Citation: Kaspersky-WUC), a spear phishing message was sent to activist groups containing a malicious Android application as an attachment.\n\nAliases: Android/Chuli.A",
"meta": {
"external_id": "MOB-S0020",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0020",
"https://securelist.com/blog/incidents/35552/android-trojan-found-in-targeted-attack-58/"
],
"synonyms": [
"Android/Chuli.A"
]
},
"related": [
{
"dest-uuid": "1f96d624-8409-4472-ad8a-30618ee6b2e2",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "d05f7357-4cbe-47ea-bf83-b8604226d533",
"value": "Android/Chuli.A - MOB-S0020"
},
{
"description": "According to Lookout (Citation: Lookout-EnterpriseApps), the PJApps Android malware family \"may collect and leak the victim’s phone number, mobile device unique identifier (IMEI), and location. In order to make money, it may send messages to premium SMS numbers. PJApps also has the ability to download further applications to the device.\"\n\nAliases: PJApps",
"meta": {
"external_id": "MOB-S0007",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0007",
"https://blog.lookout.com/blog/2016/05/25/spoofed-apps/"
],
"synonyms": [
"PJApps"
]
},
"related": [
{
"dest-uuid": "d4536441-1bcc-49fa-80ae-a596ed3f7ffd",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "c709da93-20c3-4d17-ab68-48cba76b2137",
"value": "PJApps - MOB-S0007"
},
{
"description": "Android malware analyzed by FireEye (Citation: FireEye-AndroidOverlay).\nAccording to their analysis, \"three campaigns in Europe used view overlay techniques...to present nearly identical credential input UIs as seen in benign apps, subsequently tricking unwary users into providing their banking credentials.\"\n\nAliases: AndroidOverlayMalware",
"meta": {
"external_id": "MOB-S0012",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0012",
"https://www.fireeye.com/blog/threat-research/2016/06/latest-android-overlay-malware-spreading-in-europe.html"
],
"synonyms": [
"AndroidOverlayMalware"
]
},
"related": [
{
"dest-uuid": "3dd58c80-4c2e-458c-9503-1b2cd273c4d2",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "b6d3657a-2d6a-400f-8b7e-4d60391aa1f7",
"value": "AndroidOverlayMalware - MOB-S0012"
},
{
"description": "As described by Palo Alto Networks (Citation: ZergHelper), the (Citation: ZergHelper) app uses techniques to evade Apple's App Store review process for itself and uses techniques to install additional applications that are not in Apple's App Store.\n\nAliases: (Citation: ZergHelper)",
"meta": {
"external_id": "MOB-S0003",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0003",
"http://researchcenter.paloaltonetworks.com/2016/02/pirated-ios-app-stores-client-successfully-evaded-apple-ios-code-review/"
],
"synonyms": [
"ZergHelper"
]
},
"related": [
{
"dest-uuid": "b765efd1-02e6-4e67-aebf-0fef5c37e54b",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "3c3b55a6-c3e9-4043-8aae-283fe96220c0",
"value": "ZergHelper - MOB-S0003"
},
{
"description": "SpyNote RAT (Citation: Zscaler-SpyNote) (Remote Access Trojan) is a family of malicious Android apps. The \"SpyNote RAT builder\" tool can be used to develop malicious apps with the SpyNote RAT functionality.\n\nAliases: SpyNote RAT",
"meta": {
"external_id": "MOB-S0021",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0021",
"https://www.zscaler.com/blogs/research/spynote-rat-posing-netflix-app"
],
"synonyms": [
"SpyNote RAT"
]
},
"related": [
{
"dest-uuid": "e8b4e1ec-8e3b-484c-9038-4459b1ed8060",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "20dbaf05-59b8-4dc6-8777-0b17f4553a23",
"value": "SpyNote RAT - MOB-S0021"
},
{
"description": " (Citation: RCSAndroid) (Citation: RCSAndroid) is Android malware allegedly distributed by Hacking Team.\n\nAliases: (Citation: RCSAndroid)",
"meta": {
"external_id": "MOB-S0011",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0011",
"https://github.com/hackedteam/core-android/tree/master/RCSAndroid"
],
"synonyms": [
"RCSAndroid"
]
},
"related": [
{
"dest-uuid": "6c49d50f-494d-4150-b774-a655022d20a6",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "363bc05d-13cb-4e98-a5b7-e250f2bbdc2b",
"value": "RCSAndroid - MOB-S0011"
},
{
"description": "The Charger Android malware steals \"steals contacts and SMS messages from the user's device\". It also \"asks for admin permissions\" and \"[i]f granted, the ransomware locks the device and displays a message demanding payment\". (Citation: CheckPoint-Charger)\n\nAliases: Charger",
"meta": {
"external_id": "MOB-S0039",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0039",
"http://blog.checkpoint.com/2017/01/24/charger-malware/"
],
"synonyms": [
"Charger"
]
},
"related": [
{
"dest-uuid": "6e0545df-8df6-4990-971c-e96c4c60d561",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "4e6620ac-c30c-4f6d-918e-fa20cae7c1ce",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "d1c600f8-0fb6-4367-921b-85b71947d950",
"value": "Charger - MOB-S0039"
},
{
"description": "iOS malware that \"is different from previous seen iOS malware in that it attacks both jailbroken and non-jailbroken iOS devices\" and \"abuses private APIs in the iOS system to implement malicious functionalities\" (Citation: PaloAlto-YiSpecter).\n\nAliases: YiSpecter",
"meta": {
"external_id": "MOB-S0027",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0027"
],
"synonyms": [
"YiSpecter"
]
},
"related": [
{
"dest-uuid": "51aedbd6-2837-4d15-aeb0-cb09f2bf22ac",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "a15c9357-2be0-4836-beec-594f28b9b4a9",
"value": "YiSpecter - MOB-S0027"
},
{
"description": "Discovered and analyzed by Lookout (Citation: Lookout-PegasusAndroid) and Google (Citation: Google-Chrysaor), Pegasus for Android (also known as Chrysaor) is spyware that was used in targeted attacks. Pegasus for Android does not use zero day vulnerabilities. It attempts to escalate privileges using well-known vulnerabilities, and even if the attempts fail, it still performs some subset of spyware functions that do not require escalated privileges.\n\nAliases: Pegasus for Android, Chrysaor",
"meta": {
"external_id": "MOB-S0032",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0032",
"https://blog.lookout.com/blog/2017/04/03/pegasus-android/",
"https://android-developers.googleblog.com/2017/04/an-investigation-of-chrysaor-malware-on.html"
],
"synonyms": [
"Pegasus for Android",
"Chrysaor"
]
},
"related": [
{
"dest-uuid": "9d7c772b-43f1-49cf-bc70-7a7cd2ed34c8",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "52acea22-7d88-433c-99e6-8fef1657e3ad",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "93799a9d-3537-43d8-b6f4-17215de1657c",
"value": "Pegasus for Android - MOB-S0032"
},
{
"description": "iOS malware analyzed by Palo Alto Networks (Citation: (Citation: PaloAlto-XcodeGhost)1) (Citation: PaloAlto-XcodeGhost)\n\nAliases: XcodeGhost",
"meta": {
"external_id": "MOB-S0013",
"refs": [
"https://attack.mitre.org/mobile/index.php/Software/MOB-S0013",
"http://researchcenter.paloaltonetworks.com/2015/09/novel-malware-xcodeghost-modifies-xcode-infects-apple-ios-apps-and-hits-app-store/",
"http://researchcenter.paloaltonetworks.com/2015/09/update-xcodeghost-attacker-can-phish-passwords-and-open-urls-though-infected-apps/"
],
"synonyms": [
"XcodeGhost"
]
},
"related": [
{
"dest-uuid": "c4b96c0b-cb58-497a-a1c2-bb447d79d692",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "d9e07aea-baad-4b68-bdca-90c77647d7f9",
"value": "XcodeGhost - MOB-S0013"
}
],
"version": 6
}
Reference in New Issue View Git Blame Copy Permalink