Open Delta-Sierra opened 5 years ago
Self-reminder (can be moved): Might be interesting to find a easy way to manage reciprocal relationships, such as dropped(dropper)/dropped-by or uses/used-by for instance
dropped/dropped-by --> Fallout (exploit-kit) - dropped --> SAVEFiles (ransomware) - dropped-by
variant-of --> Panda Banker (Banker) --> Zeus (Banker)
uses/used-by --> TeleBots Group --> NotPetya
uses/used-by --> TeleBots Group --> Industroyer
uses/used-by --> TA530 --> August (tool)
uses/used-by --> APT 10 --> Quasar RAT
Related (probably) --> MVP Ransomware --> Scarab Ransomware ref: https://twitter.com/siri_urz/status/1039077365039673344
uses/used-by --> HookAds --> Fallout
dropped/dropped-by --> Fallout (exploit-kit) - dropped --> DanaBot banking Trojan - dropped-by
dropped/dropped-by --> Fallout (exploit-kit) - dropped --> Nocturnal information stealer - dropped-by
dropped/dropped-by --> Fallout (exploit-kit) - dropped --> GlobeImposter ransomware - dropped-by
Possibly related: --> EnyBeny Nuclear Ransomware --> EnyBeny Horsuke Ransomware
probably related --> EQ ransomware --> Globeimposter
uses/used-by --> TA505 (threat actor) - uses --> ServHelper backdoor - used-by
uses/used-by --> TA505 (threat actor) - uses --> FlawedGrace remote access trojan (RAT) - used-by
APT10 Associated malware: HAYMAKER, SNUGRIDE, BUGJUICE, QUASARRAT
Razdel is BankBot variant
@Delta-Sierra could you label this accordingly, it seems to be WiP of some sorts?
This can be considered as WIP indeed. Or a kind of memo.
Related --> Mirai --> Mirai Sora --> Mirai Owari
dropped/dropped-by --> Fallout (exploit-kit) - dropped --> SmokeLoader (tool) - dropped-by
dropped/dropped-by --> Fallout (exploit-kit) - dropped --> Kraken Cryptor Ransomware (ransomware -should be added-) - dropped-by
dropped/dropped-by --> Fallout (exploit-kit) - dropped --> Smoke Loader (mitre-entreprise-malware) - dropped-by
dropped/dropped-by --> Fallout (exploit-kit) - dropped --> GandCrab Ransomware (ransomware) - dropped-by
dropped/dropped-by --> Fallout (exploit-kit) - dropped --> SAVEfiles (ransomware) - dropped-by
uses/used-by --> APT28 (threat-actor) - uses --> LoJax (tool) - used-by
variant-of --> BankBot (android) --> Razdel (android or banking - galaxy to choose)