MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2024-11-22 23:07:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

[cluster][tool] Adds Matanbuchus

Browse source 
+ threat actor: BelialDemon

Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
This commit is contained in:
Jürgen Löhel 2021-06-21 18:00:35 -05:00
parent 141b85c084
commit 254c201601
No known key found for this signature in database
GPG key ID: 54E44C4D345DD098
2 changed files with 29 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
clusters/threat-actor.json
View file

@ -8833,7 +8833,20 @@
},
"uuid": "2dd31182-bae1-48ed-8bb3-805a3df89783",
"value": "Gelsemium"
},
{
"description": "Mentioned as operator of TriumphLoader and Matanbuchus",
"meta": {
"refs": [
"https://unit42.paloaltonetworks.com/matanbuchus-malware-as-a-service/"
],
"synonyms": [
"Matanbuchus"
]
},
"uuid": "e7aff414-fc21-43eb-ad5d-9a46e07be9f5",
"value": "BelialDemon"
}
],
"version": 204
"version": 205
}

16
clusters/tool.json
View file

@ -8292,7 +8292,21 @@
"related": [],
"uuid": "d357a6ff-00e5-4fcc-8b9e-4a9d98a736e7",
"value": "RDAT"
},
{
"description": "Matanbuchus is a loader promoted by BelialDemon. It can launch an EXE or DLL file in memory, leverage schtasks.exe to add or modify task schedules, and launch custom PowerShell commands, among other capabilities. Attackers use a Microsoft Excel document as the initial vector to drop the Matanbuchus Loader DLL.",
"meta": {
"date": "Feb 2021.",
"refs": [
"https://unit42.paloaltonetworks.com/matanbuchus-malware-as-a-service/"
],
"type": [
"Loader"
]
},
"uuid": "2214b113-6942-494f-94b7-576e74fccdb5",
"value": "Matanbuchus"
}
],
"version": 144
"version": 145
}