Self Discovery
December 5, 2023 ยท View on GitHub
| ID | B0038 |
| Objective(s) | Discovery |
| Related ATT&CK Techniques | None |
| Version | 2.1 |
| Created | 7 October 2019 |
| Last Modified | 17 August 2023 |
Self Discovery
Malware may gather information about itself, such as its filename or size on disk.
Methods
| Name | ID | Description |
|---|---|---|
| Use Hashquine | B0038.001 | Malware uses a hashquine (the file contains it's own hash) for use as an integrity check. [1] |
| Check Magic String | B0038.002 | Malware checks a static value (i.e., magic string or number) to verify integrity. [2] |
| Check Section Length | B0038.003 | Malware checks the length of a section to verify integrity. [2] |
Use in Malware
| Name | Date | Method | Description |
|---|---|---|---|
| WannaCry | 2017 | -- | WannaCry checks the size of the file it loads into memory. [1] |
| WannaCry | 2017 | B0038.002 | WannaCry checks a string, keylen and a magic number before decrypting a dll. [2] |
| WannaCry | 2017 | B0038.003 | WannaCry checks the data lengh of a section before decypting a dll. [2] |
References
[1] https://github.com/Rogdham/gif-md5-hashquine
[2] https://www.mandiant.com/resources/blog/wannacry-malware-profile