MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2024-11-30 10:47:17 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #150 from Delta-Sierra/master

Browse source 
add Digmine
This commit is contained in:
Alexandre Dulaunoy 2018-01-15 15:52:33 +01:00 committed by GitHub
commit 3fe8677e74
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 10 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
clusters/tool.json
View file

@ -10,7 +10,7 @@
], ],
"description": "threat-actor-tools is an enumeration of tools used by adversaries. The list includes malware but also common software regularly used by the adversaries.", "description": "threat-actor-tools is an enumeration of tools used by adversaries. The list includes malware but also common software regularly used by the adversaries.",
"uuid": "0d821b68-9d82-4c6d-86a6-1071a9e0f79f", "uuid": "0d821b68-9d82-4c6d-86a6-1071a9e0f79f",
"version": 48, "version": 49,
"values": [ "values": [
{ {
"meta": { "meta": {
@ -3338,6 +3338,15 @@
"PYLOT" "PYLOT"
] ]
} }
},
{
"value": "Digmine",
"description": "Digmine is coded in AutoIt, and sent to would-be victims posing as a video file but is actually an AutoIt executable script. If the user’s Facebook account is set to log in automatically, Digmine will manipulate Facebook Messenger in order to send a link to the file to the account’s friends. The abuse of Facebook is limited to propagation for now, but it wouldn’t be implausible for attackers to hijack the Facebook account itself down the line. This functionality’s code is pushed from the command-and-control (C&C) server, which means it can be updated.",
"meta": {
"refs": [
"https://blog.trendmicro.com/trendlabs-security-intelligence/digmine-cryptocurrency-miner-spreading-via-facebook-messenger/"
]
}
} }
] ]
} }