MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2025-09-06 18:12:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

no change: dump files with sort_keys=True

Browse source 
This is needed to keep better track of the changes when other tools load and save the json files.
This commit is contained in:
Christophe Vandeplas 2018-08-13 17:06:29 +02:00
parent 021107e597
commit 5478f0aa45
36 changed files with 16174 additions and 16174 deletions
Download patch file Download diff file Expand all files Collapse all files

32
clusters/stealer.json
View file

@ -1,32 +1,37 @@
{
"uuid": "f2ef4033-9001-4427-a418-df8c48e6d054",
"authors": [
"raw-data"
],
"description": "A list of malware stealer.",
"name": "Stealer",
"source": "Open Sources",
"version": 2,
"type": "stealer",
"uuid": "f2ef4033-9001-4427-a418-df8c48e6d054",
"values": [
{
"description": "It is designed to steal data found within multiple Chromium and Firefox based browsers, it can also steal many popular cryptocurrency wallets as well as any saved FTP passwords within FileZilla. Nocturnal Stealer uses several anti-VM and anti-analysis techniques, which include but are not limited to: environment fingerprinting, checking for debuggers and analyzers, searching for known virtual machine registry keys, and checking for emulation software.",
"meta": {
"date": "March 2018.",
"refs": [
"https://www.proofpoint.com/us/threat-insight/post/thief-night-new-nocturnal-stealer-grabs-data-cheap"
]
},
"description": "It is designed to steal data found within multiple Chromium and Firefox based browsers, it can also steal many popular cryptocurrency wallets as well as any saved FTP passwords within FileZilla. Nocturnal Stealer uses several anti-VM and anti-analysis techniques, which include but are not limited to: environment fingerprinting, checking for debuggers and analyzers, searching for known virtual machine registry keys, and checking for emulation software.",
"value": "Nocturnal Stealer",
"uuid": "e7080bce-99b5-4615-a798-a192ed89bd5a"
"uuid": "e7080bce-99b5-4615-a798-a192ed89bd5a",
"value": "Nocturnal Stealer"
},
{
"description": "The first version stole browser credentials and cookies, along with all text files it can find on the system. The second variant added the ability to collect Telegram's desktop cache and key files, as well as login information for the video game storefront Steam.",
"meta": {
"date": "March 2018.",
"refs": [
"https://blog.talosintelligence.com/2018/05/telegrab.html"
]
},
"description": "The first version stole browser credentials and cookies, along with all text files it can find on the system. The second variant added the ability to collect Telegram's desktop cache and key files, as well as login information for the video game storefront Steam.",
"value": "TeleGrab",
"uuid": "a6780288-24eb-4006-9ddd-062870c6feec"
"uuid": "a6780288-24eb-4006-9ddd-062870c6feec",
"value": "TeleGrab"
},
{
"description": "It is able to steal accounts from different software, such as, Firefox password Internet Explorer/Edge Thunderbird Chrome/Chromium and many more. It is also able to (1) list all installed software, (2) list processes, (3) Get information about the machine name (CPU type, Graphic card, size of memory), (4) take screen captures, (5) Steal cryptomoney wallet from Electrum, MultiBit, monero-project, bitcoin-qt.",
"meta": {
"date": "July 2018.",
"refs": [
@ -35,14 +40,9 @@
"https://malware.lu/articles/2018/05/04/azorult-stealer.html"
]
},
"description": "It is able to steal accounts from different software, such as, Firefox password Internet Explorer/Edge Thunderbird Chrome/Chromium and many more. It is also able to (1) list all installed software, (2) list processes, (3) Get information about the machine name (CPU type, Graphic card, size of memory), (4) take screen captures, (5) Steal cryptomoney wallet from Electrum, MultiBit, monero-project, bitcoin-qt.",
"value": "AZORult",
"uuid": "a646edab-5c6f-4a79-8a6c-153535259e16"
"uuid": "a646edab-5c6f-4a79-8a6c-153535259e16",
"value": "AZORult"
}
],
"authors": [
"raw-data"
],
"type": "stealer",
"description": "A list of malware stealer."
"version": 2
}