From ac8236d16dca06076150fc9d6e7ec544645a676f Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Thu, 3 Oct 2019 14:46:07 +0200
Subject: [PATCH] chg: [misp-galaxy] jq all the things

---
 clusters/tool.json | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/clusters/tool.json b/clusters/tool.json
index 9f6b0a5..69ae9bc 100644
--- a/clusters/tool.json
+++ b/clusters/tool.json
@@ -7825,25 +7825,25 @@
       "value": "TVSPY"
     },
     {
-      "value": "COMpfun",
-      "uuid": "b2c2d42b-a6a3-4ab0-a013-eb1c7461aca9",
       "description": "The COMpfun malware was initially documented by G-DATA in 2014. Although G-DATA didn’t identify which actor was using this malware, Kaspersky tentatively linked it to the Turla APT, based on the victimology. Our telemetry indicates that the current campaign using Reductor started at the end of April 2019 and remained active at the time of writing (August 2019). We identified targets in Russia and Belarus.",
       "meta": {
         "refs": [
           "https://securelist.com/compfun-successor-reductor/93633/",
           "https://www.gdatasoftware.com/blog/2014/10/23941-com-object-hijacking-the-discreet-way-of-persistence"
         ]
-      }
+      },
+      "uuid": "b2c2d42b-a6a3-4ab0-a013-eb1c7461aca9",
+      "value": "COMpfun"
     },
     {
-      "value": "Reductor",
-      "uuid": "a577bb0d-9732-449a-80f7-5e6c93e6046c",
       "description": "We called these new modules ‘Reductor’ after a .pdb path left in some samples. Besides typical RAT functions such as uploading, downloading and executing files, Reductor’s authors put a lot of effort into manipulating digital certificates and marking outbound TLS traffic with unique host-related identifiers.  The Kaspersky Attribution Engine shows strong code similarities between this family and the COMPfun Trojan. Moreover, further research showed that the original COMpfun Trojan most probably is used as a downloader in one of the distribution schemes. Based on these similarities, we’re quite sure the new malware was developed by the COMPfun authors.",
       "meta": {
         "refs": [
           "https://securelist.com/compfun-successor-reductor/93633/"
         ]
-      }
+      },
+      "uuid": "a577bb0d-9732-449a-80f7-5e6c93e6046c",
+      "value": "Reductor"
     }
   ],
   "version": 125