MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2024-11-26 08:47:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

chg: [misp-galaxy] jq all the things

Browse source
This commit is contained in:
Alexandre Dulaunoy 2019-10-03 14:46:07 +02:00
parent 9e82b025b5
commit ac8236d16d
Signed by: adulau
GPG key ID: 09E2CD4944E6CBCD
1 changed files with 6 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
clusters/tool.json
View file

@ -7825,25 +7825,25 @@
"value": "TVSPY" "value": "TVSPY"
}, },
{ {
"value": "COMpfun",
"uuid": "b2c2d42b-a6a3-4ab0-a013-eb1c7461aca9",
"description": "The COMpfun malware was initially documented by G-DATA in 2014. Although G-DATA didn’t identify which actor was using this malware, Kaspersky tentatively linked it to the Turla APT, based on the victimology. Our telemetry indicates that the current campaign using Reductor started at the end of April 2019 and remained active at the time of writing (August 2019). We identified targets in Russia and Belarus.", "description": "The COMpfun malware was initially documented by G-DATA in 2014. Although G-DATA didn’t identify which actor was using this malware, Kaspersky tentatively linked it to the Turla APT, based on the victimology. Our telemetry indicates that the current campaign using Reductor started at the end of April 2019 and remained active at the time of writing (August 2019). We identified targets in Russia and Belarus.",
"meta": { "meta": {
"refs": [ "refs": [
"https://securelist.com/compfun-successor-reductor/93633/", "https://securelist.com/compfun-successor-reductor/93633/",
"https://www.gdatasoftware.com/blog/2014/10/23941-com-object-hijacking-the-discreet-way-of-persistence" "https://www.gdatasoftware.com/blog/2014/10/23941-com-object-hijacking-the-discreet-way-of-persistence"
] ]
} },
"uuid": "b2c2d42b-a6a3-4ab0-a013-eb1c7461aca9",
"value": "COMpfun"
}, },
{ {
"value": "Reductor",
"uuid": "a577bb0d-9732-449a-80f7-5e6c93e6046c",
"description": "We called these new modules ‘Reductor’ after a .pdb path left in some samples. Besides typical RAT functions such as uploading, downloading and executing files, Reductor’s authors put a lot of effort into manipulating digital certificates and marking outbound TLS traffic with unique host-related identifiers. The Kaspersky Attribution Engine shows strong code similarities between this family and the COMPfun Trojan. Moreover, further research showed that the original COMpfun Trojan most probably is used as a downloader in one of the distribution schemes. Based on these similarities, we’re quite sure the new malware was developed by the COMPfun authors.", "description": "We called these new modules ‘Reductor’ after a .pdb path left in some samples. Besides typical RAT functions such as uploading, downloading and executing files, Reductor’s authors put a lot of effort into manipulating digital certificates and marking outbound TLS traffic with unique host-related identifiers. The Kaspersky Attribution Engine shows strong code similarities between this family and the COMPfun Trojan. Moreover, further research showed that the original COMpfun Trojan most probably is used as a downloader in one of the distribution schemes. Based on these similarities, we’re quite sure the new malware was developed by the COMPfun authors.",
"meta": { "meta": {
"refs": [ "refs": [
"https://securelist.com/compfun-successor-reductor/93633/" "https://securelist.com/compfun-successor-reductor/93633/"
] ]
} },
"uuid": "a577bb0d-9732-449a-80f7-5e6c93e6046c",
"value": "Reductor"
} }
], ],
"version": 125 "version": 125