mirror of
https://github.com/MISP/misp-galaxy.git
synced 2024-11-26 16:57:18 +00:00
update tools
This commit is contained in:
Déborah Servili
commit
c08cc781f5
2 changed files with 1837 additions and 1683 deletions
|
|
@ -1,514 +1,539 @@
|
|||
{
|
||||
"name": "Exploit-Kit",
|
||||
"type": "exploit-kit",
|
||||
"source": "MISP Project",
|
||||
"authors": [
|
||||
"Kafeine",
|
||||
"Will Metcalf",
|
||||
"KahuSecurity"
|
||||
],
|
||||
"description": "Exploit-Kit is an enumeration of some exploitation kits used by adversaries. The list includes document, browser and router exploit kits.It's not meant to be totally exhaustive but aim at covering the most seen in the past 5 years",
|
||||
"uuid": "454f4e78-bd7c-11e6-a4a6-cec0c932ce01",
|
||||
"version": 5,
|
||||
"values": [
|
||||
{
|
||||
"value": "Astrum",
|
||||
"description": "Astrum Exploit Kit is a private Exploit Kit used in massive scale malvertising campaigns. It's notable by its use of Steganography",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2014/09/astrum-ek.html",
|
||||
"http://www.welivesecurity.com/2016/12/06/readers-popular-websites-targeted-stealthy-stegano-exploit-kit-hiding-pixels-malicious-ads/"
|
||||
],
|
||||
"status": "Active",
|
||||
"synonyms": [
|
||||
"Stegano EK"
|
||||
],
|
||||
"status": "Unknown - Last Seen 2016-12-07"
|
||||
}
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2014/09/astrum-ek.html",
|
||||
"http://www.welivesecurity.com/2016/12/06/readers-popular-websites-targeted-stealthy-stegano-exploit-kit-hiding-pixels-malicious-ads/"
|
||||
]
|
||||
},
|
||||
"description": "Astrum Exploit Kit is a private Exploit Kit used in massive scale malvertising campaigns. It's notable by its use of Steganography",
|
||||
"value": "Astrum"
|
||||
},
|
||||
{
|
||||
"value": "DealersChoice",
|
||||
"description": "DealersChoice is a Flash Player Exploit platform triggered by RTF",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"http://researchcenter.paloaltonetworks.com/2016/10/unit42-dealerschoice-sofacys-flash-player-exploit-platform/",
|
||||
"http://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-ramps-up-spear-phishing-before-zero-days-get-patched/"
|
||||
"status": "Active",
|
||||
"synonyms": [
|
||||
"Blaze EK",
|
||||
"Neptune EK"
|
||||
],
|
||||
"refs": [
|
||||
"https://www.trustwave.com/Resources/SpiderLabs-Blog/Terror-Exploit-Kit--More-like-Error-Exploit-Kit/"
|
||||
]
|
||||
},
|
||||
"description": "Terror EK is built on Hunter, Sundown and RIG EK code",
|
||||
"value": "Terror EK"
|
||||
},
|
||||
{
|
||||
"meta": {
|
||||
"status": "Active",
|
||||
"synonyms": [
|
||||
"Sednit RTF EK"
|
||||
],
|
||||
"status": "Active"
|
||||
}
|
||||
"refs": [
|
||||
"http://researchcenter.paloaltonetworks.com/2016/10/unit42-dealerschoice-sofacys-flash-player-exploit-platform/",
|
||||
"http://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-ramps-up-spear-phishing-before-zero-days-get-patched/"
|
||||
]
|
||||
},
|
||||
"description": "DealersChoice is a Flash Player Exploit platform triggered by RTF",
|
||||
"value": "DealersChoice"
|
||||
},
|
||||
{
|
||||
"value": "DNSChanger",
|
||||
"description": "DNSChanger Exploit Kit is an exploit kit targeting Routers via the browser",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2015/05/an-exploit-kit-dedicated-to-csrf.html",
|
||||
"https://www.proofpoint.com/us/threat-insight/post/home-routers-under-attack-malvertising-windows-android-devices"
|
||||
],
|
||||
"status": "Active",
|
||||
"synonyms": [
|
||||
"RouterEK"
|
||||
],
|
||||
"status": "Active"
|
||||
}
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2015/05/an-exploit-kit-dedicated-to-csrf.html",
|
||||
"https://www.proofpoint.com/us/threat-insight/post/home-routers-under-attack-malvertising-windows-android-devices"
|
||||
]
|
||||
},
|
||||
"description": "DNSChanger Exploit Kit is an exploit kit targeting Routers via the browser",
|
||||
"value": "DNSChanger"
|
||||
},
|
||||
{
|
||||
"value": "Empire",
|
||||
"description": "The Empire Pack is a variation of RIG operated by a load seller. It's being fed by many traffic actors",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2016/10/rig-evolves-neutrino-waves-goodbye.html"
|
||||
],
|
||||
"synonyms": [
|
||||
"RIG-E"
|
||||
],
|
||||
"status": "Unknown - Last seen: 2016-12-29"
|
||||
}
|
||||
},
|
||||
{
|
||||
"value": "Hunter",
|
||||
"description": "Hunter EK is an evolution of 3Ros EK",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"https://www.proofpoint.com/us/threat-insight/post/Hunter-Exploit-Kit-Targets-Brazilian-Banking-Customers"
|
||||
],
|
||||
"status": "Active",
|
||||
"synonyms": [
|
||||
"3ROS Exploit Kit"
|
||||
],
|
||||
"status": "Active"
|
||||
}
|
||||
"refs": [
|
||||
"https://www.proofpoint.com/us/threat-insight/post/Hunter-Exploit-Kit-Targets-Brazilian-Banking-Customers"
|
||||
]
|
||||
},
|
||||
"description": "Hunter EK is an evolution of 3Ros EK",
|
||||
"value": "Hunter"
|
||||
},
|
||||
{
|
||||
"value": "Kaixin",
|
||||
"description": "Kaixin is an exploit kit mainly seen behind compromised website in Asia",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"http://www.kahusecurity.com/2013/deobfuscating-the-ck-exploit-kit/",
|
||||
"http://www.kahusecurity.com/2012/new-chinese-exploit-pack/"
|
||||
],
|
||||
"status": "Active",
|
||||
"synonyms": [
|
||||
"CK vip"
|
||||
],
|
||||
"status": "Active"
|
||||
}
|
||||
"refs": [
|
||||
"http://www.kahusecurity.com/2013/deobfuscating-the-ck-exploit-kit/",
|
||||
"http://www.kahusecurity.com/2012/new-chinese-exploit-pack/"
|
||||
]
|
||||
},
|
||||
"description": "Kaixin is an exploit kit mainly seen behind compromised website in Asia",
|
||||
"value": "Kaixin"
|
||||
},
|
||||
{
|
||||
"value": "Magnitude",
|
||||
"description": "Magnitude EK",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2013/10/Magnitude.html",
|
||||
"https://www.trustwave.com/Resources/SpiderLabs-Blog/A-Peek-Into-the-Lion-s-Den-%E2%80%93-The-Magnitude--aka-PopAds--Exploit-Kit/",
|
||||
"http://malware.dontneedcoffee.com/2014/02/and-real-name-of-magnitude-is.html"
|
||||
],
|
||||
"status": "Active",
|
||||
"synonyms": [
|
||||
"Popads EK",
|
||||
"TopExp"
|
||||
],
|
||||
"status": "Active"
|
||||
}
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2013/10/Magnitude.html",
|
||||
"https://www.trustwave.com/Resources/SpiderLabs-Blog/A-Peek-Into-the-Lion-s-Den-%E2%80%93-The-Magnitude--aka-PopAds--Exploit-Kit/",
|
||||
"http://malware.dontneedcoffee.com/2014/02/and-real-name-of-magnitude-is.html",
|
||||
"https://community.rsa.com/community/products/netwitness/blog/2017/02/09/magnitude-exploit-kit-under-the-hood"
|
||||
]
|
||||
},
|
||||
"description": "Magnitude EK",
|
||||
"value": "Magnitude"
|
||||
},
|
||||
{
|
||||
"value": "MWI",
|
||||
"description": "Microsoft Word Intruder is an exploit kit focused on Word and embedded flash exploits. The author wants to avoid their customer to use it in mass spam campaign, so it's most often connected to semi-targeted attacks",
|
||||
"meta": {
|
||||
"status": "Active",
|
||||
"refs": [
|
||||
"https://www.fireeye.com/blog/threat-research/2015/04/a_new_word_document.html",
|
||||
"https://www.sophos.com/en-us/medialibrary/PDFs/technical%20papers/sophos-microsoft-word-intruder-revealed.pdf"
|
||||
],
|
||||
"status": "Active"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": "Microsoft Word Intruder is an exploit kit focused on Word and embedded flash exploits. The author wants to avoid their customer to use it in mass spam campaign, so it's most often connected to semi-targeted attacks",
|
||||
"value": "MWI"
|
||||
},
|
||||
{
|
||||
"value": "Neutrino",
|
||||
"description": "Neutrino Exploit Kit has been one of the major exploit kit from its launch in 2013 till september 2016 when it become private (defense name for this variation is Neutrino-v). This EK vanished from march 2014 till november 2014.",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2013/03/hello-neutrino-just-one-more-exploit-kit.html",
|
||||
"http://malware.dontneedcoffee.com/2014/11/neutrino-come-back.html"
|
||||
],
|
||||
"status": "Active",
|
||||
"synonyms": [
|
||||
"Job314",
|
||||
"Neutrino Rebooted",
|
||||
"Neutrino-v"
|
||||
],
|
||||
"status": "Active"
|
||||
}
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2013/03/hello-neutrino-just-one-more-exploit-kit.html",
|
||||
"http://malware.dontneedcoffee.com/2014/11/neutrino-come-back.html"
|
||||
]
|
||||
},
|
||||
"description": "Neutrino Exploit Kit has been one of the major exploit kit from its launch in 2013 till september 2016 when it become private (defense name for this variation is Neutrino-v). This EK vanished from march 2014 till november 2014.",
|
||||
"value": "Neutrino"
|
||||
},
|
||||
{
|
||||
"value": "RIG",
|
||||
"description": "RIG is an exploit kit that takes its source in Infinity EK itself an evolution of Redkit. It became dominant after the fall of Angler, Nuclear Pack and the end of public access to Neutrino. RIG-v is the name given to RIG 4 when it was only accessible by \"vip\" customers and when RIG 3 was still in use.",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"http://www.kahusecurity.com/2014/rig-exploit-pack/",
|
||||
"https://www.trustwave.com/Resources/SpiderLabs-Blog/RIG-Reloaded---Examining-the-Architecture-of-RIG-Exploit-Kit-3-0/",
|
||||
"https://www.trustwave.com/Resources/SpiderLabs-Blog/RIG-Exploit-Kit-%E2%80%93-Diving-Deeper-into-the-Infrastructure/",
|
||||
"http://malware.dontneedcoffee.com/2016/10/rig-evolves-neutrino-waves-goodbye.html"
|
||||
],
|
||||
"status": "Active",
|
||||
"synonyms": [
|
||||
"RIG 3",
|
||||
"RIG-v",
|
||||
"RIG 4",
|
||||
"Meadgive"
|
||||
],
|
||||
"status": "Active"
|
||||
}
|
||||
"refs": [
|
||||
"http://www.kahusecurity.com/2014/rig-exploit-pack/",
|
||||
"https://www.trustwave.com/Resources/SpiderLabs-Blog/RIG-Reloaded---Examining-the-Architecture-of-RIG-Exploit-Kit-3-0/",
|
||||
"https://www.trustwave.com/Resources/SpiderLabs-Blog/RIG-Exploit-Kit-%E2%80%93-Diving-Deeper-into-the-Infrastructure/",
|
||||
"http://malware.dontneedcoffee.com/2016/10/rig-evolves-neutrino-waves-goodbye.html"
|
||||
]
|
||||
},
|
||||
"description": "RIG is an exploit kit that takes its source in Infinity EK itself an evolution of Redkit. It became dominant after the fall of Angler, Nuclear Pack and the end of public access to Neutrino. RIG-v is the name given to RIG 4 when it was only accessible by \"vip\" customers and when RIG 3 was still in use.",
|
||||
"value": "RIG"
|
||||
},
|
||||
{
|
||||
"value": "Sednit EK",
|
||||
"description": "Sednit EK is the exploit kit used by APT28",
|
||||
"meta": {
|
||||
"status": "Active",
|
||||
"refs": [
|
||||
"http://www.welivesecurity.com/2014/10/08/sednit-espionage-group-now-using-custom-exploit-kit/",
|
||||
"http://blog.trendmicro.com/trendlabs-security-intelligence/new-adobe-flash-zero-day-used-in-pawn-storm-campaign/"
|
||||
],
|
||||
"status": "Active"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": "Sednit EK is the exploit kit used by APT28",
|
||||
"value": "Sednit EK"
|
||||
},
|
||||
{
|
||||
"value": "Bizarro Sundown",
|
||||
"description": "Bizarro Sundown appears to be a fork of Sundown with added anti-analysis features",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"http://blog.trendmicro.com/trendlabs-security-intelligence/new-bizarro-sundown-exploit-kit-spreads-locky/",
|
||||
"https://blog.malwarebytes.com/cybercrime/exploits/2016/10/yet-another-sundown-ek-variant/"
|
||||
],
|
||||
"status": "Retired",
|
||||
"synonyms": [
|
||||
"Sundown-b"
|
||||
],
|
||||
"status": "Active"
|
||||
}
|
||||
"refs": [
|
||||
"http://blog.trendmicro.com/trendlabs-security-intelligence/new-bizarro-sundown-exploit-kit-spreads-locky/",
|
||||
"https://blog.malwarebytes.com/cybercrime/exploits/2016/10/yet-another-sundown-ek-variant/"
|
||||
]
|
||||
},
|
||||
"description": "Bizarro Sundown appears to be a fork of Sundown with added anti-analysis features",
|
||||
"value": "Bizarro Sundown"
|
||||
},
|
||||
{
|
||||
"value": "GreenFlash Sundown",
|
||||
"description": "GreenFlash Sundown is a variation of Bizarro Sundown without landing",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"http://blog.trendmicro.com/trendlabs-security-intelligence/new-bizarro-sundown-exploit-kit-spreads-locky/"
|
||||
],
|
||||
"status": "Active",
|
||||
"synonyms": [
|
||||
"Sundown-GF"
|
||||
],
|
||||
"status": "Active"
|
||||
}
|
||||
"refs": [
|
||||
"http://blog.trendmicro.com/trendlabs-security-intelligence/new-bizarro-sundown-exploit-kit-spreads-locky/"
|
||||
]
|
||||
},
|
||||
"description": "GreenFlash Sundown is a variation of Bizarro Sundown without landing",
|
||||
"value": "GreenFlash Sundown"
|
||||
},
|
||||
{
|
||||
"value": "Sundown",
|
||||
"description": "Sundown Exploit Kit is mainly built out of stolen code from other exploit kits",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2015/06/fast-look-at-sundown-ek.html",
|
||||
"https://www.virusbulletin.com/virusbulletin/2015/06/beta-exploit-pack-one-more-piece-crimeware-infection-road"
|
||||
],
|
||||
"synonyms": [
|
||||
"Beps",
|
||||
"Xer",
|
||||
"Beta"
|
||||
],
|
||||
"status": "Active",
|
||||
"colour": "#C03701"
|
||||
}
|
||||
},
|
||||
{
|
||||
"value": "Angler",
|
||||
"description": "The Angler Exploit Kit has been the most popular and evolved exploit kit from 2014 to middle of 2016. There was several variation. The historical \"indexm\" variant was used to spread Lurk. A vip version used notabily to spread Poweliks, the \"standard\" commercial version, and a declinaison tied to load selling (mostly bankers) that can be associated to EmpirePPC",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"https://blogs.sophos.com/2015/07/21/a-closer-look-at-the-angler-exploit-kit/",
|
||||
"http://malware.dontneedcoffee.com/2015/12/xxx-is-angler-ek.html",
|
||||
"http://malware.dontneedcoffee.com/2016/06/is-it-end-of-angler.html"
|
||||
],
|
||||
"status": "Retired - Last seen: 2016-06-07",
|
||||
"synonyms": [
|
||||
"XXX",
|
||||
"AEK",
|
||||
"Axpergle"
|
||||
],
|
||||
"status": "Retired - Last seen: 2016-06-07"
|
||||
}
|
||||
"refs": [
|
||||
"https://blogs.sophos.com/2015/07/21/a-closer-look-at-the-angler-exploit-kit/",
|
||||
"http://malware.dontneedcoffee.com/2015/12/xxx-is-angler-ek.html",
|
||||
"http://malware.dontneedcoffee.com/2016/06/is-it-end-of-angler.html"
|
||||
]
|
||||
},
|
||||
"description": "The Angler Exploit Kit has been the most popular and evolved exploit kit from 2014 to middle of 2016. There was several variation. The historical \"indexm\" variant was used to spread Lurk. A vip version used notabily to spread Poweliks, the \"standard\" commercial version, and a declinaison tied to load selling (mostly bankers) that can be associated to EmpirePPC",
|
||||
"value": "Angler"
|
||||
},
|
||||
{
|
||||
"value": "Archie",
|
||||
"description": "Archie EK",
|
||||
"meta": {
|
||||
"status": "Retired",
|
||||
"refs": [
|
||||
"https://www.alienvault.com/blogs/labs-research/archie-just-another-exploit-kit"
|
||||
],
|
||||
"status": "Retired"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": "Archie EK",
|
||||
"value": "Archie"
|
||||
},
|
||||
{
|
||||
"value": "BlackHole",
|
||||
"description": "The BlackHole Exploit Kit has been the most popular exploit kit from 2011 to 2013. Its activity stopped with Paunch's arrest (all activity since then is anecdotal and based on an old leak)",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"https://www.trustwave.com/Resources/SpiderLabs-Blog/Blackhole-Exploit-Kit-v2/",
|
||||
"https://nakedsecurity.sophos.com/exploring-the-blackhole-exploit-kit/"
|
||||
],
|
||||
"status": "Retired - Last seen: 2013-10-07",
|
||||
"synonyms": [
|
||||
"BHEK"
|
||||
],
|
||||
"status": "Retired - Last seen: 2013-10-07"
|
||||
}
|
||||
"refs": [
|
||||
"https://www.trustwave.com/Resources/SpiderLabs-Blog/Blackhole-Exploit-Kit-v2/",
|
||||
"https://nakedsecurity.sophos.com/exploring-the-blackhole-exploit-kit/"
|
||||
]
|
||||
},
|
||||
"description": "The BlackHole Exploit Kit has been the most popular exploit kit from 2011 to 2013. Its activity stopped with Paunch's arrest (all activity since then is anecdotal and based on an old leak)",
|
||||
"value": "BlackHole"
|
||||
},
|
||||
{
|
||||
"value": "Bleeding Life",
|
||||
"description": "Bleeding Life is an exploit kit that became open source with its version 2",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"http://www.kahusecurity.com/2011/flash-used-in-idol-malvertisement/",
|
||||
"http://thehackernews.com/2011/10/bleeding-life-2-exploit-pack-released.html"
|
||||
],
|
||||
"status": "Retired",
|
||||
"synonyms": [
|
||||
"BL",
|
||||
"BL2"
|
||||
],
|
||||
"status": "Retired"
|
||||
}
|
||||
"refs": [
|
||||
"http://www.kahusecurity.com/2011/flash-used-in-idol-malvertisement/",
|
||||
"http://thehackernews.com/2011/10/bleeding-life-2-exploit-pack-released.html"
|
||||
]
|
||||
},
|
||||
"description": "Bleeding Life is an exploit kit that became open source with its version 2",
|
||||
"value": "Bleeding Life"
|
||||
},
|
||||
{
|
||||
"value": "Cool",
|
||||
"description": "The Cool Exploit Kit was a kind of BlackHole VIP in 2012/2013",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2012/10/newcoolek.html",
|
||||
"http://malware.dontneedcoffee.com/2013/07/a-styxy-cool-ek.html",
|
||||
"http://blog.trendmicro.com/trendlabs-security-intelligence/styx-exploit-pack-how-it-works/"
|
||||
],
|
||||
"status": "Retired - Last seen: 2013-10-07",
|
||||
"synonyms": [
|
||||
"CEK",
|
||||
"Styxy Cool"
|
||||
],
|
||||
"status": "Retired - Last seen: 2013-10-07"
|
||||
}
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2012/10/newcoolek.html",
|
||||
"http://malware.dontneedcoffee.com/2013/07/a-styxy-cool-ek.html",
|
||||
"http://blog.trendmicro.com/trendlabs-security-intelligence/styx-exploit-pack-how-it-works/"
|
||||
]
|
||||
},
|
||||
"description": "The Cool Exploit Kit was a kind of BlackHole VIP in 2012/2013",
|
||||
"value": "Cool"
|
||||
},
|
||||
{
|
||||
"value": "Fiesta",
|
||||
"description": "Fiesta Exploit Kit",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"http://blog.0x3a.com/post/110052845124/an-in-depth-analysis-of-the-fiesta-exploit-kit-an",
|
||||
"http://www.kahusecurity.com/2011/neosploit-is-back/"
|
||||
],
|
||||
"status": "Retired - Last Seen: beginning of 2015-07",
|
||||
"synonyms": [
|
||||
"NeoSploit",
|
||||
"Fiexp"
|
||||
],
|
||||
"status": "Retired - Last Seen: beginning of 2015-07"
|
||||
}
|
||||
"refs": [
|
||||
"http://blog.0x3a.com/post/110052845124/an-in-depth-analysis-of-the-fiesta-exploit-kit-an",
|
||||
"http://www.kahusecurity.com/2011/neosploit-is-back/"
|
||||
]
|
||||
},
|
||||
"description": "Fiesta Exploit Kit",
|
||||
"value": "Fiesta"
|
||||
},
|
||||
{
|
||||
"value": "FlashPack",
|
||||
"description": "FlashPack EK got multiple fork. The most common variant seen was the standalone Flash version",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2012/11/meet-critxpack-previously-vintage-pack.html",
|
||||
"http://malware.dontneedcoffee.com/2013/04/meet-safe-pack-v20-again.html"
|
||||
"status": "Retired - Last seen: 2016-12-29",
|
||||
"synonyms": [
|
||||
"RIG-E"
|
||||
],
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2016/10/rig-evolves-neutrino-waves-goodbye.html"
|
||||
]
|
||||
},
|
||||
"description": "The Empire Pack is a variation of RIG operated by a load seller. It's being fed by many traffic actors",
|
||||
"value": "Empire"
|
||||
},
|
||||
{
|
||||
"meta": {
|
||||
"status": "Retired - Last seen: middle of 2015-04",
|
||||
"synonyms": [
|
||||
"FlashEK",
|
||||
"SafePack",
|
||||
"CritXPack",
|
||||
"Vintage Pack"
|
||||
],
|
||||
"status": "Retired - Last seen: middle of 2015-04"
|
||||
}
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2012/11/meet-critxpack-previously-vintage-pack.html",
|
||||
"http://malware.dontneedcoffee.com/2013/04/meet-safe-pack-v20-again.html"
|
||||
]
|
||||
},
|
||||
"description": "FlashPack EK got multiple fork. The most common variant seen was the standalone Flash version",
|
||||
"value": "FlashPack"
|
||||
},
|
||||
{
|
||||
"value": "GrandSoft",
|
||||
"description": "GrandSoft Exploit Kit was a quite common exploit kit used in 2012/2013",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2013/09/FinallyGrandSoft.html",
|
||||
"http://malware.dontneedcoffee.com/2012/10/neosploit-now-showing-bh-ek-20-like.html",
|
||||
"https://nakedsecurity.sophos.com/2012/08/24/sophos-sucks-malware/"
|
||||
],
|
||||
"status": "Retired - Last seen: 2014-03",
|
||||
"synonyms": [
|
||||
"StampEK",
|
||||
"SofosFO"
|
||||
],
|
||||
"status": "Retired - Last seen: 2014-03"
|
||||
}
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2013/09/FinallyGrandSoft.html",
|
||||
"http://malware.dontneedcoffee.com/2012/10/neosploit-now-showing-bh-ek-20-like.html",
|
||||
"https://nakedsecurity.sophos.com/2012/08/24/sophos-sucks-malware/"
|
||||
]
|
||||
},
|
||||
"description": "GrandSoft Exploit Kit was a quite common exploit kit used in 2012/2013",
|
||||
"value": "GrandSoft"
|
||||
},
|
||||
{
|
||||
"value": "HanJuan",
|
||||
"description": "Hanjuan EK was a one actor fed variation of Angler EK used in evolved malvertising chain targeting USA. It has been using a 0day (CVE-2015-0313) from beginning of December 2014 till beginning of February 2015",
|
||||
"meta": {
|
||||
"status": "Retired - Last seen: 2015-07",
|
||||
"refs": [
|
||||
"http://www.malwaresigs.com/2013/10/14/unknown-ek/",
|
||||
"https://blog.malwarebytes.com/threat-analysis/2014/08/shining-some-light-on-the-unknown-exploit-kit/",
|
||||
"http://blog.trendmicro.com/trendlabs-security-intelligence/a-closer-look-at-the-exploit-kit-in-cve-2015-0313-attack",
|
||||
"https://twitter.com/kafeine/status/562575744501428226"
|
||||
],
|
||||
"status": "Retired - Last seen: 2015-07"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": "Hanjuan EK was a one actor fed variation of Angler EK used in evolved malvertising chain targeting USA. It has been using a 0day (CVE-2015-0313) from beginning of December 2014 till beginning of February 2015",
|
||||
"value": "HanJuan"
|
||||
},
|
||||
{
|
||||
"value": "Himan",
|
||||
"description": "Himan Exploit Kit",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2013/10/HiMan.html"
|
||||
],
|
||||
"status": "Retired - Last seen: 2014-04",
|
||||
"synonyms": [
|
||||
"High Load"
|
||||
],
|
||||
"status": "Retired - Last seen: 2014-04"
|
||||
}
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2013/10/HiMan.html"
|
||||
]
|
||||
},
|
||||
"description": "Himan Exploit Kit",
|
||||
"value": "Himan"
|
||||
},
|
||||
{
|
||||
"value": "Impact",
|
||||
"description": "Impact EK",
|
||||
"meta": {
|
||||
"status": "Retired",
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2012/12/inside-impact-exploit-kit-back-on-track.html"
|
||||
],
|
||||
"status": "Retired"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": "Impact EK",
|
||||
"value": "Impact"
|
||||
},
|
||||
{
|
||||
"value": "Infinity",
|
||||
"description": "Infinity is an evolution of Redkit",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"http://blog.talosintel.com/2013/11/im-calling-this-goon-exploit-kit-for-now.html",
|
||||
"http://www.kahusecurity.com/2014/the-resurrection-of-redkit/"
|
||||
],
|
||||
"status": "Retired - Last seen: 2014-07",
|
||||
"synonyms": [
|
||||
"Redkit v2.0",
|
||||
"Goon"
|
||||
],
|
||||
"status": "Retired - Last seen: 2014-07"
|
||||
}
|
||||
"refs": [
|
||||
"http://blog.talosintel.com/2013/11/im-calling-this-goon-exploit-kit-for-now.html",
|
||||
"http://www.kahusecurity.com/2014/the-resurrection-of-redkit/"
|
||||
]
|
||||
},
|
||||
"description": "Infinity is an evolution of Redkit",
|
||||
"value": "Infinity"
|
||||
},
|
||||
{
|
||||
"value": "Lightsout",
|
||||
"description": "Lightsout Exploit Kit has been used in Watering Hole attack performed by the APT Group havex",
|
||||
"meta": {
|
||||
"status": "Unknown - Last seen: 2014-03",
|
||||
"refs": [
|
||||
"http://blog.talosintel.com/2014/03/hello-new-exploit-kit.html",
|
||||
"http://blog.talosintel.com/2014/05/continued-analysis-of-lightsout-exploit.html",
|
||||
"http://malwageddon.blogspot.fr/2013/09/unknown-ek-by-way-how-much-is-fish.html"
|
||||
],
|
||||
"status": "Unknown - Last seen: 2014-03"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": "Lightsout Exploit Kit has been used in Watering Hole attack performed by the APT Group havex",
|
||||
"value": "Lightsout"
|
||||
},
|
||||
{
|
||||
"value": "Niteris",
|
||||
"description": "Niteris was used mainly to target Russian.",
|
||||
"meta": {
|
||||
"status": "Retired - Last seen 2017-03-09",
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2014/06/cottoncastle.html",
|
||||
"http://malware.dontneedcoffee.com/2015/05/another-look-at-niteris-post.html"
|
||||
],
|
||||
"http://malware.dontneedcoffee.com/2017/03/nebula-exploit-kit.html"
|
||||
]
|
||||
},
|
||||
"description": "Nebula Exploit Kit has been built on Sundown source and features an internal TDS",
|
||||
"value": "Nebula"
|
||||
},
|
||||
{
|
||||
"meta": {
|
||||
"status": "Unknown - Last seen: 2015-11",
|
||||
"synonyms": [
|
||||
"CottonCastle"
|
||||
],
|
||||
"status": "Unknown - Last seen: 2015-11"
|
||||
}
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2014/06/cottoncastle.html",
|
||||
"http://malware.dontneedcoffee.com/2015/05/another-look-at-niteris-post.html"
|
||||
]
|
||||
},
|
||||
"description": "Niteris was used mainly to target Russian.",
|
||||
"value": "Niteris"
|
||||
},
|
||||
{
|
||||
"value": "Nuclear",
|
||||
"description": "The Nuclear Pack appeared in 2009 and has been one of the longer living one. Spartan EK was a landing less variation of Nuclear Pack",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"http://blog.checkpoint.com/2016/05/17/inside-nuclears-core-unraveling-a-ransomware-as-a-service-infrastructure/"
|
||||
],
|
||||
"status": "Retired - Last seen: 2015-04-30",
|
||||
"synonyms": [
|
||||
"NEK",
|
||||
"Nuclear Pack",
|
||||
"Spartan",
|
||||
"Neclu"
|
||||
],
|
||||
"status": "Retired - Last seen: 2015-04-30"
|
||||
}
|
||||
"refs": [
|
||||
"http://blog.checkpoint.com/2016/05/17/inside-nuclears-core-unraveling-a-ransomware-as-a-service-infrastructure/"
|
||||
]
|
||||
},
|
||||
"description": "The Nuclear Pack appeared in 2009 and has been one of the longer living one. Spartan EK was a landing less variation of Nuclear Pack",
|
||||
"value": "Nuclear"
|
||||
},
|
||||
{
|
||||
"value": "Phoenix",
|
||||
"description": "Phoenix Exploit Kit",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"http://malwareint.blogspot.fr/2010/09/phoenix-exploits-kit-v21-inside.html",
|
||||
"http://blog.trendmicro.com/trendlabs-security-intelligence/now-exploiting-phoenix-exploit-kit-version-2-5/"
|
||||
],
|
||||
"status": "Retired",
|
||||
"synonyms": [
|
||||
"PEK"
|
||||
],
|
||||
"status": "Retired"
|
||||
}
|
||||
"refs": [
|
||||
"http://malwareint.blogspot.fr/2010/09/phoenix-exploits-kit-v21-inside.html",
|
||||
"http://blog.trendmicro.com/trendlabs-security-intelligence/now-exploiting-phoenix-exploit-kit-version-2-5/"
|
||||
]
|
||||
},
|
||||
"description": "Phoenix Exploit Kit",
|
||||
"value": "Phoenix"
|
||||
},
|
||||
{
|
||||
"value": "Private Exploit Pack",
|
||||
"description": "Private Exploit Pack",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2013/07/pep-new-bep.html",
|
||||
"http://malwageddon.blogspot.fr/2013/07/unknown-ek-well-hey-hey-i-wanna-be.html"
|
||||
],
|
||||
"status": "Retired",
|
||||
"synonyms": [
|
||||
"PEP"
|
||||
],
|
||||
"status": "Retired"
|
||||
}
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2013/07/pep-new-bep.html",
|
||||
"http://malwageddon.blogspot.fr/2013/07/unknown-ek-well-hey-hey-i-wanna-be.html"
|
||||
]
|
||||
},
|
||||
"description": "Private Exploit Pack",
|
||||
"value": "Private Exploit Pack"
|
||||
},
|
||||
{
|
||||
"value": "Redkit",
|
||||
"description": "Redkit has been a major exploit kit in 2012. One of its specific features was to allow its access against a share of a percentage of the customer's traffic",
|
||||
"meta": {
|
||||
"status": "Retired",
|
||||
"refs": [
|
||||
"https://www.trustwave.com/Resources/SpiderLabs-Blog/A-Wild-Exploit-Kit-Appears----Meet-RedKit/",
|
||||
"http://malware.dontneedcoffee.com/2012/05/inside-redkit.html",
|
||||
"https://nakedsecurity.sophos.com/2013/05/09/redkit-exploit-kit-part-2/"
|
||||
],
|
||||
"status": "Retired"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": "Redkit has been a major exploit kit in 2012. One of its specific features was to allow its access against a share of a percentage of the customer's traffic",
|
||||
"value": "Redkit"
|
||||
},
|
||||
{
|
||||
"value": "Sakura",
|
||||
"description": "Description Here",
|
||||
"meta": {
|
||||
"status": "Retired - Last seen: 2013-09",
|
||||
"refs": [
|
||||
"http://www.xylibox.com/2012/01/sakura-exploit-pack-10.html"
|
||||
],
|
||||
"status": "Retired - Last seen: 2013-09"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": "Description Here",
|
||||
"value": "Sakura"
|
||||
},
|
||||
{
|
||||
"value": "Sweet-Orange",
|
||||
"description": "Sweet Orange",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2012/12/juice-sweet-orange-2012-12.html"
|
||||
"colour": "#C03701",
|
||||
"status": "Retired - Last seen 2017-03-08",
|
||||
"synonyms": [
|
||||
"Beps",
|
||||
"Xer",
|
||||
"Beta"
|
||||
],
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2015/06/fast-look-at-sundown-ek.html",
|
||||
"https://www.virusbulletin.com/virusbulletin/2015/06/beta-exploit-pack-one-more-piece-crimeware-infection-road"
|
||||
]
|
||||
},
|
||||
"description": "Sundown Exploit Kit is mainly built out of stolen code from other exploit kits",
|
||||
"value": "Sundown"
|
||||
},
|
||||
{
|
||||
"meta": {
|
||||
"status": "Retired - Last seen: 2015-04-05",
|
||||
"synonyms": [
|
||||
"SWO",
|
||||
"Anogre"
|
||||
],
|
||||
"status": "Retired - Last seen: 2015-04-05"
|
||||
}
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2012/12/juice-sweet-orange-2012-12.html"
|
||||
]
|
||||
},
|
||||
"description": "Sweet Orange",
|
||||
"value": "Sweet-Orange"
|
||||
},
|
||||
{
|
||||
"value": "Styx",
|
||||
"description": "Styx Exploit Kit",
|
||||
"meta": {
|
||||
"status": "Retired - Last seen: 2014-06",
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2012/12/crossing-styx-styx-sploit-pack-20-cve.html",
|
||||
"https://krebsonsecurity.com/2013/07/styx-exploit-pack-domo-arigato-pc-roboto/",
|
||||
"http://malware.dontneedcoffee.com/2013/05/inside-styx-2013-05.html"
|
||||
],
|
||||
"status": "Retired - Last seen: 2014-06"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": "Styx Exploit Kit",
|
||||
"value": "Styx"
|
||||
},
|
||||
{
|
||||
"value": "Unknown",
|
||||
"description": "Unknown Exploit Kit. This is a place holder for any undocumented Exploit Kit. If you use this tag, we will be more than happy to give the associated EK a deep look.",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"https://twitter.com/kafeine",
|
||||
"https://twitter.com/node5",
|
||||
"https://twitter.com/kahusecurity"
|
||||
]
|
||||
}
|
||||
},
|
||||
"description": "Unknown Exploit Kit. This is a place holder for any undocumented Exploit Kit. If you use this tag, we will be more than happy to give the associated EK a deep look.",
|
||||
"value": "Unknown"
|
||||
}
|
||||
],
|
||||
"version": 3,
|
||||
"uuid": "454f4e78-bd7c-11e6-a4a6-cec0c932ce01",
|
||||
"description": "Exploit-Kit is an enumeration of some exploitation kits used by adversaries. The list includes document, browser and router exploit kits.It's not meant to be totally exhaustive but aim at covering the most seen in the past 5 years",
|
||||
"authors": [
|
||||
"Kafeine",
|
||||
"Will Metcalf",
|
||||
"KahuSecurity"
|
||||
],
|
||||
"source": "MISP Project",
|
||||
"type": "exploit-kit",
|
||||
"name": "Exploit-Kit"
|
||||
]
|
||||
}
|
||||
|
|
|
|||
2937
clusters/tool.json
2937
clusters/tool.json
File diff suppressed because it is too large
Load diff
Loading…
Reference in a new issue