add tools used by TA505 + others

clusters/backdoor.json

@@ -90,7 +90,16 @@
       },
       "uuid": "b7ad60a0-d648-4775-adec-c78b1a92fc34",
       "value": "Asruex"
+    },
+    {
+      "meta": {
+        "refs": [
+          "https://securityintelligence.com/news/ta505-delivers-new-gelup-malware-tool-flowerpippi-backdoor-via-spam-campaign/"
+        ]
+      },
+      "uuid": "aefe3603-8f96-425c-9f71-9fe21334f224",
+      "value": "FlowerPippi"
     }
   ],
-  "version": 6
+  "version": 7
 }

clusters/ransomware.json

@@ -13696,7 +13696,20 @@
       },
       "uuid": "000fb0bf-8be3-4ff1-8bbd-cc0513bcdd89",
       "value": "RobinHood"
+    },
+    {
+      "description": "Bart ransomware is distributed by the same Russian Cyber Mafia behind Dridex 220 and Locky.  Bart doesn't communicate with a command and control (C&C) server, so it can encrypt files without being connected to a computer.\nBart is spread to end users via phishing emails containing .zip attachments with JavaScript Code and use social engineering to trick users into opening the 'photo' attachments. The zipped files are obfuscated to make it more hard to tell what actions they are performing. See screenshot above for an example of what they look like. If opened, these attachments download and install the intermediary loader RockLoader which downloads Bart onto the machine over HTTPS.\nOnce executed, it will first check the language on the infected computer. If the malware detects Russian, Belorussian, or Ukrainian, the ransomware will terminate and will not proceed with the infection. If it's any other language, it will start scanning the computer for certain file extensions to encrypt.\nBecause Bart does not require communication with C&C infrastructure prior to encrypting files, Bart could possibly encrypt machines sitting behind corporate firewalls that would otherwise block such traffic. Thus, organizations need to ensure that Bart is blocked at the email gateway using rules that block zipped executables.",
+      "meta": {
+        "refs": [
+          "https://www.knowbe4.com/bart-ransomware"
+        ],
+        "synonyms": [
+          "Locky Bart"
+        ]
+      },
+      "uuid": "05d5263f-ec23-4279-bb98-55fc233d7e89",
+      "value": "Bart ransomware"
     }
   ],
-  "version": 79
+  "version": 80
 }

clusters/tool.json

@@ -7965,7 +7965,20 @@
       },
       "uuid": "e537e165-ea8b-4e75-8813-6519632d3f6a",
       "value": "LiquorBot"
+    },
+    {
+      "description": "Written in C++ and designed to function as a downloader of other malware, Gelup stood out for its obfuscation techniques. Gelup can also bypass User Account Control (UAC) by mocking trusted directories, abusing auto-elevated executables and using the Dynamic Link Library (DLL) side-loading technique.",
+      "meta": {
+        "refs": [
+          "https://securityintelligence.com/news/ta505-delivers-new-gelup-malware-tool-flowerpippi-backdoor-via-spam-campaign/"
+        ],
+        "synonyms": [
+          "AndroMut"
+        ]
+      },
+      "uuid": "32a6065c-4f4e-4a60-8717-5872b5f21ac4",
+      "value": "Gelup malware tool"
     }
   ],
-  "version": 132
+  "version": 133
 }