mirror of
https://github.com/MISP/misp-galaxy.git
synced 2024-11-26 16:57:18 +00:00
GitHub
commit
fa49ca127c
1 changed files with 100 additions and 68 deletions
|
|
@ -11,11 +11,26 @@
|
|||
"synonyms": [
|
||||
"Stegano EK"
|
||||
],
|
||||
"status": "Unknown - Last Seen 2016-12-07"
|
||||
"status": "Active"
|
||||
}
|
||||
},
|
||||
{
|
||||
"value": "DealersChoice",
|
||||
}
|
||||
,
|
||||
{ "value": "Terror EK",
|
||||
"description": "Terror EK is built on Hunter, Sundown and RIG EK code",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"https://www.trustwave.com/Resources/SpiderLabs-Blog/Terror-Exploit-Kit--More-like-Error-Exploit-Kit/"
|
||||
],
|
||||
"synonyms": [
|
||||
"Blaze EK",
|
||||
"Neptune EK"
|
||||
]
|
||||
,
|
||||
"status": "Active"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "DealersChoice",
|
||||
"description": "DealersChoice is a Flash Player Exploit platform triggered by RTF",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -41,22 +56,9 @@
|
|||
],
|
||||
"status": "Active"
|
||||
}
|
||||
},
|
||||
{
|
||||
"value": "Empire",
|
||||
"description": "The Empire Pack is a variation of RIG operated by a load seller. It's being fed by many traffic actors",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2016/10/rig-evolves-neutrino-waves-goodbye.html"
|
||||
],
|
||||
"synonyms": [
|
||||
"RIG-E"
|
||||
],
|
||||
"status": "Unknown - Last seen: 2016-12-29"
|
||||
}
|
||||
},
|
||||
{
|
||||
"value": "Hunter",
|
||||
,
|
||||
{ "value": "Hunter",
|
||||
"description": "Hunter EK is an evolution of 3Ros EK",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -89,7 +91,8 @@
|
|||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2013/10/Magnitude.html",
|
||||
"https://www.trustwave.com/Resources/SpiderLabs-Blog/A-Peek-Into-the-Lion-s-Den-%E2%80%93-The-Magnitude--aka-PopAds--Exploit-Kit/",
|
||||
"http://malware.dontneedcoffee.com/2014/02/and-real-name-of-magnitude-is.html"
|
||||
"http://malware.dontneedcoffee.com/2014/02/and-real-name-of-magnitude-is.html",
|
||||
"https://community.rsa.com/community/products/netwitness/blog/2017/02/09/magnitude-exploit-kit-under-the-hood"
|
||||
],
|
||||
"synonyms": [
|
||||
"Popads EK",
|
||||
|
|
@ -108,9 +111,9 @@
|
|||
],
|
||||
"status": "Active"
|
||||
}
|
||||
},
|
||||
{
|
||||
"value": "Neutrino",
|
||||
}
|
||||
,
|
||||
{ "value": "Neutrino",
|
||||
"description": "Neutrino Exploit Kit has been one of the major exploit kit from its launch in 2013 till september 2016 when it become private (defense name for this variation is Neutrino-v). This EK vanished from march 2014 till november 2014.",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -121,12 +124,13 @@
|
|||
"Job314",
|
||||
"Neutrino Rebooted",
|
||||
"Neutrino-v"
|
||||
],
|
||||
]
|
||||
,
|
||||
"status": "Active"
|
||||
}
|
||||
},
|
||||
{
|
||||
"value": "RIG",
|
||||
}
|
||||
,
|
||||
{ "value": "RIG",
|
||||
"description": "RIG is an exploit kit that takes its source in Infinity EK itself an evolution of Redkit. It became dominant after the fall of Angler, Nuclear Pack and the end of public access to Neutrino. RIG-v is the name given to RIG 4 when it was only accessible by \"vip\" customers and when RIG 3 was still in use.",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -166,7 +170,7 @@
|
|||
"synonyms": [
|
||||
"Sundown-b"
|
||||
],
|
||||
"status": "Active"
|
||||
"status": "Retired"
|
||||
}
|
||||
},
|
||||
{
|
||||
|
|
@ -182,23 +186,6 @@
|
|||
"status": "Active"
|
||||
}
|
||||
},
|
||||
{
|
||||
"value": "Sundown",
|
||||
"description": "Sundown Exploit Kit is mainly built out of stolen code from other exploit kits",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2015/06/fast-look-at-sundown-ek.html",
|
||||
"https://www.virusbulletin.com/virusbulletin/2015/06/beta-exploit-pack-one-more-piece-crimeware-infection-road"
|
||||
],
|
||||
"synonyms": [
|
||||
"Beps",
|
||||
"Xer",
|
||||
"Beta"
|
||||
],
|
||||
"status": "Active",
|
||||
"colour": "#C03701"
|
||||
}
|
||||
},
|
||||
{
|
||||
"value": "Angler",
|
||||
"description": "The Angler Exploit Kit has been the most popular and evolved exploit kit from 2014 to middle of 2016. There was several variation. The historical \"indexm\" variant was used to spread Lurk. A vip version used notabily to spread Poweliks, the \"standard\" commercial version, and a declinaison tied to load selling (mostly bankers) that can be associated to EmpirePPC",
|
||||
|
|
@ -282,12 +269,27 @@
|
|||
"synonyms": [
|
||||
"NeoSploit",
|
||||
"Fiexp"
|
||||
],
|
||||
]
|
||||
,
|
||||
"status": "Retired - Last Seen: beginning of 2015-07"
|
||||
}
|
||||
},
|
||||
{
|
||||
"value": "FlashPack",
|
||||
}
|
||||
,
|
||||
{ "value": "Empire",
|
||||
"description": "The Empire Pack is a variation of RIG operated by a load seller. It's being fed by many traffic actors",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2016/10/rig-evolves-neutrino-waves-goodbye.html"
|
||||
],
|
||||
"synonyms": [
|
||||
"RIG-E"
|
||||
]
|
||||
,
|
||||
"status": "Retired - Last seen: 2016-12-29"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "FlashPack",
|
||||
"description": "FlashPack EK got multiple fork. The most common variant seen was the standalone Flash version",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -382,6 +384,16 @@
|
|||
"status": "Unknown - Last seen: 2014-03"
|
||||
}
|
||||
},
|
||||
{ "value": "Nebula",
|
||||
"description": "Nebula Exploit Kit has been built on Sundown source and features an internal TDS",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2017/03/nebula-exploit-kit.html"
|
||||
],
|
||||
"status": "Retired - Last seen 2017-03-09"
|
||||
}
|
||||
}
|
||||
,
|
||||
{
|
||||
"value": "Niteris",
|
||||
"description": "Niteris was used mainly to target Russian.",
|
||||
|
|
@ -461,7 +473,27 @@
|
|||
],
|
||||
"status": "Retired - Last seen: 2013-09"
|
||||
}
|
||||
},
|
||||
}
|
||||
,
|
||||
{
|
||||
"value": "Sundown",
|
||||
"description": "Sundown Exploit Kit is mainly built out of stolen code from other exploit kits",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2015/06/fast-look-at-sundown-ek.html",
|
||||
"https://www.virusbulletin.com/virusbulletin/2015/06/beta-exploit-pack-one-more-piece-crimeware-infection-road"
|
||||
],
|
||||
"synonyms": [
|
||||
"Beps",
|
||||
"Xer",
|
||||
"Beta"
|
||||
],
|
||||
"status": "Retired - Last seen 2017-03-08",
|
||||
"colour": "#C03701"
|
||||
}
|
||||
}
|
||||
|
||||
,
|
||||
{
|
||||
"value": "Sweet-Orange",
|
||||
"description": "Sweet Orange",
|
||||
|
|
@ -499,8 +531,8 @@
|
|||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"version": 3,
|
||||
],
|
||||
"version": 5,
|
||||
"uuid": "454f4e78-bd7c-11e6-a4a6-cec0c932ce01",
|
||||
"description": "Exploit-Kit is an enumeration of some exploitation kits used by adversaries. The list includes document, browser and router exploit kits.It's not meant to be totally exhaustive but aim at covering the most seen in the past 5 years",
|
||||
"authors": [
|
||||
|
|
|
|||
Loading…
Reference in a new issue