adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/58d38baa-a47c-40c5-8c8f-45b4950d210f.json

520 lines
19 KiB
JSON
Raw Permalink Normal View History

chg: [feed] added
2023-04-21 13:25:09 +00:00
{
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"Event": {
"analysis": "2",
"date": "2017-03-23",
"extends_uuid": "",
"info": "OSINT - Winnti Abuses GitHub for C&C Communications",
"publish_timestamp": "1490261675",
"published": true,
"threat_level_id": "2",
"timestamp": "1490261359",
"uuid": "58d38baa-a47c-40c5-8c8f-45b4950d210f",
"Orgc": {
"name": "CIRCL",
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
},
"Tag": [
{
"colour": "#ffffff",
chg: [feed] updated
2024-04-05 12:15:17 +00:00
"local": false,
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"name": "tlp:white",
"relationship_type": ""
},
{
"colour": "#00223b",
chg: [feed] updated
2024-04-05 12:15:17 +00:00
"local": false,
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"name": "osint:source-type=\"blog-post\"",
"relationship_type": ""
},
{
"colour": "#064800",
chg: [feed] updated
2024-04-05 12:15:17 +00:00
"local": false,
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"name": "misp-galaxy:tool=\"Winnti\"",
"relationship_type": ""
}
],
"Attribute": [
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261359",
"to_ids": false,
"type": "link",
"uuid": "58d38bd6-fd08-43d4-b092-4586950d210f",
"value": "http://blog.trendmicro.com/trendlabs-security-intelligence/winnti-abuses-github/",
"Tag": [
{
"colour": "#ffffff",
chg: [feed] updated
2024-04-05 12:15:17 +00:00
"local": false,
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"name": "tlp:white",
"relationship_type": ""
},
{
"colour": "#00223b",
chg: [feed] updated
2024-04-05 12:15:17 +00:00
"local": false,
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"name": "osint:source-type=\"blog-post\"",
"relationship_type": ""
},
{
"colour": "#001fc2",
chg: [feed] updated
2024-04-05 12:15:17 +00:00
"local": false,
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"name": "estimative-language:likelihood-probability=\"almost-certain\"",
"relationship_type": ""
},
{
"colour": "#075200",
chg: [feed] updated
2024-04-05 12:15:17 +00:00
"local": false,
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"name": "admiralty-scale:source-reliability=\"b\"",
"relationship_type": ""
}
]
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261359",
"to_ids": false,
"type": "text",
"uuid": "58d38bea-6cd0-4bb7-86f6-4534950d210f",
"value": "Developers constantly need to modify and rework their source codes when releasing new versions of applications or coding projects they create and maintain. This is what makes GitHub\u00e2\u20ac\u201dan online repository hosting service that provides version control management\u00e2\u20ac\u201dpopular. In many ways, it\u00e2\u20ac\u2122s like a social networking site for programmers and developers, one that provides a valuable platform for code management, sharing, collaboration, and integration.\r\n\r\nGitHub is no stranger to misuse, however. Open-source ransomware projects EDA2 and Hidden Tear\u00e2\u20ac\u201dsupposedly created for educational purposes\u00e2\u20ac\u201dwere hosted on GitHub, and have since spawned various offshoots that have been found targeting enterprises. Tools that exploited vulnerabilities in Internet of Things (IoT) devices were also made available on GitHub. Even the Limitless Keylogger, which was used in targeted attacks, was linked to a GitHub project.\r\n\r\nRecently, the Winnti group, a threat actor with a past of traditional cybercrime -particularly with financial fraud, has been seen abusing GitHub by turning it into a conduit for the command and control (C&C) communications of their seemingly new backdoor (detected by Trend Micro as BKDR64_WINNTI.ONM).\r\n\r\nOur research also showed that the group still uses some of the infamous PlugX malware variants\u00e2\u20ac\u201da staple in Winnti\u00e2\u20ac\u2122s arsenal\u00e2\u20ac\u201dto handle targeted attack operations via the GitHub account we identified.",
"Tag": [
{
"colour": "#ffffff",
chg: [feed] updated
2024-04-05 12:15:17 +00:00
"local": false,
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"name": "tlp:white",
"relationship_type": ""
},
{
"colour": "#00223b",
chg: [feed] updated
2024-04-05 12:15:17 +00:00
"local": false,
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"name": "osint:source-type=\"blog-post\"",
"relationship_type": ""
},
{
"colour": "#001fc2",
chg: [feed] updated
2024-04-05 12:15:17 +00:00
"local": false,
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"name": "estimative-language:likelihood-probability=\"almost-certain\"",
"relationship_type": ""
},
{
"colour": "#075200",
chg: [feed] updated
2024-04-05 12:15:17 +00:00
"local": false,
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"name": "admiralty-scale:source-reliability=\"b\"",
"relationship_type": ""
}
]
},
{
"category": "Payload delivery",
"comment": "cryptbase.dll",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261359",
"to_ids": true,
"type": "sha256",
"uuid": "58d393bd-bf10-4b1e-9cbf-4ebc950d210f",
"value": "06b077e31a6f339c4f3b1f61ba9a6a6ba827afe52ed5bed6a6bf56bf18a279ba"
},
{
"category": "Payload delivery",
"comment": "loadperf.dll",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261359",
"to_ids": true,
"type": "sha256",
"uuid": "58d393be-6cb4-4753-8e81-4306950d210f",
"value": "1e63a7186886deea6c4e5c2a329eab76a60be3a65bca1ba9ed6e71f9a46b7e9d"
},
{
"category": "Payload delivery",
"comment": "loadoerf.ini",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261359",
"to_ids": true,
"type": "sha256",
"uuid": "58d393bf-f3f0-4c43-81a3-461b950d210f",
"value": "7c37ebb96c54d5d8ea232951ccf56cb1d029facdd6b730f80ca2ad566f6c5d9b"
},
{
"category": "Payload delivery",
"comment": "wbemcomn.ini",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261359",
"to_ids": true,
"type": "sha256",
"uuid": "58d393c0-18f8-4311-b6a1-4cb5950d210f",
"value": "9d04ef8708cf030b9688bf3e8287c1790023a76374e43bd332178e212420f9fb"
},
{
"category": "Payload delivery",
"comment": "cryptbase.ini",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261359",
"to_ids": true,
"type": "sha256",
"uuid": "58d393c0-5a30-47ca-be06-4960950d210f",
"value": "b1a0d0508ee932bbf91625330d2136f33344ed70cb25f7e64be0620d32c4b9e2"
},
{
"category": "Payload delivery",
"comment": "wbemcomn.dll",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261359",
"to_ids": true,
"type": "sha256",
"uuid": "58d393c1-75a4-42d5-915a-4c77950d210f",
"value": "e5273b72c853f12b77a11e9c08ae6432fabbb32238ac487af2fb959a6cc26089"
},
{
"category": "Network activity",
"comment": "443 (HTTPS) 53 (DNS) 80 (HTTP)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261359",
"to_ids": true,
"type": "ip-dst",
"uuid": "58d3950a-ffb4-4a6b-a442-4e10950d210f",
"value": "160.16.243.129"
},
{
"category": "Network activity",
"comment": "443 (HTTPS) 53 (DNS)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261359",
"to_ids": true,
"type": "ip-dst",
"uuid": "58d3950b-d098-49b4-8ad8-4255950d210f",
"value": "174.139.203.18"
},
{
"category": "Network activity",
"comment": "53 (DNS)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261359",
"to_ids": true,
"type": "ip-dst",
"uuid": "58d3950c-6c0c-41fc-b0ff-4e3c950d210f",
"value": "174.139.203.20"
},
{
"category": "Network activity",
"comment": "443 (HTTPS) 53 (DNS)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261359",
"to_ids": true,
"type": "ip-dst",
"uuid": "58d3950d-9778-4477-93b7-4192950d210f",
"value": "174.139.203.22"
},
{
"category": "Network activity",
"comment": "53 (DNS)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261359",
"to_ids": true,
"type": "ip-dst",
"uuid": "58d3950e-4164-48d4-bda4-45f8950d210f",
"value": "174.139.203.27"
},
{
"category": "Network activity",
"comment": "53 (DNS)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261359",
"to_ids": true,
"type": "ip-dst",
"uuid": "58d3950f-6e7c-4959-8f43-4f6b950d210f",
"value": "174.139.203.34"
},
{
"category": "Network activity",
"comment": "80 (HTTP)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261359",
"to_ids": true,
"type": "ip-dst",
"uuid": "58d39510-5840-4bba-b5d3-43a1950d210f",
"value": "174.139.62.58"
},
{
"category": "Network activity",
"comment": "443 (HTTPS) 53 (DNS) 80 (HTTP)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261359",
"to_ids": true,
"type": "ip-dst",
"uuid": "58d39511-d928-4adc-a65c-41ec950d210f",
"value": "174.139.62.60"
},
{
"category": "Network activity",
"comment": "443 (HTTPS)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261359",
"to_ids": true,
"type": "ip-dst",
"uuid": "58d39512-beac-4951-bd97-422f950d210f",
"value": "174.139.62.61"
},
{
"category": "Network activity",
"comment": "443 (HTTPS) 53 (DNS) 80 (HTTP)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261359",
"to_ids": true,
"type": "ip-dst",
"uuid": "58d39512-63ac-4119-b1d1-404c950d210f",
"value": "61.195.98.245"
},
{
"category": "Network activity",
"comment": "443 (HTTPS) 53 (DNS)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261359",
"to_ids": true,
"type": "ip-dst",
"uuid": "58d39513-3674-4298-83a5-4e97950d210f",
"value": "67.198.161.250"
},
{
"category": "Network activity",
"comment": "443 (HTTPS)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261359",
"to_ids": true,
"type": "ip-dst",
"uuid": "58d39514-ac10-4112-9f4a-44c6950d210f",
"value": "67.198.161.251"
},
{
"category": "Network activity",
"comment": "443 (HTTPS)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261359",
"to_ids": true,
"type": "ip-dst",
"uuid": "58d39515-1c68-4743-8f45-4132950d210f",
"value": "67.198.161.252"
},
{
"category": "Payload delivery",
"comment": "wbemcomn.dll - Xchecked via VT: e5273b72c853f12b77a11e9c08ae6432fabbb32238ac487af2fb959a6cc26089",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261378",
"to_ids": true,
"type": "sha1",
"uuid": "58d39582-f3b8-4540-bc74-478a02de0b81",
"value": "08afbd47ce5f4e296d375b3a2d069993e09c090f"
},
{
"category": "Payload delivery",
"comment": "wbemcomn.dll - Xchecked via VT: e5273b72c853f12b77a11e9c08ae6432fabbb32238ac487af2fb959a6cc26089",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261379",
"to_ids": true,
"type": "md5",
"uuid": "58d39583-c104-4652-a263-44f802de0b81",
"value": "3301341e7e769c92aefb07e4bec15ad2"
},
{
"category": "External analysis",
"comment": "wbemcomn.dll - Xchecked via VT: e5273b72c853f12b77a11e9c08ae6432fabbb32238ac487af2fb959a6cc26089",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261380",
"to_ids": false,
"type": "link",
"uuid": "58d39584-3f08-4842-848f-475602de0b81",
"value": "https://www.virustotal.com/file/e5273b72c853f12b77a11e9c08ae6432fabbb32238ac487af2fb959a6cc26089/analysis/1490216161/"
},
{
"category": "Payload delivery",
"comment": "cryptbase.ini - Xchecked via VT: b1a0d0508ee932bbf91625330d2136f33344ed70cb25f7e64be0620d32c4b9e2",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261381",
"to_ids": true,
"type": "sha1",
"uuid": "58d39585-7cf8-45ba-8f84-48a202de0b81",
"value": "5e23c5b5f21c0a6f894d636cd4f4469bf28b53ba"
},
{
"category": "Payload delivery",
"comment": "cryptbase.ini - Xchecked via VT: b1a0d0508ee932bbf91625330d2136f33344ed70cb25f7e64be0620d32c4b9e2",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261382",
"to_ids": true,
"type": "md5",
"uuid": "58d39586-7de0-4c69-b715-4bb902de0b81",
"value": "802890514844f6bab0cb2004c52025d6"
},
{
"category": "External analysis",
"comment": "cryptbase.ini - Xchecked via VT: b1a0d0508ee932bbf91625330d2136f33344ed70cb25f7e64be0620d32c4b9e2",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261383",
"to_ids": false,
"type": "link",
"uuid": "58d39587-6484-49c5-8cf5-43ac02de0b81",
"value": "https://www.virustotal.com/file/b1a0d0508ee932bbf91625330d2136f33344ed70cb25f7e64be0620d32c4b9e2/analysis/1490216160/"
},
{
"category": "Payload delivery",
"comment": "wbemcomn.ini - Xchecked via VT: 9d04ef8708cf030b9688bf3e8287c1790023a76374e43bd332178e212420f9fb",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261384",
"to_ids": true,
"type": "sha1",
"uuid": "58d39588-a408-45a0-a2fa-4ba502de0b81",
"value": "51891247e3caa4e4f8f71b2eaf8ba47602dc0be1"
},
{
"category": "Payload delivery",
"comment": "wbemcomn.ini - Xchecked via VT: 9d04ef8708cf030b9688bf3e8287c1790023a76374e43bd332178e212420f9fb",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261385",
"to_ids": true,
"type": "md5",
"uuid": "58d39589-a960-47cc-9923-483e02de0b81",
"value": "5b1852311cc9f5ccdddf35a9c473ab27"
},
{
"category": "External analysis",
"comment": "wbemcomn.ini - Xchecked via VT: 9d04ef8708cf030b9688bf3e8287c1790023a76374e43bd332178e212420f9fb",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261386",
"to_ids": false,
"type": "link",
"uuid": "58d3958a-3b38-414e-96a1-4e8502de0b81",
"value": "https://www.virustotal.com/file/9d04ef8708cf030b9688bf3e8287c1790023a76374e43bd332178e212420f9fb/analysis/1490216160/"
},
{
"category": "Payload delivery",
"comment": "loadoerf.ini - Xchecked via VT: 7c37ebb96c54d5d8ea232951ccf56cb1d029facdd6b730f80ca2ad566f6c5d9b",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261387",
"to_ids": true,
"type": "sha1",
"uuid": "58d3958b-0dd0-40a0-97d2-446102de0b81",
"value": "1eddc0e76f1dd787091cfdcf98a058dd4319fd34"
},
{
"category": "Payload delivery",
"comment": "loadoerf.ini - Xchecked via VT: 7c37ebb96c54d5d8ea232951ccf56cb1d029facdd6b730f80ca2ad566f6c5d9b",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261388",
"to_ids": true,
"type": "md5",
"uuid": "58d3958c-6118-4f70-aec5-463102de0b81",
"value": "c7d0ec5b742ee497b9ee536f23586949"
},
{
"category": "External analysis",
"comment": "loadoerf.ini - Xchecked via VT: 7c37ebb96c54d5d8ea232951ccf56cb1d029facdd6b730f80ca2ad566f6c5d9b",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261389",
"to_ids": false,
"type": "link",
"uuid": "58d3958d-3960-4962-8469-497502de0b81",
"value": "https://www.virustotal.com/file/7c37ebb96c54d5d8ea232951ccf56cb1d029facdd6b730f80ca2ad566f6c5d9b/analysis/1489477860/"
},
{
"category": "Payload delivery",
"comment": "loadperf.dll - Xchecked via VT: 1e63a7186886deea6c4e5c2a329eab76a60be3a65bca1ba9ed6e71f9a46b7e9d",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261390",
"to_ids": true,
"type": "sha1",
"uuid": "58d3958e-f960-4209-8de4-4e5f02de0b81",
"value": "64093d8dbf2e108c73fb5f96bbf0c2fcd8975c94"
},
{
"category": "Payload delivery",
"comment": "loadperf.dll - Xchecked via VT: 1e63a7186886deea6c4e5c2a329eab76a60be3a65bca1ba9ed6e71f9a46b7e9d",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261391",
"to_ids": true,
"type": "md5",
"uuid": "58d3958f-2bf4-431b-a40d-41ed02de0b81",
"value": "879ce99e253e598a3c156258a9e81457"
},
{
"category": "External analysis",
"comment": "loadperf.dll - Xchecked via VT: 1e63a7186886deea6c4e5c2a329eab76a60be3a65bca1ba9ed6e71f9a46b7e9d",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261392",
"to_ids": false,
"type": "link",
"uuid": "58d39590-87e0-4b5e-9143-4fff02de0b81",
"value": "https://www.virustotal.com/file/1e63a7186886deea6c4e5c2a329eab76a60be3a65bca1ba9ed6e71f9a46b7e9d/analysis/1490193118/"
},
{
"category": "Payload delivery",
"comment": "cryptbase.dll - Xchecked via VT: 06b077e31a6f339c4f3b1f61ba9a6a6ba827afe52ed5bed6a6bf56bf18a279ba",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261393",
"to_ids": true,
"type": "sha1",
"uuid": "58d39591-8ed8-4334-a252-473902de0b81",
"value": "1a20d3333e220f6fe2980dff119705c0ddc59604"
},
{
"category": "Payload delivery",
"comment": "cryptbase.dll - Xchecked via VT: 06b077e31a6f339c4f3b1f61ba9a6a6ba827afe52ed5bed6a6bf56bf18a279ba",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261394",
"to_ids": true,
"type": "md5",
"uuid": "58d39592-3394-4c30-9626-4f5202de0b81",
"value": "5b2484ad1f74f2c19ff0d29e63c773d8"
},
{
"category": "External analysis",
"comment": "cryptbase.dll - Xchecked via VT: 06b077e31a6f339c4f3b1f61ba9a6a6ba827afe52ed5bed6a6bf56bf18a279ba",
"deleted": false,
"disable_correlation": false,
"timestamp": "1490261395",
"to_ids": false,
"type": "link",
"uuid": "58d39593-73e0-45fe-9265-4f1002de0b81",
"value": "https://www.virustotal.com/file/06b077e31a6f339c4f3b1f61ba9a6a6ba827afe52ed5bed6a6bf56bf18a279ba/analysis/1490195522/"
}
chg: [feed] added
2023-04-21 13:25:09 +00:00
]
chg: [gen] updated
2023-12-14 14:30:15 +00:00
}
chg: [feed] added
2023-04-21 13:25:09 +00:00
}
Reference in a new issue Copy permalink