937 lines
39 KiB
JSON
937 lines
39 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--196cf336-896a-4cc1-9aa9-3480ecd9cf27",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-22T15:35:54.000Z",
|
||
|
|
"modified": "2023-03-22T15:35:54.000Z",
|
||
|
|
"name": "Centre for Cyber security Belgium",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--196cf336-896a-4cc1-9aa9-3480ecd9cf27",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-22T15:35:54.000Z",
|
||
|
|
"modified": "2023-03-22T15:35:54.000Z",
|
||
|
|
"name": "BatLoader Continues to Abuse Google Search Ads to Deliver Vidar Stealer and Ursnif",
|
||
|
|
"published": "2024-04-15T09:06:21Z",
|
||
|
|
"object_refs": [
|
||
|
|
"indicator--fbf3a94e-265c-4742-8765-42f4dee9a68a",
|
||
|
|
"indicator--e476f444-5413-4a50-8389-1942bdf0828f",
|
||
|
|
"indicator--da48fa1c-e72b-492c-aee0-618e3c0c3a41",
|
||
|
|
"indicator--b89500da-16e3-4afc-a304-197204594ca0",
|
||
|
|
"indicator--85e8cec6-63f7-44c6-8493-87efa0b28da1",
|
||
|
|
"indicator--463c4efd-3a62-4e8f-8a59-ada9b67d63e1",
|
||
|
|
"indicator--ff9a5935-7612-4689-9697-c211271ce798",
|
||
|
|
"indicator--3d3d8c59-933e-480f-865a-47ecfd490f2e",
|
||
|
|
"observed-data--45dc2de9-9c07-4ed3-ac8c-4e7822b2e776",
|
||
|
|
"domain-name--45dc2de9-9c07-4ed3-ac8c-4e7822b2e776",
|
||
|
|
"indicator--3a1e62d1-bf68-4356-ad04-a457f86bcb12",
|
||
|
|
"indicator--d45879c9-4bb9-46a4-9758-b9fdf54a559d",
|
||
|
|
"observed-data--11df1b95-2879-499b-a6e2-ddc9e23d59b3",
|
||
|
|
"domain-name--11df1b95-2879-499b-a6e2-ddc9e23d59b3",
|
||
|
|
"indicator--5998047d-94c4-42c2-8d93-ab739aa0097f",
|
||
|
|
"indicator--59e45cab-2814-42f4-a699-f5c37e90fa9d",
|
||
|
|
"indicator--c4ba0178-316f-40c3-bf9e-86d2350fdd15",
|
||
|
|
"indicator--58971541-b286-4a13-a6e5-b7567c4db9dd",
|
||
|
|
"indicator--8e535007-62fc-4cd0-8fd7-7365c6fdc5ac",
|
||
|
|
"indicator--3e0017b3-b1f3-4905-81a3-fdd887289f67",
|
||
|
|
"indicator--ce56e498-c2c3-4f31-9201-f6da1ca3aeea",
|
||
|
|
"indicator--7467cb77-71c0-49b2-9a9f-4f5325c348b0",
|
||
|
|
"indicator--4f28a958-a1be-4ab9-b124-4fa26816a1d4",
|
||
|
|
"indicator--952ed163-c947-4f3b-a0b4-066f22a5c101",
|
||
|
|
"indicator--f0dc8e12-f0c3-4b0a-bf2d-8fb3a4992df4",
|
||
|
|
"indicator--43b0d274-b672-4f39-ad1e-7dbd58d2f139",
|
||
|
|
"indicator--640f8681-54dd-4c8c-b730-fddcaab4d6f6",
|
||
|
|
"indicator--810fc6a1-2b6c-4208-853a-02a10a0d5b70",
|
||
|
|
"indicator--695d965e-ceb1-45a6-bf6b-d4ebb42706f8",
|
||
|
|
"indicator--a2e5977a-53c8-40ce-9843-32a336b560b1",
|
||
|
|
"indicator--a70561bf-d266-4235-83af-29a5a001d50a",
|
||
|
|
"indicator--280b98dc-3009-41dc-907f-65ab2421cb16",
|
||
|
|
"indicator--744a2a1e-dd30-49e8-a496-1d0f759f1498",
|
||
|
|
"indicator--cdd393cc-9a65-48b1-8644-65d98444c209",
|
||
|
|
"indicator--c834b1ec-e4e4-4623-91db-837edfcd893d",
|
||
|
|
"indicator--db709a22-984a-4b53-9831-10d85e6ea1a5",
|
||
|
|
"x-misp-object--807dc88d-0d30-4690-ac1d-a131192f1d13"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"tlp:clear",
|
||
|
|
"admiralty-scale:source-reliability=\"c\"",
|
||
|
|
"admiralty-scale:information-credibility=\"3\"",
|
||
|
|
"Ursnif",
|
||
|
|
"Vidar",
|
||
|
|
"VidarStealer",
|
||
|
|
"batloader",
|
||
|
|
"osint:source-type=\"blog-post\"",
|
||
|
|
"Python",
|
||
|
|
"stone:malware-categorization=\"Loader\"",
|
||
|
|
"malware_advertising",
|
||
|
|
"misp-galaxy:mitre-attack-pattern=\"Network Traffic Capture or Redirection - T1410\"",
|
||
|
|
"misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"",
|
||
|
|
"misp-galaxy:mitre-attack-pattern=\"Scripting - T1064\"",
|
||
|
|
"misp-galaxy:mitre-malware=\"Ursnif - S0386\"",
|
||
|
|
"misp-galaxy:sigma-rules=\"Ursnif\"",
|
||
|
|
"misp-galaxy:malpedia=\"vidar\"",
|
||
|
|
"misp-galaxy:stealer=\"Vidar\"",
|
||
|
|
"misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
|
||
|
|
"misp-galaxy:mitre-attack-pattern=\"Python - T1059.006\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--fbf3a94e-265c-4742-8765-42f4dee9a68a",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:49:19.000Z",
|
||
|
|
"modified": "2023-03-20T12:49:19.000Z",
|
||
|
|
"description": "Vidar",
|
||
|
|
"pattern": "[file:hashes.MD5 = '3db1edc5b5550f54abdcb5520cf91d75']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2023-03-20T12:49:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--e476f444-5413-4a50-8389-1942bdf0828f",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:49:20.000Z",
|
||
|
|
"modified": "2023-03-20T12:49:20.000Z",
|
||
|
|
"description": "Ursnif",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0cb75b1192b23b8e03d955f1156ad19e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2023-03-20T12:49:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--da48fa1c-e72b-492c-aee0-618e3c0c3a41",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:49:20.000Z",
|
||
|
|
"modified": "2023-03-20T12:49:20.000Z",
|
||
|
|
"description": "Ursnif",
|
||
|
|
"pattern": "[file:hashes.MD5 = '85fbc743bb686688ce05cf3289507bf7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2023-03-20T12:49:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--b89500da-16e3-4afc-a304-197204594ca0",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:49:20.000Z",
|
||
|
|
"modified": "2023-03-20T12:49:20.000Z",
|
||
|
|
"description": "AdobeSetup.msi (BatLoader)",
|
||
|
|
"pattern": "[file:hashes.MD5 = '11ae3dabdb2d2458da43558f36114acb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2023-03-20T12:49:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--85e8cec6-63f7-44c6-8493-87efa0b28da1",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:49:20.000Z",
|
||
|
|
"modified": "2023-03-20T12:49:20.000Z",
|
||
|
|
"description": "AdobeSetup.msi (BatLoader)",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9ebbe0a1b79e6f13bfca014f878ddeec']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2023-03-20T12:49:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--463c4efd-3a62-4e8f-8a59-ada9b67d63e1",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:49:20.000Z",
|
||
|
|
"modified": "2023-03-20T12:49:20.000Z",
|
||
|
|
"description": "BatLoader C2",
|
||
|
|
"pattern": "[domain-name:value = 'shvarcnegerhistory.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2023-03-20T12:49:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--ff9a5935-7612-4689-9697-c211271ce798",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:49:20.000Z",
|
||
|
|
"modified": "2023-03-20T12:49:20.000Z",
|
||
|
|
"description": "BatLoader C2",
|
||
|
|
"pattern": "[domain-name:value = 'pixelarmada.su']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2023-03-20T12:49:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--3d3d8c59-933e-480f-865a-47ecfd490f2e",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:49:20.000Z",
|
||
|
|
"modified": "2023-03-20T12:49:20.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'uelcoskdi.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2023-03-20T12:49:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--45dc2de9-9c07-4ed3-ac8c-4e7822b2e776",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:53:45.000Z",
|
||
|
|
"modified": "2023-03-20T12:53:45.000Z",
|
||
|
|
"first_observed": "2023-03-20T12:53:45Z",
|
||
|
|
"last_observed": "2023-03-20T12:53:45Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"domain-name--45dc2de9-9c07-4ed3-ac8c-4e7822b2e776"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "domain-name",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "domain-name--45dc2de9-9c07-4ed3-ac8c-4e7822b2e776",
|
||
|
|
"value": "iujdhsndjfks.ru"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--3a1e62d1-bf68-4356-ad04-a457f86bcb12",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:49:20.000Z",
|
||
|
|
"modified": "2023-03-20T12:49:20.000Z",
|
||
|
|
"description": "Ursnif C2",
|
||
|
|
"pattern": "[domain-name:value = 'isoridkf.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2023-03-20T12:49:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--d45879c9-4bb9-46a4-9758-b9fdf54a559d",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:49:20.000Z",
|
||
|
|
"modified": "2023-03-20T12:49:20.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'gameindikdowd.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2023-03-20T12:49:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--11df1b95-2879-499b-a6e2-ddc9e23d59b3",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:53:51.000Z",
|
||
|
|
"modified": "2023-03-20T12:53:51.000Z",
|
||
|
|
"first_observed": "2023-03-20T12:53:51Z",
|
||
|
|
"last_observed": "2023-03-20T12:53:51Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"domain-name--11df1b95-2879-499b-a6e2-ddc9e23d59b3"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "domain-name",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "domain-name--11df1b95-2879-499b-a6e2-ddc9e23d59b3",
|
||
|
|
"value": "jhgfdlkjhaoiu.su"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5998047d-94c4-42c2-8d93-ab739aa0097f",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:49:20.000Z",
|
||
|
|
"modified": "2023-03-20T12:49:20.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'reggy506.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2023-03-20T12:49:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59e45cab-2814-42f4-a699-f5c37e90fa9d",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:49:20.000Z",
|
||
|
|
"modified": "2023-03-20T12:49:20.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'reggy914.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2023-03-20T12:49:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--c4ba0178-316f-40c3-bf9e-86d2350fdd15",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:50:30.000Z",
|
||
|
|
"modified": "2023-03-20T12:50:30.000Z",
|
||
|
|
"description": "Suspected BatLoader Domains Registered in February 2023",
|
||
|
|
"pattern": "[domain-name:value = 'chatgpt-t.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2023-03-20T12:50:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58971541-b286-4a13-a6e5-b7567c4db9dd",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:50:31.000Z",
|
||
|
|
"modified": "2023-03-20T12:50:31.000Z",
|
||
|
|
"description": "Suspected BatLoader Domains Registered in February 2023",
|
||
|
|
"pattern": "[domain-name:value = 'zoomvideor.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2023-03-20T12:50:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--8e535007-62fc-4cd0-8fd7-7365c6fdc5ac",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:50:31.000Z",
|
||
|
|
"modified": "2023-03-20T12:50:31.000Z",
|
||
|
|
"description": "Suspected BatLoader Domains Registered in February 2023",
|
||
|
|
"pattern": "[domain-name:value = 'adobe-l.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2023-03-20T12:50:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--3e0017b3-b1f3-4905-81a3-fdd887289f67",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:50:31.000Z",
|
||
|
|
"modified": "2023-03-20T12:50:31.000Z",
|
||
|
|
"description": "Suspected BatLoader Domains Registered in February 2023",
|
||
|
|
"pattern": "[domain-name:value = 'freecad-l.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2023-03-20T12:50:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--ce56e498-c2c3-4f31-9201-f6da1ca3aeea",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:50:31.000Z",
|
||
|
|
"modified": "2023-03-20T12:50:31.000Z",
|
||
|
|
"description": "Suspected BatLoader Domains Registered in February 2023",
|
||
|
|
"pattern": "[domain-name:value = 'microso-t.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2023-03-20T12:50:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--7467cb77-71c0-49b2-9a9f-4f5325c348b0",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:50:31.000Z",
|
||
|
|
"modified": "2023-03-20T12:50:31.000Z",
|
||
|
|
"description": "Suspected BatLoader Domains Registered in February 2023",
|
||
|
|
"pattern": "[domain-name:value = 'spotify-uss.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2023-03-20T12:50:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--4f28a958-a1be-4ab9-b124-4fa26816a1d4",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:50:31.000Z",
|
||
|
|
"modified": "2023-03-20T12:50:31.000Z",
|
||
|
|
"description": "Suspected BatLoader Domains Registered in February 2023",
|
||
|
|
"pattern": "[domain-name:value = 'quickbooks-q.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2023-03-20T12:50:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--952ed163-c947-4f3b-a0b4-066f22a5c101",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:50:31.000Z",
|
||
|
|
"modified": "2023-03-20T12:50:31.000Z",
|
||
|
|
"description": "Suspected BatLoader Domains Registered in February 2023",
|
||
|
|
"pattern": "[domain-name:value = 'java-s.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2023-03-20T12:50:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--f0dc8e12-f0c3-4b0a-bf2d-8fb3a4992df4",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:50:31.000Z",
|
||
|
|
"modified": "2023-03-20T12:50:31.000Z",
|
||
|
|
"description": "Suspected BatLoader Domains Registered in February 2023",
|
||
|
|
"pattern": "[domain-name:value = 'adobe-e.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2023-03-20T12:50:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--43b0d274-b672-4f39-ad1e-7dbd58d2f139",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:50:31.000Z",
|
||
|
|
"modified": "2023-03-20T12:50:31.000Z",
|
||
|
|
"description": "Suspected BatLoader Domains Registered in February 2023",
|
||
|
|
"pattern": "[domain-name:value = 'anydesk-o.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2023-03-20T12:50:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--640f8681-54dd-4c8c-b730-fddcaab4d6f6",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:50:31.000Z",
|
||
|
|
"modified": "2023-03-20T12:50:31.000Z",
|
||
|
|
"description": "Suspected BatLoader Domains Registered in February 2023",
|
||
|
|
"pattern": "[domain-name:value = 'anydesk-r.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2023-03-20T12:50:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--810fc6a1-2b6c-4208-853a-02a10a0d5b70",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:50:31.000Z",
|
||
|
|
"modified": "2023-03-20T12:50:31.000Z",
|
||
|
|
"description": "Suspected BatLoader Domains Registered in February 2023",
|
||
|
|
"pattern": "[domain-name:value = 'java-r.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2023-03-20T12:50:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--695d965e-ceb1-45a6-bf6b-d4ebb42706f8",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:50:31.000Z",
|
||
|
|
"modified": "2023-03-20T12:50:31.000Z",
|
||
|
|
"description": "Suspected BatLoader Domains Registered in February 2023",
|
||
|
|
"pattern": "[domain-name:value = 'tableau-r.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2023-03-20T12:50:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--a2e5977a-53c8-40ce-9843-32a336b560b1",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:50:31.000Z",
|
||
|
|
"modified": "2023-03-20T12:50:31.000Z",
|
||
|
|
"description": "Suspected BatLoader Domains Registered in February 2023",
|
||
|
|
"pattern": "[domain-name:value = 'java-a.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2023-03-20T12:50:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--a70561bf-d266-4235-83af-29a5a001d50a",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:50:31.000Z",
|
||
|
|
"modified": "2023-03-20T12:50:31.000Z",
|
||
|
|
"description": "Suspected BatLoader Domains Registered in February 2023",
|
||
|
|
"pattern": "[domain-name:value = 'basecamp-a.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2023-03-20T12:50:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--280b98dc-3009-41dc-907f-65ab2421cb16",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:50:31.000Z",
|
||
|
|
"modified": "2023-03-20T12:50:31.000Z",
|
||
|
|
"description": "Suspected BatLoader Domains Registered in February 2023",
|
||
|
|
"pattern": "[domain-name:value = 'adobe-a.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2023-03-20T12:50:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--744a2a1e-dd30-49e8-a496-1d0f759f1498",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:50:31.000Z",
|
||
|
|
"modified": "2023-03-20T12:50:31.000Z",
|
||
|
|
"description": "Suspected BatLoader Domains Registered in February 2023",
|
||
|
|
"pattern": "[domain-name:value = 'visualstudio-t.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2023-03-20T12:50:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--cdd393cc-9a65-48b1-8644-65d98444c209",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:50:31.000Z",
|
||
|
|
"modified": "2023-03-20T12:50:31.000Z",
|
||
|
|
"description": "Suspected BatLoader Domains Registered in February 2023",
|
||
|
|
"pattern": "[domain-name:value = 'openoffice-a.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2023-03-20T12:50:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--c834b1ec-e4e4-4623-91db-837edfcd893d",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:50:31.000Z",
|
||
|
|
"modified": "2023-03-20T12:50:31.000Z",
|
||
|
|
"description": "Suspected BatLoader Domains Registered in February 2023",
|
||
|
|
"pattern": "[domain-name:value = 'bitwarden-t.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2023-03-20T12:50:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--db709a22-984a-4b53-9831-10d85e6ea1a5",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-20T12:50:31.000Z",
|
||
|
|
"modified": "2023-03-20T12:50:31.000Z",
|
||
|
|
"description": "Suspected BatLoader Domains Registered in February 2023",
|
||
|
|
"pattern": "[domain-name:value = 'gimp-t.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2023-03-20T12:50:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--807dc88d-0d30-4690-ac1d-a131192f1d13",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2023-03-22T13:59:16.000Z",
|
||
|
|
"modified": "2023-03-22T13:59:16.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"annotation\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "ref",
|
||
|
|
"value": "https://www.esentire.com/blog/batloader-continues-to-abuse-google-search-ads-to-deliver-vidar-stealer-and-ursnif",
|
||
|
|
"category": "External analysis",
|
||
|
|
"uuid": "2e97d257-caca-44fd-bf45-bad80fb8e9eb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "text",
|
||
|
|
"value": "In December, we published a summary of BatLoader activity whereby Google Search Ads were used to impersonate software such as WinRAR to deliver malicious Windows Installer files. The installer files contained custom action commands which used PowerShell to download and execute payloads (Redline Stealer, Ursnif, etc.) hosted on legitimate websites.\r\n\r\nThroughout February 2023, TRU has observed a series of newly registered websites impersonating various applications and brands. Included among these are:\r\n\r\nChatGPT (chatgpt-t[.]com)\r\nZoom (zoomvideor[.]com)\r\nSpotify (spotify-uss[.]com)\r\nTableau (tableau-r[.]com)\r\nAdobe (adobe-l[.]com)\r\nIn addition to comparable domain registration attributes, these websites tend to follow a similar naming convention where one or more characters are appended to the impersonated brand name (e.g., adobe-l[.]com vs adobe.com). These sites were used to host imposter download pages and all likely stem from malicious advertisements on Google Search Ads. A more complete list can be found at the end of this post.\r\n\r\nBatLoader continues to see changes and improvement since it first emerged in 2022. Recent samples analyzed by TRU utilize Windows Installer files masquerading as the above applications to launch embedded Python scripts.",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "014060f6-c423-46e3-abf2-242e69470f8a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "Introduction",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4696fac5-5ed8-4123-9079-c8f1ab35ac67"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "annotation"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|