105 lines
4.3 KiB
JSON
105 lines
4.3 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--5c533c72-f6c4-4811-b06f-4982950d210f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-01-31T18:42:07.000Z",
|
||
|
|
"modified": "2019-01-31T18:42:07.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "grouping",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "grouping--5c533c72-f6c4-4811-b06f-4982950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-01-31T18:42:07.000Z",
|
||
|
|
"modified": "2019-01-31T18:42:07.000Z",
|
||
|
|
"name": "OSINT - 2019-01-31: Gozi ISFB Malware v2 Group -> Loads Dridex Botnet ID \"3101\"",
|
||
|
|
"context": "suspicious-activity",
|
||
|
|
"object_refs": [
|
||
|
|
"x-misp-object--5c53409b-e0a8-47ab-b443-cdf9950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"misp-galaxy:banker=\"Dridex\"",
|
||
|
|
"misp-galaxy:banker=\"Gozi\"",
|
||
|
|
"misp-galaxy:malpedia=\"Dridex\"",
|
||
|
|
"misp-galaxy:malpedia=\"Gozi\"",
|
||
|
|
"misp-galaxy:malpedia=\"ISFB\"",
|
||
|
|
"misp-galaxy:tool=\"Dridex\"",
|
||
|
|
"misp-galaxy:banker=\"Gozi ISFB\"",
|
||
|
|
"misp-galaxy:banker=\"Goziv2\"",
|
||
|
|
"type:OSINT",
|
||
|
|
"osint:lifetime=\"perpetual\"",
|
||
|
|
"osint:certainty=\"50\"",
|
||
|
|
"\tmalware_classification:malware-category=\"Botnet\"",
|
||
|
|
"Botnet \"3101\"",
|
||
|
|
"malware_classification:malware-category=\"Botnet\""
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--5c53409b-e0a8-47ab-b443-cdf9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-01-31T18:38:19.000Z",
|
||
|
|
"modified": "2019-01-31T18:38:19.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"microblog\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "post",
|
||
|
|
"value": "2019-01-31: #Gozi #ISFB #Malware v2 Group -> Loads #Dridex Botnet ID \"3101\" {ISFB Ver: '2.14', Build: '62', Group: '3172'} Release w/ New Build: \"January 28, 2019\" \ud83d\ude09 Best ISFBv2/Dridex Duo Going Strong After Holidays -> #MISP JSON with IOCs (unpacked): https://pastebin.com/x5FG3ZPd",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5c53409b-a2a0-492b-9040-cdf9950d210f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "Twitter",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5c53409b-c388-4586-b9a2-cdf9950d210f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"object_relation": "url",
|
||
|
|
"value": "https://twitter.com/VK_Intel/status/1091034487146856448",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5c53409b-4fe4-4a5e-8491-cdf9950d210f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "creation-date",
|
||
|
|
"value": "31 Jan 2019 10:04 AM",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5c53409b-7df0-4389-bec7-cdf9950d210f"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "microblog"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|