588 lines
26 KiB
JSON
588 lines
26 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--5ce8f7f8-8584-40c3-b33b-4660950d210f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-25T08:14:21.000Z",
|
||
|
|
"modified": "2019-05-25T08:14:21.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--5ce8f7f8-8584-40c3-b33b-4660950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-25T08:14:21.000Z",
|
||
|
|
"modified": "2019-05-25T08:14:21.000Z",
|
||
|
|
"name": "OSINT - Sorpresa! JasperLoader targets Italy with a new bag of tricks",
|
||
|
|
"published": "2019-05-25T08:14:49Z",
|
||
|
|
"object_refs": [
|
||
|
|
"observed-data--5ce8f806-78c4-4413-8b6b-467a950d210f",
|
||
|
|
"url--5ce8f806-78c4-4413-8b6b-467a950d210f",
|
||
|
|
"indicator--5ce8f823-d814-4298-8f6b-47e9950d210f",
|
||
|
|
"indicator--5ce8f823-90e0-4cda-9aa5-46c8950d210f",
|
||
|
|
"indicator--5ce8f823-69ec-4718-87ec-4a42950d210f",
|
||
|
|
"indicator--5ce8f83d-6a58-408b-8bbf-49cd950d210f",
|
||
|
|
"indicator--5ce8f83d-a420-4c97-ba2c-472d950d210f",
|
||
|
|
"indicator--5ce8f858-6bf8-4378-804b-47d5950d210f",
|
||
|
|
"indicator--5ce8f858-4c48-42e1-8be1-4c6f950d210f",
|
||
|
|
"indicator--5ce8f858-2a8c-493c-a9b6-4ca1950d210f",
|
||
|
|
"indicator--5ce8f858-ddd8-44c9-b9e3-4f6e950d210f",
|
||
|
|
"indicator--5ce8f858-4e58-4777-9799-4b4e950d210f",
|
||
|
|
"indicator--5ce8f858-1b08-469f-bde2-4810950d210f",
|
||
|
|
"indicator--5ce8f858-2530-4f92-b6f3-48c3950d210f",
|
||
|
|
"observed-data--5ce8f866-7abc-4168-a664-459fe387cbd9",
|
||
|
|
"network-traffic--5ce8f866-7abc-4168-a664-459fe387cbd9",
|
||
|
|
"ipv4-addr--5ce8f866-7abc-4168-a664-459fe387cbd9",
|
||
|
|
"observed-data--5ce8f866-1cf0-423a-993a-431ce387cbd9",
|
||
|
|
"network-traffic--5ce8f866-1cf0-423a-993a-431ce387cbd9",
|
||
|
|
"ipv4-addr--5ce8f866-1cf0-423a-993a-431ce387cbd9",
|
||
|
|
"observed-data--5ce8f866-a36c-4e78-a62d-41b1e387cbd9",
|
||
|
|
"network-traffic--5ce8f866-a36c-4e78-a62d-41b1e387cbd9",
|
||
|
|
"ipv4-addr--5ce8f866-a36c-4e78-a62d-41b1e387cbd9",
|
||
|
|
"observed-data--5ce8f866-b738-4d0f-a1d2-4d6be387cbd9",
|
||
|
|
"network-traffic--5ce8f866-b738-4d0f-a1d2-4d6be387cbd9",
|
||
|
|
"ipv4-addr--5ce8f866-b738-4d0f-a1d2-4d6be387cbd9",
|
||
|
|
"x-misp-attribute--5ce8f88a-bdb0-437e-a975-40ad950d210f",
|
||
|
|
"indicator--5ce8f90f-8dbc-42f7-b48a-49af950d210f",
|
||
|
|
"indicator--5ce8f90f-95c0-4e47-9ae3-4de5950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"type:OSINT",
|
||
|
|
"osint:lifetime=\"perpetual\"",
|
||
|
|
"osint:certainty=\"50\"",
|
||
|
|
"misp-galaxy:tool=\"JasperLoader\""
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5ce8f806-78c4-4413-8b6b-467a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-25T08:08:38.000Z",
|
||
|
|
"modified": "2019-05-25T08:08:38.000Z",
|
||
|
|
"first_observed": "2019-05-25T08:08:38Z",
|
||
|
|
"last_observed": "2019-05-25T08:08:38Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5ce8f806-78c4-4413-8b6b-467a950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5ce8f806-78c4-4413-8b6b-467a950d210f",
|
||
|
|
"value": "https://blog.talosintelligence.com/2019/05/sorpresa-jasperloader.html"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5ce8f823-d814-4298-8f6b-47e9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-25T08:09:07.000Z",
|
||
|
|
"modified": "2019-05-25T08:09:07.000Z",
|
||
|
|
"description": "observed to be associated with JasperLoader",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '052c9895383eb10e4ad5bec37822f624e443bbe01700b1fe5abeeea757456aed']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-25T08:09:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5ce8f823-90e0-4cda-9aa5-46c8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-25T08:09:07.000Z",
|
||
|
|
"modified": "2019-05-25T08:09:07.000Z",
|
||
|
|
"description": "observed to be associated with JasperLoader",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '54666103a3c8221cf3d7d39035b638f3c3bcc233e1916b015aeee2539f38f719']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-25T08:09:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5ce8f823-69ec-4718-87ec-4a42950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-25T08:09:07.000Z",
|
||
|
|
"modified": "2019-05-25T08:09:07.000Z",
|
||
|
|
"description": "observed to be associated with JasperLoader",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ee3601c6e111c42d02c83b58b4fc70265b937e9d4d153203a4111f51a8a08aab']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-25T08:09:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5ce8f83d-6a58-408b-8bbf-49cd950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-25T08:09:33.000Z",
|
||
|
|
"modified": "2019-05-25T08:09:33.000Z",
|
||
|
|
"description": "observed to be associated with JasperLoader",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.158.251.171']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-25T08:09:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5ce8f83d-a420-4c97-ba2c-472d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-25T08:09:33.000Z",
|
||
|
|
"modified": "2019-05-25T08:09:33.000Z",
|
||
|
|
"description": "observed to be associated with JasperLoader",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.158.249.116']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-25T08:09:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5ce8f858-6bf8-4378-804b-47d5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-25T08:10:00.000Z",
|
||
|
|
"modified": "2019-05-25T08:10:00.000Z",
|
||
|
|
"description": "domains observed to be associated with JasperLoader",
|
||
|
|
"pattern": "[domain-name:value = 'breed.wanttobea.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-25T08:10:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5ce8f858-4c48-42e1-8be1-4c6f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-25T08:10:00.000Z",
|
||
|
|
"modified": "2019-05-25T08:10:00.000Z",
|
||
|
|
"description": "domains observed to be associated with JasperLoader",
|
||
|
|
"pattern": "[domain-name:value = 'zzi.aircargox.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-25T08:10:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5ce8f858-2a8c-493c-a9b6-4ca1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-25T08:10:00.000Z",
|
||
|
|
"modified": "2019-05-25T08:10:00.000Z",
|
||
|
|
"description": "domains observed to be associated with JasperLoader",
|
||
|
|
"pattern": "[domain-name:value = 'nono.littlebodiesbigsouls.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-25T08:10:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5ce8f858-ddd8-44c9-b9e3-4f6e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-25T08:10:00.000Z",
|
||
|
|
"modified": "2019-05-25T08:10:00.000Z",
|
||
|
|
"description": "domains observed to be associated with JasperLoader",
|
||
|
|
"pattern": "[domain-name:value = 'tribunaledinapoli.recsinc.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-25T08:10:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5ce8f858-4e58-4777-9799-4b4e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-25T08:10:00.000Z",
|
||
|
|
"modified": "2019-05-25T08:10:00.000Z",
|
||
|
|
"description": "domains observed to be associated with JasperLoader",
|
||
|
|
"pattern": "[domain-name:value = 'tribunaledinapoli.prepperpillbox.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-25T08:10:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5ce8f858-1b08-469f-bde2-4810950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-25T08:10:00.000Z",
|
||
|
|
"modified": "2019-05-25T08:10:00.000Z",
|
||
|
|
"description": "domains observed to be associated with JasperLoader",
|
||
|
|
"pattern": "[domain-name:value = 'tribunaledinapoli.lowellunderwood.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-25T08:10:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5ce8f858-2530-4f92-b6f3-48c3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-25T08:10:00.000Z",
|
||
|
|
"modified": "2019-05-25T08:10:00.000Z",
|
||
|
|
"description": "domains observed to be associated with JasperLoader",
|
||
|
|
"pattern": "[domain-name:value = 'tribunaledinapoli.rntman.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-25T08:10:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5ce8f866-7abc-4168-a664-459fe387cbd9",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-25T08:10:14.000Z",
|
||
|
|
"modified": "2019-05-25T08:10:14.000Z",
|
||
|
|
"first_observed": "2019-05-25T08:10:14Z",
|
||
|
|
"last_observed": "2019-05-25T08:10:14Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--5ce8f866-7abc-4168-a664-459fe387cbd9",
|
||
|
|
"ipv4-addr--5ce8f866-7abc-4168-a664-459fe387cbd9"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--5ce8f866-7abc-4168-a664-459fe387cbd9",
|
||
|
|
"src_ref": "ipv4-addr--5ce8f866-7abc-4168-a664-459fe387cbd9",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--5ce8f866-7abc-4168-a664-459fe387cbd9",
|
||
|
|
"value": "185.158.251.171"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5ce8f866-1cf0-423a-993a-431ce387cbd9",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-25T08:10:14.000Z",
|
||
|
|
"modified": "2019-05-25T08:10:14.000Z",
|
||
|
|
"first_observed": "2019-05-25T08:10:14Z",
|
||
|
|
"last_observed": "2019-05-25T08:10:14Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--5ce8f866-1cf0-423a-993a-431ce387cbd9",
|
||
|
|
"ipv4-addr--5ce8f866-1cf0-423a-993a-431ce387cbd9"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--5ce8f866-1cf0-423a-993a-431ce387cbd9",
|
||
|
|
"src_ref": "ipv4-addr--5ce8f866-1cf0-423a-993a-431ce387cbd9",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--5ce8f866-1cf0-423a-993a-431ce387cbd9",
|
||
|
|
"value": "185.158.248.110"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5ce8f866-a36c-4e78-a62d-41b1e387cbd9",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-25T08:10:14.000Z",
|
||
|
|
"modified": "2019-05-25T08:10:14.000Z",
|
||
|
|
"first_observed": "2019-05-25T08:10:14Z",
|
||
|
|
"last_observed": "2019-05-25T08:10:14Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--5ce8f866-a36c-4e78-a62d-41b1e387cbd9",
|
||
|
|
"ipv4-addr--5ce8f866-a36c-4e78-a62d-41b1e387cbd9"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--5ce8f866-a36c-4e78-a62d-41b1e387cbd9",
|
||
|
|
"src_ref": "ipv4-addr--5ce8f866-a36c-4e78-a62d-41b1e387cbd9",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--5ce8f866-a36c-4e78-a62d-41b1e387cbd9",
|
||
|
|
"value": "185.212.47.163"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5ce8f866-b738-4d0f-a1d2-4d6be387cbd9",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-25T08:10:14.000Z",
|
||
|
|
"modified": "2019-05-25T08:10:14.000Z",
|
||
|
|
"first_observed": "2019-05-25T08:10:14Z",
|
||
|
|
"last_observed": "2019-05-25T08:10:14Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--5ce8f866-b738-4d0f-a1d2-4d6be387cbd9",
|
||
|
|
"ipv4-addr--5ce8f866-b738-4d0f-a1d2-4d6be387cbd9"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--5ce8f866-b738-4d0f-a1d2-4d6be387cbd9",
|
||
|
|
"src_ref": "ipv4-addr--5ce8f866-b738-4d0f-a1d2-4d6be387cbd9",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--5ce8f866-b738-4d0f-a1d2-4d6be387cbd9",
|
||
|
|
"value": "185.212.44.126"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--5ce8f88a-bdb0-437e-a975-40ad950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-25T08:10:50.000Z",
|
||
|
|
"modified": "2019-05-25T08:10:50.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "External analysis",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Over the past few months, a new malware loader called JasperLoader has emerged that targets Italy and other European countries with banking trojans such as Gootkit. We recently released a comprehensive analysis of the functionality associated with JasperLoader. Shortly after the publication of our analysis, the distribution activity associated with these campaigns halted. But after several weeks of relatively low volumes of activity, we discovered a new version of JasperLoader being spread. This new version features several changes and improvements from the initial version we analyzed. JasperLoader is typically used to infect systems with additional malware payloads which can be used to exfiltrate sensitive information, damage systems or otherwise negatively impact organizations.\r\n\r\nThe attackers behind this specific threat have implemented additional mechanisms to control where the malware can spread and are now taking steps to avoid analysis by sandboxes and antivirus companies. There's also a new command and control (C2) mechanism to facilitate communications between infected systems and the infrastructure being used to control them. The campaigns that are currently distributing JasperLoader continue to target Italian victims and further demonstrate that while JasperLoader is a relatively new threat, the developers behind it are continuing to actively refine and improve upon this malware at a rapid pace and introduce sophistication that is not commonly seen in financially motivated malware."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5ce8f90f-8dbc-42f7-b48a-49af950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-25T08:13:03.000Z",
|
||
|
|
"modified": "2019-05-25T08:13:03.000Z",
|
||
|
|
"pattern": "[url:value = 'http://tribunaledinapoli.recsinc.com/documento.zip']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-25T08:13:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1192\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5ce8f90f-95c0-4e47-9ae3-4de5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-05-25T08:13:03.000Z",
|
||
|
|
"modified": "2019-05-25T08:13:03.000Z",
|
||
|
|
"pattern": "[url:value = 'http://tribunaledinapoli.recsinc.com/documento.zip?214299']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-05-25T08:13:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|