adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/571fd18a-efc4-4099-93f5-447502de0b81.json

288 lines
13 KiB
JSON
Raw Normal View History

chg: [feed] added
2023-04-21 13:25:09 +00:00
{
chg: [feed] feed updated
2023-06-14 17:31:25 +00:00
"type": "bundle",
"id": "bundle--571fd18a-efc4-4099-93f5-447502de0b81",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-26T21:10:11.000Z",
"modified": "2016-04-26T21:10:11.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--571fd18a-efc4-4099-93f5-447502de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-26T21:10:11.000Z",
"modified": "2016-04-26T21:10:11.000Z",
"name": "OSINT - Macro Malware Employs Advanced Obfuscation to Avoid Detection",
"published": "2016-04-26T21:10:18Z",
"object_refs": [
"indicator--571fd208-f4c8-4446-8c29-47e602de0b81",
"indicator--571fd208-4444-4bed-b668-429802de0b81",
"indicator--571fd2c9-4488-4aef-8c95-47cb02de0b81",
"indicator--571fd2c9-e9b4-40a6-9903-4c0602de0b81",
"observed-data--571fd2ca-8558-4dae-b316-413002de0b81",
"url--571fd2ca-8558-4dae-b316-413002de0b81",
"indicator--571fd2ca-19cc-4cbe-b5d1-408b02de0b81",
"indicator--571fd2cb-e308-4004-b0b6-465502de0b81",
"observed-data--571fd2cb-36dc-4351-abc4-4a9f02de0b81",
"url--571fd2cb-36dc-4351-abc4-4a9f02de0b81",
"observed-data--571fd2e0-8cfc-466c-acc3-489f02de0b81",
"url--571fd2e0-8cfc-466c-acc3-489f02de0b81",
"x-misp-attribute--571fd934-8b5c-441f-bab2-42d702de0b81"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"type:OSINT"
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--571fd208-f4c8-4446-8c29-47e602de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-26T20:39:36.000Z",
"modified": "2016-04-26T20:39:36.000Z",
"pattern": "[file:hashes.MD5 = 'd80c15fd4ee1b10512d81bde32daaf30']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-04-26T20:39:36Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload installation"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload installation\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--571fd208-4444-4bed-b668-429802de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-26T20:39:36.000Z",
"modified": "2016-04-26T20:39:36.000Z",
"pattern": "[file:hashes.MD5 = 'c1787d80ad7beb46646d5c20cdd7eff2']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-04-26T20:39:36Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload installation"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload installation\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--571fd2c9-4488-4aef-8c95-47cb02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-26T20:42:49.000Z",
"modified": "2016-04-26T20:42:49.000Z",
"description": "- Xchecked via VT: c1787d80ad7beb46646d5c20cdd7eff2",
"pattern": "[file:hashes.SHA256 = '25f7bf9246534c7aad3b728c0bad60dd62e31d9bd7695de8ac0ec7ec0270f104']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-04-26T20:42:49Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload installation"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload installation\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--571fd2c9-e9b4-40a6-9903-4c0602de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-26T20:42:49.000Z",
"modified": "2016-04-26T20:42:49.000Z",
"description": "- Xchecked via VT: c1787d80ad7beb46646d5c20cdd7eff2",
"pattern": "[file:hashes.SHA1 = 'c779587e7280121be0725fbecef2e449607f5833']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-04-26T20:42:49Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload installation"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload installation\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--571fd2ca-8558-4dae-b316-413002de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-26T20:42:50.000Z",
"modified": "2016-04-26T20:42:50.000Z",
"first_observed": "2016-04-26T20:42:50Z",
"last_observed": "2016-04-26T20:42:50Z",
"number_observed": 1,
"object_refs": [
"url--571fd2ca-8558-4dae-b316-413002de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--571fd2ca-8558-4dae-b316-413002de0b81",
"value": "https://www.virustotal.com/file/25f7bf9246534c7aad3b728c0bad60dd62e31d9bd7695de8ac0ec7ec0270f104/analysis/1461421247/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--571fd2ca-19cc-4cbe-b5d1-408b02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-26T20:42:50.000Z",
"modified": "2016-04-26T20:42:50.000Z",
"description": "- Xchecked via VT: d80c15fd4ee1b10512d81bde32daaf30",
"pattern": "[file:hashes.SHA256 = '1fcdc054fbd0ecefbb895502d271c94e4733dbb5dc0a0152d8d4864ce82cd916']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-04-26T20:42:50Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload installation"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload installation\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--571fd2cb-e308-4004-b0b6-465502de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-26T20:42:51.000Z",
"modified": "2016-04-26T20:42:51.000Z",
"description": "- Xchecked via VT: d80c15fd4ee1b10512d81bde32daaf30",
"pattern": "[file:hashes.SHA1 = '2f0219710dd785f94f7970b87c6ec19ba1635fc5']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-04-26T20:42:51Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload installation"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload installation\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--571fd2cb-36dc-4351-abc4-4a9f02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-26T20:42:51.000Z",
"modified": "2016-04-26T20:42:51.000Z",
"first_observed": "2016-04-26T20:42:51Z",
"last_observed": "2016-04-26T20:42:51Z",
"number_observed": 1,
"object_refs": [
"url--571fd2cb-36dc-4351-abc4-4a9f02de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--571fd2cb-36dc-4351-abc4-4a9f02de0b81",
"value": "https://www.virustotal.com/file/1fcdc054fbd0ecefbb895502d271c94e4733dbb5dc0a0152d8d4864ce82cd916/analysis/1461421238/"
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--571fd2e0-8cfc-466c-acc3-489f02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-26T20:43:12.000Z",
"modified": "2016-04-26T20:43:12.000Z",
"first_observed": "2016-04-26T20:43:12Z",
"last_observed": "2016-04-26T20:43:12Z",
"number_observed": 1,
"object_refs": [
"url--571fd2e0-8cfc-466c-acc3-489f02de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--571fd2e0-8cfc-466c-acc3-489f02de0b81",
"value": "https://blogs.mcafee.com/mcafee-labs/macro-malware-employs-advanced-obfuscation-to-avoid-detection/"
},
{
"type": "x-misp-attribute",
"spec_version": "2.1",
"id": "x-misp-attribute--571fd934-8b5c-441f-bab2-42d702de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-26T21:10:11.000Z",
"modified": "2016-04-26T21:10:11.000Z",
"labels": [
"misp:type=\"comment\"",
"misp:category=\"External analysis\""
],
"x_misp_category": "External analysis",
"x_misp_type": "comment",
"x_misp_value": "Attacks by macro malware carrying ransomware are growing, as we have recently reported on Blog Central here and here. Now McAfee Labs researchers have witnessed a new variant of macro malware that employs fudging techniques such as virtual machine awareness, sandbox awareness, and more.\r\n\r\nSince early March we have seen macro malware using high-obfuscation algorithms to protect itself from static and traditional antimalware detection techniques. These algorithms do not change frequently; we noticed updates only over a period of one month. This slow evolution suggests that the actors are able to sustain their binaries with few changes. So far we have seen three obfuscating algorithms deployed in such malware. The version we noticed in mid-April was quite interesting; here is our analysis.\r\n\r\nThis new variant of macro malware not only has high-level obfuscation techniques but also several layers of evasion. In addition to obfuscation, the functions are scattered across the macros. I have converted the obfuscation algorithm to an equivalent Python and the scripts used for evasion techniques into VBA scripts for easy understanding."
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
chg: [feed] added
2023-04-21 13:25:09 +00:00
]
}
Reference in a new issue Copy permalink