218 lines
10 KiB
JSON
218 lines
10 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--5c3c4a6d-15f0-4133-baff-3c2c68f8e8cf",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--5bfa439e-c978-4dcd-b474-73f568f8e8cf",
|
||
|
|
"created": "2019-01-15T20:44:35.000Z",
|
||
|
|
"modified": "2019-01-15T20:44:35.000Z",
|
||
|
|
"name": "VK-Intel",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--5c3c4a6d-15f0-4133-baff-3c2c68f8e8cf",
|
||
|
|
"created_by_ref": "identity--5bfa439e-c978-4dcd-b474-73f568f8e8cf",
|
||
|
|
"created": "2019-01-15T20:44:35.000Z",
|
||
|
|
"modified": "2019-01-15T20:44:35.000Z",
|
||
|
|
"name": "2019-01-10: North Korea Lazarus Targeting REDBANC",
|
||
|
|
"published": "2019-01-15T20:45:39Z",
|
||
|
|
"object_refs": [
|
||
|
|
"indicator--5c3c4a99-8830-4833-81d5-3c3068f8e8cf",
|
||
|
|
"indicator--5c3c4a99-9a68-4e6c-a9a4-3c3068f8e8cf",
|
||
|
|
"indicator--5c3ca28f-cb88-44d1-a7ce-382d68f8e8cf",
|
||
|
|
"indicator--5c3ca80f-b398-47e5-b633-124a0a640c05",
|
||
|
|
"indicator--5c3ce1c9-39e4-4b59-90e4-5a350a640c05",
|
||
|
|
"indicator--5c3ce1c9-4d80-470f-9cfc-5a350a640c05",
|
||
|
|
"indicator--5c3ce207-b7f0-468f-8e5a-5a330a640c05"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"Actor: Lazarus",
|
||
|
|
"Ruse: Job Application",
|
||
|
|
"Powershell",
|
||
|
|
"PowerRatankba",
|
||
|
|
"misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Trusted Relationship - T1199\"",
|
||
|
|
"misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Scripting - T1064\"",
|
||
|
|
"misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Scheduled Task - T1053\"",
|
||
|
|
"misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Windows Management Instrumentation - T1047\"",
|
||
|
|
"misp-galaxy:mitre-enterprise-attack-attack-pattern=\"New Service - T1050\"",
|
||
|
|
"misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Data from Local System - T1005\"",
|
||
|
|
"misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Exfiltration Over Command and Control Channel - T1041\"",
|
||
|
|
"misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Data Encoding - T1132\"",
|
||
|
|
"report:5ZvWjgDgRhuD1zVgDT7-cg"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c3c4a99-8830-4833-81d5-3c3068f8e8cf",
|
||
|
|
"created_by_ref": "identity--5bfa439e-c978-4dcd-b474-73f568f8e8cf",
|
||
|
|
"created": "2019-01-14T08:38:49.000Z",
|
||
|
|
"modified": "2019-01-14T08:38:49.000Z",
|
||
|
|
"description": "Malware Hash",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f12db45c32bda3108adb8ae7363c342fdd5f10342945b115d830701f95c54fa9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-14T08:38:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c3c4a99-9a68-4e6c-a9a4-3c3068f8e8cf",
|
||
|
|
"created_by_ref": "identity--5bfa439e-c978-4dcd-b474-73f568f8e8cf",
|
||
|
|
"created": "2019-01-14T08:38:49.000Z",
|
||
|
|
"modified": "2019-01-14T08:38:49.000Z",
|
||
|
|
"description": "Malware Hash",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0f56ebca33efe0a2755d3b380167e1f5eab4e6180518c03b28d5cffd5b675d26']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-14T08:38:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c3ca28f-cb88-44d1-a7ce-382d68f8e8cf",
|
||
|
|
"created_by_ref": "identity--5bfa439e-c978-4dcd-b474-73f568f8e8cf",
|
||
|
|
"created": "2019-01-14T14:54:07.000Z",
|
||
|
|
"modified": "2019-01-14T14:54:07.000Z",
|
||
|
|
"description": "C2",
|
||
|
|
"pattern": "[url:value = 'https://ecombox.store']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-14T14:54:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c3ca80f-b398-47e5-b633-124a0a640c05",
|
||
|
|
"created_by_ref": "identity--5bfa439e-c978-4dcd-b474-73f568f8e8cf",
|
||
|
|
"created": "2019-01-14T15:17:35.000Z",
|
||
|
|
"modified": "2019-01-14T15:17:35.000Z",
|
||
|
|
"description": "apt_possible_lazarus_powerratankba_b",
|
||
|
|
"pattern": "[rule apt_possible_lazarus_powerratankba_b {\r\n meta:\r\n description = \"Detects possible Lazarus PowerRatankba.B from Redbanc\"\r\n author = \"@VK_Intel\"\r\n date = \"2019-01-15\"\r\n hash1 = \"db8163d054a35522d0dec35743cfd2c9872e0eb446467b573a79f84d61761471\"\r\n strings:\r\n $f0 = \"function EncryptDES\" fullword ascii\r\n $s0 = \"$ProID = Start-Process powershell.exe -PassThru -WindowStyle Hidden -ArgumentList\" fullword ascii\r\n $s1 = \"$respTxt = HttpRequestFunc_doprocess -szURI $szFullURL -szMethod $szMethod -contentData $contentData;\" fullword ascii\r\n $s2 = \"$cmdSchedule = 'schtasks /create /tn \\\"ProxyServerUpdater\\\"\" ascii\r\n $s3 = \"/tr \\\"powershell.exe -ep bypass -windowstyle hidden -file \" ascii\r\n $s4 = \"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Documents\\\\\\\\tmp' + -join \" ascii\r\n $s5 = \"$cmdResult = cmd.exe /c $cmdInst | Out-String;\" fullword ascii\r\n $s6 = \"whoami /groups | findstr /c:\\\"S-1-5-32-544\\\"\" fullword ascii\r\n condition:\r\n filesize < 500KB and $f0 and 2 of ($s*) \r\n}]",
|
||
|
|
"pattern_type": "yara",
|
||
|
|
"valid_from": "2019-01-14T15:17:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"yara\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c3ce1c9-39e4-4b59-90e4-5a350a640c05",
|
||
|
|
"created_by_ref": "identity--5bfa439e-c978-4dcd-b474-73f568f8e8cf",
|
||
|
|
"created": "2019-01-14T19:23:53.000Z",
|
||
|
|
"modified": "2019-01-14T19:23:53.000Z",
|
||
|
|
"description": "Powershell Agent & PowerRatankba",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a1f06d69bd6379e310b10a364d689f21499953fa1118ec699a25072779de5d9b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-14T19:23:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c3ce1c9-4d80-470f-9cfc-5a350a640c05",
|
||
|
|
"created_by_ref": "identity--5bfa439e-c978-4dcd-b474-73f568f8e8cf",
|
||
|
|
"created": "2019-01-14T19:23:53.000Z",
|
||
|
|
"modified": "2019-01-14T19:23:53.000Z",
|
||
|
|
"description": "Powershell Agent & PowerRatankba",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '20d94f7d8ee2c4367443a930370d5685789762b1d11794810dc0ac6c626ad78e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-14T19:23:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c3ce207-b7f0-468f-8e5a-5a330a640c05",
|
||
|
|
"created_by_ref": "identity--5bfa439e-c978-4dcd-b474-73f568f8e8cf",
|
||
|
|
"created": "2019-01-14T19:24:55.000Z",
|
||
|
|
"modified": "2019-01-14T19:24:55.000Z",
|
||
|
|
"description": "URL C2 backup",
|
||
|
|
"pattern": "[url:value = 'https://bodyshoppechiropractic.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-14T19:24:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|