adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/stix-2.1/5e04e696-4e74-4be0-a8e1-4cee02de0b81.json

996 lines
95 KiB
JSON
Raw Normal View History

chg: [misp-stix] STIX 2.1 export added
2023-04-21 14:44:17 +00:00
{
"type": "bundle",
"id": "bundle--5e04e696-4e74-4be0-a8e1-4cee02de0b81",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-26T17:05:58.000Z",
"modified": "2019-12-26T17:05:58.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--5e04e696-4e74-4be0-a8e1-4cee02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-26T17:05:58.000Z",
"modified": "2019-12-26T17:05:58.000Z",
"name": "OSINT - Let\u00e2\u20ac\u2122s play (again) with Predator the thief \u00e2\u20ac\u201c Fumik0_'s box",
"published": "2019-12-26T17:06:31Z",
"object_refs": [
"indicator--5e04e6ad-a28c-4a80-98ba-4aec02de0b81",
"indicator--5e04e6ad-aea8-4bd4-a8ca-42c502de0b81",
"indicator--5e04e6ad-7690-4a4b-bd92-4fd802de0b81",
"indicator--5e04e6ad-f3e4-4cf9-953d-478302de0b81",
"indicator--5e04e6ad-a02c-4e88-bc60-453502de0b81",
"indicator--5e04e6ad-e90c-47c7-999d-488702de0b81",
"indicator--5e04e6ad-7c40-4b8b-997b-440302de0b81",
"indicator--5e04e6c1-41c8-4a8d-9072-a4f6950d210f",
"indicator--5e04e73d-f834-4bdb-b1ef-468c02de0b81",
"indicator--5e04e73d-14e0-465d-a699-482702de0b81",
"indicator--5e04e73d-5688-42a8-94b1-4bff02de0b81",
"observed-data--5e04e7bd-3f00-4689-8eb0-506f02de0b81",
"url--5e04e7bd-3f00-4689-8eb0-506f02de0b81",
"indicator--38108716-d461-41c6-8f58-0c2e5faa9f64",
"x-misp-object--480d06d8-d9b8-4ced-97d8-5a1dd2b938f3",
"indicator--7dd2b52a-6440-4cc6-9142-24b33b288eec",
"x-misp-object--60e31b6e-033c-4edf-8e19-187bf909e409",
"indicator--d4a24fd0-9810-4c54-86ba-631f43d4e22c",
"x-misp-object--c62ace2f-f3d3-4207-be63-75b867775faf",
"indicator--50c3e941-eafb-46ac-9dd7-96753fea8e57",
"x-misp-object--ecd2c5e0-2e9f-4c69-bc0c-c23961b9e132",
"indicator--63aa563e-87b6-4727-808c-1f8dbd42ecf2",
"x-misp-object--7bf812c0-54af-47f5-8085-751942a1c16c",
"indicator--4dce2aca-173e-45d5-ac70-39b11b0bde68",
"x-misp-object--f0633bef-4096-48ac-8076-42f96522515a",
"indicator--b146e56a-7421-4e1c-90a6-05e350142898",
"x-misp-object--2a62535e-e6ab-4678-91ed-333564e64814",
"indicator--1c1bc6e2-3c6f-4111-b421-87e1e5a05b9d",
"x-misp-object--fd386d29-307f-462e-bd14-57bd67528cee",
"x-misp-object--5e04e875-85b4-466b-9115-507002de0b81",
chg: [export] updated
2023-05-19 09:05:37 +00:00
"relationship--c1a16a81-ed73-4548-afd7-ef50da8ba022",
"relationship--b76f4080-a67f-4e95-a22c-d4f951a82188",
"relationship--8f7fe882-3e25-4801-8e3f-8e226c893e19",
"relationship--54af500a-5273-42dd-8401-661e87e23ca5",
"relationship--9083d595-79c3-4017-9e6d-2722e49fa07d",
"relationship--58aaf65a-285c-4323-a541-d81c4152d6de",
"relationship--6fea4b0c-3e02-4a8f-8fda-f9055120714f",
"relationship--a86f153b-9940-4581-9809-b282edffb479"
chg: [misp-stix] STIX 2.1 export added
2023-04-21 14:44:17 +00:00
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"misp-galaxy:malpedia=\"Predator The Thief\"",
"type:OSINT",
"osint:lifetime=\"perpetual\"",
"osint:source-type=\"blog-post\"",
"misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1503\"",
"misp-galaxy:mitre-attack-pattern=\"Exploitation for Credential Access - T1212\"",
"misp-galaxy:mitre-attack-pattern=\"Credentials in Files - T1081\"",
"misp-galaxy:mitre-attack-pattern=\"Credentials in Registry - T1214\"",
"misp-galaxy:mitre-attack-pattern=\"Credential Dumping - T1003\""
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5e04e6ad-a28c-4a80-98ba-4aec02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-26T16:58:21.000Z",
"modified": "2019-12-26T16:58:21.000Z",
"description": "Other predator hashes",
"pattern": "[file:hashes.MD5 = '9110e59b6c7ced21e194d37bb4fc14b2']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-12-26T16:58:21Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5e04e6ad-aea8-4bd4-a8ca-42c502de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-26T16:58:21.000Z",
"modified": "2019-12-26T16:58:21.000Z",
"description": "Other predator hashes",
"pattern": "[file:hashes.MD5 = '51e1924ac4c3f87553e9e9c712348ac8']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-12-26T16:58:21Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5e04e6ad-7690-4a4b-bd92-4fd802de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-26T16:58:21.000Z",
"modified": "2019-12-26T16:58:21.000Z",
"description": "Other predator hashes",
"pattern": "[file:hashes.MD5 = 'fe6125adb3cc69aa8c97ab31a0e7f5f8']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-12-26T16:58:21Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5e04e6ad-f3e4-4cf9-953d-478302de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-26T16:58:21.000Z",
"modified": "2019-12-26T16:58:21.000Z",
"description": "Other predator hashes",
"pattern": "[file:hashes.MD5 = '02484e00e248da80c897e2261e65d275']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-12-26T16:58:21Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5e04e6ad-a02c-4e88-bc60-453502de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-26T16:58:21.000Z",
"modified": "2019-12-26T16:58:21.000Z",
"description": "Other predator hashes",
"pattern": "[file:hashes.MD5 = 'a86f18fa2d67415ac2d576e1cd5ccad8']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-12-26T16:58:21Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5e04e6ad-e90c-47c7-999d-488702de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-26T16:58:21.000Z",
"modified": "2019-12-26T16:58:21.000Z",
"description": "Other predator hashes",
"pattern": "[file:hashes.MD5 = '3861a092245655330f0f1ffec75aca67']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-12-26T16:58:21Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5e04e6ad-7c40-4b8b-997b-440302de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-26T16:58:21.000Z",
"modified": "2019-12-26T16:58:21.000Z",
"description": "Other predator hashes",
"pattern": "[file:hashes.MD5 = 'ed3893c96decc3aa798be93192413d28']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-12-26T16:58:21Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5e04e6c1-41c8-4a8d-9072-a4f6950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-26T16:58:41.000Z",
"modified": "2019-12-26T16:58:41.000Z",
"description": "C&C",
"pattern": "[domain-name:value = 'cadvexmail19mn.world']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-12-26T16:58:41Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5e04e73d-f834-4bdb-b1ef-468c02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-26T17:00:45.000Z",
"modified": "2019-12-26T17:00:45.000Z",
"pattern": "[file:hashes.SHA256 = '21ebdc3a58f3d346247b2893d41c80126edabb060759af846273f9c9d0c92a9a']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-12-26T17:00:45Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5e04e73d-14e0-465d-a699-482702de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-26T17:00:45.000Z",
"modified": "2019-12-26T17:00:45.000Z",
"pattern": "[file:hashes.SHA256 = '6e27a2b223ef076d952aaa7c69725c831997898bebcd2d99654f4a1aa3358619']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-12-26T17:00:45Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5e04e73d-5688-42a8-94b1-4bff02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-26T17:00:45.000Z",
"modified": "2019-12-26T17:00:45.000Z",
"pattern": "[file:hashes.SHA256 = '01ef26b464faf08081fceeeb2cdff7a66ffdbd31072fe47b4eb43c219da287e8']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-12-26T17:00:45Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5e04e7bd-3f00-4689-8eb0-506f02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-26T17:02:53.000Z",
"modified": "2019-12-26T17:02:53.000Z",
"first_observed": "2019-12-26T17:02:53Z",
"last_observed": "2019-12-26T17:02:53Z",
"number_observed": 1,
"object_refs": [
"url--5e04e7bd-3f00-4689-8eb0-506f02de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--5e04e7bd-3f00-4689-8eb0-506f02de0b81",
"value": "https://fumik0.com/2019/12/25/lets-play-again-with-predator-the-thief/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--38108716-d461-41c6-8f58-0c2e5faa9f64",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-26T17:02:38.000Z",
"modified": "2019-12-26T17:02:38.000Z",
"pattern": "[file:hashes.MD5 = '3861a092245655330f0f1ffec75aca67' AND file:hashes.SHA1 = 'ce44e7d00cf55e8bf13f5c52bfbdbe3d4603bfa1' AND file:hashes.SHA256 = '6b02aa8fc222f1f46ffcea8ac02474d8f0ef10f7d48986348da9e2ac8c519db9']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-12-26T17:02:38Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--480d06d8-d9b8-4ced-97d8-5a1dd2b938f3",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-26T17:02:38.000Z",
"modified": "2019-12-26T17:02:38.000Z",
"labels": [
"misp:name=\"virustotal-report\"",
"misp:meta-category=\"misc\""
],
"x_misp_attributes": [
{
"type": "datetime",
"object_relation": "last-submission",
"value": "2019-12-07T18:46:23",
"category": "Other",
"comment": "Other predator hashes",
"uuid": "96d5c98a-5ac5-44c2-9f1a-353b10f7a0ab"
},
{
"type": "link",
"object_relation": "permalink",
"value": "https://www.virustotal.com/file/6b02aa8fc222f1f46ffcea8ac02474d8f0ef10f7d48986348da9e2ac8c519db9/analysis/1575744383/",
"category": "Payload delivery",
"comment": "Other predator hashes",
"uuid": "e60bda6a-dab6-444e-a401-15142aa21064"
},
{
"type": "text",
"object_relation": "detection-ratio",
"value": "27/70",
"category": "Payload delivery",
"comment": "Other predator hashes",
"uuid": "1e54635d-bec8-4e0b-93df-c8641ba189dd"
}
],
"x_misp_meta_category": "misc",
"x_misp_name": "virustotal-report"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--7dd2b52a-6440-4cc6-9142-24b33b288eec",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-26T17:02:38.000Z",
"modified": "2019-12-26T17:02:38.000Z",
"pattern": "[file:hashes.MD5 = 'fe6125adb3cc69aa8c97ab31a0e7f5f8' AND file:hashes.SHA1 = '7cc5b92224347c6e3d695b7e67dc841210b9ad04' AND file:hashes.SHA256 = '9166ef682132814d0286ddecfefcc4222759cb9dcf62f7014c53b6367d3d28c3']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-12-26T17:02:38Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--60e31b6e-033c-4edf-8e19-187bf909e409",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-26T17:02:39.000Z",
"modified": "2019-12-26T17:02:39.000Z",
"labels": [
"misp:name=\"virustotal-report\"",
"misp:meta-category=\"misc\""
],
"x_misp_attributes": [
{
"type": "datetime",
"object_relation": "last-submission",
"value": "2019-12-20T09:59:07",
"category": "Other",
"comment": "Other predator hashes",
"uuid": "856067c0-03fa-47c2-b886-6e4e3210d5a6"
},
{
"type": "link",
"object_relation": "permalink",
"value": "https://www.virustotal.com/file/9166ef682132814d0286ddecfefcc4222759cb9dcf62f7014c53b6367d3d28c3/analysis/1576835947/",
"category": "Payload delivery",
"comment": "Other predator hashes",
"uuid": "ab78c3d0-dc09-4de4-9692-9a4dda23a176"
},
{
"type": "text",
"object_relation": "detection-ratio",
"value": "51/70",
"category": "Payload delivery",
"comment": "Other predator hashes",
"uuid": "ed280824-6ca1-4c77-897c-9c5e7c0abdf5"
}
],
"x_misp_meta_category": "misc",
"x_misp_name": "virustotal-report"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--d4a24fd0-9810-4c54-86ba-631f43d4e22c",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-26T17:02:39.000Z",
"modified": "2019-12-26T17:02:39.000Z",
"pattern": "[file:hashes.MD5 = 'a86f18fa2d67415ac2d576e1cd5ccad8' AND file:hashes.SHA1 = '7dfe085e01e8285139d16455e810ae4792eb2c18' AND file:hashes.SHA256 = 'd24a2e930976774bc5f9d3246f94e1c93a707d33ed7e392cfe01bb3677cc1c22']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-12-26T17:02:39Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--c62ace2f-f3d3-4207-be63-75b867775faf",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-26T17:02:39.000Z",
"modified": "2019-12-26T17:02:39.000Z",
"labels": [
"misp:name=\"virustotal-report\"",
"misp:meta-category=\"misc\""
],
"x_misp_attributes": [
{
"type": "datetime",
"object_relation": "last-submission",
"value": "2019-12-25T07:19:31",
"category": "Other",
"comment": "Other predator hashes",
"uuid": "89df942c-9005-4f34-80f1-ea4719b6c95f"
},
{
"type": "link",
"object_relation": "permalink",
"value": "https://www.virustotal.com/file/d24a2e930976774bc5f9d3246f94e1c93a707d33ed7e392cfe01bb3677cc1c22/analysis/1577258371/",
"category": "Payload delivery",
"comment": "Other predator hashes",
"uuid": "54923d4a-fa00-4d06-8660-aa1ddc99389a"
},
{
"type": "text",
"object_relation": "detection-ratio",
"value": "57/71",
"category": "Payload delivery",
"comment": "Other predator hashes",
"uuid": "0594f440-9360-4876-b34e-ef99ffe3469b"
}
],
"x_misp_meta_category": "misc",
"x_misp_name": "virustotal-report"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--50c3e941-eafb-46ac-9dd7-96753fea8e57",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-26T17:02:39.000Z",
"modified": "2019-12-26T17:02:39.000Z",
"pattern": "[file:hashes.MD5 = 'ed3893c96decc3aa798be93192413d28' AND file:hashes.SHA1 = '32037e67ab590dbe7015109aed258035dbb0808a' AND file:hashes.SHA256 = '8ec9b712fe5f0648f015b582abca33ebbdb49670c547fdb074051f6b03c6ffc9']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-12-26T17:02:39Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--ecd2c5e0-2e9f-4c69-bc0c-c23961b9e132",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-26T17:02:40.000Z",
"modified": "2019-12-26T17:02:40.000Z",
"labels": [
"misp:name=\"virustotal-report\"",
"misp:meta-category=\"misc\""
],
"x_misp_attributes": [
{
"type": "datetime",
"object_relation": "last-submission",
"value": "2019-12-02T16:08:23",
"category": "Other",
"comment": "Other predator hashes",
"uuid": "9dcde278-2ff3-44d6-8ea8-46d6738629e6"
},
{
"type": "link",
"object_relation": "permalink",
"value": "https://www.virustotal.com/file/8ec9b712fe5f0648f015b582abca33ebbdb49670c547fdb074051f6b03c6ffc9/analysis/1575302903/",
"category": "Payload delivery",
"comment": "Other predator hashes",
"uuid": "5e9f6929-d276-4a11-87ec-13f4ea380c78"
},
{
"type": "text",
"object_relation": "detection-ratio",
"value": "33/70",
"category": "Payload delivery",
"comment": "Other predator hashes",
"uuid": "feed86f7-129f-4de7-b836-38337265abbc"
}
],
"x_misp_meta_category": "misc",
"x_misp_name": "virustotal-report"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--63aa563e-87b6-4727-808c-1f8dbd42ecf2",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-26T17:02:40.000Z",
"modified": "2019-12-26T17:02:40.000Z",
"pattern": "[file:hashes.MD5 = '9110e59b6c7ced21e194d37bb4fc14b2' AND file:hashes.SHA1 = '3359490391fb18bbe18ba12341b7476b79dac376' AND file:hashes.SHA256 = '7e666e1f9ed0cfc211096d54106d66ba47f0375e675814b44c24b34dad57f578']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-12-26T17:02:40Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--7bf812c0-54af-47f5-8085-751942a1c16c",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-26T17:02:40.000Z",
"modified": "2019-12-26T17:02:40.000Z",
"labels": [
"misp:name=\"virustotal-report\"",
"misp:meta-category=\"misc\""
],
"x_misp_attributes": [
{
"type": "datetime",
"object_relation": "last-submission",
"value": "2019-12-13T17:23:41",
"category": "Other",
"comment": "Other predator hashes",
"uuid": "f9a8fab5-cfe1-4e83-9473-fe78cf056bce"
},
{
"type": "link",
"object_relation": "permalink",
"value": "https://www.virustotal.com/file/7e666e1f9ed0cfc211096d54106d66ba47f0375e675814b44c24b34dad57f578/analysis/1576257821/",
"category": "Payload delivery",
"comment": "Other predator hashes",
"uuid": "72865949-620a-4098-b04c-59f9d39bfded"
},
{
"type": "text",
"object_relation": "detection-ratio",
"value": "48/71",
"category": "Payload delivery",
"comment": "Other predator hashes",
"uuid": "1011e2ec-c6d5-4479-9e24-040bb1dc1189"
}
],
"x_misp_meta_category": "misc",
"x_misp_name": "virustotal-report"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--4dce2aca-173e-45d5-ac70-39b11b0bde68",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-26T17:02:40.000Z",
"modified": "2019-12-26T17:02:40.000Z",
"pattern": "[file:hashes.MD5 = '51e1924ac4c3f87553e9e9c712348ac8' AND file:hashes.SHA1 = '7f81cdffcab77a07b1e15298d5b7c6681c0e5c6c' AND file:hashes.SHA256 = '271d39c0daaf1efb3571fcb7cf2b271f882aebe070176d777e3dcbbbe1d80002']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-12-26T17:02:40Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--f0633bef-4096-48ac-8076-42f96522515a",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-26T17:02:41.000Z",
"modified": "2019-12-26T17:02:41.000Z",
"labels": [
"misp:name=\"virustotal-report\"",
"misp:meta-category=\"misc\""
],
"x_misp_attributes": [
{
"type": "datetime",
"object_relation": "last-submission",
"value": "2019-12-25T23:50:06",
"category": "Other",
"comment": "Other predator hashes",
"uuid": "8f960a45-2cda-48b5-af90-bc324e624589"
},
{
"type": "link",
"object_relation": "permalink",
"value": "https://www.virustotal.com/file/271d39c0daaf1efb3571fcb7cf2b271f882aebe070176d777e3dcbbbe1d80002/analysis/1577317806/",
"category": "Payload delivery",
"comment": "Other predator hashes",
"uuid": "6815fe07-a65c-4e36-9ae8-e061f2d81996"
},
{
"type": "text",
"object_relation": "detection-ratio",
"value": "44/72",
"category": "Payload delivery",
"comment": "Other predator hashes",
"uuid": "ff524555-72ff-4dfe-ae4b-9b94c8f058fe"
}
],
"x_misp_meta_category": "misc",
"x_misp_name": "virustotal-report"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--b146e56a-7421-4e1c-90a6-05e350142898",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-26T17:02:41.000Z",
"modified": "2019-12-26T17:02:41.000Z",
"pattern": "[file:hashes.MD5 = '02484e00e248da80c897e2261e65d275' AND file:hashes.SHA1 = '8a1550d7d473c85cb8bdadce151eb66dce8bc7cc' AND file:hashes.SHA256 = '8f33307a23babe5b961fd72184274a34cad2218916ac343baa131290ff018e57']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-12-26T17:02:41Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--2a62535e-e6ab-4678-91ed-333564e64814",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-26T17:02:41.000Z",
"modified": "2019-12-26T17:02:41.000Z",
"labels": [
"misp:name=\"virustotal-report\"",
"misp:meta-category=\"misc\""
],
"x_misp_attributes": [
{
"type": "datetime",
"object_relation": "last-submission",
"value": "2019-12-23T11:50:24",
"category": "Other",
"comment": "Other predator hashes",
"uuid": "8e218d95-e946-45f4-9279-f13ac5a15eb9"
},
{
"type": "link",
"object_relation": "permalink",
"value": "https://www.virustotal.com/file/8f33307a23babe5b961fd72184274a34cad2218916ac343baa131290ff018e57/analysis/1577101824/",
"category": "Payload delivery",
"comment": "Other predator hashes",
"uuid": "b8ef1188-4a8f-4b05-9781-9c94c02046c8"
},
{
"type": "text",
"object_relation": "detection-ratio",
"value": "47/71",
"category": "Payload delivery",
"comment": "Other predator hashes",
"uuid": "5f67fdb9-1ef5-41ab-9320-11685191e102"
}
],
"x_misp_meta_category": "misc",
"x_misp_name": "virustotal-report"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--1c1bc6e2-3c6f-4111-b421-87e1e5a05b9d",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-26T17:02:41.000Z",
"modified": "2019-12-26T17:02:41.000Z",
"pattern": "[file:hashes.MD5 = '82ec8cb11e560681ffe5a2ee1397ba40' AND file:hashes.SHA1 = 'a3349ccc3ccc58424b6855dceaa740d9d144eedf' AND file:hashes.SHA256 = '21ebdc3a58f3d346247b2893d41c80126edabb060759af846273f9c9d0c92a9a']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-12-26T17:02:41Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--fd386d29-307f-462e-bd14-57bd67528cee",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-26T17:02:41.000Z",
"modified": "2019-12-26T17:02:41.000Z",
"labels": [
"misp:name=\"virustotal-report\"",
"misp:meta-category=\"misc\""
],
"x_misp_attributes": [
{
"type": "datetime",
"object_relation": "last-submission",
"value": "2019-11-06T00:05:26",
"category": "Other",
"uuid": "00c15ce8-a3c2-4a45-97c2-0099d1251967"
},
{
"type": "link",
"object_relation": "permalink",
"value": "https://www.virustotal.com/file/21ebdc3a58f3d346247b2893d41c80126edabb060759af846273f9c9d0c92a9a/analysis/1572998726/",
"category": "Payload delivery",
"uuid": "25eefa9c-ab55-4d28-80ae-513162e3c225"
},
{
"type": "text",
"object_relation": "detection-ratio",
"value": "52/72",
"category": "Payload delivery",
"uuid": "c55d65e8-361e-4d20-887a-b57b56a73cc6"
}
],
"x_misp_meta_category": "misc",
"x_misp_name": "virustotal-report"
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--5e04e875-85b4-466b-9115-507002de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-26T17:05:57.000Z",
"modified": "2019-12-26T17:05:57.000Z",
"labels": [
"misp:name=\"annotation\"",
"misp:meta-category=\"misc\""
],
"x_misp_attributes": [
{
"type": "text",
"object_relation": "format",
"value": "markdown",
"category": "Other",
"uuid": "5e04e876-5a80-4348-bbf9-507002de0b81"
},
{
"type": "text",
"object_relation": "type",
"value": "report",
"category": "Other",
"uuid": "5e04e876-d1f0-46cf-86f2-507002de0b81"
},
{
"type": "text",
"object_relation": "text",
"value": "[<img width=\"39\" height=\"32\" src=\":/87c1ef79c46d4766a0ce89c58236458d\"/>](https://fumik0.com)\r\n\r\n* [Home](https://fumik0.com/)\r\n* [Tracker](http://tracker.fumik0.com)\r\n* [Twitter](https://twitter.com/fumik0_)\r\n* [About](https://fumik0.com/about/)\r\n* [Contact](https://fumik0.com/contact/)\r\n\r\n* [Home](https://fumik0.com)\r\n* [botnet](https://fumik0.com/category/botnet/)\r\n* Let\u00e2\u20ac\u2122s play (again) with Predator the thief\r\n\r\n# Let\u00e2\u20ac\u2122s play (again) with Predator the thief\r\n\r\n[0](https://fumik0.com/2019/12/25/lets-play-again-with-predator-the-thief/#comments)\r\n\r\n![](:/5d9c033aa2614a1584eda9e4756ad915) [fumko](https://fumik0.com/author/fumko/ \"written December 25, 2019 @ 7:49 pm\") written 21 hours ago\r\n\r\n![](:/3189a43320a24016869436b1919bdb67)\r\n\r\nWhenever I reverse a sample, I am mostly interested in how it was developed, even if in the end the techniques employed are generally the same, I am always curious about what was the way to achieve a task, or just simply understand the code philosophy of a piece of code. It is a very nice way to spot different trending and discovering (sometimes) new tricks that you never know it was possible to do. This is one of the main reasons, I love digging mostly into stealers/clippers for their accessibility for being reversed, and enjoying malware analysis as a kind of game (unless some exceptions like Nymaim that is literally hell).\r\n\r\nIt's been 1 year and a half now that I start looking into \"Predator The Thief\", and this malware has evolved over time in terms of content added and code structure. This impression could be totally different from others in terms of stealing tasks performed, but based on my first in-depth analysis,, the code has changed too much and it was necessary to make another post on it.\r\n\r\nThis one will focus on some major aspects of the 3.3.2 version, but will not explain everything (because some details have already been mentioned in other papers,\u00c2\u00a0 some subjects are known). Also, times to times I will add some extra commentary about malware analysis in general.\r\n\r\n## Anti-Disassembly\r\n\r\nWhen you open an unpacked binary in IDA or other disassembler software like GHIDRA, there is an amount of code that is not interpreted correctly which leads to rubbish code, the incapacity to construct instructions or showing some graph. Behind this, it's obvious that an anti-disassembly trick is used.\r\n\r\n<img width=\"636\" height=\"317\" src=\":/6ae0ef5565ff40d5b6b87daf4ec4b7ed\"/>\r\n\r\nThe technique exploited here is known and used in the wild by other malware, it requires just a few opcodes to process and leads at the end at the creation of a false branch. In this case, it begins with a simple xor instruction that focuses on configuring the zero flag and forcing the JZ jump condition to work no matter what, so, at this stage, it's understandable that something suspicious is in progress. Then the MOV opcode (0xB8) next to the jump is a 5 bytes instruction and disturbing the disassembler to consider that this instruction is the right one to interpret beside that the correct opcode is inside this one, and in the end, by choosing this wrong path malicious tasks are hidden.\r\n\r\nOf course, fixing this issue is simple, and required just a few seconds. For example with IDA, you need to undefine the MOV instruction by pressing the keyboard shortcut \"U\", to produce this pattern.\r\n\r\n![predator_anti_analysis_03](:/49ceced72dd147d19759ebb547322859)\r\n\r\nThen skip the 0xB8 opcode, and pushing on \"C\" at the 0xE8 position, to configure the disassembler to interpret instruction at this point.\r\n\r\n<img width=\"900\" height=\"173\" src=\":/27d4709eba9d427481718e91aaa1fb67\"/>\r\n\r\nReplacing the 0xB8 opcode by 0x90. with a hexadecimal editor, will fix the issue. Opening again the patched PE, you will see that IDA is now able to even show the graph mode.\r\n\r\nAfter patching it, there are still some parts that can't be correctly parse
"category": "Other",
"uuid": "5e04e876-4654-422f-b2f5-507002de0b81"
}
],
"x_misp_comment": "Dump of the original website in Markdown format",
"x_misp_meta_category": "misc",
"x_misp_name": "annotation"
},
{
"type": "relationship",
"spec_version": "2.1",
chg: [export] updated
2023-05-19 09:05:37 +00:00
"id": "relationship--c1a16a81-ed73-4548-afd7-ef50da8ba022",
chg: [misp-stix] STIX 2.1 export added
2023-04-21 14:44:17 +00:00
"created": "2019-12-26T17:02:42.000Z",
"modified": "2019-12-26T17:02:42.000Z",
"relationship_type": "analysed-with",
"source_ref": "indicator--38108716-d461-41c6-8f58-0c2e5faa9f64",
"target_ref": "x-misp-object--480d06d8-d9b8-4ced-97d8-5a1dd2b938f3"
},
{
"type": "relationship",
"spec_version": "2.1",
chg: [export] updated
2023-05-19 09:05:37 +00:00
"id": "relationship--b76f4080-a67f-4e95-a22c-d4f951a82188",
chg: [misp-stix] STIX 2.1 export added
2023-04-21 14:44:17 +00:00
"created": "2019-12-26T17:02:42.000Z",
"modified": "2019-12-26T17:02:42.000Z",
"relationship_type": "analysed-with",
"source_ref": "indicator--7dd2b52a-6440-4cc6-9142-24b33b288eec",
"target_ref": "x-misp-object--60e31b6e-033c-4edf-8e19-187bf909e409"
},
{
"type": "relationship",
"spec_version": "2.1",
chg: [export] updated
2023-05-19 09:05:37 +00:00
"id": "relationship--8f7fe882-3e25-4801-8e3f-8e226c893e19",
chg: [misp-stix] STIX 2.1 export added
2023-04-21 14:44:17 +00:00
"created": "2019-12-26T17:02:42.000Z",
"modified": "2019-12-26T17:02:42.000Z",
"relationship_type": "analysed-with",
"source_ref": "indicator--d4a24fd0-9810-4c54-86ba-631f43d4e22c",
"target_ref": "x-misp-object--c62ace2f-f3d3-4207-be63-75b867775faf"
},
{
"type": "relationship",
"spec_version": "2.1",
chg: [export] updated
2023-05-19 09:05:37 +00:00
"id": "relationship--54af500a-5273-42dd-8401-661e87e23ca5",
chg: [misp-stix] STIX 2.1 export added
2023-04-21 14:44:17 +00:00
"created": "2019-12-26T17:02:42.000Z",
"modified": "2019-12-26T17:02:42.000Z",
"relationship_type": "analysed-with",
"source_ref": "indicator--50c3e941-eafb-46ac-9dd7-96753fea8e57",
"target_ref": "x-misp-object--ecd2c5e0-2e9f-4c69-bc0c-c23961b9e132"
},
{
"type": "relationship",
"spec_version": "2.1",
chg: [export] updated
2023-05-19 09:05:37 +00:00
"id": "relationship--9083d595-79c3-4017-9e6d-2722e49fa07d",
chg: [misp-stix] STIX 2.1 export added
2023-04-21 14:44:17 +00:00
"created": "2019-12-26T17:02:42.000Z",
"modified": "2019-12-26T17:02:42.000Z",
"relationship_type": "analysed-with",
"source_ref": "indicator--63aa563e-87b6-4727-808c-1f8dbd42ecf2",
"target_ref": "x-misp-object--7bf812c0-54af-47f5-8085-751942a1c16c"
},
{
"type": "relationship",
"spec_version": "2.1",
chg: [export] updated
2023-05-19 09:05:37 +00:00
"id": "relationship--58aaf65a-285c-4323-a541-d81c4152d6de",
chg: [misp-stix] STIX 2.1 export added
2023-04-21 14:44:17 +00:00
"created": "2019-12-26T17:02:42.000Z",
"modified": "2019-12-26T17:02:42.000Z",
"relationship_type": "analysed-with",
"source_ref": "indicator--4dce2aca-173e-45d5-ac70-39b11b0bde68",
"target_ref": "x-misp-object--f0633bef-4096-48ac-8076-42f96522515a"
},
{
"type": "relationship",
"spec_version": "2.1",
chg: [export] updated
2023-05-19 09:05:37 +00:00
"id": "relationship--6fea4b0c-3e02-4a8f-8fda-f9055120714f",
chg: [misp-stix] STIX 2.1 export added
2023-04-21 14:44:17 +00:00
"created": "2019-12-26T17:02:42.000Z",
"modified": "2019-12-26T17:02:42.000Z",
"relationship_type": "analysed-with",
"source_ref": "indicator--b146e56a-7421-4e1c-90a6-05e350142898",
"target_ref": "x-misp-object--2a62535e-e6ab-4678-91ed-333564e64814"
},
{
"type": "relationship",
"spec_version": "2.1",
chg: [export] updated
2023-05-19 09:05:37 +00:00
"id": "relationship--a86f153b-9940-4581-9809-b282edffb479",
chg: [misp-stix] STIX 2.1 export added
2023-04-21 14:44:17 +00:00
"created": "2019-12-26T17:02:42.000Z",
"modified": "2019-12-26T17:02:42.000Z",
"relationship_type": "analysed-with",
"source_ref": "indicator--1c1bc6e2-3c6f-4111-b421-87e1e5a05b9d",
"target_ref": "x-misp-object--fd386d29-307f-462e-bd14-57bd67528cee"
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
]
}
Reference in a new issue Copy permalink