369 lines
70 KiB
JSON
369 lines
70 KiB
JSON
|
{
|
||
|
|
"Event": {
|
||
|
|
"analysis": "0",
|
||
|
|
"date": "2018-03-02",
|
||
|
|
"extends_uuid": "",
|
||
|
|
"info": "SMS/iMessage phishes forcing users to install/run scripts and update VPN settings",
|
||
|
|
"publish_timestamp": "1519987698",
|
||
|
|
"published": true,
|
||
|
|
"threat_level_id": "3",
|
||
|
|
"timestamp": "1519987573",
|
||
|
|
"uuid": "5a9922cb-9c5c-4979-a78c-4fee950d210f",
|
||
|
|
"Orgc": {
|
||
|
|
"name": "CIRCL",
|
||
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
||
|
|
},
|
||
|
|
"Tag": [
|
||
|
|
{
|
||
|
|
"colour": "#ffffff",
|
||
|
|
"name": "tlp:white"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"colour": "#086200",
|
||
|
|
"name": "admiralty-scale:source-reliability=\"c\""
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1519986221",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "ip-dst",
|
||
|
|
"uuid": "5a9922e9-c640-42d2-8428-4808950d210f",
|
||
|
|
"value": "172.96.173.150"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1519986221",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "5a99230c-d524-44ac-a40a-c8e0950d210f",
|
||
|
|
"value": "corp-vpn.com"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1519986221",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "5a992340-a754-4006-9526-4892950d210f",
|
||
|
|
"value": "sso-vpn.com"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1519986222",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "5a992341-2d9c-4ece-a508-418e950d210f",
|
||
|
|
"value": "up-sso.com"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Network activity",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1519986223",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "domain",
|
||
|
|
"uuid": "5a992341-8798-47cf-ad4e-490f950d210f",
|
||
|
|
"value": "up-vpn.com"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Phishing used against Apple employees + others, this would be dropped by script that they are attempting to get piped to bash via a SMS/iMessage request. This is just a simple pyinstaller wrapped pupy script which beacons back to tipok.gotdns.ch",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1519985514",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "5a99236a-56b4-4f76-8928-4d41950d210f",
|
||
|
|
"value": "2ff6b78a4c2b239b2502d4eb7907906ae68275dbb92d3773fa083fb2fbc09a76"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "External analysis",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1519986223",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "link",
|
||
|
|
"uuid": "5a99237b-5c80-4ba0-92df-47b0950d210f",
|
||
|
|
"value": "https://virustotal.com/en/file/2ff6b78a4c2b239b2502d4eb7907906ae68275dbb92d3773fa083fb2fbc09a76/analysis/1519948184/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Phishing used against Apple employees + others, this would be dropped by script that they are attempting to get piped to bash via a SMS/iMessage request. This is just a simple pyinstaller wrapped pupy script which beacons back to tatiano96.zapto.org",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1519985899",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "5a9924eb-e468-417f-a0e9-4bce950d210f",
|
||
|
|
"value": "1bccbc10642a31b871f5503a52ec5c89598976e6aea0874ed2e396394d8dca00"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "External analysis",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1519986224",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "link",
|
||
|
|
"uuid": "5a99258c-a394-4f4b-915a-4a6b950d210f",
|
||
|
|
"value": "https://twitter.com/timstrazz/status/969360276423311360"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "External analysis",
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1519987570",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "link",
|
||
|
|
"uuid": "5a992b72-c434-48f1-af1b-43e7950d210f",
|
||
|
|
"value": "https://twitter.com/dyngnosis/status/969397210860478464"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "External analysis",
|
||
|
|
"comment": "from: https://twitter.com/dyngnosis/status/969397210860478464",
|
||
|
|
"data": "/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAUDBAQEAwUEBAQFBQUGBwwIBwcHBw8LCwkMEQ8SEhEPERETFhwXExQaFRERGCEYGh0dHx8fExciJCIeJBweHx7/2wBDAQUFBQcGBw4ICA4eFBEUHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh7/wgARCAKrBLADASIAAhEBAxEB/8QAHAABAAIDAQEBAAAAAAAAAAAAAAMEAQIFBgcI/8QAGgEBAAMBAQEAAAAAAAAAAAAAAAECAwQFBv/aAAwDAQACEAMQAAAB+ygAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAg1sgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADHBqYtzWe/5PeY9YKdQAAAAAAAAAAAAAAADjwUbc9ntebgmntWM06wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPH26rTh2nqdmLdgU7AAAAAAAAAAAAAAAAPL17EOnDtLV6Ce9uZ9gJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOWOo51M6vAtzTnzvTc7RPVc3aL9Bw+gXAAAAAAAAAAAAACuWHMydDzsl6acrvQ5ReU68adRy7pOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADlUPSDgc72A83c7A87L3R5u91hxt+sAAAAAAAAAAAAAHJ6w4MHpR5Do94cDPeHBk7Q8z35wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA03jJAAAAAAAAAAAAGNCRFkkRgkEaQa7AMGkmm4xkRpBGkGm+NCRHglRZJGm4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAjkjJAAAAAAAGmCREJdddjRKIsyDTcAAAAAEckZIAAAAAABHII0gjSCORGSIxIjEiOQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVbQhmAAABrtEZSCLMgxkAAAAAAAAAAFC+MZAAAAAAAAAAAABHII0gjSYK1qOQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAo+W83zOrD1nt/jvrYfQBzbgAIpYiUAAAAAAAAAAAApop+V87yuzD6L7H5R6fK/sxhqAAAAAAAAAAAAA5nQ+SaU9Dt4PpdOP16fw3ueTcK2AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/P9j23A7+Tk97n/QKz6kcXUAAiliJQAAAAAAAAAAAOB38THwap6ax38lPueY+vZadAcnQAAAAAAAAAAAABV+E/oD5f0Y+Q6HU5nRj3/p/D7nH0hncAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAp8Y9LzqtQ7Vzj1Zj0Ty3dibgAEUsRKAAAAAAAAAAAamzzsR6fj61Eegl89Odp5q0ntgAAAAAAAAAAAFGF55qaVq5wb0x2XnIon1CKUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA153R2NKXQEMFzJBJvqbAARSxEoAAAAAAAAAAAKS6IqfREOlkVZZMgAAAAAAAAAABrqSQ77lCexgqb2RTlmyYziMlAAAAAAAAAAAAAAAAAAAAAAAAAISZUwXFbUtquSyoTFlXFhFoWFWA6OlXclzWkLKsLKGuWpIJwCNJgyi2N4lQ6CpsWVPcsooC4qi0qTEqvqWlGQtKwsoqxeVsFpStG+EZiYAAIpURKpblpS0Ogpal9S2LahuXFGcl1pzEyHQsohKgkN1aUm2hmBCZkyANG+ptUnjJJKkR0FKQsqkpMrbkytGXWsBZUty0qbFlQmLKvgsqsZeAAAAAAAAAAAAAAAAAAARDbXfYjkAAAACOTGpuABjIi1nhJkW5sAAAAAYMtMEiMSIxJiOMkljyMb5I2sROiEsedSTNfJazVkJlecyq5LKtqW0GhaVxYU5CwhmAAGMamJQAAAxHKCGY10lGMx4JQAAAAAAAAAAAAAAAAAAAAAAAAAQ7VroAAAAAAAhmpF0AACOSMk12EM1K6ANdqpLnO5GkEedwAAxnBDPTuAAGGRhkYxsI0lEusjGQ1zkYxsMY2GGRrnIAAab1SaTXYAAAAAQT0y4ACFuId9skedskEmdiPWbBrpNg3gsRmuJBFtnYgk2yaaTamNZcEgAAAAAAAAAAAACDy1q+wfGveXr6kZaAAAAAAFO5WQtAACOSMkANIbq1mJC0AAAAAFLydq+5fGvpl69kZaAAAAAEcdZsC0AAAAAAAHC8tpT6M+W/Q4XxS4AAAABirWbYtAAAAAAAAAAAAAAAAAAAAAAAAAHhPB+w8h3csHofK+kvX6b1eL2uDqCtgAAAAOb5rt+M8P0fTdHh9XWnfHr8ICOSMkAIInyE3Gs/N+t3PSeS9b7HAHbzgAAAfLfMdvj+hya+g8t3kfXpYZvP6wSAAAA8P6/575Pb3LnE6WGvrB7vmgAAAAI5Ij4zx97HpcV31Hj/AEud/pw4eoAAAAB4313z3zOzqXOH0ePo9iPf8sAAAAAAAAAAAAAAAAAAAAAAACp8u+uNKfK+h9DzaAx0AAAAGDLXYgS7UmjewlkxaMgRyRkgDGSrHc2ztFLjN6mEsgAAA5Hzj680p8n9N7HMwGWgAAABrkzUt4rNK1JrE7Gt67AAAAAA8b5j6zjXP5D9L6iJDO4AAABgZrWdazTsTIkwvXLGQAAAAAAAAAAAAAAAAAAB5D18Z47Hth4e56wjxkfr7ET43f16XkNPZDysnpsHl4/VYPJ9Hvjxt70gAeP9gh4v0nQS8pL6YeXj9YhyPLfQEuN2QRyRknE7aHzvu+nS8F6PtDxtv048j2+mAOBzfYxQ8Xv7PeXlYvXjxmfZDgc32I8ra7kkPF9H0G8vJR+xADGR5THrB4/X2Q5HI9chxuB7hLynqwA53nfZxniXuh5/ie7jPIRe0kPI49ePE2vWDzFT2UcPPVvXJeeo+vHj+/0QB5jme6Hm+R7scbk+vHjJvWoed9ESAAAAAAAAAAIdCypSFlWFlXjLitksKc5KgiLirksoIi4g1LKvgs4qzkgAAAGiuWwAAAAAAAAI5IyQAAAAAAAGM1cllTkLCsLKOsWZOZeJVaQlQRltU2LKvGXEGhaQxlpUtGQAAANdoyQAAAEclG8AAAAAAAAAAAAAAAAAAYZGMhjGwwyMMjGQwyMZBjIxkNc5GNdxjMUoAABHJFKAAAAAAAAAI5IyQAAAAAAAEMukhjIANdojbcBqZZGM4GcAZwZwDLBljIYGWBlgZik1N2MgAA1NJddgAAAAAAAAAAAAAAAAAAAAAAAAAAAAACORESgAa7RG+wAAAAAAAAAI5IyQAAAAAAAGm2YyQACKTQkBrVuCti0Km9gV8WRX1tCttOIobYq5sirmyK+lsVs2BWlkEUse5kACOSIlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAilplxHIAI5IyQAAAAAAAAACOSgXwAAAAAAAI5OedAAEckcgAAAAAAAAAAAAAil550AARyRyAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwZAAAAAAAAAAAMGXmPP6U+juV1aWCJAAAAAAAMZAAAAAAAAAAAAAAAADGYBIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB5v0nzr
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"timestamp": "1519987611",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "attachment",
|
||
|
|
"uuid": "5a992b9b-a540-4a1e-8fd0-44a0950d210f",
|
||
|
|
"value": "DXP9dttU0AAGavM.jpg"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"Object": [
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "File object describing a file with meta-information",
|
||
|
|
"meta-category": "file",
|
||
|
|
"name": "file",
|
||
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
||
|
|
"template_version": "7",
|
||
|
|
"timestamp": "1519986227",
|
||
|
|
"uuid": "0601169d-401d-466b-99e5-ab32aca720c0",
|
||
|
|
"ObjectReference": [
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"object_uuid": "0601169d-401d-466b-99e5-ab32aca720c0",
|
||
|
|
"referenced_uuid": "37a03acb-9238-44c5-8f31-2ae308034e7b",
|
||
|
|
"relationship_type": "analysed-with",
|
||
|
|
"timestamp": "1519986229",
|
||
|
|
"uuid": "5a992635-6f58-42cc-b086-403c02de0b81"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Phishing used against Apple employees + others, this would be dropped by script that they are attempting to get piped to bash via a SMS/iMessage request. This is just a simple pyinstaller wrapped pupy script which beacons back to tipok.gotdns.ch",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"timestamp": "1519986225",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha1",
|
||
|
|
"uuid": "5a992631-1a84-4d1c-9ea0-4fe902de0b81",
|
||
|
|
"value": "5e8784026c3fd64c932e53622d0454c33038976e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Phishing used against Apple employees + others, this would be dropped by script that they are attempting to get piped to bash via a SMS/iMessage request. This is just a simple pyinstaller wrapped pupy script which beacons back to tipok.gotdns.ch",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"timestamp": "1519986225",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "5a992631-8b38-44fd-ac48-448102de0b81",
|
||
|
|
"value": "2ff6b78a4c2b239b2502d4eb7907906ae68275dbb92d3773fa083fb2fbc09a76"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Phishing used against Apple employees + others, this would be dropped by script that they are attempting to get piped to bash via a SMS/iMessage request. This is just a simple pyinstaller wrapped pupy script which beacons back to tipok.gotdns.ch",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "md5",
|
||
|
|
"timestamp": "1519986226",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "md5",
|
||
|
|
"uuid": "5a992632-03ac-46a4-931a-459602de0b81",
|
||
|
|
"value": "b97847bcc1a27107888475fd6baeb2d9"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "VirusTotal report",
|
||
|
|
"meta-category": "misc",
|
||
|
|
"name": "virustotal-report",
|
||
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
||
|
|
"template_version": "1",
|
||
|
|
"timestamp": "1519986226",
|
||
|
|
"uuid": "37a03acb-9238-44c5-8f31-2ae308034e7b",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "External analysis",
|
||
|
|
"comment": "Phishing used against Apple employees + others, this would be dropped by script that they are attempting to get piped to bash via a SMS/iMessage request. This is just a simple pyinstaller wrapped pupy script which beacons back to tipok.gotdns.ch",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"timestamp": "1519986226",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "link",
|
||
|
|
"uuid": "5a992632-874c-409b-a280-437e02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/2ff6b78a4c2b239b2502d4eb7907906ae68275dbb92d3773fa083fb2fbc09a76/analysis/1519981318/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "Phishing used against Apple employees + others, this would be dropped by script that they are attempting to get piped to bash via a SMS/iMessage request. This is just a simple pyinstaller wrapped pupy script which beacons back to tipok.gotdns.ch",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"timestamp": "1519986227",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "5a992633-db0c-4e94-bdf4-4bec02de0b81",
|
||
|
|
"value": "1/60"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "Phishing used against Apple employees + others, this would be dropped by script that they are attempting to get piped to bash via a SMS/iMessage request. This is just a simple pyinstaller wrapped pupy script which beacons back to tipok.gotdns.ch",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"timestamp": "1519986227",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "datetime",
|
||
|
|
"uuid": "5a992633-896c-4657-8f26-471002de0b81",
|
||
|
|
"value": "2018-03-02T09:01:58"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "File object describing a file with meta-information",
|
||
|
|
"meta-category": "file",
|
||
|
|
"name": "file",
|
||
|
|
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
|
||
|
|
"template_version": "7",
|
||
|
|
"timestamp": "1519986230",
|
||
|
|
"uuid": "491fb46e-2c0f-4060-a745-a5cf809be441",
|
||
|
|
"ObjectReference": [
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"object_uuid": "491fb46e-2c0f-4060-a745-a5cf809be441",
|
||
|
|
"referenced_uuid": "9aaf2bc6-ccc6-4658-9440-d6a54f790a9f",
|
||
|
|
"relationship_type": "analysed-with",
|
||
|
|
"timestamp": "1519986230",
|
||
|
|
"uuid": "5a992636-3894-4552-9ddd-467b02de0b81"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Phishing used against Apple employees + others, this would be dropped by script that they are attempting to get piped to bash via a SMS/iMessage request. This is just a simple pyinstaller wrapped pupy script which beacons back to tatiano96.zapto.org",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"timestamp": "1519986227",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha1",
|
||
|
|
"uuid": "5a992633-0954-4665-84d7-47dc02de0b81",
|
||
|
|
"value": "4fb8edfe9694e2cd58ffaae30777bae324ac1558"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Phishing used against Apple employees + others, this would be dropped by script that they are attempting to get piped to bash via a SMS/iMessage request. This is just a simple pyinstaller wrapped pupy script which beacons back to tatiano96.zapto.org",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"timestamp": "1519986228",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "sha256",
|
||
|
|
"uuid": "5a992634-52e8-4e3f-ac54-4ac202de0b81",
|
||
|
|
"value": "1bccbc10642a31b871f5503a52ec5c89598976e6aea0874ed2e396394d8dca00"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Phishing used against Apple employees + others, this would be dropped by script that they are attempting to get piped to bash via a SMS/iMessage request. This is just a simple pyinstaller wrapped pupy script which beacons back to tatiano96.zapto.org",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "md5",
|
||
|
|
"timestamp": "1519986228",
|
||
|
|
"to_ids": true,
|
||
|
|
"type": "md5",
|
||
|
|
"uuid": "5a992634-71d4-49af-bbfe-441c02de0b81",
|
||
|
|
"value": "35fba2a83659d22eedf5926a3dc680f4"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"comment": "",
|
||
|
|
"deleted": false,
|
||
|
|
"description": "VirusTotal report",
|
||
|
|
"meta-category": "misc",
|
||
|
|
"name": "virustotal-report",
|
||
|
|
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
|
||
|
|
"template_version": "1",
|
||
|
|
"timestamp": "1519986228",
|
||
|
|
"uuid": "9aaf2bc6-ccc6-4658-9440-d6a54f790a9f",
|
||
|
|
"Attribute": [
|
||
|
|
{
|
||
|
|
"category": "External analysis",
|
||
|
|
"comment": "Phishing used against Apple employees + others, this would be dropped by script that they are attempting to get piped to bash via a SMS/iMessage request. This is just a simple pyinstaller wrapped pupy script which beacons back to tatiano96.zapto.org",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"timestamp": "1519986229",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "link",
|
||
|
|
"uuid": "5a992635-6d0c-4faf-b632-449e02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/1bccbc10642a31b871f5503a52ec5c89598976e6aea0874ed2e396394d8dca00/analysis/1519980899/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "Phishing used against Apple employees + others, this would be dropped by script that they are attempting to get piped to bash via a SMS/iMessage request. This is just a simple pyinstaller wrapped pupy script which beacons back to tatiano96.zapto.org",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": true,
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"timestamp": "1519986229",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "text",
|
||
|
|
"uuid": "5a992635-0854-453f-a479-4c9d02de0b81",
|
||
|
|
"value": "1/60"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "Phishing used against Apple employees + others, this would be dropped by script that they are attempting to get piped to bash via a SMS/iMessage request. This is just a simple pyinstaller wrapped pupy script which beacons back to tatiano96.zapto.org",
|
||
|
|
"deleted": false,
|
||
|
|
"disable_correlation": false,
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"timestamp": "1519986229",
|
||
|
|
"to_ids": false,
|
||
|
|
"type": "datetime",
|
||
|
|
"uuid": "5a992635-d534-48df-ba48-41c302de0b81",
|
||
|
|
"value": "2018-03-02T08:54:59"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}
|