adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/56d42420-c838-4c85-80ee-1365950d210f.json

627 lines
23 KiB
JSON
Raw Normal View History

chg: [feed] added
2023-04-21 13:25:09 +00:00
{
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"Event": {
"analysis": "2",
"date": "2016-02-29",
"extends_uuid": "",
"info": "OSINT - ATMZombie: banking trojan in Israeli waters",
"publish_timestamp": "1456743741",
"published": true,
"threat_level_id": "3",
"timestamp": "1456743712",
"uuid": "56d42420-c838-4c85-80ee-1365950d210f",
"Orgc": {
"name": "CIRCL",
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
},
"Tag": [
{
"colour": "#ffffff",
"local": "0",
"name": "tlp:white",
"relationship_type": ""
},
{
"colour": "#004646",
"local": "0",
"name": "type:OSINT",
"relationship_type": ""
}
],
"Attribute": [
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743485",
"to_ids": false,
"type": "link",
"uuid": "56d4243d-8880-4f2f-a4b8-49d3950d210f",
"value": "https://securelist.com/blog/research/73866/atmzombie-banking-trojan-in-israeli-waters/"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743506",
"to_ids": false,
"type": "comment",
"uuid": "56d42452-69c8-434e-9609-18f0950d210f",
"value": "On November 2015, Kaspersky Lab researchers identified ATMZombie, a banking Trojan that is considered to be the first malware to ever steal money from Israeli banks. It uses insidious injection and other sophisticated and stealthy methods. The first method, dubbed \u00e2\u20ac\u0153proxy-changing\u00e2\u20ac\u009d, is commonly used for HTTP packets inspections. It involves modifying browser proxy configurations and capturing traffic between a client and a server, acting as Man-In-The-Middle.\r\n\r\nAlthough this is efficient for testing, streaming bank details isn\u00e2\u20ac\u2122t as easy. Banks are using encrypted channels, signed with authorized certificates, to prevent the data from being streamed in clear-text. The attackers, however, realized the missing piece and have since issued a certificate of their own, which is embedded in the dropper and is inserted in the root CA list of common browsers in the victim\u00e2\u20ac\u2122s machine.\r\n\r\nThe method of using a \u00e2\u20ac\u0153proxy-changer\u00e2\u20ac\u009d Trojan to steal bank credentials has been around since the end of 2005, and is being actively used by Brazilian cybercriminals; however, it wasn\u00e2\u20ac\u2122t until 2012 that Kaspersky Lab researchers compiled a full attack analysis. \u00e2\u20ac\u0153In Brazil malicious PAC files in Trojan bankers have been increasingly common since 2009, when several families such as Trojan.Win32.ProxyChanger started to force the URLs of PAC files in the browser of infected machines.\u00e2\u20ac\u0153, said Fabio Assolini, Senior Security Researcher at GReAT Kaspersky Lab, in his article."
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743528",
"to_ids": true,
"type": "domain",
"uuid": "56d42468-6254-433d-b79d-18f2950d210f",
"value": "retsback.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743528",
"to_ids": true,
"type": "domain",
"uuid": "56d42468-e430-42c1-af5f-18f2950d210f",
"value": "updconfs.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743529",
"to_ids": true,
"type": "domain",
"uuid": "56d42469-9174-4954-8e6a-18f2950d210f",
"value": "systruster.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743529",
"to_ids": true,
"type": "domain",
"uuid": "56d42469-07d4-412d-9308-18f2950d210f",
"value": "msupdcheck.com"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743544",
"to_ids": true,
"type": "ip-dst",
"uuid": "56d42478-dd34-408f-9189-49d1950d210f",
"value": "91.230.211.206"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743544",
"to_ids": true,
"type": "ip-dst",
"uuid": "56d42478-5890-4c55-b27c-49d1950d210f",
"value": "185.86.77.153"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743545",
"to_ids": true,
"type": "ip-dst",
"uuid": "56d42479-9f50-4c3f-978c-49d1950d210f",
"value": "91.215.154.90"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743545",
"to_ids": true,
"type": "ip-dst",
"uuid": "56d42479-5f9c-42dd-a40d-49d1950d210f",
"value": "88.214.236.121"
},
{
"category": "Payload delivery",
"comment": "Trojan-Banker.Win32.Capper.zym",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743629",
"to_ids": true,
"type": "md5",
"uuid": "56d424cd-0a88-4d49-aedb-18f1950d210f",
"value": "6d11090c78e6621c21836c98808ff0f4"
},
{
"category": "Payload delivery",
"comment": "Trojan-Banker.Win32.Capper.zyt",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743630",
"to_ids": true,
"type": "md5",
"uuid": "56d424ce-e0bc-4609-8eea-18f1950d210f",
"value": "4c5b7a8187475be251d05655edcaccbe"
},
{
"category": "Payload delivery",
"comment": "Trojan-Banker.Win32.Capper.zyk",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743631",
"to_ids": true,
"type": "md5",
"uuid": "56d424cf-09c0-46b9-8200-18f1950d210f",
"value": "c0201ab2a45bc0e17ebd186059d5a59e"
},
{
"category": "Payload delivery",
"comment": "Trojan-Banker.Win32.Capper.zyl",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743631",
"to_ids": true,
"type": "md5",
"uuid": "56d424cf-0fa0-405a-b234-18f1950d210f",
"value": "47b316e3227d618089eb1625c4202142"
},
{
"category": "Payload delivery",
"comment": "PAC",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743632",
"to_ids": true,
"type": "md5",
"uuid": "56d424d0-2454-4f64-b5df-18f1950d210f",
"value": "84bb5a77e28b3539a8022bc3612d4f4c"
},
{
"category": "Payload delivery",
"comment": "Trojan-Banker.Win32.Capper.zyp",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743632",
"to_ids": true,
"type": "md5",
"uuid": "56d424d0-2d60-4f0c-84ed-18f1950d210f",
"value": "d2bf165284ab1953a96dfa7b642637a8"
},
{
"category": "Payload delivery",
"comment": "Trojan-Banker.Win32.Capper.zyq",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743633",
"to_ids": true,
"type": "md5",
"uuid": "56d424d1-a3dc-4bb8-9e4b-18f1950d210f",
"value": "80440e78a68583b180ad4d3e9a676a6e"
},
{
"category": "Payload delivery",
"comment": "Trojan-Banker.Win32.Capper.zyg",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743633",
"to_ids": true,
"type": "md5",
"uuid": "56d424d1-9ec0-4d57-9620-18f1950d210f",
"value": "d08e51f8187df278296a8c4ff5cff0de"
},
{
"category": "Payload delivery",
"comment": "Trojan-Banker.Win32.Capper.zyg",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743634",
"to_ids": true,
"type": "md5",
"uuid": "56d424d2-58a0-4a99-8047-18f1950d210f",
"value": "efa5ea2c511b08d0f8259a10a49b27ad"
},
{
"category": "Payload delivery",
"comment": "Trojan-Banker.Win32.Capper.zyg",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743634",
"to_ids": true,
"type": "md5",
"uuid": "56d424d2-8998-48fb-a9a9-18f1950d210f",
"value": "13d9352a27b626e501f5889bfd614b34"
},
{
"category": "Payload delivery",
"comment": "Trojan-Banker.Win32.Capper.zyg",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743635",
"to_ids": true,
"type": "md5",
"uuid": "56d424d3-fab4-40b2-92f9-18f1950d210f",
"value": "e5b7fd7eed59340027625ac39bae7c81"
},
{
"category": "Payload delivery",
"comment": "Trojan-Banker.Win32.Capper.zyg - Xchecked via VT: e5b7fd7eed59340027625ac39bae7c81",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743712",
"to_ids": true,
"type": "sha256",
"uuid": "56d42520-66bc-461c-aec3-136b02de0b81",
"value": "83c8f47fb756860134a06eb2241467450c106059849de0a4838811f2af02f93d"
},
{
"category": "Payload delivery",
"comment": "Trojan-Banker.Win32.Capper.zyg - Xchecked via VT: e5b7fd7eed59340027625ac39bae7c81",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743713",
"to_ids": true,
"type": "sha1",
"uuid": "56d42521-e338-4251-8428-136b02de0b81",
"value": "64e27e0cafff0c230b22489baae98100a5417a86"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743713",
"to_ids": false,
"type": "link",
"uuid": "56d42521-3344-4d72-88f6-136b02de0b81",
"value": "https://www.virustotal.com/file/83c8f47fb756860134a06eb2241467450c106059849de0a4838811f2af02f93d/analysis/1447251902/"
},
{
"category": "Payload delivery",
"comment": "Trojan-Banker.Win32.Capper.zyg - Xchecked via VT: 13d9352a27b626e501f5889bfd614b34",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743713",
"to_ids": true,
"type": "sha256",
"uuid": "56d42521-c944-4a0e-a511-136b02de0b81",
"value": "76ef5d7d06e2a11bb3dd78b8a6e5f3042b79b69bec034d07f97540d8514dca3b"
},
{
"category": "Payload delivery",
"comment": "Trojan-Banker.Win32.Capper.zyg - Xchecked via VT: 13d9352a27b626e501f5889bfd614b34",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743714",
"to_ids": true,
"type": "sha1",
"uuid": "56d42522-a070-4761-a5f3-136b02de0b81",
"value": "8df6716038b03ba3bc1e31ee0587f2c093cdca48"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743714",
"to_ids": false,
"type": "link",
"uuid": "56d42522-3e6c-4af5-8980-136b02de0b81",
"value": "https://www.virustotal.com/file/76ef5d7d06e2a11bb3dd78b8a6e5f3042b79b69bec034d07f97540d8514dca3b/analysis/1447116816/"
},
{
"category": "Payload delivery",
"comment": "Trojan-Banker.Win32.Capper.zyg - Xchecked via VT: efa5ea2c511b08d0f8259a10a49b27ad",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743714",
"to_ids": true,
"type": "sha256",
"uuid": "56d42522-9e6c-47a6-99f7-136b02de0b81",
"value": "d5a4b61207294f29c4f8abd317df38d8426ef9f0c7240132d9c33764e0b535d4"
},
{
"category": "Payload delivery",
"comment": "Trojan-Banker.Win32.Capper.zyg - Xchecked via VT: efa5ea2c511b08d0f8259a10a49b27ad",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743715",
"to_ids": true,
"type": "sha1",
"uuid": "56d42523-e910-42d6-b138-136b02de0b81",
"value": "c4df3656bdea8b78ec50a5fc296f9c0e869b1864"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743715",
"to_ids": false,
"type": "link",
"uuid": "56d42523-0830-4db2-8b0f-136b02de0b81",
"value": "https://www.virustotal.com/file/d5a4b61207294f29c4f8abd317df38d8426ef9f0c7240132d9c33764e0b535d4/analysis/1456742204/"
},
{
"category": "Payload delivery",
"comment": "Trojan-Banker.Win32.Capper.zyg - Xchecked via VT: d08e51f8187df278296a8c4ff5cff0de",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743715",
"to_ids": true,
"type": "sha256",
"uuid": "56d42523-08d8-4dca-8255-136b02de0b81",
"value": "23dad1d88a73b3e4e7a938e228aa87f6af1d035d1f258644a38c085342c8eda4"
},
{
"category": "Payload delivery",
"comment": "Trojan-Banker.Win32.Capper.zyg - Xchecked via VT: d08e51f8187df278296a8c4ff5cff0de",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743716",
"to_ids": true,
"type": "sha1",
"uuid": "56d42524-d8cc-41ed-a85f-136b02de0b81",
"value": "79886aa3a13cd3ab782aa0e90bff665a70bc55b0"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743716",
"to_ids": false,
"type": "link",
"uuid": "56d42524-36b8-4213-bceb-136b02de0b81",
"value": "https://www.virustotal.com/file/23dad1d88a73b3e4e7a938e228aa87f6af1d035d1f258644a38c085342c8eda4/analysis/1456742000/"
},
{
"category": "Payload delivery",
"comment": "Trojan-Banker.Win32.Capper.zyq - Xchecked via VT: 80440e78a68583b180ad4d3e9a676a6e",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743716",
"to_ids": true,
"type": "sha256",
"uuid": "56d42524-1fa4-4522-8630-136b02de0b81",
"value": "dee548966f1e6f8d34684c98616da3021a2db5bd9b7de3543befa5a1c686ef20"
},
{
"category": "Payload delivery",
"comment": "Trojan-Banker.Win32.Capper.zyq - Xchecked via VT: 80440e78a68583b180ad4d3e9a676a6e",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743717",
"to_ids": true,
"type": "sha1",
"uuid": "56d42525-77c0-4fb8-8068-136b02de0b81",
"value": "e0514630ce24cef8b55f3d20dc43f40dd9564f13"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743717",
"to_ids": false,
"type": "link",
"uuid": "56d42525-8f14-4f99-b1bc-136b02de0b81",
"value": "https://www.virustotal.com/file/dee548966f1e6f8d34684c98616da3021a2db5bd9b7de3543befa5a1c686ef20/analysis/1456739595/"
},
{
"category": "Payload delivery",
"comment": "Trojan-Banker.Win32.Capper.zyp - Xchecked via VT: d2bf165284ab1953a96dfa7b642637a8",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743717",
"to_ids": true,
"type": "sha256",
"uuid": "56d42525-c62c-4eda-b534-136b02de0b81",
"value": "966d747a0dfdce90c32c9c8d33355c5493310b7abaa50eb0e208b35dc7614202"
},
{
"category": "Payload delivery",
"comment": "Trojan-Banker.Win32.Capper.zyp - Xchecked via VT: d2bf165284ab1953a96dfa7b642637a8",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743718",
"to_ids": true,
"type": "sha1",
"uuid": "56d42526-2cd8-4730-a95c-136b02de0b81",
"value": "76efcf23219094f45a4acb289e772ca6c7fb38e2"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743718",
"to_ids": false,
"type": "link",
"uuid": "56d42526-e5e0-4644-9409-136b02de0b81",
"value": "https://www.virustotal.com/file/966d747a0dfdce90c32c9c8d33355c5493310b7abaa50eb0e208b35dc7614202/analysis/1448457095/"
},
{
"category": "Payload delivery",
"comment": "PAC - Xchecked via VT: 84bb5a77e28b3539a8022bc3612d4f4c",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743718",
"to_ids": true,
"type": "sha256",
"uuid": "56d42526-b940-421e-afec-136b02de0b81",
"value": "0ea3e84cd40ee1a50a4161413154c983300b38aa4c78a910ba0f728618ec98e3"
},
{
"category": "Payload delivery",
"comment": "PAC - Xchecked via VT: 84bb5a77e28b3539a8022bc3612d4f4c",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743719",
"to_ids": true,
"type": "sha1",
"uuid": "56d42527-b530-4ded-897b-136b02de0b81",
"value": "926a44dcaf507955ad3ca9fa2fa0b8586036a2c3"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743719",
"to_ids": false,
"type": "link",
"uuid": "56d42527-1b18-478b-8c79-136b02de0b81",
"value": "https://www.virustotal.com/file/0ea3e84cd40ee1a50a4161413154c983300b38aa4c78a910ba0f728618ec98e3/analysis/1447258543/"
},
{
"category": "Payload delivery",
"comment": "Trojan-Banker.Win32.Capper.zyl - Xchecked via VT: 47b316e3227d618089eb1625c4202142",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743719",
"to_ids": true,
"type": "sha256",
"uuid": "56d42527-f594-4545-9380-136b02de0b81",
"value": "eb18f0d3abc6b9bfdd3d09082a027bebc4963c9bbee28b8708888cb276a00049"
},
{
"category": "Payload delivery",
"comment": "Trojan-Banker.Win32.Capper.zyl - Xchecked via VT: 47b316e3227d618089eb1625c4202142",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743720",
"to_ids": true,
"type": "sha1",
"uuid": "56d42528-c570-4870-a192-136b02de0b81",
"value": "cd0c4f2ab5f20d28c3b5d76cc7d8623fd56c78b8"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743720",
"to_ids": false,
"type": "link",
"uuid": "56d42528-27d0-4167-8efa-136b02de0b81",
"value": "https://www.virustotal.com/file/eb18f0d3abc6b9bfdd3d09082a027bebc4963c9bbee28b8708888cb276a00049/analysis/1456743361/"
},
{
"category": "Payload delivery",
"comment": "Trojan-Banker.Win32.Capper.zyk - Xchecked via VT: c0201ab2a45bc0e17ebd186059d5a59e",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743720",
"to_ids": true,
"type": "sha256",
"uuid": "56d42529-c32c-4905-b701-136b02de0b81",
"value": "294f44963b3d1e305fb4b3498a0ee616313660bdf8197d0cb2a94c0cdfaf7539"
},
{
"category": "Payload delivery",
"comment": "Trojan-Banker.Win32.Capper.zyk - Xchecked via VT: c0201ab2a45bc0e17ebd186059d5a59e",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743721",
"to_ids": true,
"type": "sha1",
"uuid": "56d42529-2ce0-4e55-971f-136b02de0b81",
"value": "987896a6befabeefcb0e42ff73ee3e1dda02f81b"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743721",
"to_ids": false,
"type": "link",
"uuid": "56d42529-3b94-45f4-90cf-136b02de0b81",
"value": "https://www.virustotal.com/file/294f44963b3d1e305fb4b3498a0ee616313660bdf8197d0cb2a94c0cdfaf7539/analysis/1447092121/"
},
{
"category": "Payload delivery",
"comment": "Trojan-Banker.Win32.Capper.zyt - Xchecked via VT: 4c5b7a8187475be251d05655edcaccbe",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743721",
"to_ids": true,
"type": "sha256",
"uuid": "56d42529-55b0-4eab-94fd-136b02de0b81",
"value": "64225a6e0815bc5b6c3414985ef5b3f374d4797d357bd243a19afc08d75c87e9"
},
{
"category": "Payload delivery",
"comment": "Trojan-Banker.Win32.Capper.zyt - Xchecked via VT: 4c5b7a8187475be251d05655edcaccbe",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743722",
"to_ids": true,
"type": "sha1",
"uuid": "56d4252a-35bc-41ea-acb1-136b02de0b81",
"value": "cd7b3d641628851ba59ac2a5260fc318c57c7fd6"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743722",
"to_ids": false,
"type": "link",
"uuid": "56d4252a-bc68-498b-a953-136b02de0b81",
"value": "https://www.virustotal.com/file/64225a6e0815bc5b6c3414985ef5b3f374d4797d357bd243a19afc08d75c87e9/analysis/1448376105/"
},
{
"category": "Payload delivery",
"comment": "Trojan-Banker.Win32.Capper.zym - Xchecked via VT: 6d11090c78e6621c21836c98808ff0f4",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743722",
"to_ids": true,
"type": "sha256",
"uuid": "56d4252a-4c40-4bb8-b5d2-136b02de0b81",
"value": "8662e3c0c564b85ee4af656dcf76fdafdacb41a2f13a3de509bca16b2e8928c7"
},
{
"category": "Payload delivery",
"comment": "Trojan-Banker.Win32.Capper.zym - Xchecked via VT: 6d11090c78e6621c21836c98808ff0f4",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743723",
"to_ids": true,
"type": "sha1",
"uuid": "56d4252b-e418-4b9c-b63b-136b02de0b81",
"value": "6da3ea5941228a08113b643297d97078c4cafb4b"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1456743723",
"to_ids": false,
"type": "link",
"uuid": "56d4252b-1c9c-4338-9754-136b02de0b81",
"value": "https://www.virustotal.com/file/8662e3c0c564b85ee4af656dcf76fdafdacb41a2f13a3de509bca16b2e8928c7/analysis/1447502166/"
}
chg: [feed] added
2023-04-21 13:25:09 +00:00
]
chg: [gen] updated
2023-12-14 14:30:15 +00:00
}
chg: [feed] added
2023-04-21 13:25:09 +00:00
}
Reference in a new issue Copy permalink