2023-04-21 13:25:09 +00:00
{
2023-12-14 14:30:15 +00:00
"Event" : {
"analysis" : "2" ,
"date" : "2016-11-17" ,
"extends_uuid" : "" ,
"info" : "It\u2019s Parliamentary: KeyBoy and the targeting of the Tibetan Community" ,
"publish_timestamp" : "1602322972" ,
"published" : true ,
"threat_level_id" : "2" ,
"timestamp" : "1588068722" ,
"uuid" : "582dd48e-66bc-40c1-ae49-6fe8d56c6cd2" ,
"Orgc" : {
"name" : "CiviCERT" ,
"uuid" : "56743359-c860-4361-b1dc-7b65d56c6cd2"
} ,
"Tag" : [
{
"colour" : "#316200" ,
"local" : "0" ,
"name" : "circl:incident-classification=\"phishing\"" ,
"relationship_type" : ""
} ,
{
"colour" : "#ffffff" ,
"local" : "0" ,
"name" : "tlp:white" ,
"relationship_type" : ""
} ,
{
"colour" : "#00223b" ,
"local" : "0" ,
"name" : "osint:source-type=\"blog-post\"" ,
"relationship_type" : ""
} ,
{
"colour" : "#0088cc" ,
"local" : "0" ,
"name" : "misp-galaxy:tool=\"KeyBoy\"" ,
"relationship_type" : ""
}
] ,
"Attribute" : [
{
"category" : "Artifacts dropped" ,
"comment" : "Wab32res.exe legitimate file used for DLL side loading" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399205" ,
"to_ids" : false ,
"type" : "md5" ,
"uuid" : "582dd725-1a84-4454-b86e-7007d56c6cd2" ,
"value" : "8f08609e4e0b3d26814b3073a42df415"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Wab32res.dll payload, KeyBoy 20160509" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399231" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "582dd740-b944-4070-9b70-0692d56c6cd2" ,
"value" : "495adb1b9777002ecfe22aaf52fcee93"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Payload KeyBoy P_20150313" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399247" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "582dd74f-c72c-4221-bc3f-6fe8d56c6cd2" ,
"value" : "0c7e55509e0b6d4277b3facf864af018"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Payload KeyBoy 20151108" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399261" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "582dd75d-7a3c-4990-883d-0696d56c6cd2" ,
"value" : "98977426d544bd145979f65f0322ae30"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Payload KeyBoy 20151108" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399277" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "582dd76d-b590-4d21-9ff6-7005d56c6cd2" ,
"value" : "c5b5f01ba24d6c02636388809f44472e"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "64b KeyBoy payload 20151108" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399290" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "582dd77a-cda4-42a0-9b86-7008d56c6cd2" ,
"value" : "371bc132499f455f06fa80696db0df27"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "wab32res.dll, agewkassif version" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1588068722" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "582dd78b-1198-4b24-b6d3-7006d56c6cd2" ,
"value" : "087bffa8a570079948310dc9731c5709"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Contains the Keyboy version" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399322" ,
"to_ids" : true ,
"type" : "regkey" ,
"uuid" : "582dd79a-c36c-4329-952c-7007d56c6cd2" ,
"value" : "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Ver"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "legitimate Microsoft Windows Address Book executable, used to load final payload" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399347" ,
"to_ids" : false ,
"type" : "sha256" ,
"uuid" : "582dd7b3-3fec-4380-b6a1-6ff1d56c6cd2" ,
"value" : "58105e9772f6befbc319c147a97faded4fbacf839947b34fe3695ae72771da5d"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Wab32res.dll payload, KeyBoy 20160509" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399362" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "582dd7c2-7434-4d28-af67-7007d56c6cd2" ,
"value" : "9a55577d357922711ab0821bf5379289293c8517ae1d94d48c389f306af57a04"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Wab32res.dll payload, KeyBoy agewkassif version" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399379" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "582dd7d3-3800-473b-b088-7006d56c6cd2" ,
"value" : "5da2f14c382d7cac8dfa6c86e528a646a81f0b40cfee9611c8cfb4b5d589aa88"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399393" ,
"to_ids" : true ,
"type" : "yara" ,
"uuid" : "582dd7e1-7bcc-4b5c-b6ef-6ff0d56c6cd2" ,
"value" : "import \"pe\"\r\nrule new_keyboy_export\r\n{\r\nmeta:\r\nauthor = \"Matt Brooks, @cmatthewbrooks\"\r\ndesc = \"Matches the new 2016 sample's export\"\r\ndate = \"2016-08-28\"\r\nmd5 = \"495adb1b9777002ecfe22aaf52fcee93\"\r\n\r\ncondition:\r\n//MZ header\r\nuint16(0) == 0x5A4D and\r\n\r\n//PE signature\r\nuint32(uint32(0x3C)) == 0x00004550 and\r\n\r\n\r\nfilesize < 200KB and\r\n\r\n\r\n//The malware family seems to share many exports\r\n//but this is the new kid on the block.\r\npe.exports(\"cfsUpdate\")\r\n}"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399405" ,
"to_ids" : true ,
"type" : "yara" ,
"uuid" : "582dd7ed-ff54-4450-9f8a-7008d56c6cd2" ,
"value" : "rule new_keyboy_header_codes\r\n{\r\nmeta:\r\nauthor = \"Matt Brooks, @cmatthewbrooks\"\r\ndesc = \"Matches the 2016 sample's header codes\"\r\ndate = \"2016-08-28\"\r\nmd5 = \"495adb1b9777002ecfe22aaf52fcee93\"\r\n\r\nstrings:\r\n$s1 = \"*l*\" wide fullword\r\n$s2 = \"*a*\" wide fullword\r\n$s3 = \"*s*\" wide fullword\r\n$s4 = \"*d*\" wide fullword\r\n$s5 = \"*f*\" wide fullword\r\n$s6 = \"*g*\" wide fullword\r\n$s7 = \"*h*\" wide fullword\r\n\r\ncondition:\r\n//MZ header\r\nuint16(0) == 0x5A4D and\r\n\r\n//PE signature\r\nuint32(uint32(0x3C)) == 0x00004550 and\r\nfilesize < 200KB and\r\nall of them\r\n}"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399417" ,
"to_ids" : true ,
"type" : "yara" ,
"uuid" : "582dd7f9-5180-4a45-baff-7005d56c6cd2" ,
"value" : "rule keyboy_commands\r\n{\r\nmeta:\r\nauthor = \"Matt Brooks, @cmatthewbrooks\"\r\ndesc = \"Matches the 2016 sample's sent and received commands\"\r\ndate = \"2016-08-28\"\r\nmd5 = \"495adb1b9777002ecfe22aaf52fcee93\"\r\n\r\nstrings:\r\n$s1 = \"Update\" wide fullword\r\n$s2 = \"UpdateAndRun\" wide fullword\r\n$s3 = \"Refresh\" wide fullword\r\n$s4 = \"OnLine\" wide fullword\r\n$s5 = \"Disconnect\" wide fullword\r\n$s6 = \"Pw_Error\" wide fullword\r\n$s7 = \"Pw_OK\" wide fullword\r\n$s8 = \"Sysinfo\" wide fullword\r\n$s9 = \"Download\" wide fullword\r\n$s10 = \"UploadFileOk\" wide fullword\r\n$s11 = \"RemoteRun\" wide fullword\r\n$s12 = \"FileManager\" wide fullword\r\n\r\ncondition:\r\n//MZ header\r\nuint16(0) == 0x5A4D and\r\n\r\n//PE signature\r\nuint32(uint32(0x3C)) == 0x00004550 and\r\nfilesize < 200KB and\r\n6 of them\r\n}"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399436" ,
"to_ids" : true ,
"type" : "yara" ,
"uuid" : "582dd80c-aa34-453f-9a06-6fe8d56c6cd2" ,
"value" : "rule keyboy_errors\r\n{\r\nmeta:\r\nauthor = \"Matt Brooks, @cmatthewbrooks\"\r\ndesc = \"Matches the sample's shell error2 log statements\"\r\ndate = \"2016-08-28\"\r\nmd5 = \"495adb1b9777002ecfe22aaf52fcee93\"\r\n\r\nstrings:\r\n//These strings are in ASCII pre-2015 and UNICODE in 2016\r\n$error = \"Error2\" ascii wide\r\n//2016 specific:\r\n$s1 = \"Can't find [%s]!Check the file name and try again!\" ascii wide\r\n$s2 = \"Open [%s] error! %d\" ascii wide\r\n$s3 = \"The Size of [%s] is zero!\" ascii wide\r\n$s4 = \"CreateThread DownloadFile[%s] Error!\" ascii wide\r\n$s5 = \"UploadFile [%s] Error:Connect Server Failed!\" ascii wide\r\n$s6 = \"Receive [%s] Error(Recved[%d] != Send[%d])!\" ascii wide\r\n$s7 = \"Receive [%s] ok! Use %2.2f seconds, Average speed %2.2f k/s\" ascii wide\r\n$s8 = \"CreateThread UploadFile[%s] Error!\" ascii wide\r\n//Pre-2016:\r\n$s9 = \"Ready Download [%s] ok!\" ascii wide\r\n$s10 = \"Get ControlInfo from FileClient error!\" ascii wide\r\n$s11 = \"FileClient has a error!\" ascii wide\r\n$s12 = \"VirtualAlloc SendBuff Error(%d)\" ascii wide\r\n$s13 = \"ReadFile [%s] Error(%d)...\" ascii wide\r\n$s14 = \"ReadFile [%s] Data[Readed(%d) != FileSize(%d)] Error...\" ascii wide\r\n$s15 = \"CreateThread DownloadFile[%s] Error!\" ascii wide\r\n$s16 = \"RecvData MyRecv_Info Size Error!\" ascii wide\r\n$s17 = \"RecvData MyRecv_Info Tag Error!\" ascii wide\r\n$s18 = \"SendData szControlInfo_1 Error!\" ascii wide\r\n$s19 = \"SendData szControlInfo_3 Error!\" ascii wide\r\n$s20 = \"VirtualAlloc RecvBuff Error(%d)\" ascii wide\r\n$s21 = \"RecvData Error!\" ascii wide\r\n$s22 = \"WriteFile [%s} Error(%d)...\" ascii wide\r\n\r\ncondition:\r\n//MZ header\r\nuint16(0) == 0x5A4D and\r\n\r\n//PE signature\r\nuint32(uint32(0x3C)) == 0x00004550 and\r\nfilesize < 200KB and\r\n$error and 3 of ($s*)\r\n}"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399459" ,
"to_ids" : true ,
"type" : "yara" ,
"uuid" : "582dd817-deac-4afa-a4a9-0696d56c6cd2" ,
"value" : "rule keyboy_systeminfo\r\n{\r\nmeta:\r\nauthor = \"Matt Brooks, @cmatthewbrooks\"\r\ndesc = \"Matches the system information format before sending to C2\"\r\ndate = \"2016-08-28\"\r\nmd5 = \"495adb1b9777002ecfe22aaf52fcee93\"\r\n\r\nstrings:\r\n//These strings are ASCII pre-2015 and UNICODE in 2016\r\n$s1 = \"SystemVersion: %s\" ascii wide\r\n$s2 = \"Product ID: %s\" ascii wide\r\n$s3 = \"InstallPath: %s\" ascii wide\r\n$s4 = \"InstallTime: %d-%d-%d, %02d:%02d:%02d\" ascii wide\r\n$s5 = \"ResgisterGroup: %s\" ascii wide\r\n$s6 = \"RegisterUser: %s\" ascii wide\r\n$s7 = \"ComputerName: %s\" ascii wide\r\n$s8 = \"WindowsDirectory: %s\" ascii wide\r\n$s9 = \"System Directory: %s\" ascii wide\r\n$s10 = \"Number of Processors: %d\" ascii wide\r\n$s11 = \"CPU[%d]: %s: %sMHz\" ascii wide\r\n$s12 = \"RAM: %dMB Total, %dMB Free.\" ascii wide\r\n$s13 = \"DisplayMode: %d x %d, %dHz, %dbit\" ascii wide\r\n$s14 = \"Uptime: %d Days %02u:%02u:%02u\" ascii wide\r\n\r\ncondition:\r\n//MZ header\r\nuint16(0) == 0x5A4D and\r\n\r\n//PE signature\r\nuint32(uint32(0x3C)) == 0x00004550 and\r\nfilesize < 200KB and\r\n7 of them\r\n}"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1588068717" ,
"to_ids" : true ,
"type" : "yara" ,
"uuid" : "582dd82e-469c-4a22-8669-6ff1d56c6cd2" ,
"value" : "import \"pe\"\nrule keyboy_related_exports\n{\nmeta:\nauthor = \"Matt Brooks, @cmatthewbrooks\"\ndesc = \"Matches the new 2016 sample's export\"\ndate = \"2016-08-28\"\nmd5 = \"495adb1b9777002ecfe22aaf52fcee93\"\n\ncondition:\n//MZ header\nuint16(0) == 0x5A4D and\n\n//PE signature\nuint32(uint32(0x3C)) == 0x00004550 and\n\n\nfilesize < 200KB and\n\n\n//The malware family seems to share many exports\n//but this is the new kid on the block.\npe.exports(\"Embedding\") or\npe.exports(\"SSSS\") or\npe.exports(\"GetUP\")\n}"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399483" ,
"to_ids" : true ,
"type" : "yara" ,
"uuid" : "582dd83b-0524-4fed-a9e3-700dd56c6cd2" ,
"value" : "import \"pe\"\r\nrule keyboy_init_config_section\r\n{\r\nmeta:\r\nauthor = \"Matt Brooks, @cmatthewbrooks\"\r\ndesc = \"Matches the Init section where the config is stored\"\r\ndate = \"2016-08-28\"\r\n\r\ncondition:\r\n//MZ header\r\nuint16(0) == 0x5A4D and\r\n\r\n//PE signature\r\nuint32(uint32(0x3C)) == 0x00004550 and\r\n\r\n//Payloads are normally smaller but the new dropper we spotted\r\n//is a bit larger.\r\nfilesize < 300KB and\r\n\r\n//Observed virtual sizes of the .Init section vary but they've\r\n//always been 1024, 2048, or 4096 bytes.\r\nfor any i in (0..pe.number_of_sections - 1):\r\n(\r\npe.sections[i].name == \".Init\" and\r\npe.sections[i].virtual_size % 1024 == 0\r\n)\r\n}"
} ,
{
"category" : "External analysis" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399925" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "582dd9f5-639c-4a10-8ced-6ff0d56c6cd2" ,
"value" : "https://citizenlab.org/2016/11/parliament-keyboy/"
} ,
{
"category" : "Network activity" ,
"comment" : "domain linked to one of the C2 IPs" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399513" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "582dd859-da30-4ad9-9118-7005d56c6cd2" ,
"value" : "tibetvoices.com"
} ,
{
"category" : "Network activity" ,
"comment" : "C2 domains" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399538" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "582dd873-7d5c-4433-9e36-6ff0d56c6cd2" ,
"value" : "www.about.jkub.com"
} ,
{
"category" : "Network activity" ,
"comment" : "C2 domains" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399539" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "582dd873-ef48-4fe2-8f27-6ff0d56c6cd2" ,
"value" : "www.eleven.mypop3.org"
} ,
{
"category" : "Network activity" ,
"comment" : "C2 domains" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399539" ,
"to_ids" : true ,
"type" : "domain" ,
"uuid" : "582dd873-7f8c-4373-aa0d-6ff0d56c6cd2" ,
"value" : "www.backus.myftp.name"
} ,
{
"category" : "Network activity" ,
"comment" : "C2 IP" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399568" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "582dd890-d548-436f-bd0a-6ff2d56c6cd2" ,
"value" : "45.125.12.147"
} ,
{
"category" : "Network activity" ,
"comment" : "C2 IP" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399568" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "582dd890-e77c-48ef-b609-6ff2d56c6cd2" ,
"value" : "103.40.102.233"
} ,
{
"category" : "Network activity" ,
"comment" : "C2 IP" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399569" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "582dd891-0d3c-41a2-9385-6ff2d56c6cd2" ,
"value" : "116.193.154.69"
} ,
{
"category" : "Network activity" ,
"comment" : "C2 IP" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399569" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "582dd891-0e90-4e82-bfba-6ff2d56c6cd2" ,
"value" : "103.242.134.243"
} ,
{
"category" : "Network activity" ,
"comment" : "IPs for C2 Host: www.about.jkub.com" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399595" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "582dd8ab-850c-4a68-812b-7007d56c6cd2" ,
"value" : "45.32.47.148"
} ,
{
"category" : "Network activity" ,
"comment" : "IPs for C2 Host: www.about.jkub.com" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399596" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "582dd8ac-097c-45be-8370-7007d56c6cd2" ,
"value" : "157.7.84.81"
} ,
{
"category" : "Network activity" ,
"comment" : "IP behind C2 Host: www.backus.myftp[.]name" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399617" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "582dd8c1-9ec0-4fa4-8d06-700fd56c6cd2" ,
"value" : "192.241.149.43"
} ,
{
"category" : "Network activity" ,
"comment" : "Other IP hosting tibetvoices.com" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399661" ,
"to_ids" : true ,
"type" : "ip-dst" ,
"uuid" : "582dd8ed-34cc-49c9-9ae4-700fd56c6cd2" ,
"value" : "112.10.117.47"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Source of phishing emails" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399684" ,
"to_ids" : true ,
"type" : "email-src" ,
"uuid" : "582dd904-3f68-4706-b596-0696d56c6cd2" ,
"value" : "tibetanparliarnent@yahoo.com"
} ,
{
"category" : "Payload delivery" ,
"comment" : "theme of the conference.doc" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1588068668" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "582dd918-13bc-44e9-9b8d-6ff2d56c6cd2" ,
"value" : "8307e444cad98b1b59568ad2eba5f201"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Dw20.exe dropper" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1588068666" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "582dd924-6350-4beb-bc4d-700dd56c6cd2" ,
"value" : "0b4d45db323f68b465ae052d3a872068"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Other similar doc" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1588068693" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "582dd932-aac0-48ba-8235-7006d56c6cd2" ,
"value" : "beadf21b923600554b0ce54df42e78f5"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Dw20.exe dropper" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399744" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "582dd940-4910-478c-a8f6-700ed56c6cd2" ,
"value" : "69df3d3df4d99bc6045d073d89c68697"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Malicious doc with CVE-2014-4114 vulnerability" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1588068677" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "582dd94c-9948-4f28-a0a8-6ff1d56c6cd2" ,
"value" : "05b5cf94f07fee666eb086c91182ad25"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Doc exploiting CVE-2012-0158" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1588068675" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "582dd958-b8e4-47e1-b3bd-6ff0d56c6cd2" ,
"value" : "8846d109b457a2ee44ddbf54d1cf7944"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Attached file urgent action larung gar buddhist academy.rtf (CVE-2015-1641)" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1588068682" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "582dd965-41f0-4ca5-a4f6-700fd56c6cd2" ,
"value" : "913b82ff8f090670fc6387e3a7bea12d"
} ,
{
"category" : "Payload delivery" ,
"comment" : "dropper of 'agewkassif' version" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1588068685" ,
"to_ids" : true ,
"type" : "md5" ,
"uuid" : "582dd971-87dc-4fa4-a22b-7007d56c6cd2" ,
"value" : "23d284245e53ae4fe05c517d807ffccf"
} ,
{
"category" : "Payload delivery" ,
"comment" : "dw20.exe dropper" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1588068687" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "582dd982-e0b0-4f79-bab1-0696d56c6cd2" ,
"value" : "5f24a5ee9ecfd4a8e5f967ffcf24580a83942cd7b09d310b9525962ed2614a49"
} ,
{
"category" : "Payload delivery" ,
"comment" : "dropper of 'agewkassif' sample" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1588068691" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "582dd992-c5ac-438a-8737-7005d56c6cd2" ,
"value" : "542c85fda8df8510c1b66a122e459aac8c0919f1fe9fa2c43fd87899cffa05bf"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399853" ,
"to_ids" : false ,
"type" : "vulnerability" ,
"uuid" : "582dd9ad-23d0-45dd-9bee-6ff2d56c6cd2" ,
"value" : "CVE-2012-0158"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399853" ,
"to_ids" : false ,
"type" : "vulnerability" ,
"uuid" : "582dd9ad-a8e4-4cd1-b839-6ff2d56c6cd2" ,
"value" : "CVE-2014-4114"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399853" ,
"to_ids" : false ,
"type" : "vulnerability" ,
"uuid" : "582dd9ad-8e60-429f-b92c-6ff2d56c6cd2" ,
"value" : "CVE-2015-1641"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399870" ,
"to_ids" : true ,
"type" : "yara" ,
"uuid" : "582dd9be-541c-40c0-875a-700dd56c6cd2" ,
"value" : "rule CVE_2012_0158_KeyBoy {\r\nmeta:\r\nauthor = \"Etienne Maynier <etienne@citizenlab.ca>\"\r\ndescription = \"CVE-2012-0158 variant\"\r\nfile = \"8307e444cad98b1b59568ad2eba5f201\"\r\n\r\nstrings:\r\n$a = \"d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff09000600000000000000000000000100000001\" nocase // OLE header\r\n$b = \"ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\" nocase // junk data\r\n$c = /5(\\{\\\\b0\\}|)[ ]*2006F00(\\{\\\\b0\\}|)[ ]*6F007(\\{\\\\b0\\}|)[ ]*400200045(\\{\\\\b0\\}|)[ ]*006(\\{\\\\b0\\}|)[ ]*E007(\\{\\\\b0\\}|)[ ]*400720079/ nocase\r\n$d = \"MSComctlLib.ListViewCtrl.2\"\r\n$e = \"ac38c874503c307405347aaaebf2ac2c31ebf6e8e3\" nocase //decoding shellcode\r\n\r\ncondition:\r\nall of them\r\n}"
} ,
{
"category" : "Payload delivery" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479399885" ,
"to_ids" : true ,
"type" : "yara" ,
"uuid" : "582dd9cd-5bf4-40a1-9f79-700ed56c6cd2" ,
"value" : "rule keyboy_exploit_doc_meta{\r\nmeta:\r\nauthor = \"Matt Brooks, @cmatthewbrooks\"\r\ndesc = \"Matches the meta associated with these exploit docs\"\r\ndate = \"2016-09-30\"\r\n\r\nstrings:\r\n$role = \"{\\\\author Master}{\\\\operator Master}\"\r\n$creatim = \"{\\\\creatim\\\\yr2015\\\\mo10\\\\dy16\\\\hr11\\\\min37}\"\r\n$revtim = \"{\\\\revtim\\\\yr2015\\\\mo10\\\\dy16\\\\hr13\\\\min54}\"\r\n\r\ncondition:\r\nuint32be(0) == 0x7B5C7274 and\r\nfilesize < 1MB and\r\nall of them\r\n}"
} ,
{
"category" : "Payload type" ,
"comment" : "" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1588068655" ,
"to_ids" : true ,
"type" : "text" ,
"uuid" : "582dd9d6-8564-46ea-9b4e-700ed56c6cd2" ,
"value" : "KeyBoy"
} ,
{
"category" : "Payload delivery" ,
"comment" : "dropper of 'agewkassif' sample - Xchecked via VT: 542c85fda8df8510c1b66a122e459aac8c0919f1fe9fa2c43fd87899cffa05bf" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1588068657" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "5832bd46-65f0-4dad-892b-426702de0b81" ,
"value" : "3afd1071b8c05d743be976468f36663c22d57311"
} ,
{
"category" : "External analysis" ,
"comment" : "dropper of 'agewkassif' sample - Xchecked via VT: 542c85fda8df8510c1b66a122e459aac8c0919f1fe9fa2c43fd87899cffa05bf" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479720263" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "5832bd47-c064-429b-bb2f-467302de0b81" ,
"value" : "https://www.virustotal.com/file/542c85fda8df8510c1b66a122e459aac8c0919f1fe9fa2c43fd87899cffa05bf/analysis/1479643747/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "dw20.exe dropper - Xchecked via VT: 5f24a5ee9ecfd4a8e5f967ffcf24580a83942cd7b09d310b9525962ed2614a49" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1588068659" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "5832bd47-9600-41f5-896c-4e8b02de0b81" ,
"value" : "c4611aff5e05ee92398b8700b878e016f4ff6113"
} ,
{
"category" : "External analysis" ,
"comment" : "dw20.exe dropper - Xchecked via VT: 5f24a5ee9ecfd4a8e5f967ffcf24580a83942cd7b09d310b9525962ed2614a49" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479720264" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "5832bd48-b104-49f7-ae8e-436e02de0b81" ,
"value" : "https://www.virustotal.com/file/5f24a5ee9ecfd4a8e5f967ffcf24580a83942cd7b09d310b9525962ed2614a49/analysis/1479643732/"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Wab32res.dll payload, KeyBoy agewkassif version - Xchecked via VT: 5da2f14c382d7cac8dfa6c86e528a646a81f0b40cfee9611c8cfb4b5d589aa88" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479720264" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "5832bd48-3de0-4688-8add-48f502de0b81" ,
"value" : "c97b12039e324721130d58d127c4e6f356e3f6e8"
} ,
{
"category" : "External analysis" ,
"comment" : "Wab32res.dll payload, KeyBoy agewkassif version - Xchecked via VT: 5da2f14c382d7cac8dfa6c86e528a646a81f0b40cfee9611c8cfb4b5d589aa88" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479720265" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "5832bd49-a008-4fd1-bc69-4cd102de0b81" ,
"value" : "https://www.virustotal.com/file/5da2f14c382d7cac8dfa6c86e528a646a81f0b40cfee9611c8cfb4b5d589aa88/analysis/1479643740/"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Wab32res.dll payload, KeyBoy 20160509 - Xchecked via VT: 9a55577d357922711ab0821bf5379289293c8517ae1d94d48c389f306af57a04" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479720265" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "5832bd49-19b0-4338-af0d-47c402de0b81" ,
"value" : "5bc42d475fa35e00e2584a4142c2767a4707019b"
} ,
{
"category" : "External analysis" ,
"comment" : "Wab32res.dll payload, KeyBoy 20160509 - Xchecked via VT: 9a55577d357922711ab0821bf5379289293c8517ae1d94d48c389f306af57a04" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479720266" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "5832bd4a-8608-4468-9038-447602de0b81" ,
"value" : "https://www.virustotal.com/file/9a55577d357922711ab0821bf5379289293c8517ae1d94d48c389f306af57a04/analysis/1479499742/"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "legitimate Microsoft Windows Address Book executable, used to load final payload - Xchecked via VT: 58105e9772f6befbc319c147a97faded4fbacf839947b34fe3695ae72771da5d" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479720266" ,
"to_ids" : false ,
"type" : "sha1" ,
"uuid" : "5832bd4a-dd54-4a76-bf57-4b9c02de0b81" ,
"value" : "280dd67bbdfadaac0a4eb7a1c770387c216f3b8b"
} ,
{
"category" : "External analysis" ,
"comment" : "legitimate Microsoft Windows Address Book executable, used to load final payload - Xchecked via VT: 58105e9772f6befbc319c147a97faded4fbacf839947b34fe3695ae72771da5d" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479720267" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "5832bd4b-25c4-4edb-8ab9-436502de0b81" ,
"value" : "https://www.virustotal.com/file/58105e9772f6befbc319c147a97faded4fbacf839947b34fe3695ae72771da5d/analysis/1478876071/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Doc exploiting CVE-2012-0158 - Xchecked via VT: 8846d109b457a2ee44ddbf54d1cf7944" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1588068702" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "5832bd4c-0190-4a6f-9c4f-472202de0b81" ,
"value" : "ba442907f3218c8664bbecb47f915c4469340219e0f05af8f2d108d72659ff0f"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Doc exploiting CVE-2012-0158 - Xchecked via VT: 8846d109b457a2ee44ddbf54d1cf7944" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1588068701" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "5832bd4c-d698-4f11-b5c9-476202de0b81" ,
"value" : "ba57bc840bc8fa5b7a235b2d2cff47af610aa14a"
} ,
{
"category" : "External analysis" ,
"comment" : "Doc exploiting CVE-2012-0158 - Xchecked via VT: 8846d109b457a2ee44ddbf54d1cf7944" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479720269" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "5832bd4d-e058-48a1-9e0a-483f02de0b81" ,
"value" : "https://www.virustotal.com/file/ba442907f3218c8664bbecb47f915c4469340219e0f05af8f2d108d72659ff0f/analysis/1479483627/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Malicious doc with CVE-2014-4114 vulnerability - Xchecked via VT: 05b5cf94f07fee666eb086c91182ad25" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1588068699" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "5832bd4d-c198-40bf-83ca-4c7002de0b81" ,
"value" : "442e5d3d46330e814b4fdc5640b06732de69a08a574d92cd9a0df5eea62d88ed"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Malicious doc with CVE-2014-4114 vulnerability - Xchecked via VT: 05b5cf94f07fee666eb086c91182ad25" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1588068697" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "5832bd4e-dab8-4936-ac41-489e02de0b81" ,
"value" : "7631a0682a1a6423c95fd1b80263b8470717f0f8"
} ,
{
"category" : "External analysis" ,
"comment" : "Malicious doc with CVE-2014-4114 vulnerability - Xchecked via VT: 05b5cf94f07fee666eb086c91182ad25" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479720270" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "5832bd4e-88e0-452b-9d0b-47f602de0b81" ,
"value" : "https://www.virustotal.com/file/442e5d3d46330e814b4fdc5640b06732de69a08a574d92cd9a0df5eea62d88ed/analysis/1479484054/"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Other similar doc - Xchecked via VT: beadf21b923600554b0ce54df42e78f5" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1588068704" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "5832bd4f-f9d0-48f9-a3dc-4f2902de0b81" ,
"value" : "b1d1b8fa9c104309fe27b3405d3572ac44d8401efba4868f743d45ed797d444b"
} ,
{
"category" : "Payload delivery" ,
"comment" : "Other similar doc - Xchecked via VT: beadf21b923600554b0ce54df42e78f5" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1588068705" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "5832bd4f-48d0-4d0b-9719-439d02de0b81" ,
"value" : "d2bf4b04d05f398b4101e91873e71d5b0e121aeb"
} ,
{
"category" : "External analysis" ,
"comment" : "Other similar doc - Xchecked via VT: beadf21b923600554b0ce54df42e78f5" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479720272" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "5832bd50-1ff0-44dd-b44d-401d02de0b81" ,
"value" : "https://www.virustotal.com/file/b1d1b8fa9c104309fe27b3405d3572ac44d8401efba4868f743d45ed797d444b/analysis/1479485679/"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "64b KeyBoy payload 20151108 - Xchecked via VT: 371bc132499f455f06fa80696db0df27" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479720272" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "5832bd50-8af8-4d7a-bf57-4c1702de0b81" ,
"value" : "4c9bf4ffbd7047f46035f89e6f7f4c63b8597ac63097577d467c157e3aa7ab4d"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "64b KeyBoy payload 20151108 - Xchecked via VT: 371bc132499f455f06fa80696db0df27" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479720273" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "5832bd51-76b0-4f37-860b-4b3802de0b81" ,
"value" : "aec5001d91673d052e9a0793aea0ebaea1a96e3d"
} ,
{
"category" : "External analysis" ,
"comment" : "64b KeyBoy payload 20151108 - Xchecked via VT: 371bc132499f455f06fa80696db0df27" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479720273" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "5832bd51-1400-4733-9436-4f7902de0b81" ,
"value" : "https://www.virustotal.com/file/4c9bf4ffbd7047f46035f89e6f7f4c63b8597ac63097577d467c157e3aa7ab4d/analysis/1479643752/"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Payload KeyBoy 20151108 - Xchecked via VT: c5b5f01ba24d6c02636388809f44472e" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479720274" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "5832bd52-5310-486b-876f-4b0e02de0b81" ,
"value" : "e6fdcf64d7e7d59366ba23c68332167dfc569b6acc71a03498d4a925ce9c1e0a"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Payload KeyBoy 20151108 - Xchecked via VT: c5b5f01ba24d6c02636388809f44472e" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479720274" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "5832bd52-2228-4453-b38e-41b102de0b81" ,
"value" : "bbeacc746b6ddb61a3be7613bb155aa2b1ac422a"
} ,
{
"category" : "External analysis" ,
"comment" : "Payload KeyBoy 20151108 - Xchecked via VT: c5b5f01ba24d6c02636388809f44472e" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479720275" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "5832bd53-a558-4ea4-957d-4e7202de0b81" ,
"value" : "https://www.virustotal.com/file/e6fdcf64d7e7d59366ba23c68332167dfc569b6acc71a03498d4a925ce9c1e0a/analysis/1479481835/"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Payload KeyBoy 20151108 - Xchecked via VT: 98977426d544bd145979f65f0322ae30" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479720275" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "5832bd53-d3f0-4c64-80cf-469402de0b81" ,
"value" : "082da7874d6c0bfbe8f2d954c8a47f25a90ef83bda89c8495101dc95986d7977"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Payload KeyBoy 20151108 - Xchecked via VT: 98977426d544bd145979f65f0322ae30" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479720276" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "5832bd54-87e0-49a7-8971-480e02de0b81" ,
"value" : "edad39839bd60bcc1426df9c68df7de169cd062f"
} ,
{
"category" : "External analysis" ,
"comment" : "Payload KeyBoy 20151108 - Xchecked via VT: 98977426d544bd145979f65f0322ae30" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479720276" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "5832bd54-0efc-4f4a-b342-4a8e02de0b81" ,
"value" : "https://www.virustotal.com/file/082da7874d6c0bfbe8f2d954c8a47f25a90ef83bda89c8495101dc95986d7977/analysis/1479643737/"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Payload KeyBoy P_20150313 - Xchecked via VT: 0c7e55509e0b6d4277b3facf864af018" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479720277" ,
"to_ids" : true ,
"type" : "sha256" ,
"uuid" : "5832bd55-6890-47d5-b97c-4a6402de0b81" ,
"value" : "5395f709ef1ca64c57be367f9795b66b5775b6e73f57089386a85925cc0ec596"
} ,
{
"category" : "Artifacts dropped" ,
"comment" : "Payload KeyBoy P_20150313 - Xchecked via VT: 0c7e55509e0b6d4277b3facf864af018" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479720277" ,
"to_ids" : true ,
"type" : "sha1" ,
"uuid" : "5832bd55-f334-44ed-81f9-401602de0b81" ,
"value" : "a3655df2811069ea7a818517c9e9f11561fce3e8"
} ,
{
"category" : "External analysis" ,
"comment" : "Payload KeyBoy P_20150313 - Xchecked via VT: 0c7e55509e0b6d4277b3facf864af018" ,
"deleted" : false ,
"disable_correlation" : false ,
"timestamp" : "1479720277" ,
"to_ids" : false ,
"type" : "link" ,
"uuid" : "5832bd55-7e88-4e84-98fa-44ea02de0b81" ,
"value" : "https://www.virustotal.com/file/5395f709ef1ca64c57be367f9795b66b5775b6e73f57089386a85925cc0ec596/analysis/1431473021/"
}
2023-04-21 13:25:09 +00:00
]
2023-12-14 14:30:15 +00:00
}
2023-04-21 13:25:09 +00:00
}
