adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/5898af07-fb0c-4135-b908-491b950d210f.json

211 lines
8.9 KiB
JSON
Raw Normal View History

chg: [feed] added
2023-04-21 13:25:09 +00:00
{
"Event": {
"analysis": "0",
"date": "2017-02-06",
"extends_uuid": "",
"info": "OSINT - ikittens: iranian actor resurfaces with malware for mac (macdownloader)",
"publish_timestamp": "1486404542",
"published": true,
"threat_level_id": "3",
"timestamp": "1486403490",
"uuid": "5898af07-fb0c-4135-b908-491b950d210f",
"Orgc": {
"name": "CIRCL",
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
},
"Tag": [
{
"colour": "#ffffff",
"name": "tlp:white"
}
],
"Attribute": [
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1486401475",
"to_ids": false,
"type": "link",
"uuid": "5898af4b-4994-4038-9585-a54f950d210f",
"value": "https://iranthreats.github.io/resources/macdownloader-macos-malware/",
"Tag": [
{
"colour": "#00223b",
"name": "osint:source-type=\"blog-post\""
},
{
"colour": "#0c9100",
"name": "admiralty-scale:source-reliability=\"f\""
}
]
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1486401369",
"to_ids": false,
"type": "text",
"uuid": "5898af5b-0820-480b-9940-4e56950d210f",
"value": "A macOS malware agent, named MacDownloader, was observed in the wild as targeting the defense industrial base, and reported elsewhere to have been used against an human rights advocate. MacDownloader strangely attempts to pose as both an installer for Adobe Flash, as well as the Bitdefender Adware Removal Tool, in order to extract system information and copies of OS X keychain databases. Based on observations on infrastructure, and the state of the code, we believe these incidents represent the first attempts to deploy the agent, and features such as persistence do not appear to work. Instead, MacDownloader is a simple exfiltration agent, with broader ambitions.\r\n\r\nThe macOS malware also mirrors the approach of the ExtremeDownloader dropper previously documented in our research, and samples of the latter identified during this time used the same infrastructure. Lastly, the exposure of test victim data and code references provide a unique insight into the development of the malware, with potential connections to agents developed by long dormant threat groups.\r\n\r\nSince the Technical Preview of our forthcoming Carnegie Endowment publication about state-sponsored espionage campaigns was released at Black Hat USA, we have continued to disclose information about current Iranian activities in order to promote public education and to provide indicators of compromise. While this agent is neither sophisticated nor full-featured, its sudden appearance is concerning given the popularity of Apple computers with certain community, and inaccurate perceptions about the security of those devices."
},
{
"category": "Payload delivery",
"comment": "addone flashplayer.app.zip",
"deleted": false,
"disable_correlation": false,
"timestamp": "1486403059",
"to_ids": true,
"type": "sha256",
"uuid": "5898b5f3-546c-4237-a137-4d0e950d210f",
"value": "52efcfe30f96a85c9c068880c20663db64f0e08346e0f3b59c2e5bbcb41ba73c"
},
{
"category": "Payload delivery",
"comment": "Bitdefender Adware Removal Tool",
"deleted": false,
"disable_correlation": false,
"timestamp": "1486403076",
"to_ids": true,
"type": "sha256",
"uuid": "5898b604-bfb0-4064-9959-4c1a950d210f",
"value": "7a9cdb9d608b88bd7afce001cb285c2bb2ae76f5027977e8635aa04bd064ffb7"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1486403168",
"to_ids": true,
"type": "ip-dst",
"uuid": "5898b660-daa0-4188-a261-41b7950d210f",
"value": "46.17.97.37"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1486403170",
"to_ids": true,
"type": "domain",
"uuid": "5898b662-245c-4479-8ff0-4a02950d210f",
"value": "officialswebsites.info"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1486403171",
"to_ids": true,
"type": "hostname",
"uuid": "5898b663-fbfc-4d90-8d77-4b07950d210f",
"value": "utc.officialswebsites.info"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1486403209",
"to_ids": false,
"type": "pdb",
"uuid": "5898b67e-5360-4339-aa8b-a54f950d210f",
"value": "%USERPROFILE%\\Desktop\\Projects\\Tiny_st\\BlackBerry\\obj\\Debug\\MSSUP.pdb"
},
{
"category": "Network activity",
"comment": "The malware reads from the embedded Resources folder the \"checkadr.txt,\" which contains the URL for the first beacon. 192.168.3.217 is internal development server address",
"deleted": false,
"disable_correlation": false,
"timestamp": "1486403324",
"to_ids": true,
"type": "url",
"uuid": "5898b6fc-a64c-4400-bcaf-76fb950d210f",
"value": "http://192.168.3.217/DroperTest"
},
{
"category": "Network activity",
"comment": "The malware reads from the embedded Resources folder the \"checkadr.txt,\" which contains the URL for the first beacon. 192.168.3.217 is internal development server address",
"deleted": false,
"disable_correlation": false,
"timestamp": "1486403326",
"to_ids": true,
"type": "url",
"uuid": "5898b6fe-3ac0-4dc2-b797-76fb950d210f",
"value": "http://46.17.97.37/Servermac.php"
},
{
"category": "Payload delivery",
"comment": "Bitdefender Adware Removal Tool - Xchecked via VT: 7a9cdb9d608b88bd7afce001cb285c2bb2ae76f5027977e8635aa04bd064ffb7",
"deleted": false,
"disable_correlation": false,
"timestamp": "1486403491",
"to_ids": true,
"type": "sha1",
"uuid": "5898b7a3-86b8-4477-9fdb-584202de0b81",
"value": "5b5a34dfc102f0c18b0b0e83c6fda431969e7957"
},
{
"category": "Payload delivery",
"comment": "Bitdefender Adware Removal Tool - Xchecked via VT: 7a9cdb9d608b88bd7afce001cb285c2bb2ae76f5027977e8635aa04bd064ffb7",
"deleted": false,
"disable_correlation": false,
"timestamp": "1486403493",
"to_ids": true,
"type": "md5",
"uuid": "5898b7a5-b58c-4f35-a7c7-584202de0b81",
"value": "f8e4cab429263406fbf11b41fd539839"
},
{
"category": "External analysis",
"comment": "Bitdefender Adware Removal Tool - Xchecked via VT: 7a9cdb9d608b88bd7afce001cb285c2bb2ae76f5027977e8635aa04bd064ffb7",
"deleted": false,
"disable_correlation": false,
"timestamp": "1486403494",
"to_ids": false,
"type": "link",
"uuid": "5898b7a6-5ea8-4aee-ba0f-584202de0b81",
"value": "https://www.virustotal.com/file/7a9cdb9d608b88bd7afce001cb285c2bb2ae76f5027977e8635aa04bd064ffb7/analysis/1486400681/"
},
{
"category": "Payload delivery",
"comment": "addone flashplayer.app.zip - Xchecked via VT: 52efcfe30f96a85c9c068880c20663db64f0e08346e0f3b59c2e5bbcb41ba73c",
"deleted": false,
"disable_correlation": false,
"timestamp": "1486403495",
"to_ids": true,
"type": "sha1",
"uuid": "5898b7a7-4314-4a24-a1c4-584202de0b81",
"value": "a323168f95d1a1c65186888c6dd16cd2f9f8539a"
},
{
"category": "Payload delivery",
"comment": "addone flashplayer.app.zip - Xchecked via VT: 52efcfe30f96a85c9c068880c20663db64f0e08346e0f3b59c2e5bbcb41ba73c",
"deleted": false,
"disable_correlation": false,
"timestamp": "1486403496",
"to_ids": true,
"type": "md5",
"uuid": "5898b7a8-a824-4dcc-98d3-584202de0b81",
"value": "787d664e842961f2a335139407f91a70"
},
{
"category": "External analysis",
"comment": "addone flashplayer.app.zip - Xchecked via VT: 52efcfe30f96a85c9c068880c20663db64f0e08346e0f3b59c2e5bbcb41ba73c",
"deleted": false,
"disable_correlation": false,
"timestamp": "1486403496",
"to_ids": false,
"type": "link",
"uuid": "5898b7a8-acac-4f83-9097-584202de0b81",
"value": "https://www.virustotal.com/file/52efcfe30f96a85c9c068880c20663db64f0e08346e0f3b59c2e5bbcb41ba73c/analysis/1486400701/"
}
]
}
}
Reference in a new issue Copy permalink