adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/5a391a35-45c8-4e0b-b580-4cdc950d210f.json

216 lines
9.6 KiB
JSON
Raw Normal View History

chg: [feed] added
2023-04-21 13:25:09 +00:00
{
chg: [feed] feed updated
2023-06-14 17:31:25 +00:00
"type": "bundle",
"id": "bundle--5a391a35-45c8-4e0b-b580-4cdc950d210f",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-12-21T03:00:48.000Z",
"modified": "2017-12-21T03:00:48.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--5a391a35-45c8-4e0b-b580-4cdc950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-12-21T03:00:48.000Z",
"modified": "2017-12-21T03:00:48.000Z",
"name": "OSINT - The Emotet Banking Trojan: Analysis of Dropped Malware Morphing at Scale",
"published": "2017-12-28T13:35:51Z",
"object_refs": [
"observed-data--5a391a5b-1b48-4f03-ad50-18e3950d210f",
"url--5a391a5b-1b48-4f03-ad50-18e3950d210f",
"x-misp-attribute--5a391b26-fa94-4cb9-b69d-1690950d210f",
"indicator--5a391b6c-d4e4-4072-9d3c-1713950d210f",
"indicator--5a391b85-5068-4092-ba25-bfca950d210f",
"indicator--e3be9ae2-cc8e-4629-a7e7-266ea9e25610",
"x-misp-object--c29a6f81-d269-48e2-8e91-585613d1fbd0",
"relationship--0a00d54b-c884-42b7-b847-712f8c2a6c3b"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"misp-galaxy:tool=\"Emotet\"",
"misp-galaxy:banker=\"Geodo\"",
"type:OSINT",
"osint:source-type=\"blog-post\"",
"ms-caro-malware-full:malware-family=\"Banker\"",
"malware_classification:malware-category=\"Trojan\""
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5a391a5b-1b48-4f03-ad50-18e3950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-12-20T21:37:39.000Z",
"modified": "2017-12-20T21:37:39.000Z",
"first_observed": "2017-12-20T21:37:39Z",
"last_observed": "2017-12-20T21:37:39Z",
"number_observed": 1,
"object_refs": [
"url--5a391a5b-1b48-4f03-ad50-18e3950d210f"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\"",
"osint:source-type=\"blog-post\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--5a391a5b-1b48-4f03-ad50-18e3950d210f",
"value": "https://blogs.bromium.com/emotet-banking-trojan-malware-analysis/"
},
{
"type": "x-misp-attribute",
"spec_version": "2.1",
"id": "x-misp-attribute--5a391b26-fa94-4cb9-b69d-1690950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-12-20T21:37:39.000Z",
"modified": "2017-12-20T21:37:39.000Z",
"labels": [
"misp:type=\"comment\"",
"misp:category=\"External analysis\"",
"osint:source-type=\"blog-post\""
],
"x_misp_category": "External analysis",
"x_misp_type": "comment",
"x_misp_value": "Recently, the Bromium Lab team uncovered a series of samples containing the Emotet banking trojan, which indicates that malware authors are rapidly rewrapping their packed executables and the documents used to distribute them. Based on feedback and further monitoring, we investigated the polymorphic dropped executables in more detail. The results are quite interesting; the samples don\u00e2\u20ac\u2122t just feature trivial changes or the addition of random data. Rather, the sample appears like completely different software in many aspects. This allows the samples to avoid signature-based anti-virus as well as package detection and static analysis."
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a391b6c-d4e4-4072-9d3c-1713950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-12-19T14:00:12.000Z",
"modified": "2017-12-19T14:00:12.000Z",
"pattern": "[file:hashes.SHA256 = '906e9607b4ad68eb380a1bd55842b8a7c601a8108c16d1c3d3a1cf74eefeb180' AND file:size = '229000' AND file:x_misp_state = 'Malicious']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-12-19T14:00:12Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a391b85-5068-4092-ba25-bfca950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-12-19T14:00:37.000Z",
"modified": "2017-12-19T14:00:37.000Z",
"pattern": "[file:hashes.SHA256 = 'bcc70a49fab005b4cdbe0cbd87863ec622c6b2c656987d201adbb0e05ec03e56' AND file:size = '95000' AND file:x_misp_state = 'Malicious']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-12-19T14:00:37Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--e3be9ae2-cc8e-4629-a7e7-266ea9e25610",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-12-20T21:37:42.000Z",
"modified": "2017-12-20T21:37:42.000Z",
"pattern": "[file:hashes.MD5 = '16b3f663d0f0371a4706642c6ac04e42' AND file:hashes.SHA1 = '3a1f908941311fc357051b5c35fd2a4e0c834e37' AND file:hashes.SHA256 = 'bcc70a49fab005b4cdbe0cbd87863ec622c6b2c656987d201adbb0e05ec03e56']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-12-20T21:37:42Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--c29a6f81-d269-48e2-8e91-585613d1fbd0",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-12-20T21:37:39.000Z",
"modified": "2017-12-20T21:37:39.000Z",
"labels": [
"misp:name=\"virustotal-report\"",
"misp:meta-category=\"misc\""
],
"x_misp_attributes": [
{
"type": "link",
"object_relation": "permalink",
"value": "https://www.virustotal.com/file/bcc70a49fab005b4cdbe0cbd87863ec622c6b2c656987d201adbb0e05ec03e56/analysis/1513344175/",
"category": "External analysis",
"uuid": "5a3ad823-da5c-4c1a-b078-406702de0b81"
},
{
"type": "text",
"object_relation": "detection-ratio",
"value": "53/67",
"category": "Other",
"uuid": "5a3ad823-f67c-4a9a-b75a-4f2802de0b81"
},
{
"type": "datetime",
"object_relation": "last-submission",
"value": "2017-12-15T13:22:55",
"category": "Other",
"uuid": "5a3ad823-6f14-43ea-a9e7-43e902de0b81"
}
],
"x_misp_meta_category": "misc",
"x_misp_name": "virustotal-report"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--0a00d54b-c884-42b7-b847-712f8c2a6c3b",
"created": "2017-12-28T13:35:51.000Z",
"modified": "2017-12-28T13:35:51.000Z",
chg: [feed] added
2023-04-21 13:25:09 +00:00
"relationship_type": "analysed-with",
chg: [feed] feed updated
2023-06-14 17:31:25 +00:00
"source_ref": "indicator--e3be9ae2-cc8e-4629-a7e7-266ea9e25610",
"target_ref": "x-misp-object--c29a6f81-d269-48e2-8e91-585613d1fbd0"
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
chg: [feed] added
2023-04-21 13:25:09 +00:00
]
}
Reference in a new issue Copy permalink