2023-06-14 17:31:25 +00:00
{
"type" : "bundle" ,
"id" : "bundle--5ab38840-3960-4b05-b391-4dd7950d210f" ,
"objects" : [
{
"type" : "identity" ,
"spec_version" : "2.1" ,
"id" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-03-23T09:33:42.000Z" ,
"modified" : "2018-03-23T09:33:42.000Z" ,
"name" : "CIRCL" ,
"identity_class" : "organization"
} ,
{
"type" : "grouping" ,
"spec_version" : "2.1" ,
"id" : "grouping--5ab38840-3960-4b05-b391-4dd7950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-03-23T09:33:42.000Z" ,
"modified" : "2018-03-23T09:33:42.000Z" ,
"name" : "OSINT - Malicious applications stayed at Google Appstore for months" ,
"context" : "suspicious-activity" ,
"object_refs" : [
"observed-data--5ab38865-2bf4-47ff-bed8-4cd4950d210f" ,
"url--5ab38865-2bf4-47ff-bed8-4cd4950d210f" ,
"x-misp-attribute--5ab4c44e-68e0-4c6b-a64b-4e95950d210f" ,
"indicator--5ab4c654-02e8-4593-a7b0-469e950d210f" ,
"indicator--5ab4c66d-2c44-4d7b-ac13-442f950d210f" ,
"indicator--5ab4c7f7-a8e0-4032-a804-4d10950d210f" ,
"indicator--5ab4c7f7-4b34-447f-b729-490a950d210f" ,
"indicator--5ab4c7f7-e1d0-4f47-87b0-4aff950d210f" ,
"indicator--5ab4c7f7-b048-4be2-a6a6-406b950d210f" ,
"indicator--5ab4c7f7-81e0-4f35-ab10-44ea950d210f" ,
"indicator--5ab4c7f7-6d40-409f-be23-47bd950d210f" ,
"indicator--5ab4c7f7-e5a4-4492-bf54-4556950d210f" ,
"indicator--5ab4c7f7-64ac-4a3e-846f-42a5950d210f" ,
"indicator--5ab4c7f7-1854-4560-b54d-4b2e950d210f" ,
"indicator--5ab4c7f7-5be0-413c-94e7-431b950d210f" ,
"indicator--5ab4c7f7-4934-4ff5-b997-4c18950d210f" ,
"indicator--5ab4c7f7-5884-4c0c-94f1-4c8d950d210f"
] ,
"labels" : [
"Threat-Report" ,
"misp:tool=\"MISP-STIX-Converter\"" ,
"Android Malware" ,
"ms-caro-malware-full:malware-platform=\"AndroidOS\"" ,
"osint:source-type=\"blog-post\"" ,
"workflow:todo=\"create-missing-misp-galaxy-cluster-values\""
] ,
"object_marking_refs" : [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5ab38865-2bf4-47ff-bed8-4cd4950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-03-23T09:09:57.000Z" ,
"modified" : "2018-03-23T09:09:57.000Z" ,
"first_observed" : "2018-03-23T09:09:57Z" ,
"last_observed" : "2018-03-23T09:09:57Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5ab38865-2bf4-47ff-bed8-4cd4950d210f"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\"" ,
"osint:source-type=\"blog-post\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5ab38865-2bf4-47ff-bed8-4cd4950d210f" ,
"value" : "https://blog.fosec.vn/malicious-applications-stayed-at-google-appstore-for-months-d8834ff4de59"
} ,
{
"type" : "x-misp-attribute" ,
"spec_version" : "2.1" ,
"id" : "x-misp-attribute--5ab4c44e-68e0-4c6b-a64b-4e95950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-03-23T09:09:48.000Z" ,
"modified" : "2018-03-23T09:09:48.000Z" ,
"labels" : [
"misp:type=\"comment\"" ,
"misp:category=\"External analysis\"" ,
"osint:source-type=\"blog-post\""
] ,
"x_misp_category" : "External analysis" ,
"x_misp_type" : "comment" ,
"x_misp_value" : "According to estimates from downloads, at least 640,000 and at most 2.6 million Android subscribers have been infected with this malicious code. If the subscription price is just 0.1$/day, then every day the subscriber was hooked 64.000$-260.000$, so no one knows how many USD a year."
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ab4c654-02e8-4593-a7b0-469e950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-03-23T09:18:12.000Z" ,
"modified" : "2018-03-23T09:18:12.000Z" ,
"description" : "C&C" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '139.162.12.9']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-03-23T09:18:12Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ab4c66d-2c44-4d7b-ac13-442f950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-03-23T09:18:37.000Z" ,
"modified" : "2018-03-23T09:18:37.000Z" ,
"pattern" : "[url:value = 'gamestore.vn/?page=wapreg&mm=2201']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-03-23T09:18:37Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"url\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ab4c7f7-a8e0-4032-a804-4d10950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-03-23T09:25:11.000Z" ,
"modified" : "2018-03-23T09:25:11.000Z" ,
"pattern" : "[file:name = 'vn.lichvannien.lichamduongvietnam']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-03-23T09:25:11Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ab4c7f7-4b34-447f-b729-490a950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-03-23T09:25:11.000Z" ,
"modified" : "2018-03-23T09:25:11.000Z" ,
"pattern" : "[file:name = 'com.antivirus.virusremover.security']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-03-23T09:25:11Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ab4c7f7-e1d0-4f47-87b0-4aff950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-03-23T09:25:11.000Z" ,
"modified" : "2018-03-23T09:25:11.000Z" ,
"pattern" : "[file:name = 'com.weatherforecast.weatherwidget']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-03-23T09:25:11Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ab4c7f7-b048-4be2-a6a6-406b950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-03-23T09:25:11.000Z" ,
"modified" : "2018-03-23T09:25:11.000Z" ,
"pattern" : "[file:name = 'com.captain.qrcodescanner.barcodescannerreader']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-03-23T09:25:11Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ab4c7f7-81e0-4f35-ab10-44ea950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-03-23T09:25:11.000Z" ,
"modified" : "2018-03-23T09:25:11.000Z" ,
"pattern" : "[file:name = 'com.captainstudio.musicplayerandvideoplayer']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-03-23T09:25:11Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ab4c7f7-6d40-409f-be23-47bd950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-03-23T09:25:11.000Z" ,
"modified" : "2018-03-23T09:25:11.000Z" ,
"pattern" : "[file:name = 'com.captain.lovebyte.lovedaycounter']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-03-23T09:25:11Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ab4c7f7-e5a4-4492-bf54-4556950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-03-23T09:25:11.000Z" ,
"modified" : "2018-03-23T09:25:11.000Z" ,
"pattern" : "[file:name = 'com.captain.callrecorder']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-03-23T09:25:11Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ab4c7f7-64ac-4a3e-846f-42a5950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-03-23T09:25:11.000Z" ,
"modified" : "2018-03-23T09:25:11.000Z" ,
"pattern" : "[file:name = 'com.crackscreen.prankscreencrack']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-03-23T09:25:11Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ab4c7f7-1854-4560-b54d-4b2e950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-03-23T09:25:11.000Z" ,
"modified" : "2018-03-23T09:25:11.000Z" ,
"pattern" : "[file:name = 'com.weed.assistivetouch.easytouch']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-03-23T09:25:11Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ab4c7f7-5be0-413c-94e7-431b950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-03-23T09:25:11.000Z" ,
"modified" : "2018-03-23T09:25:11.000Z" ,
"pattern" : "[file:name = 'com.hidepicturesandvideos.applocker']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-03-23T09:25:11Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ab4c7f7-4934-4ff5-b997-4c18950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-03-23T09:25:11.000Z" ,
"modified" : "2018-03-23T09:25:11.000Z" ,
"pattern" : "[file:name = 'com.cameraselfie.filtercamera']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-03-23T09:25:11Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ab4c7f7-5884-4c0c-94f1-4c8d950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-03-23T09:25:11.000Z" ,
"modified" : "2018-03-23T09:25:11.000Z" ,
"pattern" : "[file:name = 'com.memorycleaner.speedbooster.memorybooster']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-03-23T09:25:11Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "marking-definition" ,
"spec_version" : "2.1" ,
"id" : "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ,
"created" : "2017-01-20T00:00:00.000Z" ,
"definition_type" : "tlp" ,
"name" : "TLP:WHITE" ,
"definition" : {
"tlp" : "white"
}
}
]
}
