881 lines
38 KiB
JSON
881 lines
38 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--59282239-845c-495d-b3db-4ebb950d210f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:14:36.000Z",
|
||
|
|
"modified": "2017-05-26T13:14:36.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--59282239-845c-495d-b3db-4ebb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:14:36.000Z",
|
||
|
|
"modified": "2017-05-26T13:14:36.000Z",
|
||
|
|
"name": "OSINT - Analysis of Emotet v4",
|
||
|
|
"published": "2017-05-26T13:14:42Z",
|
||
|
|
"object_refs": [
|
||
|
|
"observed-data--59282258-d130-4a21-864e-4712950d210f",
|
||
|
|
"url--59282258-d130-4a21-864e-4712950d210f",
|
||
|
|
"x-misp-attribute--59282381-e64c-46c9-88a9-40ff950d210f",
|
||
|
|
"x-misp-attribute--592823a0-1400-4721-8b31-4276950d210f",
|
||
|
|
"indicator--592823c5-6a88-4023-aa9e-4b45950d210f",
|
||
|
|
"indicator--592823d5-b3bc-4845-a841-4ae5950d210f",
|
||
|
|
"indicator--592823d5-63d4-4ae4-ac7c-4c0c950d210f",
|
||
|
|
"indicator--592823d6-83cc-4b3b-adc5-4b2b950d210f",
|
||
|
|
"indicator--592823f7-6938-4073-8b4e-4331950d210f",
|
||
|
|
"indicator--592823f7-f390-440f-87de-4f93950d210f",
|
||
|
|
"indicator--592823f7-b7b4-4ca7-8917-4eaa950d210f",
|
||
|
|
"indicator--592823f8-72dc-4b2d-b274-4902950d210f",
|
||
|
|
"indicator--592823f8-4144-4d11-8f74-4a27950d210f",
|
||
|
|
"indicator--592823f9-30a4-4976-8f2f-486d950d210f",
|
||
|
|
"indicator--592823f9-8680-4722-90bd-4679950d210f",
|
||
|
|
"indicator--592823fa-8980-4ea0-bee6-4f15950d210f",
|
||
|
|
"indicator--592823fa-9250-447d-a1ac-44d5950d210f",
|
||
|
|
"indicator--592823fa-38b0-4c02-80cd-45ef950d210f",
|
||
|
|
"indicator--592823fb-b55c-4f7f-aca5-4edd950d210f",
|
||
|
|
"indicator--592823fc-fd98-4a8a-9724-496f950d210f",
|
||
|
|
"indicator--5928243e-f388-465a-b65b-447b02de0b81",
|
||
|
|
"indicator--5928243e-1490-48d5-a33e-487a02de0b81",
|
||
|
|
"observed-data--5928243f-2964-4f17-a96e-470402de0b81",
|
||
|
|
"url--5928243f-2964-4f17-a96e-470402de0b81",
|
||
|
|
"indicator--5928243f-2ebc-40bb-af6b-44d902de0b81",
|
||
|
|
"indicator--59282440-d650-4fba-bc1c-407f02de0b81",
|
||
|
|
"observed-data--59282440-a03c-44f6-b704-4b7402de0b81",
|
||
|
|
"url--59282440-a03c-44f6-b704-4b7402de0b81",
|
||
|
|
"indicator--59282441-91c8-46fc-8cda-4e4c02de0b81",
|
||
|
|
"indicator--59282442-2d44-44c0-808b-4f3a02de0b81",
|
||
|
|
"observed-data--59282442-eb34-44fd-91b4-422102de0b81",
|
||
|
|
"url--59282442-eb34-44fd-91b4-422102de0b81",
|
||
|
|
"indicator--59282443-fa58-432a-a85b-426202de0b81",
|
||
|
|
"indicator--59282443-f8b4-4ced-bc34-4eb402de0b81",
|
||
|
|
"observed-data--59282443-b4d8-4777-a97c-4e0902de0b81",
|
||
|
|
"url--59282443-b4d8-4777-a97c-4e0902de0b81",
|
||
|
|
"indicator--592829fc-1088-4bea-a59d-4eb4950d210f",
|
||
|
|
"indicator--59282a1c-e2a8-4c42-99c0-4985950d210f",
|
||
|
|
"indicator--59282a3c-eeb8-4231-b073-44b6950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"ms-caro-malware:malware-type=\"Trojan\"",
|
||
|
|
"misp-galaxy:tool=\"Emotet\""
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59282258-d130-4a21-864e-4712950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T12:49:24.000Z",
|
||
|
|
"modified": "2017-05-26T12:49:24.000Z",
|
||
|
|
"first_observed": "2017-05-26T12:49:24Z",
|
||
|
|
"last_observed": "2017-05-26T12:49:24Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--59282258-d130-4a21-864e-4712950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\"",
|
||
|
|
"osint:source-type=\"blog-post\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--59282258-d130-4a21-864e-4712950d210f",
|
||
|
|
"value": "https://www.cert.pl/en/news/single/analysis-of-emotet-v4/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--59282381-e64c-46c9-88a9-40ff950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T12:49:25.000Z",
|
||
|
|
"modified": "2017-05-26T12:49:25.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"External analysis\"",
|
||
|
|
"osint:source-type=\"blog-post\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "External analysis",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Emotet is a modular Trojan horse, which was firstly noticed in June 2014 by Trend Micro. This malware is related to other types like Geodo, Bugat or Dridex, which are attributed by researches to the same family.\r\n\r\nEmotet was discovered as an advanced banker \u00e2\u20ac\u201c it\u00e2\u20ac\u2122s first campaign targeted clients of German and Austrian banks. Victims\u00e2\u20ac\u2122 bank accounts were infiltrated by a web browser infection which intercept communication between webpage and bank servers. In such scenario, malware hooks specific routines to sniff network activity and steal information. This technique is typical for modern banking malware and is widely known as Man-in-the-Browser attack.\r\n\r\nNext, modified release of Emotet banker (v2) has taken advantage of another technique \u00e2\u20ac\u201c automation of stealing money from hijacked bank accounts using ATSs (Automated Transfer Systems, more informations on page 20 of CERT Polska Report 2013). This technology is also used in other bankers. Good examples are ISFB (Gozi) or Tinba.\r\n\r\nAt the beginning of April 2017, we observed wide malspam campaign in Poland, distributing fraudulent mails. E-mails were imitating delivery notifications from DHL logistics company and contained malicious link, which referred to brand-new, unknown variant of Emotet.\r\n\r\n\r\n\r\nMalware distributed in this campaign differed from previously known versions. Behavior and communication methods were similar, but malware used different encryption and we noticed significant changes in its code. Thus we called this modification version 4."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--592823a0-1400-4721-8b31-4276950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T12:48:53.000Z",
|
||
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"other\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Artifacts dropped",
|
||
|
|
"x_misp_comment": "C&C public key",
|
||
|
|
"x_misp_type": "other",
|
||
|
|
"x_misp_value": "-----BEGIN PUBLIC KEY-----\r\nMHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAJ16QBv5Csq0eruFy4BvTcXmmIyeqUb3\r\nvCCc8K/zOYOpL/Ww6FCdUpvPfs+RR/sLBalwtKmT14iRUaNmJdygnAKUIRWR1HNt\r\n0rQRir0pD4QlkXlnZ9lZazTfyMV8BLCatwIDAQAB\r\n-----END PUBLIC KEY-----"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--592823c5-6a88-4023-aa9e-4b45950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T12:48:53.000Z",
|
||
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
||
|
|
"description": "Analysis based on sample",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c53956c95100c5c0ba342977f8fc44fcad35aabc24ec44cb12bb83eee1ed34fa']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T12:48:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--592823d5-b3bc-4845-a841-4ae5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T12:48:53.000Z",
|
||
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
||
|
|
"description": "fetched modules (13th April)",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0497c120248c6f00f1ac37513bd572e5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T12:48:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--592823d5-63d4-4ae4-ac7c-4c0c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T12:48:53.000Z",
|
||
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
||
|
|
"description": "fetched modules (13th April)",
|
||
|
|
"pattern": "[file:hashes.MD5 = '5b2d58b4104309ee9c93b455d39c7314']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T12:48:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--592823d6-83cc-4b3b-adc5-4b2b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T12:48:53.000Z",
|
||
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
||
|
|
"description": "fetched modules (13th April)",
|
||
|
|
"pattern": "[file:hashes.MD5 = '722268bad0d3a2e90aa148d52c60943e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T12:48:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--592823f7-6938-4073-8b4e-4331950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T12:48:53.000Z",
|
||
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
||
|
|
"description": "On port 443 C&C",
|
||
|
|
"pattern": "[url:value = 'http://87.106.105.76']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T12:48:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--592823f7-f390-440f-87de-4f93950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T12:48:53.000Z",
|
||
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
||
|
|
"description": "On port 443 C&C",
|
||
|
|
"pattern": "[url:value = 'http://173.255.229.121']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T12:48:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--592823f7-b7b4-4ca7-8917-4eaa950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T12:48:53.000Z",
|
||
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
||
|
|
"description": "On port 443 C&C",
|
||
|
|
"pattern": "[url:value = 'http://178.79.177.141']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T12:48:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--592823f8-72dc-4b2d-b274-4902950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T12:48:53.000Z",
|
||
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
||
|
|
"description": "On port 7080 C&C",
|
||
|
|
"pattern": "[url:value = 'http://79.170.95.202']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T12:48:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--592823f8-4144-4d11-8f74-4a27950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T12:48:53.000Z",
|
||
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
||
|
|
"description": "On port 8080 C&C",
|
||
|
|
"pattern": "[url:value = 'http://206.214.220.79']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T12:48:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--592823f9-30a4-4976-8f2f-486d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T12:48:53.000Z",
|
||
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
||
|
|
"description": "On port 8080 C&C",
|
||
|
|
"pattern": "[url:value = 'http://88.198.50.221']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T12:48:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--592823f9-8680-4722-90bd-4679950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T12:48:53.000Z",
|
||
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
||
|
|
"description": "On port 8080 C&C",
|
||
|
|
"pattern": "[url:value = 'http://5.39.84.48']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T12:48:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--592823fa-8980-4ea0-bee6-4f15950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T12:48:53.000Z",
|
||
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
||
|
|
"description": "On port 7080 C&C",
|
||
|
|
"pattern": "[url:value = 'http://188.68.58.8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T12:48:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--592823fa-9250-447d-a1ac-44d5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T12:48:53.000Z",
|
||
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
||
|
|
"description": "On port 7080 C&C",
|
||
|
|
"pattern": "[url:value = 'http://162.214.11.56']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T12:48:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--592823fa-38b0-4c02-80cd-45ef950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T12:48:53.000Z",
|
||
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
||
|
|
"description": "On port 8080 C&C",
|
||
|
|
"pattern": "[url:value = 'http://5.196.73.150']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T12:48:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--592823fb-b55c-4f7f-aca5-4edd950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T12:48:53.000Z",
|
||
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
||
|
|
"description": "On port 7080 C&C",
|
||
|
|
"pattern": "[url:value = 'http://203.121.145.40']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T12:48:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--592823fc-fd98-4a8a-9724-496f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T12:48:53.000Z",
|
||
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
||
|
|
"description": "On port 7080 C&C",
|
||
|
|
"pattern": "[url:value = 'http://46.165.212.76']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T12:48:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5928243e-f388-465a-b65b-447b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T12:49:02.000Z",
|
||
|
|
"modified": "2017-05-26T12:49:02.000Z",
|
||
|
|
"description": "Analysis based on sample - Xchecked via VT: c53956c95100c5c0ba342977f8fc44fcad35aabc24ec44cb12bb83eee1ed34fa",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '7b353d4f26acd06fdf8abed661f048a02cd1bbcf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T12:49:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5928243e-1490-48d5-a33e-487a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T12:49:02.000Z",
|
||
|
|
"modified": "2017-05-26T12:49:02.000Z",
|
||
|
|
"description": "Analysis based on sample - Xchecked via VT: c53956c95100c5c0ba342977f8fc44fcad35aabc24ec44cb12bb83eee1ed34fa",
|
||
|
|
"pattern": "[file:hashes.MD5 = '5b3f0c1b0231e7873b587131b112139f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T12:49:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5928243f-2964-4f17-a96e-470402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T12:49:03.000Z",
|
||
|
|
"modified": "2017-05-26T12:49:03.000Z",
|
||
|
|
"first_observed": "2017-05-26T12:49:03Z",
|
||
|
|
"last_observed": "2017-05-26T12:49:03Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5928243f-2964-4f17-a96e-470402de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5928243f-2964-4f17-a96e-470402de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/c53956c95100c5c0ba342977f8fc44fcad35aabc24ec44cb12bb83eee1ed34fa/analysis/1494971561/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5928243f-2ebc-40bb-af6b-44d902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T12:49:03.000Z",
|
||
|
|
"modified": "2017-05-26T12:49:03.000Z",
|
||
|
|
"description": "fetched modules (13th April) - Xchecked via VT: 722268bad0d3a2e90aa148d52c60943e",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'fe8c3e060969c3e8842bcbcab161cd0ba477d2614115e2cf46588eed30554a12']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T12:49:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282440-d650-4fba-bc1c-407f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T12:49:04.000Z",
|
||
|
|
"modified": "2017-05-26T12:49:04.000Z",
|
||
|
|
"description": "fetched modules (13th April) - Xchecked via VT: 722268bad0d3a2e90aa148d52c60943e",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '498cf1ac35d1c31c6920d5305cc78129c3d18ecf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T12:49:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59282440-a03c-44f6-b704-4b7402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T12:49:04.000Z",
|
||
|
|
"modified": "2017-05-26T12:49:04.000Z",
|
||
|
|
"first_observed": "2017-05-26T12:49:04Z",
|
||
|
|
"last_observed": "2017-05-26T12:49:04Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--59282440-a03c-44f6-b704-4b7402de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--59282440-a03c-44f6-b704-4b7402de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/fe8c3e060969c3e8842bcbcab161cd0ba477d2614115e2cf46588eed30554a12/analysis/1495693771/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282441-91c8-46fc-8cda-4e4c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T12:49:05.000Z",
|
||
|
|
"modified": "2017-05-26T12:49:05.000Z",
|
||
|
|
"description": "fetched modules (13th April) - Xchecked via VT: 5b2d58b4104309ee9c93b455d39c7314",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '621c0a11ee0100b8fc3190e471ed4936204e897d97394ba9614ec95f1b69c69c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T12:49:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282442-2d44-44c0-808b-4f3a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T12:49:06.000Z",
|
||
|
|
"modified": "2017-05-26T12:49:06.000Z",
|
||
|
|
"description": "fetched modules (13th April) - Xchecked via VT: 5b2d58b4104309ee9c93b455d39c7314",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '59745dfbac015cec3bf66d9c4ad5cc37737adb84']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T12:49:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59282442-eb34-44fd-91b4-422102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T12:49:06.000Z",
|
||
|
|
"modified": "2017-05-26T12:49:06.000Z",
|
||
|
|
"first_observed": "2017-05-26T12:49:06Z",
|
||
|
|
"last_observed": "2017-05-26T12:49:06Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--59282442-eb34-44fd-91b4-422102de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--59282442-eb34-44fd-91b4-422102de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/621c0a11ee0100b8fc3190e471ed4936204e897d97394ba9614ec95f1b69c69c/analysis/1493454650/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282443-fa58-432a-a85b-426202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T12:49:07.000Z",
|
||
|
|
"modified": "2017-05-26T12:49:07.000Z",
|
||
|
|
"description": "fetched modules (13th April) - Xchecked via VT: 0497c120248c6f00f1ac37513bd572e5",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1eb9c52548870533246932e12843318a95f876fd873bf4dfec7759214d1c2cc9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T12:49:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282443-f8b4-4ced-bc34-4eb402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T12:49:07.000Z",
|
||
|
|
"modified": "2017-05-26T12:49:07.000Z",
|
||
|
|
"description": "fetched modules (13th April) - Xchecked via VT: 0497c120248c6f00f1ac37513bd572e5",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '199da8defc4b1cd8513ca9bea76e96571dc6e5e2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T12:49:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59282443-b4d8-4777-a97c-4e0902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T12:49:07.000Z",
|
||
|
|
"modified": "2017-05-26T12:49:07.000Z",
|
||
|
|
"first_observed": "2017-05-26T12:49:07Z",
|
||
|
|
"last_observed": "2017-05-26T12:49:07Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--59282443-b4d8-4777-a97c-4e0902de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--59282443-b4d8-4777-a97c-4e0902de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/1eb9c52548870533246932e12843318a95f876fd873bf4dfec7759214d1c2cc9/analysis/1493439636/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--592829fc-1088-4bea-a59d-4eb4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:13:32.000Z",
|
||
|
|
"modified": "2017-05-26T13:13:32.000Z",
|
||
|
|
"pattern": "[rule emotet4_basic: trojan\r\n{\r\nmeta:\r\nauthor = \"psrok1/mak\"\r\nmodule = \"emotet\"\r\nstrings:\r\n$emotet4_rsa_public = { 8d ?? ?? 5? 8d ?? ?? 5? 6a 00 68 00 80 00 00 ff 35 [4] ff 35 [4] 6a 13 68 01 00 01 00 ff 15 [4] 85 }\r\n$emotet4_cnc_list = { 39 ?? ?5 [4] 0f 44 ?? (FF | A3)}\r\ncondition:\r\nall of them\r\n}]",
|
||
|
|
"pattern_type": "yara",
|
||
|
|
"valid_from": "2017-05-26T13:13:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"yara\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a1c-e2a8-4c42-99c0-4985950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:14:04.000Z",
|
||
|
|
"modified": "2017-05-26T13:14:04.000Z",
|
||
|
|
"pattern": "[rule emotet4: trojan\r\n{\r\nmeta:\r\nauthor = \"psrok1\"\r\nmodule = \"emotet\"\r\nstrings:\r\n$emotet4_x65599 = { 0f b6 ?? 8d ?? ?? 69 ?? 3f 00 01 00 4? 0? ?? 3? ?? 72 }\r\ncondition:\r\nany of them and emotet4_basic\r\n}]",
|
||
|
|
"pattern_type": "yara",
|
||
|
|
"valid_from": "2017-05-26T13:14:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"yara\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a3c-eeb8-4231-b073-44b6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:14:36.000Z",
|
||
|
|
"modified": "2017-05-26T13:14:36.000Z",
|
||
|
|
"description": "IDS flag not set (false-positive?)",
|
||
|
|
"pattern": "[rule emotet4_spam : spambot\r\n{\r\nmeta:\r\nauthor=\"mak\"\r\nmodule=\"emotet\"\r\nstrings:\r\n$login=\"LOGIN\" fullword\r\n$startls=\"STARTTLS\" fullword\r\n$mailfrom=\"MAIL FROM:\"\r\ncondition:\r\nall of them and emotet4_basic\r\n}]",
|
||
|
|
"pattern_type": "yara",
|
||
|
|
"valid_from": "2017-05-26T13:14:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"yara\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|