adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/582dd48e-66bc-40c1-ae49-6fe8d56c6cd2.json

906 lines
39 KiB
JSON
Raw Normal View History

chg: [feed] added
2023-04-21 13:25:09 +00:00
{
"Event": {
"analysis": "2",
"date": "2016-11-17",
"extends_uuid": "",
"info": "It\u2019s Parliamentary: KeyBoy and the targeting of the Tibetan Community",
"publish_timestamp": "1602322972",
"published": true,
"threat_level_id": "2",
"timestamp": "1588068722",
"uuid": "582dd48e-66bc-40c1-ae49-6fe8d56c6cd2",
"Orgc": {
"name": "CiviCERT",
"uuid": "56743359-c860-4361-b1dc-7b65d56c6cd2"
},
"Tag": [
{
"colour": "#326300",
"name": "circl:incident-classification=\"phishing\""
},
{
"colour": "#ffffff",
"name": "tlp:white"
},
{
"colour": "#00223b",
"name": "osint:source-type=\"blog-post\""
},
{
"colour": "#0088cc",
"name": "misp-galaxy:tool=\"KeyBoy\""
}
],
"Attribute": [
{
"category": "Artifacts dropped",
"comment": "Wab32res.exe legitimate file used for DLL side loading",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399205",
"to_ids": false,
"type": "md5",
"uuid": "582dd725-1a84-4454-b86e-7007d56c6cd2",
"value": "8f08609e4e0b3d26814b3073a42df415"
},
{
"category": "Artifacts dropped",
"comment": "Wab32res.dll payload, KeyBoy 20160509",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399231",
"to_ids": true,
"type": "md5",
"uuid": "582dd740-b944-4070-9b70-0692d56c6cd2",
"value": "495adb1b9777002ecfe22aaf52fcee93"
},
{
"category": "Artifacts dropped",
"comment": "Payload KeyBoy P_20150313",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399247",
"to_ids": true,
"type": "md5",
"uuid": "582dd74f-c72c-4221-bc3f-6fe8d56c6cd2",
"value": "0c7e55509e0b6d4277b3facf864af018"
},
{
"category": "Artifacts dropped",
"comment": "Payload KeyBoy 20151108",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399261",
"to_ids": true,
"type": "md5",
"uuid": "582dd75d-7a3c-4990-883d-0696d56c6cd2",
"value": "98977426d544bd145979f65f0322ae30"
},
{
"category": "Artifacts dropped",
"comment": "Payload KeyBoy 20151108",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399277",
"to_ids": true,
"type": "md5",
"uuid": "582dd76d-b590-4d21-9ff6-7005d56c6cd2",
"value": "c5b5f01ba24d6c02636388809f44472e"
},
{
"category": "Artifacts dropped",
"comment": "64b KeyBoy payload 20151108",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399290",
"to_ids": true,
"type": "md5",
"uuid": "582dd77a-cda4-42a0-9b86-7008d56c6cd2",
"value": "371bc132499f455f06fa80696db0df27"
},
{
"category": "Artifacts dropped",
"comment": "wab32res.dll, agewkassif version",
"deleted": false,
"disable_correlation": false,
"timestamp": "1588068722",
"to_ids": true,
"type": "md5",
"uuid": "582dd78b-1198-4b24-b6d3-7006d56c6cd2",
"value": "087bffa8a570079948310dc9731c5709"
},
{
"category": "Artifacts dropped",
"comment": "Contains the Keyboy version",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399322",
"to_ids": true,
"type": "regkey",
"uuid": "582dd79a-c36c-4329-952c-7007d56c6cd2",
"value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Ver"
},
{
"category": "Artifacts dropped",
"comment": "legitimate Microsoft Windows Address Book executable, used to load final payload",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399347",
"to_ids": false,
"type": "sha256",
"uuid": "582dd7b3-3fec-4380-b6a1-6ff1d56c6cd2",
"value": "58105e9772f6befbc319c147a97faded4fbacf839947b34fe3695ae72771da5d"
},
{
"category": "Artifacts dropped",
"comment": "Wab32res.dll payload, KeyBoy 20160509",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399362",
"to_ids": true,
"type": "sha256",
"uuid": "582dd7c2-7434-4d28-af67-7007d56c6cd2",
"value": "9a55577d357922711ab0821bf5379289293c8517ae1d94d48c389f306af57a04"
},
{
"category": "Artifacts dropped",
"comment": "Wab32res.dll payload, KeyBoy agewkassif version",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399379",
"to_ids": true,
"type": "sha256",
"uuid": "582dd7d3-3800-473b-b088-7006d56c6cd2",
"value": "5da2f14c382d7cac8dfa6c86e528a646a81f0b40cfee9611c8cfb4b5d589aa88"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399393",
"to_ids": true,
"type": "yara",
"uuid": "582dd7e1-7bcc-4b5c-b6ef-6ff0d56c6cd2",
"value": "import \"pe\"\r\nrule new_keyboy_export\r\n{\r\nmeta:\r\nauthor = \"Matt Brooks, @cmatthewbrooks\"\r\ndesc = \"Matches the new 2016 sample's export\"\r\ndate = \"2016-08-28\"\r\nmd5 = \"495adb1b9777002ecfe22aaf52fcee93\"\r\n\r\ncondition:\r\n//MZ header\r\nuint16(0) == 0x5A4D and\r\n\r\n//PE signature\r\nuint32(uint32(0x3C)) == 0x00004550 and\r\n\r\n\r\nfilesize < 200KB and\r\n\r\n\r\n//The malware family seems to share many exports\r\n//but this is the new kid on the block.\r\npe.exports(\"cfsUpdate\")\r\n}"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399405",
"to_ids": true,
"type": "yara",
"uuid": "582dd7ed-ff54-4450-9f8a-7008d56c6cd2",
"value": "rule new_keyboy_header_codes\r\n{\r\nmeta:\r\nauthor = \"Matt Brooks, @cmatthewbrooks\"\r\ndesc = \"Matches the 2016 sample's header codes\"\r\ndate = \"2016-08-28\"\r\nmd5 = \"495adb1b9777002ecfe22aaf52fcee93\"\r\n\r\nstrings:\r\n$s1 = \"*l*\" wide fullword\r\n$s2 = \"*a*\" wide fullword\r\n$s3 = \"*s*\" wide fullword\r\n$s4 = \"*d*\" wide fullword\r\n$s5 = \"*f*\" wide fullword\r\n$s6 = \"*g*\" wide fullword\r\n$s7 = \"*h*\" wide fullword\r\n\r\ncondition:\r\n//MZ header\r\nuint16(0) == 0x5A4D and\r\n\r\n//PE signature\r\nuint32(uint32(0x3C)) == 0x00004550 and\r\nfilesize < 200KB and\r\nall of them\r\n}"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399417",
"to_ids": true,
"type": "yara",
"uuid": "582dd7f9-5180-4a45-baff-7005d56c6cd2",
"value": "rule keyboy_commands\r\n{\r\nmeta:\r\nauthor = \"Matt Brooks, @cmatthewbrooks\"\r\ndesc = \"Matches the 2016 sample's sent and received commands\"\r\ndate = \"2016-08-28\"\r\nmd5 = \"495adb1b9777002ecfe22aaf52fcee93\"\r\n\r\nstrings:\r\n$s1 = \"Update\" wide fullword\r\n$s2 = \"UpdateAndRun\" wide fullword\r\n$s3 = \"Refresh\" wide fullword\r\n$s4 = \"OnLine\" wide fullword\r\n$s5 = \"Disconnect\" wide fullword\r\n$s6 = \"Pw_Error\" wide fullword\r\n$s7 = \"Pw_OK\" wide fullword\r\n$s8 = \"Sysinfo\" wide fullword\r\n$s9 = \"Download\" wide fullword\r\n$s10 = \"UploadFileOk\" wide fullword\r\n$s11 = \"RemoteRun\" wide fullword\r\n$s12 = \"FileManager\" wide fullword\r\n\r\ncondition:\r\n//MZ header\r\nuint16(0) == 0x5A4D and\r\n\r\n//PE signature\r\nuint32(uint32(0x3C)) == 0x00004550 and\r\nfilesize < 200KB and\r\n6 of them\r\n}"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399436",
"to_ids": true,
"type": "yara",
"uuid": "582dd80c-aa34-453f-9a06-6fe8d56c6cd2",
"value": "rule keyboy_errors\r\n{\r\nmeta:\r\nauthor = \"Matt Brooks, @cmatthewbrooks\"\r\ndesc = \"Matches the sample's shell error2 log statements\"\r\ndate = \"2016-08-28\"\r\nmd5 = \"495adb1b9777002ecfe22aaf52fcee93\"\r\n\r\nstrings:\r\n//These strings are in ASCII pre-2015 and UNICODE in 2016\r\n$error = \"Error2\" ascii wide\r\n//2016 specific:\r\n$s1 = \"Can't find [%s]!Check the file name and try again!\" ascii wide\r\n$s2 = \"Open [%s] error! %d\" ascii wide\r\n$s3 = \"The Size of [%s] is zero!\" ascii wide\r\n$s4 = \"CreateThread DownloadFile[%s] Error!\" ascii wide\r\n$s5 = \"UploadFile [%s] Error:Connect Server Failed!\" ascii wide\r\n$s6 = \"Receive [%s] Error(Recved[%d] != Send[%d])!\" ascii wide\r\n$s7 = \"Receive [%s] ok! Use %2.2f seconds, Average speed %2.2f k/s\" ascii wide\r\n$s8 = \"CreateThread UploadFile[%s] Error!\" ascii wide\r\n//Pre-2016:\r\n$s9 = \"Ready Download [%s] ok!\" ascii wide\r\n$s10 = \"Get ControlInfo from FileClient error!\" ascii wide\r\n$s11 = \"FileClient has a error!\" ascii wide\r\n$s12 = \"VirtualAlloc SendBuff Error(%d)\" ascii wide\r\n$s13 = \"ReadFile [%s] Error(%d)...\" ascii wide\r\n$s14 = \"ReadFile [%s] Data[Readed(%d) != FileSize(%d)] Error...\" ascii wide\r\n$s15 = \"CreateThread DownloadFile[%s] Error!\" ascii wide\r\n$s16 = \"RecvData MyRecv_Info Size Error!\" ascii wide\r\n$s17 = \"RecvData MyRecv_Info Tag Error!\" ascii wide\r\n$s18 = \"SendData szControlInfo_1 Error!\" ascii wide\r\n$s19 = \"SendData szControlInfo_3 Error!\" ascii wide\r\n$s20 = \"VirtualAlloc RecvBuff Error(%d)\" ascii wide\r\n$s21 = \"RecvData Error!\" ascii wide\r\n$s22 = \"WriteFile [%s} Error(%d)...\" ascii wide\r\n\r\ncondition:\r\n//MZ header\r\nuint16(0) == 0x5A4D and\r\n\r\n//PE signature\r\nuint32(uint32(0x3C)) == 0x00004550 and\r\nfilesize < 200KB and\r\n$error and 3 of ($s*)\r\n}"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399459",
"to_ids": true,
"type": "yara",
"uuid": "582dd817-deac-4afa-a4a9-0696d56c6cd2",
"value": "rule keyboy_systeminfo\r\n{\r\nmeta:\r\nauthor = \"Matt Brooks, @cmatthewbrooks\"\r\ndesc = \"Matches the system information format before sending to C2\"\r\ndate = \"2016-08-28\"\r\nmd5 = \"495adb1b9777002ecfe22aaf52fcee93\"\r\n\r\nstrings:\r\n//These strings are ASCII pre-2015 and UNICODE in 2016\r\n$s1 = \"SystemVersion: %s\" ascii wide\r\n$s2 = \"Product ID: %s\" ascii wide\r\n$s3 = \"InstallPath: %s\" ascii wide\r\n$s4 = \"InstallTime: %d-%d-%d, %02d:%02d:%02d\" ascii wide\r\n$s5 = \"ResgisterGroup: %s\" ascii wide\r\n$s6 = \"RegisterUser: %s\" ascii wide\r\n$s7 = \"ComputerName: %s\" ascii wide\r\n$s8 = \"WindowsDirectory: %s\" ascii wide\r\n$s9 = \"System Directory: %s\" ascii wide\r\n$s10 = \"Number of Processors: %d\" ascii wide\r\n$s11 = \"CPU[%d]: %s: %sMHz\" ascii wide\r\n$s12 = \"RAM: %dMB Total, %dMB Free.\" ascii wide\r\n$s13 = \"DisplayMode: %d x %d, %dHz, %dbit\" ascii wide\r\n$s14 = \"Uptime: %d Days %02u:%02u:%02u\" ascii wide\r\n\r\ncondition:\r\n//MZ header\r\nuint16(0) == 0x5A4D and\r\n\r\n//PE signature\r\nuint32(uint32(0x3C)) == 0x00004550 and\r\nfilesize < 200KB and\r\n7 of them\r\n}"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1588068717",
"to_ids": true,
"type": "yara",
"uuid": "582dd82e-469c-4a22-8669-6ff1d56c6cd2",
"value": "import \"pe\"\nrule keyboy_related_exports\n{\nmeta:\nauthor = \"Matt Brooks, @cmatthewbrooks\"\ndesc = \"Matches the new 2016 sample's export\"\ndate = \"2016-08-28\"\nmd5 = \"495adb1b9777002ecfe22aaf52fcee93\"\n\ncondition:\n//MZ header\nuint16(0) == 0x5A4D and\n\n//PE signature\nuint32(uint32(0x3C)) == 0x00004550 and\n\n\nfilesize < 200KB and\n\n\n//The malware family seems to share many exports\n//but this is the new kid on the block.\npe.exports(\"Embedding\") or\npe.exports(\"SSSS\") or\npe.exports(\"GetUP\")\n}"
},
{
"category": "Artifacts dropped",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399483",
"to_ids": true,
"type": "yara",
"uuid": "582dd83b-0524-4fed-a9e3-700dd56c6cd2",
"value": "import \"pe\"\r\nrule keyboy_init_config_section\r\n{\r\nmeta:\r\nauthor = \"Matt Brooks, @cmatthewbrooks\"\r\ndesc = \"Matches the Init section where the config is stored\"\r\ndate = \"2016-08-28\"\r\n\r\ncondition:\r\n//MZ header\r\nuint16(0) == 0x5A4D and\r\n\r\n//PE signature\r\nuint32(uint32(0x3C)) == 0x00004550 and\r\n\r\n//Payloads are normally smaller but the new dropper we spotted\r\n//is a bit larger.\r\nfilesize < 300KB and\r\n\r\n//Observed virtual sizes of the .Init section vary but they've\r\n//always been 1024, 2048, or 4096 bytes.\r\nfor any i in (0..pe.number_of_sections - 1):\r\n(\r\npe.sections[i].name == \".Init\" and\r\npe.sections[i].virtual_size % 1024 == 0\r\n)\r\n}"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399925",
"to_ids": false,
"type": "link",
"uuid": "582dd9f5-639c-4a10-8ced-6ff0d56c6cd2",
"value": "https://citizenlab.org/2016/11/parliament-keyboy/"
},
{
"category": "Network activity",
"comment": "domain linked to one of the C2 IPs",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399513",
"to_ids": true,
"type": "domain",
"uuid": "582dd859-da30-4ad9-9118-7005d56c6cd2",
"value": "tibetvoices.com"
},
{
"category": "Network activity",
"comment": "C2 domains",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399538",
"to_ids": true,
"type": "domain",
"uuid": "582dd873-7d5c-4433-9e36-6ff0d56c6cd2",
"value": "www.about.jkub.com"
},
{
"category": "Network activity",
"comment": "C2 domains",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399539",
"to_ids": true,
"type": "domain",
"uuid": "582dd873-ef48-4fe2-8f27-6ff0d56c6cd2",
"value": "www.eleven.mypop3.org"
},
{
"category": "Network activity",
"comment": "C2 domains",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399539",
"to_ids": true,
"type": "domain",
"uuid": "582dd873-7f8c-4373-aa0d-6ff0d56c6cd2",
"value": "www.backus.myftp.name"
},
{
"category": "Network activity",
"comment": "C2 IP",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399568",
"to_ids": true,
"type": "ip-dst",
"uuid": "582dd890-d548-436f-bd0a-6ff2d56c6cd2",
"value": "45.125.12.147"
},
{
"category": "Network activity",
"comment": "C2 IP",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399568",
"to_ids": true,
"type": "ip-dst",
"uuid": "582dd890-e77c-48ef-b609-6ff2d56c6cd2",
"value": "103.40.102.233"
},
{
"category": "Network activity",
"comment": "C2 IP",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399569",
"to_ids": true,
"type": "ip-dst",
"uuid": "582dd891-0d3c-41a2-9385-6ff2d56c6cd2",
"value": "116.193.154.69"
},
{
"category": "Network activity",
"comment": "C2 IP",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399569",
"to_ids": true,
"type": "ip-dst",
"uuid": "582dd891-0e90-4e82-bfba-6ff2d56c6cd2",
"value": "103.242.134.243"
},
{
"category": "Network activity",
"comment": "IPs for C2 Host: www.about.jkub.com",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399595",
"to_ids": true,
"type": "ip-dst",
"uuid": "582dd8ab-850c-4a68-812b-7007d56c6cd2",
"value": "45.32.47.148"
},
{
"category": "Network activity",
"comment": "IPs for C2 Host: www.about.jkub.com",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399596",
"to_ids": true,
"type": "ip-dst",
"uuid": "582dd8ac-097c-45be-8370-7007d56c6cd2",
"value": "157.7.84.81"
},
{
"category": "Network activity",
"comment": "IP behind C2 Host: www.backus.myftp[.]name",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399617",
"to_ids": true,
"type": "ip-dst",
"uuid": "582dd8c1-9ec0-4fa4-8d06-700fd56c6cd2",
"value": "192.241.149.43"
},
{
"category": "Network activity",
"comment": "Other IP hosting tibetvoices.com",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399661",
"to_ids": true,
"type": "ip-dst",
"uuid": "582dd8ed-34cc-49c9-9ae4-700fd56c6cd2",
"value": "112.10.117.47"
},
{
"category": "Payload delivery",
"comment": "Source of phishing emails",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399684",
"to_ids": true,
"type": "email-src",
"uuid": "582dd904-3f68-4706-b596-0696d56c6cd2",
"value": "tibetanparliarnent@yahoo.com"
},
{
"category": "Payload delivery",
"comment": "theme of the conference.doc",
"deleted": false,
"disable_correlation": false,
"timestamp": "1588068668",
"to_ids": true,
"type": "md5",
"uuid": "582dd918-13bc-44e9-9b8d-6ff2d56c6cd2",
"value": "8307e444cad98b1b59568ad2eba5f201"
},
{
"category": "Payload delivery",
"comment": "Dw20.exe dropper",
"deleted": false,
"disable_correlation": false,
"timestamp": "1588068666",
"to_ids": true,
"type": "md5",
"uuid": "582dd924-6350-4beb-bc4d-700dd56c6cd2",
"value": "0b4d45db323f68b465ae052d3a872068"
},
{
"category": "Payload delivery",
"comment": "Other similar doc",
"deleted": false,
"disable_correlation": false,
"timestamp": "1588068693",
"to_ids": true,
"type": "md5",
"uuid": "582dd932-aac0-48ba-8235-7006d56c6cd2",
"value": "beadf21b923600554b0ce54df42e78f5"
},
{
"category": "Payload delivery",
"comment": "Dw20.exe dropper",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399744",
"to_ids": true,
"type": "md5",
"uuid": "582dd940-4910-478c-a8f6-700ed56c6cd2",
"value": "69df3d3df4d99bc6045d073d89c68697"
},
{
"category": "Payload delivery",
"comment": "Malicious doc with CVE-2014-4114 vulnerability",
"deleted": false,
"disable_correlation": false,
"timestamp": "1588068677",
"to_ids": true,
"type": "md5",
"uuid": "582dd94c-9948-4f28-a0a8-6ff1d56c6cd2",
"value": "05b5cf94f07fee666eb086c91182ad25"
},
{
"category": "Payload delivery",
"comment": "Doc exploiting CVE-2012-0158",
"deleted": false,
"disable_correlation": false,
"timestamp": "1588068675",
"to_ids": true,
"type": "md5",
"uuid": "582dd958-b8e4-47e1-b3bd-6ff0d56c6cd2",
"value": "8846d109b457a2ee44ddbf54d1cf7944"
},
{
"category": "Payload delivery",
"comment": "Attached file urgent action larung gar buddhist academy.rtf (CVE-2015-1641)",
"deleted": false,
"disable_correlation": false,
"timestamp": "1588068682",
"to_ids": true,
"type": "md5",
"uuid": "582dd965-41f0-4ca5-a4f6-700fd56c6cd2",
"value": "913b82ff8f090670fc6387e3a7bea12d"
},
{
"category": "Payload delivery",
"comment": "dropper of 'agewkassif' version",
"deleted": false,
"disable_correlation": false,
"timestamp": "1588068685",
"to_ids": true,
"type": "md5",
"uuid": "582dd971-87dc-4fa4-a22b-7007d56c6cd2",
"value": "23d284245e53ae4fe05c517d807ffccf"
},
{
"category": "Payload delivery",
"comment": "dw20.exe dropper",
"deleted": false,
"disable_correlation": false,
"timestamp": "1588068687",
"to_ids": true,
"type": "sha256",
"uuid": "582dd982-e0b0-4f79-bab1-0696d56c6cd2",
"value": "5f24a5ee9ecfd4a8e5f967ffcf24580a83942cd7b09d310b9525962ed2614a49"
},
{
"category": "Payload delivery",
"comment": "dropper of 'agewkassif' sample",
"deleted": false,
"disable_correlation": false,
"timestamp": "1588068691",
"to_ids": true,
"type": "sha256",
"uuid": "582dd992-c5ac-438a-8737-7005d56c6cd2",
"value": "542c85fda8df8510c1b66a122e459aac8c0919f1fe9fa2c43fd87899cffa05bf"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399853",
"to_ids": false,
"type": "vulnerability",
"uuid": "582dd9ad-23d0-45dd-9bee-6ff2d56c6cd2",
"value": "CVE-2012-0158"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399853",
"to_ids": false,
"type": "vulnerability",
"uuid": "582dd9ad-a8e4-4cd1-b839-6ff2d56c6cd2",
"value": "CVE-2014-4114"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399853",
"to_ids": false,
"type": "vulnerability",
"uuid": "582dd9ad-8e60-429f-b92c-6ff2d56c6cd2",
"value": "CVE-2015-1641"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399870",
"to_ids": true,
"type": "yara",
"uuid": "582dd9be-541c-40c0-875a-700dd56c6cd2",
"value": "rule CVE_2012_0158_KeyBoy {\r\nmeta:\r\nauthor = \"Etienne Maynier <etienne@citizenlab.ca>\"\r\ndescription = \"CVE-2012-0158 variant\"\r\nfile = \"8307e444cad98b1b59568ad2eba5f201\"\r\n\r\nstrings:\r\n$a = \"d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff09000600000000000000000000000100000001\" nocase // OLE header\r\n$b = \"ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff\" nocase // junk data\r\n$c = /5(\\{\\\\b0\\}|)[ ]*2006F00(\\{\\\\b0\\}|)[ ]*6F007(\\{\\\\b0\\}|)[ ]*400200045(\\{\\\\b0\\}|)[ ]*006(\\{\\\\b0\\}|)[ ]*E007(\\{\\\\b0\\}|)[ ]*400720079/ nocase\r\n$d = \"MSComctlLib.ListViewCtrl.2\"\r\n$e = \"ac38c874503c307405347aaaebf2ac2c31ebf6e8e3\" nocase //decoding shellcode\r\n\r\ncondition:\r\nall of them\r\n}"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479399885",
"to_ids": true,
"type": "yara",
"uuid": "582dd9cd-5bf4-40a1-9f79-700ed56c6cd2",
"value": "rule keyboy_exploit_doc_meta{\r\nmeta:\r\nauthor = \"Matt Brooks, @cmatthewbrooks\"\r\ndesc = \"Matches the meta associated with these exploit docs\"\r\ndate = \"2016-09-30\"\r\n\r\nstrings:\r\n$role = \"{\\\\author Master}{\\\\operator Master}\"\r\n$creatim = \"{\\\\creatim\\\\yr2015\\\\mo10\\\\dy16\\\\hr11\\\\min37}\"\r\n$revtim = \"{\\\\revtim\\\\yr2015\\\\mo10\\\\dy16\\\\hr13\\\\min54}\"\r\n\r\ncondition:\r\nuint32be(0) == 0x7B5C7274 and\r\nfilesize < 1MB and\r\nall of them\r\n}"
},
{
"category": "Payload type",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1588068655",
"to_ids": true,
"type": "text",
"uuid": "582dd9d6-8564-46ea-9b4e-700ed56c6cd2",
"value": "KeyBoy"
},
{
"category": "Payload delivery",
"comment": "dropper of 'agewkassif' sample - Xchecked via VT: 542c85fda8df8510c1b66a122e459aac8c0919f1fe9fa2c43fd87899cffa05bf",
"deleted": false,
"disable_correlation": false,
"timestamp": "1588068657",
"to_ids": true,
"type": "sha1",
"uuid": "5832bd46-65f0-4dad-892b-426702de0b81",
"value": "3afd1071b8c05d743be976468f36663c22d57311"
},
{
"category": "External analysis",
"comment": "dropper of 'agewkassif' sample - Xchecked via VT: 542c85fda8df8510c1b66a122e459aac8c0919f1fe9fa2c43fd87899cffa05bf",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479720263",
"to_ids": false,
"type": "link",
"uuid": "5832bd47-c064-429b-bb2f-467302de0b81",
"value": "https://www.virustotal.com/file/542c85fda8df8510c1b66a122e459aac8c0919f1fe9fa2c43fd87899cffa05bf/analysis/1479643747/"
},
{
"category": "Payload delivery",
"comment": "dw20.exe dropper - Xchecked via VT: 5f24a5ee9ecfd4a8e5f967ffcf24580a83942cd7b09d310b9525962ed2614a49",
"deleted": false,
"disable_correlation": false,
"timestamp": "1588068659",
"to_ids": true,
"type": "sha1",
"uuid": "5832bd47-9600-41f5-896c-4e8b02de0b81",
"value": "c4611aff5e05ee92398b8700b878e016f4ff6113"
},
{
"category": "External analysis",
"comment": "dw20.exe dropper - Xchecked via VT: 5f24a5ee9ecfd4a8e5f967ffcf24580a83942cd7b09d310b9525962ed2614a49",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479720264",
"to_ids": false,
"type": "link",
"uuid": "5832bd48-b104-49f7-ae8e-436e02de0b81",
"value": "https://www.virustotal.com/file/5f24a5ee9ecfd4a8e5f967ffcf24580a83942cd7b09d310b9525962ed2614a49/analysis/1479643732/"
},
{
"category": "Artifacts dropped",
"comment": "Wab32res.dll payload, KeyBoy agewkassif version - Xchecked via VT: 5da2f14c382d7cac8dfa6c86e528a646a81f0b40cfee9611c8cfb4b5d589aa88",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479720264",
"to_ids": true,
"type": "sha1",
"uuid": "5832bd48-3de0-4688-8add-48f502de0b81",
"value": "c97b12039e324721130d58d127c4e6f356e3f6e8"
},
{
"category": "External analysis",
"comment": "Wab32res.dll payload, KeyBoy agewkassif version - Xchecked via VT: 5da2f14c382d7cac8dfa6c86e528a646a81f0b40cfee9611c8cfb4b5d589aa88",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479720265",
"to_ids": false,
"type": "link",
"uuid": "5832bd49-a008-4fd1-bc69-4cd102de0b81",
"value": "https://www.virustotal.com/file/5da2f14c382d7cac8dfa6c86e528a646a81f0b40cfee9611c8cfb4b5d589aa88/analysis/1479643740/"
},
{
"category": "Artifacts dropped",
"comment": "Wab32res.dll payload, KeyBoy 20160509 - Xchecked via VT: 9a55577d357922711ab0821bf5379289293c8517ae1d94d48c389f306af57a04",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479720265",
"to_ids": true,
"type": "sha1",
"uuid": "5832bd49-19b0-4338-af0d-47c402de0b81",
"value": "5bc42d475fa35e00e2584a4142c2767a4707019b"
},
{
"category": "External analysis",
"comment": "Wab32res.dll payload, KeyBoy 20160509 - Xchecked via VT: 9a55577d357922711ab0821bf5379289293c8517ae1d94d48c389f306af57a04",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479720266",
"to_ids": false,
"type": "link",
"uuid": "5832bd4a-8608-4468-9038-447602de0b81",
"value": "https://www.virustotal.com/file/9a55577d357922711ab0821bf5379289293c8517ae1d94d48c389f306af57a04/analysis/1479499742/"
},
{
"category": "Artifacts dropped",
"comment": "legitimate Microsoft Windows Address Book executable, used to load final payload - Xchecked via VT: 58105e9772f6befbc319c147a97faded4fbacf839947b34fe3695ae72771da5d",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479720266",
"to_ids": false,
"type": "sha1",
"uuid": "5832bd4a-dd54-4a76-bf57-4b9c02de0b81",
"value": "280dd67bbdfadaac0a4eb7a1c770387c216f3b8b"
},
{
"category": "External analysis",
"comment": "legitimate Microsoft Windows Address Book executable, used to load final payload - Xchecked via VT: 58105e9772f6befbc319c147a97faded4fbacf839947b34fe3695ae72771da5d",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479720267",
"to_ids": false,
"type": "link",
"uuid": "5832bd4b-25c4-4edb-8ab9-436502de0b81",
"value": "https://www.virustotal.com/file/58105e9772f6befbc319c147a97faded4fbacf839947b34fe3695ae72771da5d/analysis/1478876071/"
},
{
"category": "Payload delivery",
"comment": "Doc exploiting CVE-2012-0158 - Xchecked via VT: 8846d109b457a2ee44ddbf54d1cf7944",
"deleted": false,
"disable_correlation": false,
"timestamp": "1588068702",
"to_ids": true,
"type": "sha256",
"uuid": "5832bd4c-0190-4a6f-9c4f-472202de0b81",
"value": "ba442907f3218c8664bbecb47f915c4469340219e0f05af8f2d108d72659ff0f"
},
{
"category": "Payload delivery",
"comment": "Doc exploiting CVE-2012-0158 - Xchecked via VT: 8846d109b457a2ee44ddbf54d1cf7944",
"deleted": false,
"disable_correlation": false,
"timestamp": "1588068701",
"to_ids": true,
"type": "sha1",
"uuid": "5832bd4c-d698-4f11-b5c9-476202de0b81",
"value": "ba57bc840bc8fa5b7a235b2d2cff47af610aa14a"
},
{
"category": "External analysis",
"comment": "Doc exploiting CVE-2012-0158 - Xchecked via VT: 8846d109b457a2ee44ddbf54d1cf7944",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479720269",
"to_ids": false,
"type": "link",
"uuid": "5832bd4d-e058-48a1-9e0a-483f02de0b81",
"value": "https://www.virustotal.com/file/ba442907f3218c8664bbecb47f915c4469340219e0f05af8f2d108d72659ff0f/analysis/1479483627/"
},
{
"category": "Payload delivery",
"comment": "Malicious doc with CVE-2014-4114 vulnerability - Xchecked via VT: 05b5cf94f07fee666eb086c91182ad25",
"deleted": false,
"disable_correlation": false,
"timestamp": "1588068699",
"to_ids": true,
"type": "sha256",
"uuid": "5832bd4d-c198-40bf-83ca-4c7002de0b81",
"value": "442e5d3d46330e814b4fdc5640b06732de69a08a574d92cd9a0df5eea62d88ed"
},
{
"category": "Payload delivery",
"comment": "Malicious doc with CVE-2014-4114 vulnerability - Xchecked via VT: 05b5cf94f07fee666eb086c91182ad25",
"deleted": false,
"disable_correlation": false,
"timestamp": "1588068697",
"to_ids": true,
"type": "sha1",
"uuid": "5832bd4e-dab8-4936-ac41-489e02de0b81",
"value": "7631a0682a1a6423c95fd1b80263b8470717f0f8"
},
{
"category": "External analysis",
"comment": "Malicious doc with CVE-2014-4114 vulnerability - Xchecked via VT: 05b5cf94f07fee666eb086c91182ad25",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479720270",
"to_ids": false,
"type": "link",
"uuid": "5832bd4e-88e0-452b-9d0b-47f602de0b81",
"value": "https://www.virustotal.com/file/442e5d3d46330e814b4fdc5640b06732de69a08a574d92cd9a0df5eea62d88ed/analysis/1479484054/"
},
{
"category": "Payload delivery",
"comment": "Other similar doc - Xchecked via VT: beadf21b923600554b0ce54df42e78f5",
"deleted": false,
"disable_correlation": false,
"timestamp": "1588068704",
"to_ids": true,
"type": "sha256",
"uuid": "5832bd4f-f9d0-48f9-a3dc-4f2902de0b81",
"value": "b1d1b8fa9c104309fe27b3405d3572ac44d8401efba4868f743d45ed797d444b"
},
{
"category": "Payload delivery",
"comment": "Other similar doc - Xchecked via VT: beadf21b923600554b0ce54df42e78f5",
"deleted": false,
"disable_correlation": false,
"timestamp": "1588068705",
"to_ids": true,
"type": "sha1",
"uuid": "5832bd4f-48d0-4d0b-9719-439d02de0b81",
"value": "d2bf4b04d05f398b4101e91873e71d5b0e121aeb"
},
{
"category": "External analysis",
"comment": "Other similar doc - Xchecked via VT: beadf21b923600554b0ce54df42e78f5",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479720272",
"to_ids": false,
"type": "link",
"uuid": "5832bd50-1ff0-44dd-b44d-401d02de0b81",
"value": "https://www.virustotal.com/file/b1d1b8fa9c104309fe27b3405d3572ac44d8401efba4868f743d45ed797d444b/analysis/1479485679/"
},
{
"category": "Artifacts dropped",
"comment": "64b KeyBoy payload 20151108 - Xchecked via VT: 371bc132499f455f06fa80696db0df27",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479720272",
"to_ids": true,
"type": "sha256",
"uuid": "5832bd50-8af8-4d7a-bf57-4c1702de0b81",
"value": "4c9bf4ffbd7047f46035f89e6f7f4c63b8597ac63097577d467c157e3aa7ab4d"
},
{
"category": "Artifacts dropped",
"comment": "64b KeyBoy payload 20151108 - Xchecked via VT: 371bc132499f455f06fa80696db0df27",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479720273",
"to_ids": true,
"type": "sha1",
"uuid": "5832bd51-76b0-4f37-860b-4b3802de0b81",
"value": "aec5001d91673d052e9a0793aea0ebaea1a96e3d"
},
{
"category": "External analysis",
"comment": "64b KeyBoy payload 20151108 - Xchecked via VT: 371bc132499f455f06fa80696db0df27",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479720273",
"to_ids": false,
"type": "link",
"uuid": "5832bd51-1400-4733-9436-4f7902de0b81",
"value": "https://www.virustotal.com/file/4c9bf4ffbd7047f46035f89e6f7f4c63b8597ac63097577d467c157e3aa7ab4d/analysis/1479643752/"
},
{
"category": "Artifacts dropped",
"comment": "Payload KeyBoy 20151108 - Xchecked via VT: c5b5f01ba24d6c02636388809f44472e",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479720274",
"to_ids": true,
"type": "sha256",
"uuid": "5832bd52-5310-486b-876f-4b0e02de0b81",
"value": "e6fdcf64d7e7d59366ba23c68332167dfc569b6acc71a03498d4a925ce9c1e0a"
},
{
"category": "Artifacts dropped",
"comment": "Payload KeyBoy 20151108 - Xchecked via VT: c5b5f01ba24d6c02636388809f44472e",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479720274",
"to_ids": true,
"type": "sha1",
"uuid": "5832bd52-2228-4453-b38e-41b102de0b81",
"value": "bbeacc746b6ddb61a3be7613bb155aa2b1ac422a"
},
{
"category": "External analysis",
"comment": "Payload KeyBoy 20151108 - Xchecked via VT: c5b5f01ba24d6c02636388809f44472e",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479720275",
"to_ids": false,
"type": "link",
"uuid": "5832bd53-a558-4ea4-957d-4e7202de0b81",
"value": "https://www.virustotal.com/file/e6fdcf64d7e7d59366ba23c68332167dfc569b6acc71a03498d4a925ce9c1e0a/analysis/1479481835/"
},
{
"category": "Artifacts dropped",
"comment": "Payload KeyBoy 20151108 - Xchecked via VT: 98977426d544bd145979f65f0322ae30",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479720275",
"to_ids": true,
"type": "sha256",
"uuid": "5832bd53-d3f0-4c64-80cf-469402de0b81",
"value": "082da7874d6c0bfbe8f2d954c8a47f25a90ef83bda89c8495101dc95986d7977"
},
{
"category": "Artifacts dropped",
"comment": "Payload KeyBoy 20151108 - Xchecked via VT: 98977426d544bd145979f65f0322ae30",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479720276",
"to_ids": true,
"type": "sha1",
"uuid": "5832bd54-87e0-49a7-8971-480e02de0b81",
"value": "edad39839bd60bcc1426df9c68df7de169cd062f"
},
{
"category": "External analysis",
"comment": "Payload KeyBoy 20151108 - Xchecked via VT: 98977426d544bd145979f65f0322ae30",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479720276",
"to_ids": false,
"type": "link",
"uuid": "5832bd54-0efc-4f4a-b342-4a8e02de0b81",
"value": "https://www.virustotal.com/file/082da7874d6c0bfbe8f2d954c8a47f25a90ef83bda89c8495101dc95986d7977/analysis/1479643737/"
},
{
"category": "Artifacts dropped",
"comment": "Payload KeyBoy P_20150313 - Xchecked via VT: 0c7e55509e0b6d4277b3facf864af018",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479720277",
"to_ids": true,
"type": "sha256",
"uuid": "5832bd55-6890-47d5-b97c-4a6402de0b81",
"value": "5395f709ef1ca64c57be367f9795b66b5775b6e73f57089386a85925cc0ec596"
},
{
"category": "Artifacts dropped",
"comment": "Payload KeyBoy P_20150313 - Xchecked via VT: 0c7e55509e0b6d4277b3facf864af018",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479720277",
"to_ids": true,
"type": "sha1",
"uuid": "5832bd55-f334-44ed-81f9-401602de0b81",
"value": "a3655df2811069ea7a818517c9e9f11561fce3e8"
},
{
"category": "External analysis",
"comment": "Payload KeyBoy P_20150313 - Xchecked via VT: 0c7e55509e0b6d4277b3facf864af018",
"deleted": false,
"disable_correlation": false,
"timestamp": "1479720277",
"to_ids": false,
"type": "link",
"uuid": "5832bd55-7e88-4e84-98fa-44ea02de0b81",
"value": "https://www.virustotal.com/file/5395f709ef1ca64c57be367f9795b66b5775b6e73f57089386a85925cc0ec596/analysis/1431473021/"
}
]
}
}
Reference in a new issue Copy permalink