772 lines
34 KiB
JSON
772 lines
34 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--5cc023e7-9c7c-418e-b908-4d46950d210f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-04-24T11:21:10.000Z",
|
||
|
|
"modified": "2019-04-24T11:21:10.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--5cc023e7-9c7c-418e-b908-4d46950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-04-24T11:21:10.000Z",
|
||
|
|
"modified": "2019-04-24T11:21:10.000Z",
|
||
|
|
"name": "OSINT - DNSpionage brings out the Karkoff",
|
||
|
|
"published": "2019-04-24T11:21:35Z",
|
||
|
|
"object_refs": [
|
||
|
|
"observed-data--5cc023f7-8650-4b3b-b631-4d52950d210f",
|
||
|
|
"url--5cc023f7-8650-4b3b-b631-4d52950d210f",
|
||
|
|
"x-misp-attribute--5cc0240c-fb80-4eb2-99bb-4040950d210f",
|
||
|
|
"indicator--5cc0242b-2ba8-419f-8d14-42e7950d210f",
|
||
|
|
"indicator--5cc0242b-e1cc-4aec-a163-471f950d210f",
|
||
|
|
"indicator--5cc0242b-1ac0-448a-a3c9-45ff950d210f",
|
||
|
|
"indicator--5cc0242b-d758-44d4-9614-4759950d210f",
|
||
|
|
"indicator--5cc02456-7350-4263-bbc9-4205950d210f",
|
||
|
|
"indicator--5cc02456-7a84-49a2-b073-4ea8950d210f",
|
||
|
|
"indicator--5cc02456-b618-4f07-9281-4404950d210f",
|
||
|
|
"observed-data--5cc024aa-ff04-4ef8-8acd-1bc4e387cbd9",
|
||
|
|
"network-traffic--5cc024aa-ff04-4ef8-8acd-1bc4e387cbd9",
|
||
|
|
"ipv4-addr--5cc024aa-ff04-4ef8-8acd-1bc4e387cbd9",
|
||
|
|
"observed-data--5cc024b9-0c94-42a4-820b-1bc4e387cbd9",
|
||
|
|
"network-traffic--5cc024b9-0c94-42a4-820b-1bc4e387cbd9",
|
||
|
|
"ipv4-addr--5cc024b9-0c94-42a4-820b-1bc4e387cbd9",
|
||
|
|
"indicator--5cc02a7b-08f8-493b-b253-247f950d210f",
|
||
|
|
"indicator--5cc02ab1-70b0-446f-8b28-2497950d210f",
|
||
|
|
"indicator--3148bbb8-f76e-4556-b973-3dea9cf89820",
|
||
|
|
"x-misp-object--5f8b1fcb-d5e4-4e95-adc0-253f765c8f61",
|
||
|
|
"indicator--6393b267-5ff7-4204-85cf-709530bc110d",
|
||
|
|
"x-misp-object--5baaf36e-74f0-4e6b-b18a-377bc301867e",
|
||
|
|
"indicator--52ca9602-5ef6-4de3-b528-058d33844ea3",
|
||
|
|
"x-misp-object--993871f0-b786-4813-9811-7f60eb385014",
|
||
|
|
"indicator--9daaf5c9-c7e0-444d-b551-ff231e16521a",
|
||
|
|
"x-misp-object--fd6fe17b-18a9-4729-9276-796667da59b6",
|
||
|
|
"indicator--1fc50c0d-6a22-4c8f-9823-229fb2334f2e",
|
||
|
|
"x-misp-object--71ee7c63-f4fa-463e-8a7d-054b9920e0a3",
|
||
|
|
"relationship--32150263-0a25-4053-a03c-7237072e629a",
|
||
|
|
"relationship--6a4824dd-74ff-4f66-b923-42037d5dd2d0",
|
||
|
|
"relationship--8862bb8d-7bbc-4c4c-b897-8f4b7124d350",
|
||
|
|
"relationship--90c7c2d8-d7d1-4757-b9fd-ab4ed5c8e1f0",
|
||
|
|
"relationship--3e199573-1c43-4dc1-9259-b6b8009f15cc"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"misp-galaxy:malpedia=\"DNSpionage\"",
|
||
|
|
"misp-galaxy:threat-actor=\"DNSpionage\"",
|
||
|
|
"type:OSINT",
|
||
|
|
"osint:lifetime=\"perpetual\"",
|
||
|
|
"osint:certainty=\"50\"",
|
||
|
|
"misp-galaxy:tool=\"Karkoff\""
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5cc023f7-8650-4b3b-b631-4d52950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-04-24T08:53:11.000Z",
|
||
|
|
"modified": "2019-04-24T08:53:11.000Z",
|
||
|
|
"first_observed": "2019-04-24T08:53:11Z",
|
||
|
|
"last_observed": "2019-04-24T08:53:11Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5cc023f7-8650-4b3b-b631-4d52950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5cc023f7-8650-4b3b-b631-4d52950d210f",
|
||
|
|
"value": "https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--5cc0240c-fb80-4eb2-99bb-4040950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-04-24T08:53:32.000Z",
|
||
|
|
"modified": "2019-04-24T08:53:32.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "External analysis",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "In November 2018, Cisco Talos discovered an attack campaign, called DNSpionage, in which threat actors created a new remote administrative tool that supports HTTP and DNS communication with the attackers' command and control(C2). Since then, there have been several other public reports of additional DNSpionage attacks, and in January, the U.S. Department of Homeland Security issued an alert warning users about this threat activity.\r\n\r\nIn addition to increased reports of threat activity, we have also discovered new evidence that the threat actors behind the DNSpionage campaign continue to change their tactics, likely in an attempt to improve the efficacy of their operations. In February, we discovered some changes to the actors' tactics, techniques and procedures (TTPs), including the use of a new reconnaissance phase that selectively chooses which targets to infect with malware. In April 2019, we also discovered the actors using a new malware, which we are calling \"Karkoff.\"\r\n\r\nThis post will cover the aforementioned DNSpionage updates, the discovery of the Karkoff malware and an analysis of the recent Oilrig malware toolset leak \u00e2\u20ac\u201d and how it could be connected to these two attacks."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cc0242b-2ba8-419f-8d14-42e7950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-04-24T08:54:03.000Z",
|
||
|
|
"modified": "2019-04-24T08:54:03.000Z",
|
||
|
|
"description": "Karkoff sample",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-04-24T08:54:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cc0242b-e1cc-4aec-a163-471f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-04-24T08:54:03.000Z",
|
||
|
|
"modified": "2019-04-24T08:54:03.000Z",
|
||
|
|
"description": "Karkoff sample",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-04-24T08:54:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cc0242b-1ac0-448a-a3c9-45ff950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-04-24T08:54:03.000Z",
|
||
|
|
"modified": "2019-04-24T08:54:03.000Z",
|
||
|
|
"description": "Karkoff sample",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-04-24T08:54:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cc0242b-d758-44d4-9614-4759950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-04-24T08:54:03.000Z",
|
||
|
|
"modified": "2019-04-24T08:54:03.000Z",
|
||
|
|
"description": "Karkoff sample",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-04-24T08:54:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cc02456-7350-4263-bbc9-4205950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-04-24T08:54:46.000Z",
|
||
|
|
"modified": "2019-04-24T08:54:46.000Z",
|
||
|
|
"description": "C2 server",
|
||
|
|
"pattern": "[domain-name:value = 'coldfart.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-04-24T08:54:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cc02456-7a84-49a2-b073-4ea8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-04-24T08:54:46.000Z",
|
||
|
|
"modified": "2019-04-24T08:54:46.000Z",
|
||
|
|
"description": "C2 server",
|
||
|
|
"pattern": "[domain-name:value = 'rimrun.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-04-24T08:54:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cc02456-b618-4f07-9281-4404950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-04-24T08:54:46.000Z",
|
||
|
|
"modified": "2019-04-24T08:54:46.000Z",
|
||
|
|
"description": "C2 server",
|
||
|
|
"pattern": "[domain-name:value = 'kuternull.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-04-24T08:54:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5cc024aa-ff04-4ef8-8acd-1bc4e387cbd9",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-04-24T08:56:10.000Z",
|
||
|
|
"modified": "2019-04-24T08:56:10.000Z",
|
||
|
|
"first_observed": "2019-04-24T08:56:10Z",
|
||
|
|
"last_observed": "2019-04-24T08:56:10Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--5cc024aa-ff04-4ef8-8acd-1bc4e387cbd9",
|
||
|
|
"ipv4-addr--5cc024aa-ff04-4ef8-8acd-1bc4e387cbd9"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--5cc024aa-ff04-4ef8-8acd-1bc4e387cbd9",
|
||
|
|
"src_ref": "ipv4-addr--5cc024aa-ff04-4ef8-8acd-1bc4e387cbd9",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--5cc024aa-ff04-4ef8-8acd-1bc4e387cbd9",
|
||
|
|
"value": "108.62.141.247"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5cc024b9-0c94-42a4-820b-1bc4e387cbd9",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-04-24T08:56:25.000Z",
|
||
|
|
"modified": "2019-04-24T08:56:25.000Z",
|
||
|
|
"first_observed": "2019-04-24T08:56:25Z",
|
||
|
|
"last_observed": "2019-04-24T08:56:25Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--5cc024b9-0c94-42a4-820b-1bc4e387cbd9",
|
||
|
|
"ipv4-addr--5cc024b9-0c94-42a4-820b-1bc4e387cbd9"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--5cc024b9-0c94-42a4-820b-1bc4e387cbd9",
|
||
|
|
"src_ref": "ipv4-addr--5cc024b9-0c94-42a4-820b-1bc4e387cbd9",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--5cc024b9-0c94-42a4-820b-1bc4e387cbd9",
|
||
|
|
"value": "74.118.138.192"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cc02a7b-08f8-493b-b253-247f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-04-24T09:20:59.000Z",
|
||
|
|
"modified": "2019-04-24T09:20:59.000Z",
|
||
|
|
"description": "DNSpionage XLS document",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2fa19292f353b4078a9bf398f8837d991e383c99e147727eaa6a03ce0259b3c5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-04-24T09:20:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5cc02ab1-70b0-446f-8b28-2497950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-04-24T09:21:53.000Z",
|
||
|
|
"modified": "2019-04-24T09:21:53.000Z",
|
||
|
|
"description": "DNSpionage",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e398dac59f604d42362ffe8a2947d4351a652516ebfb25ddf0838dd2c8523be8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-04-24T09:21:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--3148bbb8-f76e-4556-b973-3dea9cf89820",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-04-24T09:22:50.000Z",
|
||
|
|
"modified": "2019-04-24T09:22:50.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'a583430c9c504fb216c9f976401ecd13' AND file:hashes.SHA1 = 'cd3b6c517227ad356264ff076cf0ea106b67fc13' AND file:hashes.SHA256 = 'cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-04-24T09:22:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--5f8b1fcb-d5e4-4e95-adc0-253f765c8f61",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-04-24T09:22:51.000Z",
|
||
|
|
"modified": "2019-04-24T09:22:51.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2019-04-24T08:58:49",
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "Karkoff sample",
|
||
|
|
"uuid": "cb98656d-453e-40aa-b337-e83a5c473a20"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5/analysis/1556096329/",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Karkoff sample",
|
||
|
|
"uuid": "28a8b196-6a06-44d6-962b-6efc4d4f3945"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "38/71",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Karkoff sample",
|
||
|
|
"uuid": "b29d31d3-c624-4c4c-99cd-626101e0d47b"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--6393b267-5ff7-4204-85cf-709530bc110d",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-04-24T09:22:51.000Z",
|
||
|
|
"modified": "2019-04-24T09:22:51.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '530606b66bcd5a776f2cdecb34ee0fd1' AND file:hashes.SHA1 = '72ada4db1c70214e19eece2021669d95b94c0d4f' AND file:hashes.SHA256 = 'e398dac59f604d42362ffe8a2947d4351a652516ebfb25ddf0838dd2c8523be8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-04-24T09:22:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--5baaf36e-74f0-4e6b-b18a-377bc301867e",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-04-24T09:22:51.000Z",
|
||
|
|
"modified": "2019-04-24T09:22:51.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2019-04-24T09:05:37",
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "DNSpionage",
|
||
|
|
"uuid": "6e2a7b92-867b-4c11-8b30-b925221ce51a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/e398dac59f604d42362ffe8a2947d4351a652516ebfb25ddf0838dd2c8523be8/analysis/1556096737/",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "DNSpionage",
|
||
|
|
"uuid": "9eda0fba-ebc8-494e-81a2-3c45135c591e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "48/69",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "DNSpionage",
|
||
|
|
"uuid": "ee3f4732-30c5-49fc-9b1d-a6a732cb4f42"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--52ca9602-5ef6-4de3-b528-058d33844ea3",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-04-24T09:22:51.000Z",
|
||
|
|
"modified": "2019-04-24T09:22:51.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'a37703a0d08996a5fc04db52b71b9bcd' AND file:hashes.SHA1 = '7c7e1179eb3cd9effa92f303dd5e45ba881db15d' AND file:hashes.SHA256 = '6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-04-24T09:22:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--993871f0-b786-4813-9811-7f60eb385014",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-04-24T09:22:51.000Z",
|
||
|
|
"modified": "2019-04-24T09:22:51.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2019-04-24T07:39:13",
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "Karkoff sample",
|
||
|
|
"uuid": "a0e51f81-2cc5-438d-96d0-de19d5e93442"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11/analysis/1556091553/",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Karkoff sample",
|
||
|
|
"uuid": "ccb7b733-4e20-4840-9ee4-be4b8451f1e1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "39/66",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Karkoff sample",
|
||
|
|
"uuid": "c6600e9e-5bf0-402c-8666-df0823154fe9"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--9daaf5c9-c7e0-444d-b551-ff231e16521a",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-04-24T09:22:51.000Z",
|
||
|
|
"modified": "2019-04-24T09:22:51.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '5733afe71bd0a32328d6ed9978260fa4' AND file:hashes.SHA1 = '5dbaaf4b338471ad58065fcdf335673977b2b261' AND file:hashes.SHA256 = '5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-04-24T09:22:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--fd6fe17b-18a9-4729-9276-796667da59b6",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-04-24T09:22:51.000Z",
|
||
|
|
"modified": "2019-04-24T09:22:51.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2019-04-24T07:39:16",
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "Karkoff sample",
|
||
|
|
"uuid": "287255d9-5d0f-49f7-afd9-256da7290db1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c/analysis/1556091556/",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Karkoff sample",
|
||
|
|
"uuid": "d2ae94de-8869-48a0-bff0-acf3465c6a74"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "42/71",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Karkoff sample",
|
||
|
|
"uuid": "7c4854e3-0c44-4143-b133-8273c30bf122"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--1fc50c0d-6a22-4c8f-9823-229fb2334f2e",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-04-24T09:22:51.000Z",
|
||
|
|
"modified": "2019-04-24T09:22:51.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '85a3a5f55fcbe63d2181cfa753f35fe1' AND file:hashes.SHA1 = 'd9844a1845446367822944464ba65965b1b70c4f' AND file:hashes.SHA256 = 'b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-04-24T09:22:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--71ee7c63-f4fa-463e-8a7d-054b9920e0a3",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-04-24T09:22:51.000Z",
|
||
|
|
"modified": "2019-04-24T09:22:51.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2019-04-24T07:39:18",
|
||
|
|
"category": "Other",
|
||
|
|
"comment": "Karkoff sample",
|
||
|
|
"uuid": "4ab8fa22-de5b-4d45-b328-a28f6ca4bc4f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04/analysis/1556091558/",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Karkoff sample",
|
||
|
|
"uuid": "2490a445-4913-49ad-9366-9cecf26b7505"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "41/65",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"comment": "Karkoff sample",
|
||
|
|
"uuid": "3d31e031-8726-4941-a004-143375bd7aa0"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--32150263-0a25-4053-a03c-7237072e629a",
|
||
|
|
"created": "2019-04-24T09:22:51.000Z",
|
||
|
|
"modified": "2019-04-24T09:22:51.000Z",
|
||
|
|
"relationship_type": "analysed-with",
|
||
|
|
"source_ref": "indicator--3148bbb8-f76e-4556-b973-3dea9cf89820",
|
||
|
|
"target_ref": "x-misp-object--5f8b1fcb-d5e4-4e95-adc0-253f765c8f61"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--6a4824dd-74ff-4f66-b923-42037d5dd2d0",
|
||
|
|
"created": "2019-04-24T09:22:52.000Z",
|
||
|
|
"modified": "2019-04-24T09:22:52.000Z",
|
||
|
|
"relationship_type": "analysed-with",
|
||
|
|
"source_ref": "indicator--6393b267-5ff7-4204-85cf-709530bc110d",
|
||
|
|
"target_ref": "x-misp-object--5baaf36e-74f0-4e6b-b18a-377bc301867e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--8862bb8d-7bbc-4c4c-b897-8f4b7124d350",
|
||
|
|
"created": "2019-04-24T09:22:52.000Z",
|
||
|
|
"modified": "2019-04-24T09:22:52.000Z",
|
||
|
|
"relationship_type": "analysed-with",
|
||
|
|
"source_ref": "indicator--52ca9602-5ef6-4de3-b528-058d33844ea3",
|
||
|
|
"target_ref": "x-misp-object--993871f0-b786-4813-9811-7f60eb385014"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--90c7c2d8-d7d1-4757-b9fd-ab4ed5c8e1f0",
|
||
|
|
"created": "2019-04-24T09:22:52.000Z",
|
||
|
|
"modified": "2019-04-24T09:22:52.000Z",
|
||
|
|
"relationship_type": "analysed-with",
|
||
|
|
"source_ref": "indicator--9daaf5c9-c7e0-444d-b551-ff231e16521a",
|
||
|
|
"target_ref": "x-misp-object--fd6fe17b-18a9-4729-9276-796667da59b6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--3e199573-1c43-4dc1-9259-b6b8009f15cc",
|
||
|
|
"created": "2019-04-24T09:22:52.000Z",
|
||
|
|
"modified": "2019-04-24T09:22:52.000Z",
|
||
|
|
"relationship_type": "analysed-with",
|
||
|
|
"source_ref": "indicator--1fc50c0d-6a22-4c8f-9823-229fb2334f2e",
|
||
|
|
"target_ref": "x-misp-object--71ee7c63-f4fa-463e-8a7d-054b9920e0a3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|