misp-circl-feed/feeds/circl/misp/57dfe878-f93c-4eaa-baa9-085f0a950b0c.json

{
  "Event": {
    "analysis": "1",
    "date": "2016-09-19",
    "extends_uuid": "",
    "info": "Dridex IoC's",
    "publish_timestamp": "1476171097",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1607523239",
    "uuid": "57dfe878-f93c-4eaa-baa9-085f0a950b0c",
    "Orgc": {
      "name": "NCSC-NL",
      "uuid": "5697b0c4-9474-4336-b675-28140a950b0b"
    },
    "Tag": [
      {
        "colour": "#ab022a",
        "local": false,
        "name": "Dridex",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      },
      {
        "colour": "#3a7300",
        "local": false,
        "name": "circl:incident-classification=\"malware\"",
        "relationship_type": ""
      },
      {
        "colour": "#770095",
        "local": false,
        "name": "ms-caro-malware:malware-platform=\"Win32\"",
        "relationship_type": ""
      },
      {
        "colour": "#76d2b6",
        "local": false,
        "name": "ncsc-nl-ndn:feed=\"selected\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1474292124",
        "to_ids": false,
        "type": "link",
        "uuid": "57dfe8df-ff08-4dee-9b60-08610a950b0c",
        "value": "https://securityintelligence.com/hey-dridex-tu-runa-latviski/"
      },
      {
        "category": "Other",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1474292449",
        "to_ids": false,
        "type": "comment",
        "uuid": "57dfeae1-fee4-4995-aec4-085d0a950b0c",
        "value": "According to IBM X-Force Research, Dridex configurations from the past two months are replete with a hefty count of targets in some more common countries, such as the U.S., U.K., Canada and Australia. However, the Trojan is targeting some less charted territories as well, such as Lithuania, Latvia, Estonia, Lebanon and Ukraine, to name a few. This is quite uncommon for any banking Trojan.\r\n\r\nPer its configuration files, Dridex currently targets over 20 Latvian banks, three banks in Estonia, three in Lithuania and one in Ukraine, among its other uncommon choices of late."
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the Freetext Import Tool",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1474291864",
        "to_ids": true,
        "type": "md5",
        "uuid": "57dfe898-0424-402e-ad39-5a120a950b0c",
        "value": "fa6781ced155213d7a7535bbe109cf04"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the Freetext Import Tool",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1474291865",
        "to_ids": true,
        "type": "md5",
        "uuid": "57dfe899-0148-4aaa-b16d-5a120a950b0c",
        "value": "f5fe906f801d99fafa8a9e0584a37008"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the Freetext Import Tool",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1474291865",
        "to_ids": true,
        "type": "md5",
        "uuid": "57dfe899-aad4-43d7-aae6-5a120a950b0c",
        "value": "7752eaeac2c3a37bba3564fbab0233fc"
      },
      {
        "category": "Payload delivery",
        "comment": "Imported via the Freetext Import Tool",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1474291866",
        "to_ids": true,
        "type": "md5",
        "uuid": "57dfe89a-976c-4691-9742-5a120a950b0c",
        "value": "f8fd038db826a1e1c28d384cdc61a82d"
      },
      {
        "category": "Payload delivery",
        "comment": "Automatically added (via fa6781ced155213d7a7535bbe109cf04)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1474293376",
        "to_ids": true,
        "type": "sha1",
        "uuid": "57dfee80-ba88-42ec-9a44-4a53950d210f",
        "value": "33d75eb5f9cf1ec42a86a110ffa739fade550361"
      },
      {
        "category": "Payload delivery",
        "comment": "Automatically added (via fa6781ced155213d7a7535bbe109cf04)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1474293379",
        "to_ids": true,
        "type": "sha256",
        "uuid": "57dfee83-fc38-40b2-a013-4b74950d210f",
        "value": "ea00c9d89e42c3e5c87577dac8cc4c074523becce6bccf6cfe1fd18fa6db1083"
      },
      {
        "category": "Payload delivery",
        "comment": "Automatically added (via f5fe906f801d99fafa8a9e0584a37008)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1474293381",
        "to_ids": true,
        "type": "sha1",
        "uuid": "57dfee85-fe9c-4fe0-9c2d-449e950d210f",
        "value": "a80175b91e3f9606e63dd0d9a9271e23bbe10321"
      },
      {
        "category": "Payload delivery",
        "comment": "Automatically added (via f5fe906f801d99fafa8a9e0584a37008)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1474293382",
        "to_ids": true,
        "type": "sha256",
        "uuid": "57dfee86-6b0c-46ea-bc1e-415b950d210f",
        "value": "10b12825603dc3f1946bfd4e7cbebda5885fe4fccaeb0df8b6e862ad3dad720b"
      },
      {
        "category": "Payload delivery",
        "comment": "Automatically added (via 7752eaeac2c3a37bba3564fbab0233fc)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1474293384",
        "to_ids": true,
        "type": "sha1",
        "uuid": "57dfee88-4cf8-4a0d-9f8f-442b950d210f",
        "value": "c20c12991e8f1c7a520229fdd924fa0c6335302f"
      },
      {
        "category": "Payload delivery",
        "comment": "Automatically added (via 7752eaeac2c3a37bba3564fbab0233fc)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1474293385",
        "to_ids": true,
        "type": "sha256",
        "uuid": "57dfee89-31c4-4f4a-98c6-45eb950d210f",
        "value": "82b727ce67a96ec3f929a628e0533eaa377734579d02bc7cf76b874083bbc8ab"
      },
      {
        "category": "Payload delivery",
        "comment": "Automatically added (via f8fd038db826a1e1c28d384cdc61a82d)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1474293386",
        "to_ids": true,
        "type": "sha1",
        "uuid": "57dfee8a-69e0-4f72-982d-4b01950d210f",
        "value": "0ecbb4d0fe1ab0a716f80da855c6b75860ad7dd1"
      },
      {
        "category": "Payload delivery",
        "comment": "Automatically added (via f8fd038db826a1e1c28d384cdc61a82d)",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1474293387",
        "to_ids": true,
        "type": "sha256",
        "uuid": "57dfee8b-7278-4824-a5a5-4059950d210f",
        "value": "49a247166e5af64c9e593d75d751ba8366171c010cc3d57f17ab5657fb6d35a7"
      }
    ]
  }
}