252 lines
11 KiB
JSON
252 lines
11 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--57aaeefd-0bd4-4a41-87ad-4e17950d210f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-08-10T09:40:36.000Z",
|
||
|
|
"modified": "2016-08-10T09:40:36.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--57aaeefd-0bd4-4a41-87ad-4e17950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-08-10T09:40:36.000Z",
|
||
|
|
"modified": "2016-08-10T09:40:36.000Z",
|
||
|
|
"name": "OSINT - Cracking Orcus RAT",
|
||
|
|
"published": "2016-08-10T09:50:13Z",
|
||
|
|
"object_refs": [
|
||
|
|
"observed-data--57aaef08-62dc-4948-ac44-473b950d210f",
|
||
|
|
"url--57aaef08-62dc-4948-ac44-473b950d210f",
|
||
|
|
"x-misp-attribute--57aaef3b-655c-4274-a59d-4572950d210f",
|
||
|
|
"indicator--57aaef5f-1808-4585-a00b-497c950d210f",
|
||
|
|
"indicator--57aaf016-8cf0-439a-b2a6-441002de0b81",
|
||
|
|
"indicator--57aaf016-ac94-4574-ba76-4b6a02de0b81",
|
||
|
|
"observed-data--57aaf016-ade0-4582-afcc-4d4602de0b81",
|
||
|
|
"url--57aaf016-ade0-4582-afcc-4d4602de0b81",
|
||
|
|
"observed-data--57aaf05f-b420-419c-bcc6-477d950d210f",
|
||
|
|
"url--57aaf05f-b420-419c-bcc6-477d950d210f",
|
||
|
|
"indicator--57aaf0e6-c11c-4aa5-99a0-4293950d210f",
|
||
|
|
"indicator--57aaf0e7-6fec-409e-9459-46ee950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"type:OSINT",
|
||
|
|
"ms-caro-malware:malware-type=\"RemoteAccess\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--57aaef08-62dc-4948-ac44-473b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-08-10T09:08:23.000Z",
|
||
|
|
"modified": "2016-08-10T09:08:23.000Z",
|
||
|
|
"first_observed": "2016-08-10T09:08:23Z",
|
||
|
|
"last_observed": "2016-08-10T09:08:23Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--57aaef08-62dc-4948-ac44-473b950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--57aaef08-62dc-4948-ac44-473b950d210f",
|
||
|
|
"value": "http://blog.deniable.org/blog/2016/08/09/cracking-orcus-rat/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--57aaef3b-655c-4274-a59d-4572950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-08-10T09:09:15.000Z",
|
||
|
|
"modified": "2016-08-10T09:09:15.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"comment\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "External analysis",
|
||
|
|
"x_misp_type": "comment",
|
||
|
|
"x_misp_value": "At first I thought I could be dealing with someone trying to \u00e2\u20ac\u02dcphish\u00e2\u20ac\u2122 me, but the offer was legit. Challenge accepted. The zip file I got is for version 1.4.2 (which is the latest version available at the \u00e2\u20ac\u02dcOrcus RAT\u00e2\u20ac\u2122 website, at the time of this writing). The zip file is massive. Here\u00e2\u20ac\u2122s the whole contents of the zip file."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57aaef5f-1808-4585-a00b-497c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-08-10T09:09:51.000Z",
|
||
|
|
"modified": "2016-08-10T09:09:51.000Z",
|
||
|
|
"description": "Orcus.Administration.exe",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4056ee5b23e47d172b48c84ceb5b6eca5ee68cf839dc7e5f28e984005ed7dcea']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-10T09:09:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57aaf016-8cf0-439a-b2a6-441002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-08-10T09:12:54.000Z",
|
||
|
|
"modified": "2016-08-10T09:12:54.000Z",
|
||
|
|
"description": "Orcus.Administration.exe - Xchecked via VT: 4056ee5b23e47d172b48c84ceb5b6eca5ee68cf839dc7e5f28e984005ed7dcea",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'ea6d05abfce77d01a1a039c8bc97f973b6780f07']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-10T09:12:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57aaf016-ac94-4574-ba76-4b6a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-08-10T09:12:54.000Z",
|
||
|
|
"modified": "2016-08-10T09:12:54.000Z",
|
||
|
|
"description": "Orcus.Administration.exe - Xchecked via VT: 4056ee5b23e47d172b48c84ceb5b6eca5ee68cf839dc7e5f28e984005ed7dcea",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd2140d8c9eb3889dee164f09014380d7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-10T09:12:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--57aaf016-ade0-4582-afcc-4d4602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-08-10T09:12:54.000Z",
|
||
|
|
"modified": "2016-08-10T09:12:54.000Z",
|
||
|
|
"first_observed": "2016-08-10T09:12:54Z",
|
||
|
|
"last_observed": "2016-08-10T09:12:54Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--57aaf016-ade0-4582-afcc-4d4602de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--57aaf016-ade0-4582-afcc-4d4602de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/4056ee5b23e47d172b48c84ceb5b6eca5ee68cf839dc7e5f28e984005ed7dcea/analysis/1467970246/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--57aaf05f-b420-419c-bcc6-477d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-08-10T09:14:07.000Z",
|
||
|
|
"modified": "2016-08-10T09:14:07.000Z",
|
||
|
|
"first_observed": "2016-08-10T09:14:07Z",
|
||
|
|
"last_observed": "2016-08-10T09:14:07Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--57aaf05f-b420-419c-bcc6-477d950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--57aaf05f-b420-419c-bcc6-477d950d210f",
|
||
|
|
"value": "http://researchcenter.paloaltonetworks.com/2016/08/unit42-orcus-birth-of-an-unusual-plugin-builder-rat/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57aaf0e6-c11c-4aa5-99a0-4293950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-08-10T09:16:22.000Z",
|
||
|
|
"modified": "2016-08-10T09:16:22.000Z",
|
||
|
|
"description": "Sample",
|
||
|
|
"pattern": "[file:name = '4056ee5b23e47d172b48c84ceb5b6eca5ee68cf839dc7e5f28e984005ed7dcea' AND file:hashes.SHA1 = 'ea6d05abfce77d01a1a039c8bc97f973b6780f07']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-10T09:16:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha1\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57aaf0e7-6fec-409e-9459-46ee950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-08-10T09:16:23.000Z",
|
||
|
|
"modified": "2016-08-10T09:16:23.000Z",
|
||
|
|
"description": "Sample",
|
||
|
|
"pattern": "[file:name = '4056ee5b23e47d172b48c84ceb5b6eca5ee68cf839dc7e5f28e984005ed7dcea' AND file:hashes.SHA256 = '4056ee5b23e47d172b48c84ceb5b6eca5ee68cf839dc7e5f28e984005ed7dcea']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-10T09:16:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|