807 lines
33 KiB
JSON
807 lines
33 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--b7a486af-8b67-4f58-873b-0ae25fea43e9",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-10-24T08:56:38.000Z",
|
||
|
|
"modified": "2022-10-24T08:56:38.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--b7a486af-8b67-4f58-873b-0ae25fea43e9",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-10-24T08:56:38.000Z",
|
||
|
|
"modified": "2022-10-24T08:56:38.000Z",
|
||
|
|
"name": "[OSINT] No Honor Among Thieves - Prynt Stealer\u2019s Backdoor Exposed",
|
||
|
|
"published": "2022-10-24T08:56:47Z",
|
||
|
|
"object_refs": [
|
||
|
|
"indicator--9888e096-1341-4655-9a0c-1e53df9a6096",
|
||
|
|
"indicator--6de8e173-c0fd-4be3-b4b1-42fc8c76c8e7",
|
||
|
|
"indicator--d1d5db20-15d9-4e1f-a4e6-cab7a0bdf0b5",
|
||
|
|
"indicator--d451551e-c177-4ed9-a989-af74bb028188",
|
||
|
|
"indicator--a9b86903-b79c-455c-bbf0-7b488d90a3dc",
|
||
|
|
"indicator--ae705dbd-6b31-41b9-9cfb-eb8ac1121210",
|
||
|
|
"indicator--f54aa09c-1841-4826-9b28-22ef426079b6",
|
||
|
|
"indicator--74ed1b4c-6d5b-4d42-91fb-b642d4079067",
|
||
|
|
"indicator--ce2ad6bb-1747-4b74-bfce-8fb70c2051a0",
|
||
|
|
"indicator--5ed227fe-15f1-44e9-bd7f-7fc04710ec7c",
|
||
|
|
"indicator--b2cce1cd-8669-4f40-8215-2f4f141c8b1d",
|
||
|
|
"indicator--4ec5a062-377a-4d46-954f-c0e9a5c9d798",
|
||
|
|
"indicator--ff207b26-10e9-41d8-a901-208460f5f1f8",
|
||
|
|
"indicator--3f959b7e-8c08-4fe2-b769-7ace9f1d3b20",
|
||
|
|
"indicator--967a4473-5c38-421a-b44c-68d71767fec5",
|
||
|
|
"indicator--b25ef0d4-7c29-4dbc-8cd5-b9619400bf65",
|
||
|
|
"indicator--b176d8c2-0949-4e79-b7e7-4891a729c352",
|
||
|
|
"indicator--59827e8b-9dab-44b4-aab4-4ed13b02b39b",
|
||
|
|
"x-misp-object--39c86d1d-05bd-4dae-a488-360079914b64",
|
||
|
|
"x-misp-object--32c7146e-8ac3-4543-889b-1c39754b6303",
|
||
|
|
"x-misp-object--535b633e-9e74-4f90-8e28-bfbbc342fb33",
|
||
|
|
"x-misp-object--921b1fa9-a804-47ec-99fc-2b0c63517d7a",
|
||
|
|
"x-misp-object--09b2266a-460d-45cd-968a-f903dcb8e938",
|
||
|
|
"x-misp-object--89ca0c35-28ce-4896-97ef-96a1277a042b",
|
||
|
|
"indicator--ae21fd17-1261-4d84-a0ac-44d65e3a9c31",
|
||
|
|
"indicator--df65f997-8718-4042-9aee-c63b8065db3d",
|
||
|
|
"indicator--fb51780b-d597-4c98-9c55-e84bea603537",
|
||
|
|
"indicator--422c54fd-935c-4f2d-b07d-3e8701cad357"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"osint:source-type=\"blog-post\"",
|
||
|
|
"misp-galaxy:malpedia=\"Prynt Stealer\"",
|
||
|
|
"type:OSINT",
|
||
|
|
"osint:lifetime=\"perpetual\"",
|
||
|
|
"osint:certainty=\"50\"",
|
||
|
|
"misp-galaxy:malpedia=\"WorldWind\"",
|
||
|
|
"misp-galaxy:stealer=\"DarkEye\"",
|
||
|
|
"misp-galaxy:stealer=\"Prynt Stealer\"",
|
||
|
|
"misp-galaxy:stealer=\"WorldWind\"",
|
||
|
|
"misp-galaxy:malpedia=\"DarkEye\"",
|
||
|
|
"ecsirt:intrusions=\"backdoor\"",
|
||
|
|
"veris:action:malware:variety=\"Backdoor\"",
|
||
|
|
"ms-caro-malware:malware-type=\"Backdoor\"",
|
||
|
|
"ms-caro-malware-full:malware-type=\"Backdoor\""
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--9888e096-1341-4655-9a0c-1e53df9a6096",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-10-17T06:56:41.000Z",
|
||
|
|
"modified": "2022-10-17T06:56:41.000Z",
|
||
|
|
"description": "Prynt Stealer",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd8469e32afc3499a04f9bcb0ca34fde63140c3b872c41e898f4e31f2a7c1f61f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-17T06:56:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--6de8e173-c0fd-4be3-b4b1-42fc8c76c8e7",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-10-17T06:56:41.000Z",
|
||
|
|
"modified": "2022-10-17T06:56:41.000Z",
|
||
|
|
"description": "Prynt Stealer",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f15e92c34dd8adfcd471d726e88292d6698217f05f1d2bcce8193eb2536f817c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-17T06:56:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--d1d5db20-15d9-4e1f-a4e6-cab7a0bdf0b5",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-10-17T06:56:41.000Z",
|
||
|
|
"modified": "2022-10-17T06:56:41.000Z",
|
||
|
|
"description": "WorldWind Stealer",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3b948a0eb0e9bbca72fc363b63ffd3a5983e23c47f14f8296e8559fd98c25094']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-17T06:56:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--d451551e-c177-4ed9-a989-af74bb028188",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-10-17T06:56:41.000Z",
|
||
|
|
"modified": "2022-10-17T06:56:41.000Z",
|
||
|
|
"description": "DarkEye Stealer",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'bb96db7406566ec0e9305acde9205763d4e9d7a65f257f3d5c47c15f393628ec']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-17T06:56:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--a9b86903-b79c-455c-bbf0-7b488d90a3dc",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-10-17T06:56:41.000Z",
|
||
|
|
"modified": "2022-10-17T06:56:41.000Z",
|
||
|
|
"description": "DarkEye Stealer (old version without AsyncRAT)",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e48179c4629b5ab9e53ccb785ab3ee5eeb2e246e1897154a15fec8fd9237f44b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-17T06:56:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--ae705dbd-6b31-41b9-9cfb-eb8ac1121210",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-10-17T06:56:41.000Z",
|
||
|
|
"modified": "2022-10-17T06:56:41.000Z",
|
||
|
|
"description": "Celesty Binder payload",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9678ca06068b705da310aa2f76713d2d59905b12b67097364160857cd1f90c58']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-17T06:56:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--f54aa09c-1841-4826-9b28-22ef426079b6",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-10-17T06:56:41.000Z",
|
||
|
|
"modified": "2022-10-17T06:56:41.000Z",
|
||
|
|
"description": "Builder",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '654f080d5790054f0cd1a0f9b31cd7a82a4722ff3ce5093acdc31ff154f1ae24']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-17T06:56:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--74ed1b4c-6d5b-4d42-91fb-b642d4079067",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-10-17T06:56:41.000Z",
|
||
|
|
"modified": "2022-10-17T06:56:41.000Z",
|
||
|
|
"description": "LodaRAT",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'cb132691793e93ad8065f857b4b1baba92e937cfc3d3a8042ce9109e12d32b4c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-17T06:56:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--ce2ad6bb-1747-4b74-bfce-8fb70c2051a0",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-10-17T06:56:41.000Z",
|
||
|
|
"modified": "2022-10-17T06:56:41.000Z",
|
||
|
|
"description": "Prynt Stealer Stub",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd37d0ae4c5ced373fe1960af5ea494a6131717d1c400da877d9daa13f55439bb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-17T06:56:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5ed227fe-15f1-44e9-bd7f-7fc04710ec7c",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-10-17T06:56:41.000Z",
|
||
|
|
"modified": "2022-10-17T06:56:41.000Z",
|
||
|
|
"description": "Loader",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c79aed9551260daf74a2af2ec5b239332f3b89764ede670106389c3078e74d1a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-17T06:56:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--b2cce1cd-8669-4f40-8215-2f4f141c8b1d",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-10-17T07:49:50.000Z",
|
||
|
|
"modified": "2022-10-17T07:49:50.000Z",
|
||
|
|
"description": "DarkEye Stealer Hosting",
|
||
|
|
"pattern": "[url:value = 'https://cdn.discordapp.com/attachments/523238636561629190/890007970207907871/vltn.exe']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-17T07:49:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--4ec5a062-377a-4d46-954f-c0e9a5c9d798",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-10-17T07:54:10.000Z",
|
||
|
|
"modified": "2022-10-17T07:54:10.000Z",
|
||
|
|
"description": "WorldWind - Market Website (Inactive)",
|
||
|
|
"pattern": "[url:value = 'http://shop.prynt.market']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-17T07:54:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--ff207b26-10e9-41d8-a901-208460f5f1f8",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-10-17T07:54:10.000Z",
|
||
|
|
"modified": "2022-10-17T07:54:10.000Z",
|
||
|
|
"description": "Prynt Stealer - Market Website (Inactive)",
|
||
|
|
"pattern": "[url:value = 'http://market.prynt.market']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-17T07:54:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--3f959b7e-8c08-4fe2-b769-7ace9f1d3b20",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-10-17T07:54:10.000Z",
|
||
|
|
"modified": "2022-10-17T07:54:10.000Z",
|
||
|
|
"description": "Prynt Stealer - Market Website (Active)",
|
||
|
|
"pattern": "[url:value = 'http://venoxxxx.xxx']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-17T07:54:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--967a4473-5c38-421a-b44c-68d71767fec5",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-10-17T08:14:55.000Z",
|
||
|
|
"modified": "2022-10-17T08:14:55.000Z",
|
||
|
|
"description": "Prynt Stealer builder package - Prynt stub used by the builder",
|
||
|
|
"pattern": "[file:name = 'Stub.exe']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-17T08:14:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--b25ef0d4-7c29-4dbc-8cd5-b9619400bf65",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-10-17T08:14:55.000Z",
|
||
|
|
"modified": "2022-10-17T08:14:55.000Z",
|
||
|
|
"description": "Prynt Stealer builder package - Builder executable",
|
||
|
|
"pattern": "[file:name = 'Prynt Stealer.exe']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-17T08:14:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--b176d8c2-0949-4e79-b7e7-4891a729c352",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-10-17T08:14:55.000Z",
|
||
|
|
"modified": "2022-10-17T08:14:55.000Z",
|
||
|
|
"description": "Prynt Stealer builder package - Unmanaged PE",
|
||
|
|
"pattern": "[file:name = 'Prynt sub.exe']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-17T08:14:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59827e8b-9dab-44b4-aab4-4ed13b02b39b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-10-17T08:14:55.000Z",
|
||
|
|
"modified": "2022-10-17T08:14:55.000Z",
|
||
|
|
"description": "Prynt Stealer builder package - Backdoor that downloads and executes DarkEye Stealer",
|
||
|
|
"pattern": "[file:name = 'Prynt.exe']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-17T08:14:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--39c86d1d-05bd-4dae-a488-360079914b64",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-10-17T06:52:52.000Z",
|
||
|
|
"modified": "2022-10-17T06:52:52.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "link",
|
||
|
|
"value": "https://www.zscaler.com/blogs/security-research/no-honor-among-thieves-prynt-stealers-backdoor-exposed",
|
||
|
|
"category": "External analysis",
|
||
|
|
"uuid": "3f4d70ad-8208-4707-afa6-0f7400f55025"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "summary",
|
||
|
|
"value": "Technical Comparison of Prynt Stealer, WorldWind, and DarkEye Malware",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ccb48af3-8af0-428e-9c57-ba2b922f879a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "Blog",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6aad45d1-0674-4854-b666-4d813ffbbc1f"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--32c7146e-8ac3-4543-889b-1c39754b6303",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-10-17T07:04:02.000Z",
|
||
|
|
"modified": "2022-10-17T07:04:02.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"telegram-bot\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "chat-id",
|
||
|
|
"value": "1096425866",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "19aa10d9-e55d-4bed-b8fd-2a4e1403553b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "token",
|
||
|
|
"value": "1119746739:AAGMhvpUjXI4CzIfizRC--VXilxnkJlhaf8",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ae8f5b64-bd3c-4c9e-896c-4c3dff3b5374"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_comment": "WorldWind (hardcoded)",
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "telegram-bot"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--535b633e-9e74-4f90-8e28-bfbbc342fb33",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-10-17T07:06:18.000Z",
|
||
|
|
"modified": "2022-10-17T07:06:18.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"telegram-bot\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "chat-id",
|
||
|
|
"value": "1937717367",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "29b53d36-ff5a-4e5f-8f0b-b4f072e0ab66"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "token",
|
||
|
|
"value": "1784055443:AAG-bXLYtnFpjJ_L3ogxA3bq6Mx09cqh8ug",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5a092591-61bc-436f-8dd4-be5af46783ce"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_comment": "Prynt Stealer (hardcoded)",
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "telegram-bot"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--921b1fa9-a804-47ec-99fc-2b0c63517d7a",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-10-17T07:13:00.000Z",
|
||
|
|
"modified": "2022-10-17T07:13:00.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"telegram-bot\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "chat-id",
|
||
|
|
"value": "5038570348",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3508cefe-b0b3-4906-ab78-d73a06e0260a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "token",
|
||
|
|
"value": "5292408150:AAHAPbTr2Jc9L4hgsfkDkvfw_hISg6lPMMI",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b17b02c2-bc88-42bb-9de7-0106b1edf26b"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_comment": "Prynt Stealer",
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "telegram-bot"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--09b2266a-460d-45cd-968a-f903dcb8e938",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-10-17T07:27:23.000Z",
|
||
|
|
"modified": "2022-10-17T07:27:23.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"telegram-bot\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "chat-id",
|
||
|
|
"value": "1856525476",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "57e39ba6-a415-4771-96c5-62ceadadc360"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "token",
|
||
|
|
"value": "5292408150:AAHAPbTr2Jc9L4hgsfkDkvfw_hISg6lPMMI",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7849bf84-5d84-4049-a686-8834b91323ce"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_comment": "Prynt Stealer",
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "telegram-bot"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--89ca0c35-28ce-4896-97ef-96a1277a042b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-10-17T07:30:57.000Z",
|
||
|
|
"modified": "2022-10-17T07:30:57.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"telegram-bot\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "chat-id",
|
||
|
|
"value": "849561191",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a02fdd87-9fd4-4b74-af29-72cc7d256918"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "token",
|
||
|
|
"value": "1916193181:AAHhdcx3k6mHbnJ6JLfyWtJBMChny-la8Xs",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5f075a20-5076-45dc-9217-90afc883968a"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_comment": "Prynt Stealer",
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "telegram-bot"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--ae21fd17-1261-4d84-a0ac-44d65e3a9c31",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-10-17T07:50:35.000Z",
|
||
|
|
"modified": "2022-10-17T07:50:35.000Z",
|
||
|
|
"description": "DarkEye Stealer C&C ",
|
||
|
|
"pattern": "[domain-name:value = 'bigdaddy-service.biz' AND domain-name:x_misp_port = '6606']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-17T07:50:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "network"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"domain-ip\"",
|
||
|
|
"misp:meta-category=\"network\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--df65f997-8718-4042-9aee-c63b8065db3d",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-10-17T07:50:59.000Z",
|
||
|
|
"modified": "2022-10-17T07:50:59.000Z",
|
||
|
|
"description": "DarkEye Stealer C&C ",
|
||
|
|
"pattern": "[domain-name:value = 'bigdaddy-service.biz' AND domain-name:x_misp_port = '7707']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-17T07:50:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "network"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"domain-ip\"",
|
||
|
|
"misp:meta-category=\"network\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--fb51780b-d597-4c98-9c55-e84bea603537",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-10-17T07:51:30.000Z",
|
||
|
|
"modified": "2022-10-17T07:51:30.000Z",
|
||
|
|
"description": "DarkEye Stealer C&C ",
|
||
|
|
"pattern": "[domain-name:value = 'bigdaddy-service.biz' AND domain-name:x_misp_port = '8808']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-17T07:51:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "network"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"domain-ip\"",
|
||
|
|
"misp:meta-category=\"network\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--422c54fd-935c-4f2d-b07d-3e8701cad357",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-10-17T07:52:29.000Z",
|
||
|
|
"modified": "2022-10-17T07:52:29.000Z",
|
||
|
|
"description": "LodaRAT C&C",
|
||
|
|
"pattern": "[domain-name:value = 'daddy.linkpc.net' AND domain-name:x_misp_port = '1199']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-17T07:52:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "network"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"domain-ip\"",
|
||
|
|
"misp:meta-category=\"network\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|