{ "type": "bundle", "id": "bundle--5bfc6891-b838-44fe-bc17-16b702de0b81", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-26T22:13:14.000Z", "modified": "2018-11-26T22:13:14.000Z", "name": "CIRCL", "identity_class": "organization" }, { "type": "report", "spec_version": "2.1", "id": "report--5bfc6891-b838-44fe-bc17-16b702de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-26T22:13:14.000Z", "modified": "2018-11-26T22:13:14.000Z", "name": "OSINT - `event-stream` dependency attack steals wallets from users of copay", "published": "2018-11-26T22:13:22Z", "object_refs": [ "observed-data--5bfc68a3-19e0-4f70-81d4-48d502de0b81", "url--5bfc68a3-19e0-4f70-81d4-48d502de0b81", "indicator--5bfc68be-0b50-47a2-a33e-16c502de0b81", "indicator--5bfc68bf-51a0-4f93-84ff-16c502de0b81", "indicator--5bfc68bf-4798-421d-b09f-16c502de0b81", "indicator--5bfc68c0-af3c-4165-8243-16c502de0b81", "x-misp-attribute--5bfc68ef-2698-4780-b1f5-45c902de0b81", "observed-data--5bfc691b-da14-4228-997c-40e802de0b81", "user-account--5bfc691b-da14-4228-997c-40e802de0b81", "observed-data--5bfc696a-2a8c-4e1d-9f1c-4ef902de0b81", "url--5bfc696a-2a8c-4e1d-9f1c-4ef902de0b81", "observed-data--5bfc697d-ab8c-4a6b-9083-453702de0b81", "url--5bfc697d-ab8c-4a6b-9083-453702de0b81", "observed-data--5bfc6990-28ec-4517-a397-4b8502de0b81", "url--5bfc6990-28ec-4517-a397-4b8502de0b81", "observed-data--5bfc69b5-bd34-40c5-a2da-42e202de0b81", "url--5bfc69b5-bd34-40c5-a2da-42e202de0b81", "x-misp-attribute--5bfc69de-2090-455c-8b3c-45b102de0b81" ], "labels": [ "Threat-Report", "misp:tool=\"MISP-STIX-Converter\"", "ecsirt:intrusions=\"application-compromise\"", "estimative-language:confidence-in-analytic-judgment=\"high\"", "estimative-language:likelihood-probability=\"almost-certain\"" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5bfc68a3-19e0-4f70-81d4-48d502de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-26T21:41:55.000Z", "modified": "2018-11-26T21:41:55.000Z", "first_observed": "2018-11-26T21:41:55Z", "last_observed": "2018-11-26T21:41:55Z", "number_observed": 1, "object_refs": [ "url--5bfc68a3-19e0-4f70-81d4-48d502de0b81" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--5bfc68a3-19e0-4f70-81d4-48d502de0b81", "value": "https://github.com/bitpay/copay/issues/9346#issuecomment-441749542" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5bfc68be-0b50-47a2-a33e-16c502de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-26T21:42:22.000Z", "modified": "2018-11-26T21:42:22.000Z", "description": "\"HTTP POST traffic on port 8080 to copayapi.host (which currently resolves to 51.38.112.212 and previously resolved to 145.249.104.239) or 111.90.151.134 indicates compromised and exfiltrated wallet private keys.\"", "pattern": "[domain-name:value = 'copayapi.host']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-11-26T21:42:22Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5bfc68bf-51a0-4f93-84ff-16c502de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-26T21:42:23.000Z", "modified": "2018-11-26T21:42:23.000Z", "description": "\"HTTP POST traffic on port 8080 to copayapi.host (which currently resolves to 51.38.112.212 and previously resolved to 145.249.104.239) or 111.90.151.134 indicates compromised and exfiltrated wallet private keys.\"", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '51.38.112.212']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-11-26T21:42:23Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5bfc68bf-4798-421d-b09f-16c502de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-26T21:42:23.000Z", "modified": "2018-11-26T21:42:23.000Z", "description": "\"HTTP POST traffic on port 8080 to copayapi.host (which currently resolves to 51.38.112.212 and previously resolved to 145.249.104.239) or 111.90.151.134 indicates compromised and exfiltrated wallet private keys.\"", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '145.249.104.239']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-11-26T21:42:23Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5bfc68c0-af3c-4165-8243-16c502de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-26T21:42:24.000Z", "modified": "2018-11-26T21:42:24.000Z", "description": "\"HTTP POST traffic on port 8080 to copayapi.host (which currently resolves to 51.38.112.212 and previously resolved to 145.249.104.239) or 111.90.151.134 indicates compromised and exfiltrated wallet private keys.\"", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '111.90.151.134']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-11-26T21:42:24Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5bfc68ef-2698-4780-b1f5-45c902de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-26T21:47:26.000Z", "modified": "2018-11-26T21:47:26.000Z", "labels": [ "misp:type=\"dns-soa-email\"", "misp:category=\"Attribution\"", "misp:to_ids=\"True\"" ], "x_misp_category": "Attribution", "x_misp_comment": "copayapi.host's SOA record indicates the domain registrant's email address is \"kvlguuvh@sharklasers.co\" (very likely a throwaway email address).", "x_misp_type": "dns-soa-email", "x_misp_value": "kvlguuvh@sharklasers.co" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5bfc691b-da14-4228-997c-40e802de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-26T21:43:55.000Z", "modified": "2018-11-26T21:43:55.000Z", "first_observed": "2018-11-26T21:43:55Z", "last_observed": "2018-11-26T21:43:55Z", "number_observed": 1, "object_refs": [ "user-account--5bfc691b-da14-4228-997c-40e802de0b81" ], "labels": [ "misp:type=\"github-username\"", "misp:category=\"Social network\"" ] }, { "type": "user-account", "spec_version": "2.1", "id": "user-account--5bfc691b-da14-4228-997c-40e802de0b81", "account_login": "right9ctrl", "account_type": "github" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5bfc696a-2a8c-4e1d-9f1c-4ef902de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-26T21:45:14.000Z", "modified": "2018-11-26T21:45:14.000Z", "first_observed": "2018-11-26T21:45:14Z", "last_observed": "2018-11-26T21:45:14Z", "number_observed": 1, "object_refs": [ "url--5bfc696a-2a8c-4e1d-9f1c-4ef902de0b81" ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--5bfc696a-2a8c-4e1d-9f1c-4ef902de0b81", "value": "https://www.npmjs.com/~right9ctrl" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5bfc697d-ab8c-4a6b-9083-453702de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-26T21:45:33.000Z", "modified": "2018-11-26T21:45:33.000Z", "first_observed": "2018-11-26T21:45:33Z", "last_observed": "2018-11-26T21:45:33Z", "number_observed": 1, "object_refs": [ "url--5bfc697d-ab8c-4a6b-9083-453702de0b81" ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--5bfc697d-ab8c-4a6b-9083-453702de0b81", "value": "https://github.com/hugeglass/flatmap-stream" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5bfc6990-28ec-4517-a397-4b8502de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-26T21:45:52.000Z", "modified": "2018-11-26T21:45:52.000Z", "first_observed": "2018-11-26T21:45:52Z", "last_observed": "2018-11-26T21:45:52Z", "number_observed": 1, "object_refs": [ "url--5bfc6990-28ec-4517-a397-4b8502de0b81" ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--5bfc6990-28ec-4517-a397-4b8502de0b81", "value": "https://www.npmjs.com/~hugeglass" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5bfc69b5-bd34-40c5-a2da-42e202de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-26T21:46:29.000Z", "modified": "2018-11-26T21:46:29.000Z", "first_observed": "2018-11-26T21:46:29Z", "last_observed": "2018-11-26T21:46:29Z", "number_observed": 1, "object_refs": [ "url--5bfc69b5-bd34-40c5-a2da-42e202de0b81" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--5bfc69b5-bd34-40c5-a2da-42e202de0b81", "value": "https://github.com/dominictarr/event-stream/issues/116" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5bfc69de-2090-455c-8b3c-45b102de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-26T21:47:10.000Z", "modified": "2018-11-26T21:47:10.000Z", "labels": [ "misp:type=\"whois-registrant-email\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-registrant-email", "x_misp_value": "right9ctrl@outlook.com" }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } } ] }