{ "type": "bundle", "id": "bundle--5d78a50e-ba3c-40b3-a5c1-4fb1950d210f", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-09-11T09:15:00.000Z", "modified": "2019-09-11T09:15:00.000Z", "name": "CIRCL", "identity_class": "organization" }, { "type": "report", "spec_version": "2.1", "id": "report--5d78a50e-ba3c-40b3-a5c1-4fb1950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-09-11T09:15:00.000Z", "modified": "2019-09-11T09:15:00.000Z", "name": "OSINT - ESET discovered an undocumented backdoor used by the infamous Stealth Falcon group", "published": "2019-09-11T12:17:21Z", "object_refs": [ "observed-data--5d78a9c4-1108-4eb4-aca8-e76e950d210f", "url--5d78a9c4-1108-4eb4-aca8-e76e950d210f", "x-misp-attribute--5d78a9db-1b4c-4f0b-8e96-8aaa950d210f", "indicator--5d78acb4-ae5c-468f-8570-e7f0950d210f", "indicator--5d78acb4-8a10-4a25-9981-e7f0950d210f", "indicator--5d78acb4-91d4-4a43-b367-e7f0950d210f", "indicator--5d78acb4-fed4-4e1a-9239-e7f0950d210f", "indicator--5d78acb4-1f6c-43db-9dc0-e7f0950d210f", "indicator--5d78acde-9514-4e9d-968b-c52e950d210f", "indicator--5d78acde-80f8-4127-81c8-c52e950d210f", "indicator--5d78acde-69bc-4b16-935d-c52e950d210f", "indicator--5d78acde-d94c-48a4-9770-c52e950d210f", "x-misp-attribute--5d78ba7f-97f0-4ba7-8062-95e4950d210f", "observed-data--5d78bb45-783c-456e-a632-4105e387cbd9", "network-traffic--5d78bb45-783c-456e-a632-4105e387cbd9", "ipv4-addr--5d78bb45-783c-456e-a632-4105e387cbd9", "observed-data--5d78bb45-5550-4792-81df-43b1e387cbd9", "network-traffic--5d78bb45-5550-4792-81df-43b1e387cbd9", "ipv4-addr--5d78bb45-5550-4792-81df-43b1e387cbd9", "observed-data--5d78bb46-8dbc-41cf-971d-431de387cbd9", "network-traffic--5d78bb46-8dbc-41cf-971d-431de387cbd9", "ipv4-addr--5d78bb46-8dbc-41cf-971d-431de387cbd9", "x-misp-object--5d78aae9-e0fc-4efb-957e-4829950d210f", "x-misp-object--5d78ab5c-a620-4d62-b72b-8aa5950d210f", "x-misp-object--5d78ad11-8e74-4fda-92f9-e7f0950d210f", "x-misp-object--5d78ad26-4fbc-4e8e-a634-ca95950d210f", "x-misp-object--5d78ad3a-5f28-4ba2-a5c6-8aa5950d210f", "x-misp-object--5d78ad60-53c4-4617-b7c0-8aa9950d210f", "x-misp-object--5d78adad-d90c-4b7f-b37c-8aaa950d210f", "observed-data--5d78aee4-c290-488a-a73c-e7f0950d210f", "user-account--5d78aee4-c290-488a-a73c-e7f0950d210f", "x-misp-object--5d78b6f6-9ae4-4260-a284-c534950d210f", "relationship--318cbcf3-e128-4e9f-932d-cc57d63c1cee", "relationship--83b4da32-7b57-4a1d-9e9d-5096d3c1cebf", "relationship--6150c089-ff4f-41a8-9810-79d2ae8ce6a4", "relationship--fb09f469-92f0-4a83-87b5-b25f7e26a47d", "relationship--7555b868-22bb-4760-9443-557e05fb86e4", "relationship--b1216ab0-fbed-4bd0-9617-d0657b1f2d19", "relationship--2801ef8b-1ff5-4080-bce2-3ac11cd8fedc" ], "labels": [ "Threat-Report", "misp:tool=\"MISP-STIX-Converter\"", "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"Stealth Falcon\"", "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"Stealth Falcon - G0038\"", "misp-galaxy:mitre-intrusion-set=\"Stealth Falcon\"", "misp-galaxy:mitre-intrusion-set=\"Stealth Falcon - G0038\"", "misp-galaxy:threat-actor=\"Stealth Falcon\"", "type:OSINT", "osint:lifetime=\"perpetual\"", "osint:certainty=\"50\"", "misp-galaxy:mitre-attack-pattern=\"BITS Jobs - T1197\"", "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"BITS Jobs - T1197\"" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5d78a9c4-1108-4eb4-aca8-e76e950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-09-11T08:01:08.000Z", "modified": "2019-09-11T08:01:08.000Z", "first_observed": "2019-09-11T08:01:08Z", "last_observed": "2019-09-11T08:01:08Z", "number_observed": 1, "object_refs": [ "url--5d78a9c4-1108-4eb4-aca8-e76e950d210f" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--5d78a9c4-1108-4eb4-aca8-e76e950d210f", "value": "https://www.welivesecurity.com/2019/09/09/backdoor-stealth-falcon-group/" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5d78a9db-1b4c-4f0b-8e96-8aaa950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-09-11T08:01:31.000Z", "modified": "2019-09-11T08:01:31.000Z", "labels": [ "misp:type=\"text\"", "misp:category=\"External analysis\"" ], "x_misp_category": "External analysis", "x_misp_type": "text", "x_misp_value": "Stealth Falcon is a threat group, active since 2012, that targets political activists and journalists in the Middle East. It has been tracked by the Citizen Lab, a non-profit organization focusing on security and human rights, which published an analysis of a particular cyberattack in 2016. In January of 2019, Reuters published an investigative report into Project Raven, an initiative allegedly employing former NSA operatives and aiming at the same types of targets as Stealth Falcon." }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5d78acb4-ae5c-468f-8570-e7f0950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-09-11T08:13:40.000Z", "modified": "2019-09-11T08:13:40.000Z", "description": "C&C", "pattern": "[domain-name:value = 'footballtimes.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-09-11T08:13:40Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5d78acb4-8a10-4a25-9981-e7f0950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-09-11T08:13:40.000Z", "modified": "2019-09-11T08:13:40.000Z", "description": "C&C", "pattern": "[domain-name:value = 'vegetableportfolio.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-09-11T08:13:40Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5d78acb4-91d4-4a43-b367-e7f0950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-09-11T08:13:40.000Z", "modified": "2019-09-11T08:13:40.000Z", "description": "C&C", "pattern": "[domain-name:value = 'windowsearchcache.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-09-11T08:13:40Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5d78acb4-fed4-4e1a-9239-e7f0950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-09-11T08:13:40.000Z", "modified": "2019-09-11T08:13:40.000Z", "description": "C&C", "pattern": "[domain-name:value = 'electricalweb.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-09-11T08:13:40Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5d78acb4-1f6c-43db-9dc0-e7f0950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-09-11T08:13:40.000Z", "modified": "2019-09-11T08:13:40.000Z", "description": "C&C", "pattern": "[domain-name:value = 'upnpdiscover.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-09-11T08:13:40Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5d78acde-9514-4e9d-968b-c52e950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-09-11T08:14:22.000Z", "modified": "2019-09-11T08:14:22.000Z", "description": "malware as detected by ESET", "pattern": "[file:hashes.SHA1 = '31b54aebdaf5fbc73a66ac41ccb35943cc9b7f72']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-09-11T08:14:22Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5d78acde-80f8-4127-81c8-c52e950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-09-11T08:14:22.000Z", "modified": "2019-09-11T08:14:22.000Z", "description": "malware as detected by ESET", "pattern": "[file:hashes.SHA1 = '50973a3fc57d70c7911f7a952356188b9939e56b']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-09-11T08:14:22Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5d78acde-69bc-4b16-935d-c52e950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-09-11T08:14:22.000Z", "modified": "2019-09-11T08:14:22.000Z", "description": "malware as detected by ESET", "pattern": "[file:hashes.SHA1 = '244eb62b9ac30934098ca4204447440d6fc4e259']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-09-11T08:14:22Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5d78acde-d94c-48a4-9770-c52e950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-09-11T08:14:22.000Z", "modified": "2019-09-11T08:14:22.000Z", "description": "malware as detected by ESET", "pattern": "[file:hashes.SHA1 = '5c8f83cc4ff57e7c67925df4d9daabe5d0cc07e2']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-09-11T08:14:22Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5d78ba7f-97f0-4ba7-8062-95e4950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-09-11T09:12:31.000Z", "modified": "2019-09-11T09:12:31.000Z", "labels": [ "misp:type=\"text\"", "misp:category=\"Antivirus detection\"" ], "x_misp_category": "Antivirus detection", "x_misp_type": "text", "x_misp_value": "Win32/StealthFalcon" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5d78bb45-783c-456e-a632-4105e387cbd9", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-09-11T09:15:49.000Z", "modified": "2019-09-11T09:15:49.000Z", "first_observed": "2019-09-11T09:15:49Z", "last_observed": "2019-09-11T09:15:49Z", "number_observed": 1, "object_refs": [ "network-traffic--5d78bb45-783c-456e-a632-4105e387cbd9", "ipv4-addr--5d78bb45-783c-456e-a632-4105e387cbd9" ], "labels": [ "misp:type=\"ip-src\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5d78bb45-783c-456e-a632-4105e387cbd9", "src_ref": "ipv4-addr--5d78bb45-783c-456e-a632-4105e387cbd9", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5d78bb45-783c-456e-a632-4105e387cbd9", "value": "185.227.82.19" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5d78bb45-5550-4792-81df-43b1e387cbd9", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-09-11T09:15:49.000Z", "modified": "2019-09-11T09:15:49.000Z", "first_observed": "2019-09-11T09:15:49Z", "last_observed": "2019-09-11T09:15:49Z", "number_observed": 1, "object_refs": [ "network-traffic--5d78bb45-5550-4792-81df-43b1e387cbd9", "ipv4-addr--5d78bb45-5550-4792-81df-43b1e387cbd9" ], "labels": [ "misp:type=\"ip-src\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5d78bb45-5550-4792-81df-43b1e387cbd9", "src_ref": "ipv4-addr--5d78bb45-5550-4792-81df-43b1e387cbd9", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5d78bb45-5550-4792-81df-43b1e387cbd9", "value": "46.183.219.85" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5d78bb46-8dbc-41cf-971d-431de387cbd9", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-09-11T09:15:50.000Z", "modified": "2019-09-11T09:15:50.000Z", "first_observed": "2019-09-11T09:15:50Z", "last_observed": "2019-09-11T09:15:50Z", "number_observed": 1, "object_refs": [ "network-traffic--5d78bb46-8dbc-41cf-971d-431de387cbd9", "ipv4-addr--5d78bb46-8dbc-41cf-971d-431de387cbd9" ], "labels": [ "misp:type=\"ip-src\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5d78bb46-8dbc-41cf-971d-431de387cbd9", "src_ref": "ipv4-addr--5d78bb46-8dbc-41cf-971d-431de387cbd9", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5d78bb46-8dbc-41cf-971d-431de387cbd9", "value": "193.105.134.75" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--5d78aae9-e0fc-4efb-957e-4829950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-09-11T08:06:01.000Z", "modified": "2019-09-11T08:06:01.000Z", "labels": [ "misp:name=\"command-line\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "text", "object_relation": "description", "value": "Uninstall itself", "category": "Other", "uuid": "5d78aae9-9994-4be3-90b5-4f4e950d210f" }, { "type": "text", "object_relation": "value", "value": "K", "category": "Other", "uuid": "5d78aaef-b248-4e75-a0eb-4453950d210f" } ], "x_misp_meta_category": "misc", "x_misp_name": "command-line" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--5d78ab5c-a620-4d62-b72b-8aa5950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-09-11T08:07:56.000Z", "modified": "2019-09-11T08:07:56.000Z", "labels": [ "misp:name=\"command-line\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "text", "object_relation": "description", "value": "Update configuration data", "category": "Other", "uuid": "5d78ab5c-a738-43f5-9441-8aa5950d210f" }, { "type": "text", "object_relation": "value", "value": "CFG", "category": "Other", "uuid": "5d78ab62-3fd8-49d7-9c2e-8aa5950d210f" } ], "x_misp_meta_category": "misc", "x_misp_name": "command-line" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--5d78ad11-8e74-4fda-92f9-e7f0950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-09-11T08:15:13.000Z", "modified": "2019-09-11T08:15:13.000Z", "labels": [ "misp:name=\"command-line\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "text", "object_relation": "description", "value": "Execute the specified application", "category": "Other", "uuid": "5d78ad11-5028-48f2-a2d7-e7f0950d210f" }, { "type": "text", "object_relation": "value", "value": "RC", "category": "Other", "uuid": "5d78ad11-deb8-4372-a92a-e7f0950d210f" } ], "x_misp_meta_category": "misc", "x_misp_name": "command-line" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--5d78ad26-4fbc-4e8e-a634-ca95950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-09-11T08:15:34.000Z", "modified": "2019-09-11T08:15:34.000Z", "labels": [ "misp:name=\"command-line\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "text", "object_relation": "description", "value": "Write downloaded data to file", "category": "Other", "uuid": "5d78ad26-9728-4f7e-b0d1-ca95950d210f" }, { "type": "text", "object_relation": "value", "value": "DL", "category": "Other", "uuid": "5d78ad26-84c0-4df6-884e-ca95950d210f" } ], "x_misp_meta_category": "misc", "x_misp_name": "command-line" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--5d78ad3a-5f28-4ba2-a5c6-8aa5950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-09-11T08:15:54.000Z", "modified": "2019-09-11T08:15:54.000Z", "labels": [ "misp:name=\"command-line\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "text", "object_relation": "description", "value": "Prepare a file for exfiltration", "category": "Other", "uuid": "5d78ad3a-3c64-4abb-917a-8aa5950d210f" }, { "type": "text", "object_relation": "value", "value": "CF", "category": "Other", "uuid": "5d78ad3a-4e10-403d-8aac-8aa5950d210f" } ], "x_misp_meta_category": "misc", "x_misp_name": "command-line" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--5d78ad60-53c4-4617-b7c0-8aa9950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-09-11T08:16:32.000Z", "modified": "2019-09-11T08:16:32.000Z", "labels": [ "misp:name=\"command-line\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "text", "object_relation": "description", "value": "Not implemented/no operation", "category": "Other", "uuid": "5d78ad60-b23c-4624-9dbe-8aa9950d210f" }, { "type": "text", "object_relation": "value", "value": "CFWD", "category": "Other", "uuid": "5d78ad60-44bc-474a-b925-8aa9950d210f" } ], "x_misp_meta_category": "misc", "x_misp_name": "command-line" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--5d78adad-d90c-4b7f-b37c-8aaa950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-09-11T08:17:49.000Z", "modified": "2019-09-11T08:17:49.000Z", "labels": [ "misp:name=\"command-line\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "text", "object_relation": "description", "value": "Exfiltrate and delete files", "category": "Other", "uuid": "5d78adad-02d8-4d3d-8e80-8aaa950d210f" }, { "type": "text", "object_relation": "value", "value": "CFW", "category": "Other", "uuid": "5d78adad-0394-46aa-8539-8aaa950d210f" } ], "x_misp_meta_category": "misc", "x_misp_name": "command-line" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5d78aee4-c290-488a-a73c-e7f0950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-09-11T08:23:00.000Z", "modified": "2019-09-11T08:23:00.000Z", "first_observed": "2019-09-11T08:23:00Z", "last_observed": "2019-09-11T08:23:00Z", "number_observed": 1, "object_refs": [ "user-account--5d78aee4-c290-488a-a73c-e7f0950d210f" ], "labels": [ "misp:name=\"credential\"", "misp:meta-category=\"misc\"", "misp:to_ids=\"False\"" ] }, { "type": "user-account", "spec_version": "2.1", "id": "user-account--5d78aee4-c290-488a-a73c-e7f0950d210f", "credential": "258A4A9D139823F55D7B9DA1825D101107FBF88634A870DE9800580DAD556BA3", "x_misp_format": "clear-text", "x_misp_origin": "malware-analysis", "x_misp_password": [ "2519DB0FFEC604D6C9A655CF56B98EDCE10405DE36810BC3DCF125CDE30BA5A2", "3EDB6EA77CD0987668B360365D5F39FDCF6B366D0DEAC9ECE5ADC6FFD20227F6", "8DFFDE77A39F3AF46D0CE0B84A189DB25A2A0FEFD71A0CD0054D8E0D60AB08DE" ], "x_misp_text": "Note: Malware derives a second RC4 key by XORing each byte of the hardcoded key with 0x3D.", "x_misp_type": "encryption-key" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--5d78b6f6-9ae4-4260-a284-c534950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-09-11T09:12:00.000Z", "modified": "2019-09-11T09:12:00.000Z", "labels": [ "misp:name=\"command\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "text", "object_relation": "description", "value": "Win32/StealthFalcon is a DLL file which, after execution, schedules itself as a task running on each user login. It only supports basic commands but displays a systematic approach to data collection, data exfiltration, employing further malicious tools, and updating its configuration.", "category": "Other", "uuid": "5d78b6f7-b7a4-49ac-9369-c534950d210f" }, { "type": "text", "object_relation": "trigger", "value": "Network", "category": "Other", "uuid": "5d78b6f7-17a8-4b54-8725-c534950d210f" }, { "type": "text", "object_relation": "location", "value": "Bundled", "category": "Other", "uuid": "5d78b6f7-be18-4e99-add1-c534950d210f" } ], "x_misp_comment": "Backdoor commands", "x_misp_meta_category": "misc", "x_misp_name": "command" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--318cbcf3-e128-4e9f-932d-cc57d63c1cee", "created": "2019-09-11T08:58:18.000Z", "modified": "2019-09-11T08:58:18.000Z", "relationship_type": "contains", "source_ref": "x-misp-object--5d78b6f6-9ae4-4260-a284-c534950d210f", "target_ref": "x-misp-object--5d78aae9-e0fc-4efb-957e-4829950d210f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--83b4da32-7b57-4a1d-9e9d-5096d3c1cebf", "created": "2019-09-11T09:05:16.000Z", "modified": "2019-09-11T09:05:16.000Z", "relationship_type": "contains", "source_ref": "x-misp-object--5d78b6f6-9ae4-4260-a284-c534950d210f", "target_ref": "x-misp-object--5d78ab5c-a620-4d62-b72b-8aa5950d210f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6150c089-ff4f-41a8-9810-79d2ae8ce6a4", "created": "2019-09-11T09:05:28.000Z", "modified": "2019-09-11T09:05:28.000Z", "relationship_type": "contains", "source_ref": "x-misp-object--5d78b6f6-9ae4-4260-a284-c534950d210f", "target_ref": "x-misp-object--5d78ad11-8e74-4fda-92f9-e7f0950d210f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fb09f469-92f0-4a83-87b5-b25f7e26a47d", "created": "2019-09-11T09:05:39.000Z", "modified": "2019-09-11T09:05:39.000Z", "relationship_type": "contains", "source_ref": "x-misp-object--5d78b6f6-9ae4-4260-a284-c534950d210f", "target_ref": "x-misp-object--5d78ad26-4fbc-4e8e-a634-ca95950d210f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7555b868-22bb-4760-9443-557e05fb86e4", "created": "2019-09-11T09:06:37.000Z", "modified": "2019-09-11T09:06:37.000Z", "relationship_type": "contains", "source_ref": "x-misp-object--5d78b6f6-9ae4-4260-a284-c534950d210f", "target_ref": "x-misp-object--5d78ad3a-5f28-4ba2-a5c6-8aa5950d210f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b1216ab0-fbed-4bd0-9617-d0657b1f2d19", "created": "2019-09-11T09:06:49.000Z", "modified": "2019-09-11T09:06:49.000Z", "relationship_type": "contains", "source_ref": "x-misp-object--5d78b6f6-9ae4-4260-a284-c534950d210f", "target_ref": "x-misp-object--5d78ad60-53c4-4617-b7c0-8aa9950d210f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2801ef8b-1ff5-4080-bce2-3ac11cd8fedc", "created": "2019-09-11T09:07:11.000Z", "modified": "2019-09-11T09:07:11.000Z", "relationship_type": "contains", "source_ref": "x-misp-object--5d78b6f6-9ae4-4260-a284-c534950d210f", "target_ref": "x-misp-object--5d78adad-d90c-4b7f-b37c-8aaa950d210f" }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } } ] }