{ "type": "bundle", "id": "bundle--57b5a864-be78-4eba-af85-4608950d210f", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f", "created": "2016-08-18T12:32:42.000Z", "modified": "2016-08-18T12:32:42.000Z", "name": "CthulhuSPRL.be", "identity_class": "organization" }, { "type": "report", "spec_version": "2.1", "id": "report--57b5a864-be78-4eba-af85-4608950d210f", "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f", "created": "2016-08-18T12:32:42.000Z", "modified": "2016-08-18T12:32:42.000Z", "name": "OSINT Shakti Trojan: Document Thief by Malwarebytes", "published": "2016-08-18T12:37:57Z", "object_refs": [ "observed-data--57b5a877-9d20-49f7-aa38-4c16950d210f", "url--57b5a877-9d20-49f7-aa38-4c16950d210f", "observed-data--57b5a877-9be4-4767-b8e5-436a950d210f", "url--57b5a877-9be4-4767-b8e5-436a950d210f", "observed-data--57b5a877-a95c-48cf-be90-4981950d210f", "url--57b5a877-a95c-48cf-be90-4981950d210f", "observed-data--57b5a8aa-4290-4175-9509-478d950d210f", "url--57b5a8aa-4290-4175-9509-478d950d210f", "indicator--57b5a8c8-1a70-4ec3-9746-44dc950d210f", "indicator--57b5a8c8-a87c-44bf-9aec-46e8950d210f", "indicator--57b5a8c9-3110-4536-8e93-4baa950d210f", "indicator--57b5a8c9-31ec-442a-9e77-4819950d210f", "indicator--57b5a8c9-6830-4de5-a4b0-4b00950d210f", "indicator--57b5a8ff-4aa4-4baf-a764-49ad950d210f", "indicator--57b5a8ff-c074-4601-92b7-4dbc950d210f", "indicator--57b5a8ff-8974-40f4-b6bd-44b6950d210f", "indicator--57b5a8ff-1dd0-413f-8ede-46ab950d210f", "indicator--57b5a900-db74-4f77-8cff-4754950d210f", "indicator--57b5a919-cad0-42ff-9825-4d5a950d210f", "x-misp-attribute--57b5a93e-f604-442f-8443-49d2950d210f", "x-misp-attribute--57b5a93f-9fb4-4436-a220-4a41950d210f", "observed-data--57b5a9d1-46d0-4515-8152-429a950d210f", "url--57b5a9d1-46d0-4515-8152-429a950d210f", "indicator--57b5aa1a-cd14-4bd9-b994-4e4f950d210f", "x-misp-attribute--57b5aaea-41e8-41ee-9a00-499c950d210f" ], "labels": [ "Threat-Report", "misp:tool=\"MISP-STIX-Converter\"", "OSINT" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--57b5a877-9d20-49f7-aa38-4c16950d210f", "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f", "created": "2016-08-18T12:22:15.000Z", "modified": "2016-08-18T12:22:15.000Z", "first_observed": "2016-08-18T12:22:15Z", "last_observed": "2016-08-18T12:22:15Z", "number_observed": 1, "object_refs": [ "url--57b5a877-9d20-49f7-aa38-4c16950d210f" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--57b5a877-9d20-49f7-aa38-4c16950d210f", "value": "https://blog.malwarebytes.com/threat-analysis/2016/08/shakti-trojan-stealing-documents/" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--57b5a877-9be4-4767-b8e5-436a950d210f", "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f", "created": "2016-08-18T12:22:15.000Z", "modified": "2016-08-18T12:22:15.000Z", "first_observed": "2016-08-18T12:22:15Z", "last_observed": "2016-08-18T12:22:15Z", "number_observed": 1, "object_refs": [ "url--57b5a877-9be4-4767-b8e5-436a950d210f" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--57b5a877-9be4-4767-b8e5-436a950d210f", "value": "https://malwr.com/analysis/NjA0OGVmMDdlMzg5NDJjOGI1OTA3YTJkMDllZTk5Y2U/" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--57b5a877-a95c-48cf-be90-4981950d210f", "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f", "created": "2016-08-18T12:22:15.000Z", "modified": "2016-08-18T12:22:15.000Z", "first_observed": "2016-08-18T12:22:15Z", "last_observed": "2016-08-18T12:22:15Z", "number_observed": 1, "object_refs": [ "url--57b5a877-a95c-48cf-be90-4981950d210f" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--57b5a877-a95c-48cf-be90-4981950d210f", "value": "http://www.bleepingcomputer.com/news/security/new-information-stealing-trojan-steals-and-uploads-corporate-files/" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--57b5a8aa-4290-4175-9509-478d950d210f", "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f", "created": "2016-08-18T12:23:05.000Z", "modified": "2016-08-18T12:23:05.000Z", "first_observed": "2016-08-18T12:23:05Z", "last_observed": "2016-08-18T12:23:05Z", "number_observed": 1, "object_refs": [ "url--57b5a8aa-4290-4175-9509-478d950d210f" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--57b5a8aa-4290-4175-9509-478d950d210f", "value": "https://blog.malwarebytes.com/threat-analysis/2016/08/shakti-trojan-technical-analysis/" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57b5a8c8-1a70-4ec3-9746-44dc950d210f", "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f", "created": "2016-08-18T12:23:36.000Z", "modified": "2016-08-18T12:23:36.000Z", "description": "Imported via the Freetext Import Tool", "pattern": "[file:name = 'Carrier.dll']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-18T12:23:36Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Artifacts dropped" } ], "labels": [ "misp:type=\"filename\"", "misp:category=\"Artifacts dropped\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57b5a8c8-a87c-44bf-9aec-46e8950d210f", "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f", "created": "2016-08-18T12:23:36.000Z", "modified": "2016-08-18T12:23:36.000Z", "description": "Imported via the Freetext Import Tool", "pattern": "[file:name = 'Payload.dll']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-18T12:23:36Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Artifacts dropped" } ], "labels": [ "misp:type=\"filename\"", "misp:category=\"Artifacts dropped\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57b5a8c9-3110-4536-8e93-4baa950d210f", "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f", "created": "2016-08-18T12:23:37.000Z", "modified": "2016-08-18T12:23:37.000Z", "description": "Imported via the Freetext Import Tool", "pattern": "[domain-name:value = 'web4solution.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-18T12:23:37Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57b5a8c9-31ec-442a-9e77-4819950d210f", "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f", "created": "2016-08-18T12:23:37.000Z", "modified": "2016-08-18T12:23:37.000Z", "description": "Imported via the Freetext Import Tool", "pattern": "[domain-name:value = 'securedesignus.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-18T12:23:37Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57b5a8c9-6830-4de5-a4b0-4b00950d210f", "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f", "created": "2016-08-18T12:23:37.000Z", "modified": "2016-08-18T12:23:37.000Z", "description": "Imported via the Freetext Import Tool", "pattern": "[domain-name:value = 'securedesignuk.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-18T12:23:37Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57b5a8ff-4aa4-4baf-a764-49ad950d210f", "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f", "created": "2016-08-18T12:24:31.000Z", "modified": "2016-08-18T12:24:31.000Z", "description": "Imported via the Freetext Import Tool", "pattern": "[file:name = 'Carrier.dll']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-18T12:24:31Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"filename\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57b5a8ff-c074-4601-92b7-4dbc950d210f", "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f", "created": "2016-08-18T12:24:31.000Z", "modified": "2016-08-18T12:24:31.000Z", "description": "Imported via the Freetext Import Tool", "pattern": "[file:name = 'Payload.dll']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-18T12:24:31Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"filename\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57b5a8ff-8974-40f4-b6bd-44b6950d210f", "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f", "created": "2016-08-18T12:24:31.000Z", "modified": "2016-08-18T12:24:31.000Z", "description": "Imported via the Freetext Import Tool", "pattern": "[file:hashes.MD5 = '8ea35293cbb0712a520c7b89059d5a2a']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-18T12:24:31Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Artifacts dropped" } ], "labels": [ "misp:type=\"md5\"", "misp:category=\"Artifacts dropped\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57b5a8ff-1dd0-413f-8ede-46ab950d210f", "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f", "created": "2016-08-18T12:24:31.000Z", "modified": "2016-08-18T12:24:31.000Z", "description": "Imported via the Freetext Import Tool", "pattern": "[file:hashes.MD5 = '6992370821f8fbeea4a96f7be8015967']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-18T12:24:31Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Artifacts dropped" } ], "labels": [ "misp:type=\"md5\"", "misp:category=\"Artifacts dropped\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57b5a900-db74-4f77-8cff-4754950d210f", "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f", "created": "2016-08-18T12:24:32.000Z", "modified": "2016-08-18T12:24:32.000Z", "description": "Imported via the Freetext Import Tool", "pattern": "[file:hashes.MD5 = 'd9181d69c40fc95d7d27448f5ece1878']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-18T12:24:32Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Artifacts dropped" } ], "labels": [ "misp:type=\"md5\"", "misp:category=\"Artifacts dropped\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57b5a919-cad0-42ff-9825-4d5a950d210f", "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f", "created": "2016-08-18T12:24:57.000Z", "modified": "2016-08-18T12:24:57.000Z", "pattern": "[url:value = '/external/update']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-18T12:24:57Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"uri\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--57b5a93e-f604-442f-8443-49d2950d210f", "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f", "created": "2016-08-18T12:25:34.000Z", "modified": "2016-08-18T12:25:34.000Z", "labels": [ "misp:type=\"pdb\"", "misp:category=\"Artifacts dropped\"", "misp:to_ids=\"True\"" ], "x_misp_category": "Artifacts dropped", "x_misp_type": "pdb", "x_misp_value": "E:\\Projects\\ComplexStatement\\Shakti\\Code\\Carrier\\Release\\Carrier.pdb" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--57b5a93f-9fb4-4436-a220-4a41950d210f", "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f", "created": "2016-08-18T12:25:35.000Z", "modified": "2016-08-18T12:25:35.000Z", "labels": [ "misp:type=\"pdb\"", "misp:category=\"Artifacts dropped\"", "misp:to_ids=\"True\"" ], "x_misp_category": "Artifacts dropped", "x_misp_type": "pdb", "x_misp_value": "E:\\Projects\\ComplexStatement\\Shakti\\Code\\Payload\\Release\\Payload.pdb" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--57b5a9d1-46d0-4515-8152-429a950d210f", "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f", "created": "2016-08-18T12:28:01.000Z", "modified": "2016-08-18T12:28:01.000Z", "first_observed": "2016-08-18T12:28:01Z", "last_observed": "2016-08-18T12:28:01Z", "number_observed": 1, "object_refs": [ "url--57b5a9d1-46d0-4515-8152-429a950d210f" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--57b5a9d1-46d0-4515-8152-429a950d210f", "value": "http://vms.drweb.ru/virus/?i=3793941&virus_name=Trojan.DownLoader11.5634" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57b5aa1a-cd14-4bd9-b994-4e4f950d210f", "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f", "created": "2016-08-18T12:29:14.000Z", "modified": "2016-08-18T12:29:14.000Z", "pattern": "[file:name = '\\\\%UserProfile\\\\%\\\\uninst.dll']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-18T12:29:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Artifacts dropped" } ], "labels": [ "misp:type=\"filename\"", "misp:category=\"Artifacts dropped\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--57b5aaea-41e8-41ee-9a00-499c950d210f", "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f", "created": "2016-08-18T12:32:42.000Z", "modified": "2016-08-18T12:32:42.000Z", "labels": [ "misp:type=\"whois-registrant-email\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-registrant-email", "x_misp_value": "ashrafahmed2882@yahoo.com" }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } } ] }