adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/5b3b7b62-5728-4980-937b-40240acd0835.json

392 lines
No EOL
13 KiB
JSON
Raw Permalink Blame History

{
"Event": {
"analysis": "2",
"date": "2018-07-03",
"extends_uuid": "",
"info": "Clipboard CryptoCoin Hijacker",
"publish_timestamp": "1530625191",
"published": true,
"threat_level_id": "2",
"timestamp": "1530625163",
"uuid": "5b3b7b62-5728-4980-937b-40240acd0835",
"Orgc": {
"name": "Synovus Financial",
"uuid": "5a68c02d-959c-4c8a-a571-0dcac0a8060a"
},
"Tag": [
{
"colour": "#ffffff",
"local": false,
"name": "tlp:white",
"relationship_type": ""
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "Megasync.exe/allradio_4.27_portable.exe",
"deleted": false,
"disable_correlation": false,
"timestamp": "1530624986",
"to_ids": true,
"type": "sha256",
"uuid": "5b3b7bda-702c-45b3-831a-024a0acd0835",
"value": "9d891048dddda8a65de966c71f81464b20e402766aaee8a284da8d25c98270bd"
},
{
"category": "Payload delivery",
"comment": "Clipboard CryptoCoin Hijacker, d3dx11_31.dll",
"deleted": false,
"disable_correlation": false,
"timestamp": "1530624986",
"to_ids": true,
"type": "sha256",
"uuid": "5b3b7bda-c67c-4e90-8a40-024a0acd0835",
"value": "48b66dd02a336eb049a784b3fd1beb5312fb8c078b3729d49e92e3e986c98e91"
},
{
"category": "Payload delivery",
"comment": "Logger.exe",
"deleted": false,
"disable_correlation": false,
"timestamp": "1530624986",
"to_ids": true,
"type": "sha256",
"uuid": "5b3b7bda-6d70-4225-b6ad-024a0acd0835",
"value": "0cc32e6e6a407b2b69e1d89b3f005eecc54e238104725dcdcc8d3fc09c109bb4"
},
{
"category": "Payload delivery",
"comment": "Injected miner",
"deleted": false,
"disable_correlation": false,
"timestamp": "1530624986",
"to_ids": true,
"type": "sha256",
"uuid": "5b3b7bda-e698-4e7c-86fa-024a0acd0835",
"value": "cf8ef10678e63ffd02a5a35c84461d0195e0eed234bf9328eede52f3bef0e5f7"
},
{
"category": "Payload delivery",
"comment": "Hidden Service",
"deleted": false,
"disable_correlation": false,
"timestamp": "1530624986",
"to_ids": true,
"type": "sha256",
"uuid": "5b3b7bda-cbb0-4075-9c70-024a0acd0835",
"value": "2e23ab52259e45eaced300811a6d6795db719b029d06b08ca7bac7d86cc289ad"
},
{
"category": "Payload delivery",
"comment": "Satamon.exe",
"deleted": false,
"disable_correlation": false,
"timestamp": "1530624986",
"to_ids": true,
"type": "sha256",
"uuid": "5b3b7bda-2b64-42b1-b364-024a0acd0835",
"value": "2c3eae980a88e7bb6a91f2b466856f612f34b8a37fac46bbbb52c0af0e695488"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1530624986",
"to_ids": true,
"type": "sha256",
"uuid": "5b3b7bda-5fe0-459b-8a68-024a0acd0835",
"value": "ffdc286711557df5f0bfd6a96744e93633d13fe45c02c240d5d6cf7531b21847",
"Tag": [
{
"colour": "#42933e",
"local": false,
"name": "Adware",
"relationship_type": ""
}
]
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1530624986",
"to_ids": true,
"type": "sha256",
"uuid": "5b3b7bda-fcec-4230-94ba-024a0acd0835",
"value": "20bdef6e68bbec5ddeb7b893a9b4f387adbf2ee304963e905d98116a57334a41",
"Tag": [
{
"colour": "#42933e",
"local": false,
"name": "Adware",
"relationship_type": ""
}
]
},
{
"category": "Payload delivery",
"comment": "Temp downloader",
"deleted": false,
"disable_correlation": false,
"timestamp": "1530624986",
"to_ids": true,
"type": "sha256",
"uuid": "5b3b7bda-d310-4dcb-be70-024a0acd0835",
"value": "acf810c7bb3961fd42f5925fcd4417cb812eb6fdaad00c98830c522d54c7f6eb"
},
{
"category": "Payload delivery",
"comment": "Temp downloader",
"deleted": false,
"disable_correlation": false,
"timestamp": "1530624986",
"to_ids": true,
"type": "sha256",
"uuid": "5b3b7bda-cb08-43c7-a5aa-024a0acd0835",
"value": "084d4811c47a5dc36df59bfaf477e1f0bf3a9b3901877de1d1548c3343d1e4d6"
},
{
"category": "Payload delivery",
"comment": "Temp downloader",
"deleted": false,
"disable_correlation": false,
"timestamp": "1530624987",
"to_ids": true,
"type": "sha256",
"uuid": "5b3b7bdb-fe10-4c9d-af40-024a0acd0835",
"value": "ea92702d5fe168a57ccf5abbe6b9f5eca25f039e111db4b010183aa6909c38d2"
},
{
"category": "Persistence mechanism",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1530625013",
"to_ids": false,
"type": "regkey",
"uuid": "5b3b7bf5-c840-40dd-ac6d-28b70acd0835",
"value": "HKCU\\Software\\All-Radio"
},
{
"category": "Persistence mechanism",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1530625013",
"to_ids": false,
"type": "regkey",
"uuid": "5b3b7bf5-f378-43e3-b6f5-28b70acd0835",
"value": "HKCU\\Software\\All-Radio\\Settings"
},
{
"category": "Persistence mechanism",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1530625013",
"to_ids": false,
"type": "regkey",
"uuid": "5b3b7bf5-0998-428e-b04f-28b70acd0835",
"value": "HKCU\\Software\\All-Radio\\Settings\\TimeStamp\t914BE45509E88CBE12C9C147B92F8928"
},
{
"category": "Persistence mechanism",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1530625013",
"to_ids": false,
"type": "regkey",
"uuid": "5b3b7bf5-1978-4c09-995a-28b70acd0835",
"value": "HKCU\\Software\\All-Radio\\Settings\\CurrentLanguage\tEnglish"
},
{
"category": "Persistence mechanism",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1530625013",
"to_ids": false,
"type": "regkey",
"uuid": "5b3b7bf5-2764-426d-998b-28b70acd0835",
"value": "HKCU\\Software\\All-Radio\\Settings\\skin name\tCold"
},
{
"category": "Persistence mechanism",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1530625013",
"to_ids": false,
"type": "regkey",
"uuid": "5b3b7bf5-3294-4b11-92e1-28b70acd0835",
"value": "HKCU\\Software\\All-Radio\\Settings\\color\t0"
},
{
"category": "Persistence mechanism",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1530625013",
"to_ids": false,
"type": "regkey",
"uuid": "5b3b7bf5-4788-4c49-9e44-28b70acd0835",
"value": "HKCU\\Software\\All-Radio\\Settings\\saturation\t0"
},
{
"category": "Persistence mechanism",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1530625013",
"to_ids": false,
"type": "regkey",
"uuid": "5b3b7bf5-4ed0-48e1-98be-28b70acd0835",
"value": "HKCU\\Software\\All-Radio\\Settings\\use skin\t1"
},
{
"category": "Persistence mechanism",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1530625013",
"to_ids": false,
"type": "regkey",
"uuid": "5b3b7bf5-5230-4d33-bb44-28b70acd0835",
"value": "HKCU\\Software\\All-Radio\\Settings\\CurrentServer\thttp://www.radioserver2.com/"
},
{
"category": "Persistence mechanism",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1530625013",
"to_ids": false,
"type": "regkey",
"uuid": "5b3b7bf5-4e24-4424-bf77-28b70acd0835",
"value": "HKCU\\Software\\All-Radio\\Settings\\ServersCount\t8"
},
{
"category": "Persistence mechanism",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1530625013",
"to_ids": false,
"type": "regkey",
"uuid": "5b3b7bf5-5e68-475b-bb2f-28b70acd0835",
"value": "HKCU\\Software\\All-Radio\\Settings\\resize\t1"
},
{
"category": "Persistence mechanism",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1530625013",
"to_ids": false,
"type": "regkey",
"uuid": "5b3b7bf5-5ea8-4f33-8ddf-28b70acd0835",
"value": "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\agwpyjho\t\"%USERPROFILE%\\gidulfmf.exe\""
},
{
"category": "Persistence mechanism",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1530625013",
"to_ids": false,
"type": "regkey",
"uuid": "5b3b7bf5-7464-428d-bd37-28b70acd0835",
"value": "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\DirectX 11\trundll32 %Temp%\\d3dx11_31.dll,includes_func_runnded"
},
{
"category": "Persistence mechanism",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1530625013",
"to_ids": false,
"type": "regkey",
"uuid": "5b3b7bf5-93e4-4134-8ab3-28b70acd0835",
"value": "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{E50B01A9-6717-4321-B6C1-3444E35D4419}"
},
{
"category": "Persistence mechanism",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1530625013",
"to_ids": false,
"type": "regkey",
"uuid": "5b3b7bf5-a6e4-4316-a19e-28b70acd0835",
"value": "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{E50B01A9-6717-4321-B6C1-3444E35D4419}\\Path\t\\Opera scheduled Autoupdate 1427321617"
},
{
"category": "Persistence mechanism",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1530625013",
"to_ids": false,
"type": "regkey",
"uuid": "5b3b7bf5-b5fc-41d6-b3a7-28b70acd0835",
"value": "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{E50B01A9-6717-4321-B6C1-3444E35D4419}\\Hash\tBINARY SIZE=32 MD5=5520F781167B06815EF8BD54DD186F9C"
},
{
"category": "Persistence mechanism",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1530625013",
"to_ids": false,
"type": "regkey",
"uuid": "5b3b7bf5-b768-43cb-8995-28b70acd0835",
"value": "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{E50B01A9-6717-4321-B6C1-3444E35D4419}\\Triggers\tBINARY SIZE=352 MD5=83356B89B15EAB067435487A7B92FDBE"
},
{
"category": "Persistence mechanism",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1530625013",
"to_ids": false,
"type": "regkey",
"uuid": "5b3b7bf5-d9a4-40e4-b86f-28b70acd0835",
"value": "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{E50B01A9-6717-4321-B6C1-3444E35D4419}\\DynamicInfo\tBINARY SIZE=28 MD5=3068A03846DFF3649992C32FBA75E688"
},
{
"category": "Persistence mechanism",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1530625013",
"to_ids": false,
"type": "regkey",
"uuid": "5b3b7bf5-fa50-44a7-b755-28b70acd0835",
"value": "HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths\\%WINDIR%\\SysWOW64\\kqgzitry\t0"
},
{
"category": "External analysis",
"comment": "",
"deleted": false,
"disable_correlation": false,
"timestamp": "1530625146",
"to_ids": false,
"type": "link",
"uuid": "5b3b7c72-4be0-49cf-94eb-28b50acd0835",
"value": "https://www.bleepingcomputer.com/news/security/all-radio-427-portable-cant-be-removed-then-your-pc-is-severely-infected/",
"Tag": [
{
"colour": "#00223b",
"local": false,
"name": "osint:source-type=\"blog-post\"",
"relationship_type": ""
}
]
}
]
}
}
Reference in a new issue View git blame Copy permalink