207 lines
No EOL
5.7 KiB
JSON
207 lines
No EOL
5.7 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "0",
|
|
"date": "2019-01-31",
|
|
"extends_uuid": "",
|
|
"info": "2019-01-31: ISFB v2 Installs Dridex \"3101\"",
|
|
"publish_timestamp": "1548966939",
|
|
"published": true,
|
|
"threat_level_id": "2",
|
|
"timestamp": "1548966934",
|
|
"uuid": "5c5331ac-c160-4a17-a34f-3da568f8e8cf",
|
|
"Orgc": {
|
|
"name": "VK-Intel",
|
|
"uuid": "5bfa439e-c978-4dcd-b474-73f568f8e8cf"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#20ad13",
|
|
"local": false,
|
|
"name": "Banker: Gozi ISFB v2",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#6f236b",
|
|
"local": false,
|
|
"name": "Banker: Dridex",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#bcdb18",
|
|
"local": false,
|
|
"name": "Botnet \"3101\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#000000",
|
|
"local": false,
|
|
"name": "10291029JSJUYNHG",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"local": false,
|
|
"name": "misp-galaxy:malpedia=\"Dridex\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#004646",
|
|
"local": false,
|
|
"name": "type:OSINT",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0071c3",
|
|
"local": false,
|
|
"name": "osint:lifetime=\"perpetual\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#0087e8",
|
|
"local": false,
|
|
"name": "osint:certainty=\"50\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": false,
|
|
"name": "tlp:white",
|
|
"relationship_type": ""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1548956076",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5c5331ac-9784-4e2e-8d87-3da568f8e8cf",
|
|
"value": "dc0cf61f5118914e13699fc94419815a"
|
|
},
|
|
{
|
|
"category": "Payload installation",
|
|
"comment": "ISFB v2 Unpacked",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1548956643",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5c5333e3-bdc0-4d4d-88bc-3a8868f8e8cf",
|
|
"value": "dc0cf61f5118914e13699fc94419815a"
|
|
},
|
|
{
|
|
"category": "Payload installation",
|
|
"comment": "ISFB v2 Loader packed",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1548956664",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5c5333f8-415c-4a90-9d03-3a8768f8e8cf",
|
|
"value": "d81e207b6ab5630b9f77b8ef383d9adc"
|
|
},
|
|
{
|
|
"category": "Payload installation",
|
|
"comment": "Dridex Loader 3101",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1548956738",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5c533442-dcc4-4cf9-96b3-3da768f8e8cf",
|
|
"value": "80c732191c362d74f1bad004335e4432"
|
|
},
|
|
{
|
|
"category": "Payload installation",
|
|
"comment": "Dridex Hooker",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1548956766",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5c53345e-faf4-4d87-a9d4-3daa68f8e8cf",
|
|
"value": "d987c99fb2afc70bf0df8e05216da356"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Gozi ISFB v2 Config",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1548956800",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5c533480-1348-48e5-a808-512d68f8e8cf",
|
|
"value": "taileenanahi.company"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Gozi ISFB v2 Config",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1548956800",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5c533480-206c-40d1-9d3c-512d68f8e8cf",
|
|
"value": "f60vinnie75.city"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Gozi ISFB v2 Config",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1548956800",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "5c533480-1eb8-458f-8481-512d68f8e8cf",
|
|
"value": "h5441eqzey.fun"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Dridex 3101 Config",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1548956877",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5c5334cd-ffdc-4fd3-8666-3a8f68f8e8cf",
|
|
"value": "185.236.76.35:443"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Dridex 3101 Config",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1548956877",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5c5334cd-32e4-47ec-90a2-3a8f68f8e8cf",
|
|
"value": "185.158.251.13:443"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Dridex 3101 Config",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1548956877",
|
|
"to_ids": true,
|
|
"type": "url",
|
|
"uuid": "5c5334cd-93e0-4733-a743-3a8f68f8e8cf",
|
|
"value": "5.188.232.210:443"
|
|
},
|
|
{
|
|
"category": "Payload installation",
|
|
"comment": "ISFB v214.06 Loader Unpacked",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1548957342",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5c53369e-a31c-4875-9c94-513268f8e8cf",
|
|
"value": "96deee3639b433eedebbbbc15ee56787"
|
|
}
|
|
]
|
|
}
|
|
} |