adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/5d01fda4-353c-4011-854f-459c950d210f.json

450 lines
No EOL
15 KiB
JSON
Raw Blame History

{
"Event": {
"analysis": "0",
"date": "2019-06-12",
"extends_uuid": "",
"info": "OSINT - Trojan downloader found on Google Play by @Maler360",
"publish_timestamp": "1566554388",
"published": true,
"threat_level_id": "3",
"timestamp": "1566554377",
"uuid": "5d01fda4-353c-4011-854f-459c950d210f",
"Orgc": {
"name": "CIRCL",
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
},
"Tag": [
{
"colour": "#500064",
"local": false,
"name": "ms-caro-malware:malware-type=\"Trojan\"",
"relationship_type": ""
},
{
"colour": "#00183c",
"local": false,
"name": "ms-caro-malware-full:malware-type=\"Trojan\"",
"relationship_type": ""
},
{
"colour": "#004f4f",
"local": false,
"name": "ecsirt:malicious-code=\"trojan\"",
"relationship_type": ""
},
{
"colour": "#5a0041",
"local": false,
"name": "CERT-XLM:malicious-code=\"trojan-malware\"",
"relationship_type": ""
},
{
"colour": "#284800",
"local": false,
"name": "malware_classification:malware-category=\"Trojan\"",
"relationship_type": ""
},
{
"colour": "#004646",
"local": false,
"name": "type:OSINT",
"relationship_type": ""
},
{
"colour": "#0071c3",
"local": false,
"name": "osint:lifetime=\"perpetual\"",
"relationship_type": ""
},
{
"colour": "#0087e8",
"local": false,
"name": "osint:certainty=\"50\"",
"relationship_type": ""
},
{
"colour": "#ffffff",
"local": false,
"name": "tlp:white",
"relationship_type": ""
}
],
"Object": [
{
"comment": "",
"deleted": false,
"description": "Microblog post like a Twitter tweet or a post on a Facebook wall.",
"meta-category": "misc",
"name": "microblog",
"template_uuid": "8ec8c911-ddbe-4f5b-895b-fbff70c42a60",
"template_version": "6",
"timestamp": "1560416338",
"uuid": "5d021052-19e0-4c1a-9f4e-4beb950d210f",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "post",
"timestamp": "1560416338",
"to_ids": false,
"type": "text",
"uuid": "5d021052-eaa4-46aa-834d-47e0950d210f",
"value": "Trojan downloader found on Google Play by @Maler360\r\n\r\n\r\n-once launched, hides itself icon\r\n-downloads additional app over HTTP\r\n-makes user install it\r\n-second app can then download additional apps & make user install them as \"Update Alert\" + display ads\r\n-100,000+ installs\r\n-reported"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "type",
"timestamp": "1560416339",
"to_ids": false,
"type": "text",
"uuid": "5d021053-7740-497d-b628-4080950d210f",
"value": "Twitter"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "url",
"timestamp": "1560416339",
"to_ids": true,
"type": "url",
"uuid": "5d021053-c424-4754-a928-4d60950d210f",
"value": "https://mobile.twitter.com/LukasStefanko/status/1138764352411131905"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "username-quoted",
"timestamp": "1560416339",
"to_ids": false,
"type": "text",
"uuid": "5d021053-5310-4d89-9100-4cc4950d210f",
"value": "@Maler360"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "username",
"timestamp": "1560416339",
"to_ids": false,
"type": "text",
"uuid": "5d021053-f308-4168-8167-4f9a950d210f",
"value": "LukasStefanko"
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "creation-date",
"timestamp": "1560416339",
"to_ids": false,
"type": "datetime",
"uuid": "5d021053-5a70-46c7-938e-47dc950d210f",
"value": "2019-06-12T13:05:00"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "17",
"timestamp": "1560416558",
"uuid": "5d02112e-2e34-48ce-9cc6-42aa950d210f",
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "filename",
"timestamp": "1560416558",
"to_ids": true,
"type": "filename",
"uuid": "5d02112e-20ac-452a-903b-43f1950d210f",
"value": "com.pippa.amazingmonstercar"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1560416568",
"to_ids": true,
"type": "md5",
"uuid": "5d021138-4ab8-49a2-b718-4513950d210f",
"value": "6d48cf90e0af21da5e516f0009efcc7f"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "17",
"timestamp": "1560416709",
"uuid": "5d0211c5-e644-494f-9fb6-4475950d210f",
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "filename",
"timestamp": "1560416710",
"to_ids": true,
"type": "filename",
"uuid": "5d0211c6-7fb4-451f-ac91-4cb8950d210f",
"value": "nightdescent.apk"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1560416713",
"to_ids": true,
"type": "md5",
"uuid": "5d0211c9-beec-436e-98b8-4be8950d210f",
"value": "f64cbd33651a99b08a9168607a2374d1"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "17",
"timestamp": "1566554363",
"uuid": "1aff6893-393f-4b72-ac4d-9e083901d021",
"ObjectReference": [
{
"comment": "",
"object_uuid": "1aff6893-393f-4b72-ac4d-9e083901d021",
"referenced_uuid": "97e74bae-c5ce-4338-8ccc-42d85a523d67",
"relationship_type": "analysed-with",
"timestamp": "1566554365",
"uuid": "5d5fb8fd-f340-4de1-9dc9-4168950d210f"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1560416713",
"to_ids": true,
"type": "md5",
"uuid": "b32c0591-6c4a-4ed8-a915-35eba5cb1fac",
"value": "f64cbd33651a99b08a9168607a2374d1"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1560416713",
"to_ids": true,
"type": "sha1",
"uuid": "a5d88c4e-b23b-4185-9c52-3e15f613d37a",
"value": "a16bb93ee35e7636e4f824010ddbba975a7db5ed"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1560416713",
"to_ids": true,
"type": "sha256",
"uuid": "6373314d-4122-4da7-9e1f-1207fef3b124",
"value": "3055fc207f21d4140249a3eb3efcdea047dfe005a4c23388ab917ffe3a8515d7"
}
]
},
{
"comment": "",
"deleted": false,
"description": "VirusTotal report",
"meta-category": "misc",
"name": "virustotal-report",
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
"template_version": "2",
"timestamp": "1566554363",
"uuid": "97e74bae-c5ce-4338-8ccc-42d85a523d67",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "last-submission",
"timestamp": "1560416713",
"to_ids": false,
"type": "datetime",
"uuid": "230977f5-f6de-4656-b687-80da6fea7b01",
"value": "2019-06-30T19:04:50"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "permalink",
"timestamp": "1560416713",
"to_ids": false,
"type": "link",
"uuid": "cace9e83-b407-4f5f-8650-67b59112656b",
"value": "https://www.virustotal.com/file/3055fc207f21d4140249a3eb3efcdea047dfe005a4c23388ab917ffe3a8515d7/analysis/1561921490/"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "detection-ratio",
"timestamp": "1560416713",
"to_ids": false,
"type": "text",
"uuid": "7f114609-9d79-47f5-a3f9-1ab3d9abd96f",
"value": "24/61"
}
]
},
{
"comment": "",
"deleted": false,
"description": "File object describing a file with meta-information",
"meta-category": "file",
"name": "file",
"template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
"template_version": "17",
"timestamp": "1566554364",
"uuid": "43258e1d-e7f7-4d86-81e2-be8ea5699a06",
"ObjectReference": [
{
"comment": "",
"object_uuid": "43258e1d-e7f7-4d86-81e2-be8ea5699a06",
"referenced_uuid": "e77b5597-90c3-4499-8562-25ffbea00286",
"relationship_type": "analysed-with",
"timestamp": "1566554365",
"uuid": "5d5fb8fd-e214-4ed1-ab14-4dca950d210f"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "md5",
"timestamp": "1560416568",
"to_ids": true,
"type": "md5",
"uuid": "878fd93b-27bf-49e3-a7db-04083ed645d8",
"value": "6d48cf90e0af21da5e516f0009efcc7f"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha1",
"timestamp": "1560416568",
"to_ids": true,
"type": "sha1",
"uuid": "f6772f0b-7182-4768-b096-109a2d023768",
"value": "83dbf7f9097aa314c64d1ed50a7a112ca87ed38d"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "sha256",
"timestamp": "1560416568",
"to_ids": true,
"type": "sha256",
"uuid": "c95bcce1-789d-4e80-a880-d839f1b2d3d4",
"value": "32c3c1732d8a5b299045ef44f9165d2710d098fc402358aa09ad07fcfd05db1c"
}
]
},
{
"comment": "",
"deleted": false,
"description": "VirusTotal report",
"meta-category": "misc",
"name": "virustotal-report",
"template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
"template_version": "2",
"timestamp": "1566554364",
"uuid": "e77b5597-90c3-4499-8562-25ffbea00286",
"Attribute": [
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "last-submission",
"timestamp": "1560416568",
"to_ids": false,
"type": "datetime",
"uuid": "bd891f80-8e4c-4dc6-801a-dc838de32a1a",
"value": "2019-06-30T19:04:34"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "permalink",
"timestamp": "1560416568",
"to_ids": false,
"type": "link",
"uuid": "24a845de-e030-41f1-893e-d0b69cdfb811",
"value": "https://www.virustotal.com/file/32c3c1732d8a5b299045ef44f9165d2710d098fc402358aa09ad07fcfd05db1c/analysis/1561921474/"
},
{
"category": "Payload delivery",
"comment": "",
"deleted": false,
"disable_correlation": true,
"object_relation": "detection-ratio",
"timestamp": "1560416568",
"to_ids": false,
"type": "text",
"uuid": "55169594-dc67-4c52-8b57-5b134a3fdd8e",
"value": "16/60"
}
]
}
]
}
}
Reference in a new issue View git blame Copy permalink