848 lines
No EOL
35 KiB
JSON
848 lines
No EOL
35 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--4ce77fdd-19a8-4037-ac75-4ece0c05d63f",
|
|
"objects": [
|
|
{
|
|
"type": "identity",
|
|
"spec_version": "2.1",
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2021-01-05T14:32:21.000Z",
|
|
"modified": "2021-01-05T14:32:21.000Z",
|
|
"name": "CIRCL",
|
|
"identity_class": "organization"
|
|
},
|
|
{
|
|
"type": "report",
|
|
"spec_version": "2.1",
|
|
"id": "report--4ce77fdd-19a8-4037-ac75-4ece0c05d63f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2021-01-05T14:32:21.000Z",
|
|
"modified": "2021-01-05T14:32:21.000Z",
|
|
"name": "C2-JARM - A list of JARM hashes for different ssl implementations used by some C2 tools.",
|
|
"published": "2021-01-05T14:32:45Z",
|
|
"object_refs": [
|
|
"observed-data--f572abd2-6032-4d7b-a43a-b7e3c02ec2cc",
|
|
"url--f572abd2-6032-4d7b-a43a-b7e3c02ec2cc",
|
|
"x-misp-object--ced5e867-1f14-4ffb-9689-8b567dc4fc67",
|
|
"x-misp-object--e93aa5ee-e092-4ef5-8e41-3429a83d2abe",
|
|
"x-misp-object--e6dd5ea7-3f49-4a62-bb21-b9ce07651d20",
|
|
"x-misp-object--a758246f-0986-4fe6-b97e-5abaa78aaa1c",
|
|
"x-misp-object--14941eb1-e8eb-424e-baec-9bbe3484c37c",
|
|
"x-misp-object--149bb42e-13f3-40cd-86f2-a777bcd48e5c",
|
|
"x-misp-object--71540ec8-7ab5-4101-833b-9581fa00aec3",
|
|
"x-misp-object--2167582f-1957-42e4-b487-07ab72472ebd",
|
|
"x-misp-object--8217d319-e5d7-4060-84ac-3cf744310696",
|
|
"x-misp-object--34e5ca1e-c73e-4d3c-a0b6-d4050ed3333c",
|
|
"x-misp-object--673d0d58-9054-4746-88e6-4e6a0ba0dec6",
|
|
"x-misp-object--961dd2b0-5313-4148-bb63-9b5ed35da7c0",
|
|
"x-misp-object--3858ea64-da2d-4f65-a09e-8f6b8d6221aa",
|
|
"x-misp-object--992020a7-615a-444c-b1f7-7770dbd88f3d",
|
|
"x-misp-object--4d3e74f4-45fc-48b5-bed2-df9fee9a7546",
|
|
"relationship--96484e76-3ae1-4fae-8507-9b3c109a0ed6"
|
|
],
|
|
"labels": [
|
|
"Threat-Report",
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
"type:OSINT",
|
|
"osint:lifetime=\"perpetual\"",
|
|
"osint:certainty=\"50\"",
|
|
"cycat:type=\"fingerprint\"",
|
|
"cycat:scope=\"investigation\"",
|
|
"misp-galaxy:tool=\"Cobalt Strike\"",
|
|
"misp-galaxy:tool=\"metasploit\""
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--f572abd2-6032-4d7b-a43a-b7e3c02ec2cc",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2021-01-05T14:18:43.000Z",
|
|
"modified": "2021-01-05T14:18:43.000Z",
|
|
"first_observed": "2021-01-05T14:18:43Z",
|
|
"last_observed": "2021-01-05T14:18:43Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--f572abd2-6032-4d7b-a43a-b7e3c02ec2cc"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--f572abd2-6032-4d7b-a43a-b7e3c02ec2cc",
|
|
"value": "https://github.com/cedowens/C2-JARM"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--ced5e867-1f14-4ffb-9689-8b567dc4fc67",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2021-01-05T13:56:11.000Z",
|
|
"modified": "2021-01-05T13:56:11.000Z",
|
|
"labels": [
|
|
"misp:name=\"jarm\"",
|
|
"misp:meta-category=\"network\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "jarm-fingerprint",
|
|
"object_relation": "jarm",
|
|
"value": "2ad2ad0002ad2ad00042d42d000000ad9bf51cc3f5a1e29eecb81d0c7b06eb",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "db1bef7e-6b94-40a6-94eb-e5b8c47ff6c5"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "tool",
|
|
"value": "Mythic",
|
|
"category": "Other",
|
|
"uuid": "2c127d4d-5c31-47c4-94fb-bff1bbb00674"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "reference",
|
|
"value": "https://github.com/its-a-feature/Mythic",
|
|
"category": "External analysis",
|
|
"uuid": "6cfc5cd7-4bec-479d-96d2-05c708aafd77"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "scope",
|
|
"value": "Malicious - C2",
|
|
"category": "Other",
|
|
"uuid": "61ad29ea-41a7-45ad-81c6-6ac7c737254f"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "tls-implementation",
|
|
"value": "python 3 w/aiohttp 3",
|
|
"category": "Other",
|
|
"uuid": "c1257f87-04cc-412b-8643-bd77b0b3f620"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "network",
|
|
"x_misp_name": "jarm"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--e93aa5ee-e092-4ef5-8e41-3429a83d2abe",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2021-01-05T13:58:49.000Z",
|
|
"modified": "2021-01-05T13:58:49.000Z",
|
|
"labels": [
|
|
"misp:name=\"jarm\"",
|
|
"misp:meta-category=\"network\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "jarm-fingerprint",
|
|
"object_relation": "jarm",
|
|
"value": "07d14d16d21d21d00042d43d000000aa99ce74e2c6d013c745aa52b5cc042d",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "a764fde0-771a-49f3-9702-f553f0daa10b"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "tool",
|
|
"value": "Metasploit ssl listener",
|
|
"category": "Other",
|
|
"uuid": "706d348d-6db7-4fa9-afc3-1c79baeaf25b"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "reference",
|
|
"value": "https://github.com/rapid7/metasploit-framework",
|
|
"category": "External analysis",
|
|
"uuid": "4df63fc2-8887-4744-b28f-d9fe004434ce"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "scope",
|
|
"value": "Malicious - C2",
|
|
"category": "Other",
|
|
"uuid": "c05806f2-43a0-4895-81f4-85c6e255f4f9"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "tls-implementation",
|
|
"value": "ruby 2.7.0p0",
|
|
"category": "Other",
|
|
"uuid": "10aff875-65e8-4d18-a105-bdd98197629d"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "network",
|
|
"x_misp_name": "jarm"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--e6dd5ea7-3f49-4a62-bb21-b9ce07651d20",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2021-01-05T14:00:10.000Z",
|
|
"modified": "2021-01-05T14:00:10.000Z",
|
|
"labels": [
|
|
"misp:name=\"jarm\"",
|
|
"misp:meta-category=\"network\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "jarm-fingerprint",
|
|
"object_relation": "jarm",
|
|
"value": "07d14d16d21d21d07c42d43d000000f50d155305214cf247147c43c0f1a823",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "b50ff3c6-6cd9-4371-be55-8a89a7fc545e"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "tool",
|
|
"value": "Metasploit ssl listener",
|
|
"category": "Other",
|
|
"uuid": "2fa1d211-4cb4-4b04-afae-4c51e96e08ff"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "reference",
|
|
"value": "https://github.com/rapid7/metasploit-framework",
|
|
"category": "External analysis",
|
|
"uuid": "fe088a1c-acc5-426c-9337-d756b9a98531"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "scope",
|
|
"value": "Malicious - C2",
|
|
"category": "Other",
|
|
"uuid": "0cd2a53a-27f3-47d6-98c0-97c68ea4eb47"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "tls-implementation",
|
|
"value": "ruby",
|
|
"category": "Other",
|
|
"uuid": "2a80b9e7-8403-426e-8b7e-d8b10430e3a8"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "network",
|
|
"x_misp_name": "jarm"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--a758246f-0986-4fe6-b97e-5abaa78aaa1c",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2021-01-05T14:05:35.000Z",
|
|
"modified": "2021-01-05T14:05:35.000Z",
|
|
"labels": [
|
|
"misp:name=\"jarm\"",
|
|
"misp:meta-category=\"network\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "jarm-fingerprint",
|
|
"object_relation": "jarm",
|
|
"value": "07d14d16d21d21d07c42d41d00041d24a458a375eef0c576d23a7bab9a9fb1",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "449c5134-2c5a-411d-b700-064ce3d0d5a1"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "tool",
|
|
"value": "Cobalt Strike",
|
|
"category": "Other",
|
|
"uuid": "34040bae-2bad-4dd3-8dec-219ae06f87fb"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "reference",
|
|
"value": "https://www.cobaltstrike.com/",
|
|
"category": "External analysis",
|
|
"uuid": "5a8c65ce-a5ee-4a30-a05e-ccc4764bde6c"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "scope",
|
|
"value": "Malicious - C2",
|
|
"category": "Other",
|
|
"uuid": "94f82e21-704d-4b5d-bdfb-673d7d7d6210"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "tls-implementation",
|
|
"value": "Java 11",
|
|
"category": "Other",
|
|
"uuid": "7f3f56cf-14e1-42c0-97e3-809fe3e7ad0c"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "network",
|
|
"x_misp_name": "jarm"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--14941eb1-e8eb-424e-baec-9bbe3484c37c",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2021-01-05T14:10:04.000Z",
|
|
"modified": "2021-01-05T14:10:04.000Z",
|
|
"labels": [
|
|
"misp:name=\"jarm\"",
|
|
"misp:meta-category=\"network\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "jarm-fingerprint",
|
|
"object_relation": "jarm",
|
|
"value": "29d21b20d29d29d21c41d21b21b41d494e0df9532e75299f15ba73156cee38",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "08ca7b92-8172-4739-ac7c-3f972cc8a328"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "tool",
|
|
"value": "Merlin",
|
|
"category": "Other",
|
|
"uuid": "fad3fccb-ef05-4c4c-bd93-7dd5ea0d216a"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "reference",
|
|
"value": "https://github.com/Ne0nd0g/merlin",
|
|
"category": "External analysis",
|
|
"uuid": "99f11535-af75-480e-b4e5-23750e58a893"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "scope",
|
|
"value": "Malicious - C2",
|
|
"category": "Other",
|
|
"uuid": "1887a168-ee89-4ce1-81a3-7ee8c64a0fa3"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "tls-implementation",
|
|
"value": "go 1.15.2 linux/amd64",
|
|
"category": "Other",
|
|
"uuid": "1a340b19-e004-4912-8b89-a786b6eaf10e"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "network",
|
|
"x_misp_name": "jarm"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--149bb42e-13f3-40cd-86f2-a777bcd48e5c",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2021-01-05T14:11:05.000Z",
|
|
"modified": "2021-01-05T14:11:05.000Z",
|
|
"labels": [
|
|
"misp:name=\"jarm\"",
|
|
"misp:meta-category=\"network\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "jarm-fingerprint",
|
|
"object_relation": "jarm",
|
|
"value": "00000000000000000041d00000041d9535d5979f591ae8e547c5e5743e5b64",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "89af9cc4-f17a-4aae-b816-467f6fb4410b"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "tool",
|
|
"value": "Deimos",
|
|
"category": "Other",
|
|
"uuid": "9553b5f5-cd91-415f-9f3e-eb4ff4fb2e41"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "reference",
|
|
"value": "https://github.com/DeimosC2/DeimosC2",
|
|
"category": "External analysis",
|
|
"uuid": "de402bf3-2c76-48dd-bbc4-1175f681b4e6"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "scope",
|
|
"value": "Malicious - C2",
|
|
"category": "Other",
|
|
"uuid": "5559888d-fc30-4f6f-9410-9b779fd6aca7"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "tls-implementation",
|
|
"value": "go 1.15.2 linux/amd64 with github.com/gorilla/websocket package",
|
|
"category": "Other",
|
|
"uuid": "c1bbab5c-0986-406e-b8d3-ef943c916417"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "network",
|
|
"x_misp_name": "jarm"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--71540ec8-7ab5-4101-833b-9581fa00aec3",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2021-01-05T14:12:09.000Z",
|
|
"modified": "2021-01-05T14:12:09.000Z",
|
|
"labels": [
|
|
"misp:name=\"jarm\"",
|
|
"misp:meta-category=\"network\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "jarm-fingerprint",
|
|
"object_relation": "jarm",
|
|
"value": "2ad2ad0002ad2ad22c42d42d000000faabb8fd156aa8b4d8a37853e1063261",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "0d79a2ce-2bcc-4972-a162-edceab95f71e"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "tool",
|
|
"value": "MacC2",
|
|
"category": "Other",
|
|
"uuid": "a13f2baf-9827-489d-9674-3b06a5d06804"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "reference",
|
|
"value": "https://github.com/cedowens/MacC2",
|
|
"category": "External analysis",
|
|
"uuid": "42f879f6-629d-4e43-8d5b-aaa98a0c9c03"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "scope",
|
|
"value": "Malicious - C2",
|
|
"category": "Other",
|
|
"uuid": "8644069d-b351-4d10-904e-5783aaae069b"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "tls-implementation",
|
|
"value": "python 3.8.6 w/aiohttp 3",
|
|
"category": "Other",
|
|
"uuid": "d6f89037-50c0-4460-b1ca-b89311d5419b"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "network",
|
|
"x_misp_name": "jarm"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--2167582f-1957-42e4-b487-07ab72472ebd",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2021-01-05T14:13:00.000Z",
|
|
"modified": "2021-01-05T14:13:00.000Z",
|
|
"labels": [
|
|
"misp:name=\"jarm\"",
|
|
"misp:meta-category=\"network\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "jarm-fingerprint",
|
|
"object_relation": "jarm",
|
|
"value": "2ad2ad0002ad2ad00042d42d000000ad9bf51cc3f5a1e29eecb81d0c7b06eb",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "ba06f416-b663-481e-89f7-eff6bd163088"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "tool",
|
|
"value": "MacC2",
|
|
"category": "Other",
|
|
"uuid": "c73119c6-0185-4ce4-9236-65d290d0873f"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "reference",
|
|
"value": "https://github.com/cedowens/MacC2",
|
|
"category": "External analysis",
|
|
"uuid": "90b06fa0-129e-4218-b4e7-bca7209df738"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "scope",
|
|
"value": "Malicious - C2",
|
|
"category": "Other",
|
|
"uuid": "c841489d-53f6-4a0c-a9c1-76368f92ebaf"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "tls-implementation",
|
|
"value": "python 3.8.2 w/aiohttp 3",
|
|
"category": "Other",
|
|
"uuid": "918e6d7a-670e-48c3-ae5e-2eaa1dbba809"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "network",
|
|
"x_misp_name": "jarm"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--8217d319-e5d7-4060-84ac-3cf744310696",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2021-01-05T14:13:49.000Z",
|
|
"modified": "2021-01-05T14:13:49.000Z",
|
|
"labels": [
|
|
"misp:name=\"jarm\"",
|
|
"misp:meta-category=\"network\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "jarm-fingerprint",
|
|
"object_relation": "jarm",
|
|
"value": "2ad000000000000000000000000000eeebf944d0b023a00f510f06a29b4f46",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "d0c773b3-60a6-4f65-afee-9b62c8e7917e"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "tool",
|
|
"value": "MacShellSwift",
|
|
"category": "Other",
|
|
"uuid": "ce2cd483-5478-413c-954d-09e0ccae2f19"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "reference",
|
|
"value": "https://github.com/cedowens/MacShellSwift",
|
|
"category": "External analysis",
|
|
"uuid": "1e917e1a-8cfd-4f4d-8b4f-a9680a92b872"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "scope",
|
|
"value": "Malicious - C2",
|
|
"category": "Other",
|
|
"uuid": "73e97aac-333e-46a0-82ff-96ef1fe6143d"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "tls-implementation",
|
|
"value": "python 3.8.6 socket",
|
|
"category": "Other",
|
|
"uuid": "9ad1e43d-ed19-4e62-84f5-60e65fe943b4"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "network",
|
|
"x_misp_name": "jarm"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--34e5ca1e-c73e-4d3c-a0b6-d4050ed3333c",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2021-01-05T14:14:34.000Z",
|
|
"modified": "2021-01-05T14:14:34.000Z",
|
|
"labels": [
|
|
"misp:name=\"jarm\"",
|
|
"misp:meta-category=\"network\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "jarm-fingerprint",
|
|
"object_relation": "jarm",
|
|
"value": "2ad000000000000000000000000000eeebf944d0b023a00f510f06a29b4f46",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "eb638ebb-b415-42a5-a0ec-e921aba3e8f0"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "tool",
|
|
"value": "MacShell",
|
|
"category": "Other",
|
|
"uuid": "8ad8e0cc-ca3b-4254-bf54-27806f22587f"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "reference",
|
|
"value": "https://github.com/cedowens/MacShellSwift",
|
|
"category": "External analysis",
|
|
"uuid": "c54ba9b9-0bba-4068-8008-8adc23303b91"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "scope",
|
|
"value": "Malicious - C2",
|
|
"category": "Other",
|
|
"uuid": "c0ff2c54-cb3b-47e5-8583-0a21bca31678"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "tls-implementation",
|
|
"value": "python 3.8.6 socket",
|
|
"category": "Other",
|
|
"uuid": "c26b76fa-3580-43a3-9249-fcefe4d87388"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "network",
|
|
"x_misp_name": "jarm"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--673d0d58-9054-4746-88e6-4e6a0ba0dec6",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2021-01-05T14:15:29.000Z",
|
|
"modified": "2021-01-05T14:15:29.000Z",
|
|
"labels": [
|
|
"misp:name=\"jarm\"",
|
|
"misp:meta-category=\"network\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "jarm-fingerprint",
|
|
"object_relation": "jarm",
|
|
"value": "2ad2ad0002ad2ad00041d2ad2ad41da5207249a18099be84ef3c8811adc883",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "05fa1dff-6273-470a-b49c-431994743fdb"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "tool",
|
|
"value": "Sliver",
|
|
"category": "Other",
|
|
"uuid": "e9af814d-14bc-427b-bfff-4405779c931a"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "reference",
|
|
"value": "https://github.com/BishopFox/sliver",
|
|
"category": "External analysis",
|
|
"uuid": "21e9691b-95be-41a4-971b-11b08bf0fdea"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "scope",
|
|
"value": "Malicious - C2",
|
|
"category": "Other",
|
|
"uuid": "133624cd-879e-4695-a0fd-0423467dd688"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "tls-implementation",
|
|
"value": "go 1.15.2 linux/amd64",
|
|
"category": "Other",
|
|
"uuid": "351e1c90-ee5f-4ea4-8f2a-71246084365c"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "network",
|
|
"x_misp_name": "jarm"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--961dd2b0-5313-4148-bb63-9b5ed35da7c0",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2021-01-05T14:16:37.000Z",
|
|
"modified": "2021-01-05T14:16:37.000Z",
|
|
"labels": [
|
|
"misp:name=\"jarm\"",
|
|
"misp:meta-category=\"network\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "jarm-fingerprint",
|
|
"object_relation": "jarm",
|
|
"value": "20d14d20d21d20d20c20d14d20d20daddf8a68a1444c74b6dbe09910a511e6",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "8c3f9ef9-70f8-44ee-9884-c963b2917b2c"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "tool",
|
|
"value": "EvilGinx2",
|
|
"category": "Other",
|
|
"uuid": "ebf3ebf0-9d01-490b-a91e-587b2be69cd8"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "reference",
|
|
"value": "https://github.com/kgretzky/evilginx2",
|
|
"category": "External analysis",
|
|
"uuid": "9e987aac-60ed-490a-9250-a952a2dcda82"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "scope",
|
|
"value": "Malicious - C2",
|
|
"category": "Other",
|
|
"uuid": "d62d2f32-f935-4f48-9121-c064cb2e06f8"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "tls-implementation",
|
|
"value": "go 1.10.4 linux/amd64",
|
|
"category": "Other",
|
|
"uuid": "ef99db24-fa12-44f6-8ebe-ec984577bd87"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "network",
|
|
"x_misp_name": "jarm"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--3858ea64-da2d-4f65-a09e-8f6b8d6221aa",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2021-01-05T14:17:25.000Z",
|
|
"modified": "2021-01-05T14:17:25.000Z",
|
|
"labels": [
|
|
"misp:name=\"jarm\"",
|
|
"misp:meta-category=\"network\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "jarm-fingerprint",
|
|
"object_relation": "jarm",
|
|
"value": "2ad2ad0002ad2ad00042d42d000000ad9bf51cc3f5a1e29eecb81d0c7b06eb",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "7814567b-ad50-4351-8d2d-21ce8a382dd3"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "tool",
|
|
"value": "Shad0w",
|
|
"category": "Other",
|
|
"uuid": "5e0e2530-9051-460a-8990-bb03e4791a90"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "reference",
|
|
"value": "https://github.com/bats3c/shad0w",
|
|
"category": "External analysis",
|
|
"uuid": "fc29c257-02dc-4c94-b27d-bbd4f2caa13f"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "scope",
|
|
"value": "Malicious - C2",
|
|
"category": "Other",
|
|
"uuid": "1365786b-5c55-4ec2-b140-5dfda158e75b"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "tls-implementation",
|
|
"value": "python 3.8 flask",
|
|
"category": "Other",
|
|
"uuid": "7db599cc-c1a7-478b-9ea6-95d585ce5643"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "network",
|
|
"x_misp_name": "jarm"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--992020a7-615a-444c-b1f7-7770dbd88f3d",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2021-01-05T14:18:09.000Z",
|
|
"modified": "2021-01-05T14:18:09.000Z",
|
|
"labels": [
|
|
"misp:name=\"jarm\"",
|
|
"misp:meta-category=\"network\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "jarm-fingerprint",
|
|
"object_relation": "jarm",
|
|
"value": "07d19d12d21d21d07c07d19d07d21da5a8ab90bcc6bf8bbc6fbec4bcaa8219",
|
|
"category": "Network activity",
|
|
"to_ids": true,
|
|
"uuid": "3991d211-7c60-4c55-bf9d-1e8cb0e26eed"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "tool",
|
|
"value": "Get2",
|
|
"category": "Other",
|
|
"uuid": "4ba185ae-af87-4a08-959d-3a6c1e2f83c1"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "scope",
|
|
"value": "Malicious - C2",
|
|
"category": "Other",
|
|
"uuid": "b2963c66-ff54-41fd-8484-a9271d710be2"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "tls-implementation",
|
|
"value": "N/A",
|
|
"category": "Other",
|
|
"uuid": "814aaeef-74ae-48de-aaf5-745cc3e42a90"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "network",
|
|
"x_misp_name": "jarm"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--4d3e74f4-45fc-48b5-bed2-df9fee9a7546",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2021-01-05T14:30:42.000Z",
|
|
"modified": "2021-01-05T14:30:42.000Z",
|
|
"labels": [
|
|
"misp:name=\"report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "text",
|
|
"object_relation": "summary",
|
|
"value": "A list of JARM hashes for different ssl implementations used by some C2 tools. Also adding other useful red team tools that use ssl (ex: EvilGinx2).\r\n\r\nFor more info on JARM hashing, check out the work by the Salesforce security team on their JARM github link here: https://github.com/salesforce/jarm\r\n\r\nThis is a neat way to fingerprint ssl servers by the software implementation. This alone would not be sufficient to detect C2 in a high fidelity manner, but JARM hashes coupled with other high value indicators would certainly be of value. This also highlights the need for red teams to ensure their C2 infra is not exposed for public access.\r\n\r\nI plan to add more to this list over time. Feel free to contribute!!",
|
|
"category": "Other",
|
|
"uuid": "631bc767-1690-4513-bbb7-ab93acb34a34"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "report"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--96484e76-3ae1-4fae-8507-9b3c109a0ed6",
|
|
"created": "1970-01-01T00:00:00.000Z",
|
|
"modified": "1970-01-01T00:00:00.000Z",
|
|
"relationship_type": "references",
|
|
"source_ref": "x-misp-object--4d3e74f4-45fc-48b5-bed2-df9fee9a7546",
|
|
"target_ref": "observed-data--f572abd2-6032-4d7b-a43a-b7e3c02ec2cc"
|
|
},
|
|
{
|
|
"type": "marking-definition",
|
|
"spec_version": "2.1",
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
"definition_type": "tlp",
|
|
"name": "TLP:WHITE",
|
|
"definition": {
|
|
"tlp": "white"
|
|
}
|
|
}
|
|
]
|
|
} |