adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/5e00d123-d688-417f-aafe-40fb02de0b81.json

256 lines
No EOL
12 KiB
JSON
Raw Blame History

{
"type": "bundle",
"id": "bundle--5e00d123-d688-417f-aafe-40fb02de0b81",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-23T14:43:48.000Z",
"modified": "2019-12-23T14:43:48.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--5e00d123-d688-417f-aafe-40fb02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-23T14:43:48.000Z",
"modified": "2019-12-23T14:43:48.000Z",
"name": "OSINT - Reversing a real-world 249 bytes backdoor!",
"published": "2019-12-23T14:44:10Z",
"object_refs": [
"observed-data--5e00d23b-051c-4038-866e-4aaa02de0b81",
"url--5e00d23b-051c-4038-866e-4aaa02de0b81",
"indicator--5e00d186-98c8-4333-8ce9-464802de0b81",
"indicator--5e00d1ba-d438-4138-90ad-427802de0b81",
"indicator--565a1793-5fe6-4024-aa00-e20ba4508e7d",
"x-misp-object--2be25da5-2716-4bb5-b8e7-cc49a557b6ea",
"indicator--5e00d259-cf84-4973-84be-41ac02de0b81",
"relationship--da578384-7f24-4c71-b1cb-758bdf9ec851",
"relationship--b2035f8e-ac01-4418-8793-eae28d3ecf67",
"relationship--e90f8c8a-e9ca-4992-9fc1-bf7012a66f13",
"relationship--8f1cc498-63b6-4bc3-a5a0-271753f6dff6"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"type:OSINT",
"osint:lifetime=\"perpetual\"",
"osint:certainty=\"50\"",
"ms-caro-malware:malware-type=\"Backdoor\""
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5e00d23b-051c-4038-866e-4aaa02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-23T14:42:03.000Z",
"modified": "2019-12-23T14:42:03.000Z",
"first_observed": "2019-12-23T14:42:03Z",
"last_observed": "2019-12-23T14:42:03Z",
"number_observed": 1,
"object_refs": [
"url--5e00d23b-051c-4038-866e-4aaa02de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--5e00d23b-051c-4038-866e-4aaa02de0b81",
"value": "https://anee.me/reversing-a-real-world-249-bytes-backdoor-aadd876c0a32?gi=af1848a0c8d6"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5e00d186-98c8-4333-8ce9-464802de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-23T14:39:02.000Z",
"modified": "2019-12-23T14:39:02.000Z",
"description": "Apparently it tries to make a socket and connect to the IP address: 104.248.237.194 on port number 1337. This ip address is owned by Digital Ocean.",
"pattern": "[(network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '104.248.237.194') AND network-traffic:dst_port = '1337']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-12-23T14:39:02Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "network"
}
],
"labels": [
"misp:name=\"ip-port\"",
"misp:meta-category=\"network\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5e00d1ba-d438-4138-90ad-427802de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-23T14:43:48.000Z",
"modified": "2019-12-23T14:43:48.000Z",
"description": "Epic! This 249 byte backdoor can run any shellcode we give it. The attackers can deploy it on an offshore IP address and execute arbitrary instructions on the victim\u00e2\u20ac\u2122s box.",
"pattern": "[file:hashes.MD5 = '93363683dcf1ccc4db296fa5fde69b71' AND file:hashes.SHA1 = '0d4570ae80f9fca2d4b68a7f4b88dd0eb2df3573']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-12-23T14:43:48Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--565a1793-5fe6-4024-aa00-e20ba4508e7d",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-23T14:43:22.000Z",
"modified": "2019-12-23T14:43:22.000Z",
"pattern": "[file:hashes.MD5 = '93363683dcf1ccc4db296fa5fde69b71' AND file:hashes.SHA1 = '0d4570ae80f9fca2d4b68a7f4b88dd0eb2df3573' AND file:hashes.SHA256 = '5141d29d0278c8da4eac177126cbf4d15623502d4763abd6d3a4dca2a3ea616e']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-12-23T14:43:22Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--2be25da5-2716-4bb5-b8e7-cc49a557b6ea",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-23T14:41:16.000Z",
"modified": "2019-12-23T14:41:16.000Z",
"labels": [
"misp:name=\"virustotal-report\"",
"misp:meta-category=\"misc\""
],
"x_misp_attributes": [
{
"type": "datetime",
"object_relation": "last-submission",
"value": "2019-12-23T14:37:22",
"category": "Other",
"uuid": "455902f8-0097-4722-b3e8-632b0576b786"
},
{
"type": "link",
"object_relation": "permalink",
"value": "https://www.virustotal.com/file/5141d29d0278c8da4eac177126cbf4d15623502d4763abd6d3a4dca2a3ea616e/analysis/1577111842/",
"category": "Payload delivery",
"uuid": "8e8622e6-c217-4007-b5b1-f687b7229150"
},
{
"type": "text",
"object_relation": "detection-ratio",
"value": "16/60",
"category": "Payload delivery",
"uuid": "9eace253-03a3-48a4-b9df-372f58d000fe"
}
],
"x_misp_meta_category": "misc",
"x_misp_name": "virustotal-report"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5e00d259-cf84-4973-84be-41ac02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-12-23T14:42:33.000Z",
"modified": "2019-12-23T14:42:33.000Z",
"description": "The payload",
"pattern": "[file:hashes.MD5 = '93363683dcf1ccc4db296fa5fde69b71' AND file:hashes.SHA1 = '0d4570ae80f9fca2d4b68a7f4b88dd0eb2df3573' AND file:hashes.SHA256 = '5141d29d0278c8da4eac177126cbf4d15623502d4763abd6d3a4dca2a3ea616e' AND file:name = 'pay.bin' AND file:size = '249' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIAFF1l0/yRZ1UsgAAAPkAAAAgABwAOTMzNjM2ODNkY2YxY2NjNGRiMjk2ZmE1ZmRlNjliNzFVVAkAA1nSAF5Z0gBedXgLAAEEIQAAAAQhAAAAvqjt0iUIi4uyNisDgBbMaHCnsKqPxjxpPH/j7WjbigFyFZA/IjIYjAG+CYO0Z4hGM+ugnHUGqFnGgUZG9pDrFQxcSI06cNK19h+1W8HjHTIGLnsIXlwIYPEyVaTS7mpAP9Cp/67AnVBRTqd9OiDzStsPebcgilKPPiXPmG3PvTFWBBCtEcVIwswY6e3dSDdUsZJ77r11CBOk89VTgD49ONCQx5n3uP0Gj9dDUCyQ+TrGiFBLBwjyRZ1UsgAAAPkAAABQSwMECgAJAAAAUXWXT+YK5VMTAAAABwAAAC0AHAA5MzM2MzY4M2RjZjFjY2M0ZGIyOTZmYTVmZGU2OWI3MS5maWxlbmFtZS50eHRVVAkAA1nSAF5Z0gBedXgLAAEEIQAAAAQhAAAA5ApOcJaEASZbKJeSi3wsUB8AIVBLBwjmCuVTEwAAAAcAAABQSwECHgMUAAkACABRdZdP8kWdVLIAAAD5AAAAIAAYAAAAAAAAAAAApIEAAAAAOTMzNjM2ODNkY2YxY2NjNGRiMjk2ZmE1ZmRlNjliNzFVVAUAA1nSAF51eAsAAQQhAAAABCEAAABQSwECHgMKAAkAAABRdZdP5grlUxMAAAAHAAAALQAYAAAAAAABAAAApIEcAQAAOTMzNjM2ODNkY2YxY2NjNGRiMjk2ZmE1ZmRlNjliNzEuZmlsZW5hbWUudHh0VVQFAANZ0gBedXgLAAEEIQAAAAQhAAAAUEsFBgAAAAACAAIA2QAAAKYBAAAAAA==' AND file:content_ref.x_misp_filename = 'pay.bin' AND file:content_ref.hashes.MD5 = '93363683dcf1ccc4db296fa5fde69b71' AND file:content_ref.mime_type = 'application/zip' AND file:content_ref.encryption_algorithm = 'mime-type-indicated' AND file:content_ref.decryption_key = 'infected')]",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-12-23T14:42:33Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--da578384-7f24-4c71-b1cb-758bdf9ec851",
"created": "2019-12-23T14:40:19.000Z",
"modified": "2019-12-23T14:40:19.000Z",
"relationship_type": "connects-to",
"source_ref": "indicator--5e00d1ba-d438-4138-90ad-427802de0b81",
"target_ref": "indicator--5e00d186-98c8-4333-8ce9-464802de0b81"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--b2035f8e-ac01-4418-8793-eae28d3ecf67",
"created": "2019-12-23T14:43:48.000Z",
"modified": "2019-12-23T14:43:48.000Z",
"relationship_type": "related-to",
"source_ref": "indicator--5e00d1ba-d438-4138-90ad-427802de0b81",
"target_ref": "indicator--5e00d259-cf84-4973-84be-41ac02de0b81"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e90f8c8a-e9ca-4992-9fc1-bf7012a66f13",
"created": "2019-12-23T14:41:17.000Z",
"modified": "2019-12-23T14:41:17.000Z",
"relationship_type": "analysed-with",
"source_ref": "indicator--565a1793-5fe6-4024-aa00-e20ba4508e7d",
"target_ref": "x-misp-object--2be25da5-2716-4bb5-b8e7-cc49a557b6ea"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--8f1cc498-63b6-4bc3-a5a0-271753f6dff6",
"created": "2019-12-23T14:43:22.000Z",
"modified": "2019-12-23T14:43:22.000Z",
"relationship_type": "connects-to",
"source_ref": "indicator--565a1793-5fe6-4024-aa00-e20ba4508e7d",
"target_ref": "indicator--5e00d186-98c8-4333-8ce9-464802de0b81"
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
]
}
Reference in a new issue View git blame Copy permalink