881 lines
No EOL
38 KiB
JSON
881 lines
No EOL
38 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--59282239-845c-495d-b3db-4ebb950d210f",
|
|
"objects": [
|
|
{
|
|
"type": "identity",
|
|
"spec_version": "2.1",
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T13:14:36.000Z",
|
|
"modified": "2017-05-26T13:14:36.000Z",
|
|
"name": "CIRCL",
|
|
"identity_class": "organization"
|
|
},
|
|
{
|
|
"type": "report",
|
|
"spec_version": "2.1",
|
|
"id": "report--59282239-845c-495d-b3db-4ebb950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T13:14:36.000Z",
|
|
"modified": "2017-05-26T13:14:36.000Z",
|
|
"name": "OSINT - Analysis of Emotet v4",
|
|
"published": "2017-05-26T13:14:42Z",
|
|
"object_refs": [
|
|
"observed-data--59282258-d130-4a21-864e-4712950d210f",
|
|
"url--59282258-d130-4a21-864e-4712950d210f",
|
|
"x-misp-attribute--59282381-e64c-46c9-88a9-40ff950d210f",
|
|
"x-misp-attribute--592823a0-1400-4721-8b31-4276950d210f",
|
|
"indicator--592823c5-6a88-4023-aa9e-4b45950d210f",
|
|
"indicator--592823d5-b3bc-4845-a841-4ae5950d210f",
|
|
"indicator--592823d5-63d4-4ae4-ac7c-4c0c950d210f",
|
|
"indicator--592823d6-83cc-4b3b-adc5-4b2b950d210f",
|
|
"indicator--592823f7-6938-4073-8b4e-4331950d210f",
|
|
"indicator--592823f7-f390-440f-87de-4f93950d210f",
|
|
"indicator--592823f7-b7b4-4ca7-8917-4eaa950d210f",
|
|
"indicator--592823f8-72dc-4b2d-b274-4902950d210f",
|
|
"indicator--592823f8-4144-4d11-8f74-4a27950d210f",
|
|
"indicator--592823f9-30a4-4976-8f2f-486d950d210f",
|
|
"indicator--592823f9-8680-4722-90bd-4679950d210f",
|
|
"indicator--592823fa-8980-4ea0-bee6-4f15950d210f",
|
|
"indicator--592823fa-9250-447d-a1ac-44d5950d210f",
|
|
"indicator--592823fa-38b0-4c02-80cd-45ef950d210f",
|
|
"indicator--592823fb-b55c-4f7f-aca5-4edd950d210f",
|
|
"indicator--592823fc-fd98-4a8a-9724-496f950d210f",
|
|
"indicator--5928243e-f388-465a-b65b-447b02de0b81",
|
|
"indicator--5928243e-1490-48d5-a33e-487a02de0b81",
|
|
"observed-data--5928243f-2964-4f17-a96e-470402de0b81",
|
|
"url--5928243f-2964-4f17-a96e-470402de0b81",
|
|
"indicator--5928243f-2ebc-40bb-af6b-44d902de0b81",
|
|
"indicator--59282440-d650-4fba-bc1c-407f02de0b81",
|
|
"observed-data--59282440-a03c-44f6-b704-4b7402de0b81",
|
|
"url--59282440-a03c-44f6-b704-4b7402de0b81",
|
|
"indicator--59282441-91c8-46fc-8cda-4e4c02de0b81",
|
|
"indicator--59282442-2d44-44c0-808b-4f3a02de0b81",
|
|
"observed-data--59282442-eb34-44fd-91b4-422102de0b81",
|
|
"url--59282442-eb34-44fd-91b4-422102de0b81",
|
|
"indicator--59282443-fa58-432a-a85b-426202de0b81",
|
|
"indicator--59282443-f8b4-4ced-bc34-4eb402de0b81",
|
|
"observed-data--59282443-b4d8-4777-a97c-4e0902de0b81",
|
|
"url--59282443-b4d8-4777-a97c-4e0902de0b81",
|
|
"indicator--592829fc-1088-4bea-a59d-4eb4950d210f",
|
|
"indicator--59282a1c-e2a8-4c42-99c0-4985950d210f",
|
|
"indicator--59282a3c-eeb8-4231-b073-44b6950d210f"
|
|
],
|
|
"labels": [
|
|
"Threat-Report",
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
"ms-caro-malware:malware-type=\"Trojan\"",
|
|
"misp-galaxy:tool=\"Emotet\""
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59282258-d130-4a21-864e-4712950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T12:49:24.000Z",
|
|
"modified": "2017-05-26T12:49:24.000Z",
|
|
"first_observed": "2017-05-26T12:49:24Z",
|
|
"last_observed": "2017-05-26T12:49:24Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--59282258-d130-4a21-864e-4712950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\"",
|
|
"osint:source-type=\"blog-post\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--59282258-d130-4a21-864e-4712950d210f",
|
|
"value": "https://www.cert.pl/en/news/single/analysis-of-emotet-v4/"
|
|
},
|
|
{
|
|
"type": "x-misp-attribute",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-attribute--59282381-e64c-46c9-88a9-40ff950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T12:49:25.000Z",
|
|
"modified": "2017-05-26T12:49:25.000Z",
|
|
"labels": [
|
|
"misp:type=\"text\"",
|
|
"misp:category=\"External analysis\"",
|
|
"osint:source-type=\"blog-post\""
|
|
],
|
|
"x_misp_category": "External analysis",
|
|
"x_misp_type": "text",
|
|
"x_misp_value": "Emotet is a modular Trojan horse, which was firstly noticed in June 2014 by Trend Micro. This malware is related to other types like Geodo, Bugat or Dridex, which are attributed by researches to the same family.\r\n\r\nEmotet was discovered as an advanced banker \u00e2\u20ac\u201c it\u00e2\u20ac\u2122s first campaign targeted clients of German and Austrian banks. Victims\u00e2\u20ac\u2122 bank accounts were infiltrated by a web browser infection which intercept communication between webpage and bank servers. In such scenario, malware hooks specific routines to sniff network activity and steal information. This technique is typical for modern banking malware and is widely known as Man-in-the-Browser attack.\r\n\r\nNext, modified release of Emotet banker (v2) has taken advantage of another technique \u00e2\u20ac\u201c automation of stealing money from hijacked bank accounts using ATSs (Automated Transfer Systems, more informations on page 20 of CERT Polska Report 2013). This technology is also used in other bankers. Good examples are ISFB (Gozi) or Tinba.\r\n\r\nAt the beginning of April 2017, we observed wide malspam campaign in Poland, distributing fraudulent mails. E-mails were imitating delivery notifications from DHL logistics company and contained malicious link, which referred to brand-new, unknown variant of Emotet.\r\n\r\n\r\n\r\nMalware distributed in this campaign differed from previously known versions. Behavior and communication methods were similar, but malware used different encryption and we noticed significant changes in its code. Thus we called this modification version 4."
|
|
},
|
|
{
|
|
"type": "x-misp-attribute",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-attribute--592823a0-1400-4721-8b31-4276950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T12:48:53.000Z",
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
|
"labels": [
|
|
"misp:type=\"other\"",
|
|
"misp:category=\"Artifacts dropped\""
|
|
],
|
|
"x_misp_category": "Artifacts dropped",
|
|
"x_misp_comment": "C&C public key",
|
|
"x_misp_type": "other",
|
|
"x_misp_value": "-----BEGIN PUBLIC KEY-----\r\nMHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAJ16QBv5Csq0eruFy4BvTcXmmIyeqUb3\r\nvCCc8K/zOYOpL/Ww6FCdUpvPfs+RR/sLBalwtKmT14iRUaNmJdygnAKUIRWR1HNt\r\n0rQRir0pD4QlkXlnZ9lZazTfyMV8BLCatwIDAQAB\r\n-----END PUBLIC KEY-----"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--592823c5-6a88-4023-aa9e-4b45950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T12:48:53.000Z",
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
|
"description": "Analysis based on sample",
|
|
"pattern": "[file:hashes.SHA256 = 'c53956c95100c5c0ba342977f8fc44fcad35aabc24ec44cb12bb83eee1ed34fa']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-26T12:48:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--592823d5-b3bc-4845-a841-4ae5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T12:48:53.000Z",
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
|
"description": "fetched modules (13th April)",
|
|
"pattern": "[file:hashes.MD5 = '0497c120248c6f00f1ac37513bd572e5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-26T12:48:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--592823d5-63d4-4ae4-ac7c-4c0c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T12:48:53.000Z",
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
|
"description": "fetched modules (13th April)",
|
|
"pattern": "[file:hashes.MD5 = '5b2d58b4104309ee9c93b455d39c7314']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-26T12:48:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--592823d6-83cc-4b3b-adc5-4b2b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T12:48:53.000Z",
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
|
"description": "fetched modules (13th April)",
|
|
"pattern": "[file:hashes.MD5 = '722268bad0d3a2e90aa148d52c60943e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-26T12:48:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--592823f7-6938-4073-8b4e-4331950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T12:48:53.000Z",
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
|
"description": "On port 443 C&C",
|
|
"pattern": "[url:value = 'http://87.106.105.76']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-26T12:48:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--592823f7-f390-440f-87de-4f93950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T12:48:53.000Z",
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
|
"description": "On port 443 C&C",
|
|
"pattern": "[url:value = 'http://173.255.229.121']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-26T12:48:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--592823f7-b7b4-4ca7-8917-4eaa950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T12:48:53.000Z",
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
|
"description": "On port 443 C&C",
|
|
"pattern": "[url:value = 'http://178.79.177.141']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-26T12:48:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--592823f8-72dc-4b2d-b274-4902950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T12:48:53.000Z",
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
|
"description": "On port 7080 C&C",
|
|
"pattern": "[url:value = 'http://79.170.95.202']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-26T12:48:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--592823f8-4144-4d11-8f74-4a27950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T12:48:53.000Z",
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
|
"description": "On port 8080 C&C",
|
|
"pattern": "[url:value = 'http://206.214.220.79']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-26T12:48:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--592823f9-30a4-4976-8f2f-486d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T12:48:53.000Z",
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
|
"description": "On port 8080 C&C",
|
|
"pattern": "[url:value = 'http://88.198.50.221']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-26T12:48:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--592823f9-8680-4722-90bd-4679950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T12:48:53.000Z",
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
|
"description": "On port 8080 C&C",
|
|
"pattern": "[url:value = 'http://5.39.84.48']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-26T12:48:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--592823fa-8980-4ea0-bee6-4f15950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T12:48:53.000Z",
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
|
"description": "On port 7080 C&C",
|
|
"pattern": "[url:value = 'http://188.68.58.8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-26T12:48:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--592823fa-9250-447d-a1ac-44d5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T12:48:53.000Z",
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
|
"description": "On port 7080 C&C",
|
|
"pattern": "[url:value = 'http://162.214.11.56']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-26T12:48:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--592823fa-38b0-4c02-80cd-45ef950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T12:48:53.000Z",
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
|
"description": "On port 8080 C&C",
|
|
"pattern": "[url:value = 'http://5.196.73.150']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-26T12:48:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--592823fb-b55c-4f7f-aca5-4edd950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T12:48:53.000Z",
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
|
"description": "On port 7080 C&C",
|
|
"pattern": "[url:value = 'http://203.121.145.40']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-26T12:48:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--592823fc-fd98-4a8a-9724-496f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T12:48:53.000Z",
|
|
"modified": "2017-05-26T12:48:53.000Z",
|
|
"description": "On port 7080 C&C",
|
|
"pattern": "[url:value = 'http://46.165.212.76']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-26T12:48:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5928243e-f388-465a-b65b-447b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T12:49:02.000Z",
|
|
"modified": "2017-05-26T12:49:02.000Z",
|
|
"description": "Analysis based on sample - Xchecked via VT: c53956c95100c5c0ba342977f8fc44fcad35aabc24ec44cb12bb83eee1ed34fa",
|
|
"pattern": "[file:hashes.SHA1 = '7b353d4f26acd06fdf8abed661f048a02cd1bbcf']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-26T12:49:02Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5928243e-1490-48d5-a33e-487a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T12:49:02.000Z",
|
|
"modified": "2017-05-26T12:49:02.000Z",
|
|
"description": "Analysis based on sample - Xchecked via VT: c53956c95100c5c0ba342977f8fc44fcad35aabc24ec44cb12bb83eee1ed34fa",
|
|
"pattern": "[file:hashes.MD5 = '5b3f0c1b0231e7873b587131b112139f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-26T12:49:02Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5928243f-2964-4f17-a96e-470402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T12:49:03.000Z",
|
|
"modified": "2017-05-26T12:49:03.000Z",
|
|
"first_observed": "2017-05-26T12:49:03Z",
|
|
"last_observed": "2017-05-26T12:49:03Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5928243f-2964-4f17-a96e-470402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5928243f-2964-4f17-a96e-470402de0b81",
|
|
"value": "https://www.virustotal.com/file/c53956c95100c5c0ba342977f8fc44fcad35aabc24ec44cb12bb83eee1ed34fa/analysis/1494971561/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5928243f-2ebc-40bb-af6b-44d902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T12:49:03.000Z",
|
|
"modified": "2017-05-26T12:49:03.000Z",
|
|
"description": "fetched modules (13th April) - Xchecked via VT: 722268bad0d3a2e90aa148d52c60943e",
|
|
"pattern": "[file:hashes.SHA256 = 'fe8c3e060969c3e8842bcbcab161cd0ba477d2614115e2cf46588eed30554a12']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-26T12:49:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59282440-d650-4fba-bc1c-407f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T12:49:04.000Z",
|
|
"modified": "2017-05-26T12:49:04.000Z",
|
|
"description": "fetched modules (13th April) - Xchecked via VT: 722268bad0d3a2e90aa148d52c60943e",
|
|
"pattern": "[file:hashes.SHA1 = '498cf1ac35d1c31c6920d5305cc78129c3d18ecf']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-26T12:49:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59282440-a03c-44f6-b704-4b7402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T12:49:04.000Z",
|
|
"modified": "2017-05-26T12:49:04.000Z",
|
|
"first_observed": "2017-05-26T12:49:04Z",
|
|
"last_observed": "2017-05-26T12:49:04Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--59282440-a03c-44f6-b704-4b7402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--59282440-a03c-44f6-b704-4b7402de0b81",
|
|
"value": "https://www.virustotal.com/file/fe8c3e060969c3e8842bcbcab161cd0ba477d2614115e2cf46588eed30554a12/analysis/1495693771/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59282441-91c8-46fc-8cda-4e4c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T12:49:05.000Z",
|
|
"modified": "2017-05-26T12:49:05.000Z",
|
|
"description": "fetched modules (13th April) - Xchecked via VT: 5b2d58b4104309ee9c93b455d39c7314",
|
|
"pattern": "[file:hashes.SHA256 = '621c0a11ee0100b8fc3190e471ed4936204e897d97394ba9614ec95f1b69c69c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-26T12:49:05Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59282442-2d44-44c0-808b-4f3a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T12:49:06.000Z",
|
|
"modified": "2017-05-26T12:49:06.000Z",
|
|
"description": "fetched modules (13th April) - Xchecked via VT: 5b2d58b4104309ee9c93b455d39c7314",
|
|
"pattern": "[file:hashes.SHA1 = '59745dfbac015cec3bf66d9c4ad5cc37737adb84']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-26T12:49:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59282442-eb34-44fd-91b4-422102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T12:49:06.000Z",
|
|
"modified": "2017-05-26T12:49:06.000Z",
|
|
"first_observed": "2017-05-26T12:49:06Z",
|
|
"last_observed": "2017-05-26T12:49:06Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--59282442-eb34-44fd-91b4-422102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--59282442-eb34-44fd-91b4-422102de0b81",
|
|
"value": "https://www.virustotal.com/file/621c0a11ee0100b8fc3190e471ed4936204e897d97394ba9614ec95f1b69c69c/analysis/1493454650/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59282443-fa58-432a-a85b-426202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T12:49:07.000Z",
|
|
"modified": "2017-05-26T12:49:07.000Z",
|
|
"description": "fetched modules (13th April) - Xchecked via VT: 0497c120248c6f00f1ac37513bd572e5",
|
|
"pattern": "[file:hashes.SHA256 = '1eb9c52548870533246932e12843318a95f876fd873bf4dfec7759214d1c2cc9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-26T12:49:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59282443-f8b4-4ced-bc34-4eb402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T12:49:07.000Z",
|
|
"modified": "2017-05-26T12:49:07.000Z",
|
|
"description": "fetched modules (13th April) - Xchecked via VT: 0497c120248c6f00f1ac37513bd572e5",
|
|
"pattern": "[file:hashes.SHA1 = '199da8defc4b1cd8513ca9bea76e96571dc6e5e2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-26T12:49:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59282443-b4d8-4777-a97c-4e0902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T12:49:07.000Z",
|
|
"modified": "2017-05-26T12:49:07.000Z",
|
|
"first_observed": "2017-05-26T12:49:07Z",
|
|
"last_observed": "2017-05-26T12:49:07Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--59282443-b4d8-4777-a97c-4e0902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--59282443-b4d8-4777-a97c-4e0902de0b81",
|
|
"value": "https://www.virustotal.com/file/1eb9c52548870533246932e12843318a95f876fd873bf4dfec7759214d1c2cc9/analysis/1493439636/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--592829fc-1088-4bea-a59d-4eb4950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T13:13:32.000Z",
|
|
"modified": "2017-05-26T13:13:32.000Z",
|
|
"pattern": "[rule emotet4_basic: trojan\r\n{\r\nmeta:\r\nauthor = \"psrok1/mak\"\r\nmodule = \"emotet\"\r\nstrings:\r\n$emotet4_rsa_public = { 8d ?? ?? 5? 8d ?? ?? 5? 6a 00 68 00 80 00 00 ff 35 [4] ff 35 [4] 6a 13 68 01 00 01 00 ff 15 [4] 85 }\r\n$emotet4_cnc_list = { 39 ?? ?5 [4] 0f 44 ?? (FF | A3)}\r\ncondition:\r\nall of them\r\n}]",
|
|
"pattern_type": "yara",
|
|
"valid_from": "2017-05-26T13:13:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"yara\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59282a1c-e2a8-4c42-99c0-4985950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T13:14:04.000Z",
|
|
"modified": "2017-05-26T13:14:04.000Z",
|
|
"pattern": "[rule emotet4: trojan\r\n{\r\nmeta:\r\nauthor = \"psrok1\"\r\nmodule = \"emotet\"\r\nstrings:\r\n$emotet4_x65599 = { 0f b6 ?? 8d ?? ?? 69 ?? 3f 00 01 00 4? 0? ?? 3? ?? 72 }\r\ncondition:\r\nany of them and emotet4_basic\r\n}]",
|
|
"pattern_type": "yara",
|
|
"valid_from": "2017-05-26T13:14:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"yara\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59282a3c-eeb8-4231-b073-44b6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-26T13:14:36.000Z",
|
|
"modified": "2017-05-26T13:14:36.000Z",
|
|
"description": "IDS flag not set (false-positive?)",
|
|
"pattern": "[rule emotet4_spam : spambot\r\n{\r\nmeta:\r\nauthor=\"mak\"\r\nmodule=\"emotet\"\r\nstrings:\r\n$login=\"LOGIN\" fullword\r\n$startls=\"STARTTLS\" fullword\r\n$mailfrom=\"MAIL FROM:\"\r\ncondition:\r\nall of them and emotet4_basic\r\n}]",
|
|
"pattern_type": "yara",
|
|
"valid_from": "2017-05-26T13:14:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"yara\"",
|
|
"misp:category=\"Artifacts dropped\""
|
|
]
|
|
},
|
|
{
|
|
"type": "marking-definition",
|
|
"spec_version": "2.1",
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
"definition_type": "tlp",
|
|
"name": "TLP:WHITE",
|
|
"definition": {
|
|
"tlp": "white"
|
|
}
|
|
}
|
|
]
|
|
} |