126 lines
No EOL
4.6 KiB
JSON
126 lines
No EOL
4.6 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "2",
|
|
"date": "2017-08-15",
|
|
"extends_uuid": "",
|
|
"info": "OSINT - ShadowPad : popular server management software hit in supply chain attack",
|
|
"publish_timestamp": "1504707530",
|
|
"published": true,
|
|
"threat_level_id": "3",
|
|
"timestamp": "1504707501",
|
|
"uuid": "59aea569-4598-47c4-827d-4d35950d210f",
|
|
"Orgc": {
|
|
"name": "CIRCL",
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#004646",
|
|
"name": "type:OSINT"
|
|
},
|
|
{
|
|
"colour": "#ffffff",
|
|
"name": "tlp:white"
|
|
},
|
|
{
|
|
"colour": "#002b4a",
|
|
"name": "osint:source-type=\"technical-report\""
|
|
},
|
|
{
|
|
"colour": "#0088cc",
|
|
"name": "misp-galaxy:tool=\"ShadowPad\""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1504625506",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "59aea5dc-e0a0-477d-81e6-4482950d210f",
|
|
"value": "https://cdn.securelist.com/files/2017/08/ShadowPad_technical_description_PDF.pdf",
|
|
"Tag": [
|
|
{
|
|
"colour": "#002b4a",
|
|
"name": "osint:source-type=\"technical-report\""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1504625506",
|
|
"to_ids": false,
|
|
"type": "comment",
|
|
"uuid": "59aea657-ad00-4a77-b187-baa3950d210f",
|
|
"value": "ShadowPad is a modular cyber-attack platform that attackers deploy in victim networks to gain flexible remote control capabilities. The platform is designed to run in two stages. The first stage is a shellcode that was embedded in a legitimate nssock2.dll used by Xshell, Xmanager and other software packages produced by NetSarang. This stage is responsible for connecting to \u00e2\u20ac\u0153validation\u00e2\u20ac\u009d command and control (C&C) servers and getting configuration information including the location of the real C&C server, which may be unique per victim. The second stage acts as an orchestrator for five main modules responsible for C&C communication, working with the DNS protocol, loading and injecting additional plugins into the memory of other processes.\r\nAll actual payloads are received from the real C&C as plugins and can perform different types of data exfiltration.",
|
|
"Tag": [
|
|
{
|
|
"colour": "#002b4a",
|
|
"name": "osint:source-type=\"technical-report\""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1504625506",
|
|
"to_ids": true,
|
|
"type": "filename|sha256",
|
|
"uuid": "59aea68c-4b88-4e38-a6a4-423a950d210f",
|
|
"value": "nssock2.dll|462a02a8094e833fd456baf0a6d4e18bb7dab1a9f74d5f163a8334921a4ffde8"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1504625506",
|
|
"to_ids": true,
|
|
"type": "filename|md5",
|
|
"uuid": "59aea68c-8638-4526-807a-44af950d210f",
|
|
"value": "nssock2.dll|97363d50a279492fda14cbab53429e75"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1504625506",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "59aea6b0-9fd4-45d5-bde0-457e950d210f",
|
|
"value": "nylalobghyhirgh.com"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "- Xchecked via VT: 462a02a8094e833fd456baf0a6d4e18bb7dab1a9f74d5f163a8334921a4ffde8",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1504625507",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "59aec363-c3e8-4351-87ef-488002de0b81",
|
|
"value": "f1a181d29b38dfe60d8ea487e8ed0ef30f064763"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "- Xchecked via VT: 462a02a8094e833fd456baf0a6d4e18bb7dab1a9f74d5f163a8334921a4ffde8",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1504625507",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "59aec363-7618-42e1-a4d0-48fb02de0b81",
|
|
"value": "https://www.virustotal.com/file/462a02a8094e833fd456baf0a6d4e18bb7dab1a9f74d5f163a8334921a4ffde8/analysis/1504181851/"
|
|
}
|
|
]
|
|
}
|
|
} |