adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/5a3a3aca-a210-497a-9715-452c950d210f.json

294 lines
No EOL
13 KiB
JSON
Raw Blame History

{
"type": "bundle",
"id": "bundle--5a3a3aca-a210-497a-9715-452c950d210f",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-12-22T03:00:33.000Z",
"modified": "2017-12-22T03:00:33.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--5a3a3aca-a210-497a-9715-452c950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-12-22T03:00:33.000Z",
"modified": "2017-12-22T03:00:33.000Z",
"name": "OSINT - Rise of One More Mirai Worm Variant",
"published": "2017-12-28T13:36:26Z",
"object_refs": [
"observed-data--5a3a3ad7-43e0-4b4c-9343-49b6950d210f",
"url--5a3a3ad7-43e0-4b4c-9343-49b6950d210f",
"x-misp-attribute--5a3a3aee-d9e0-43bf-a335-49e4950d210f",
"indicator--5a3a3b1a-44f4-4bcf-953f-4af4950d210f",
"indicator--5a3a3b1a-3398-40a6-8ed9-430d950d210f",
"indicator--4a76a7c3-a63e-4701-882d-dcada5375372",
"x-misp-object--402734d9-a857-45bd-9ae8-04657966f1c8",
"indicator--10e3647b-ec40-4bba-9dae-9b62d89a7ff0",
"x-misp-object--eae4f37c-fb66-445a-a462-c399c92638a3",
"relationship--af6cbcca-9ed4-4d23-a6a1-4db39c78e3a0",
"relationship--6408a22d-390c-4ccb-97ea-55f466ce9017"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"osint:source-type=\"blog-post\"",
"malware_classification:malware-category=\"Botnet\"",
"misp-galaxy:tool=\"Satori\""
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5a3a3ad7-43e0-4b4c-9343-49b6950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-12-20T21:37:12.000Z",
"modified": "2017-12-20T21:37:12.000Z",
"first_observed": "2017-12-20T21:37:12Z",
"last_observed": "2017-12-20T21:37:12Z",
"number_observed": 1,
"object_refs": [
"url--5a3a3ad7-43e0-4b4c-9343-49b6950d210f"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\"",
"osint:source-type=\"blog-post\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--5a3a3ad7-43e0-4b4c-9343-49b6950d210f",
"value": "https://blog.fortinet.com/2017/12/12/rise-of-one-more-mirai-worm-variant"
},
{
"type": "x-misp-attribute",
"spec_version": "2.1",
"id": "x-misp-attribute--5a3a3aee-d9e0-43bf-a335-49e4950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-12-20T21:37:12.000Z",
"modified": "2017-12-20T21:37:12.000Z",
"labels": [
"misp:type=\"comment\"",
"misp:category=\"External analysis\"",
"osint:source-type=\"blog-post\""
],
"x_misp_category": "External analysis",
"x_misp_type": "comment",
"x_misp_value": "Not long after a new strain of the Akuma malware was discovered targeting ZyXEL devices with a new series of login/password attacks, FortiGuard Labs last week also began detecting strange scanning activities on uncommon TCP ports 52869 and 37215. We and other threat research teams quickly began to suspect that these were tied together, and that there was a new botnet out there.\r\n\r\nWith some focused research, the new Satori botnet, or \u00e2\u20ac\u0153Okiru\u00e2\u20ac\u009d \u00e2\u20ac\u201c as it was named by its malevolent author \u00e2\u20ac\u201c came to light. Okiru is a Japanese word that can be translated to \u00e2\u20ac\u0153to get up\u00e2\u20ac\u009d or \u00e2\u20ac\u0153to rise\u00e2\u20ac\u009d. Okiru first appeared on our radar at the end of October 2017, but during the first week of December it significantly stepped up its game by also adding worm capabilities to its arsenal. I will break down our analysis of this new botnet strain in this report."
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a3a3b1a-44f4-4bcf-953f-4af4950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-12-20T10:27:38.000Z",
"modified": "2017-12-20T10:27:38.000Z",
"description": "Linux/Mirai.Y!tr.bdr",
"pattern": "[file:hashes.SHA256 = 'e5fc493874f2a49e1a1594f3ee2254fa30e6dd69c6f24d24a08a562f03b2fd26']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-12-20T10:27:38Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a3a3b1a-3398-40a6-8ed9-430d950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-12-20T10:27:38.000Z",
"modified": "2017-12-20T10:27:38.000Z",
"description": "Linux/Mirai.Y!tr.bdr",
"pattern": "[file:hashes.SHA256 = 'dd6e5607f137b6536097670a1211b4e20821ca136e2db26529948ff0a48555ff']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-12-20T10:27:38Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--4a76a7c3-a63e-4701-882d-dcada5375372",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-12-20T21:37:15.000Z",
"modified": "2017-12-20T21:37:15.000Z",
"pattern": "[file:hashes.MD5 = 'fc11c9cb0d4433143271f0f767864a30' AND file:hashes.SHA1 = '562c61a6413bf35c00a76e22d4cd8278658a0483' AND file:hashes.SHA256 = 'e5fc493874f2a49e1a1594f3ee2254fa30e6dd69c6f24d24a08a562f03b2fd26']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-12-20T21:37:15Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--402734d9-a857-45bd-9ae8-04657966f1c8",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-12-20T21:37:12.000Z",
"modified": "2017-12-20T21:37:12.000Z",
"labels": [
"misp:name=\"virustotal-report\"",
"misp:meta-category=\"misc\""
],
"x_misp_attributes": [
{
"type": "link",
"object_relation": "permalink",
"value": "https://www.virustotal.com/file/e5fc493874f2a49e1a1594f3ee2254fa30e6dd69c6f24d24a08a562f03b2fd26/analysis/1513339300/",
"category": "External analysis",
"comment": "Linux/Mirai.Y!tr.bdr",
"uuid": "5a3ad808-98b0-4301-aeb3-04a602de0b81"
},
{
"type": "text",
"object_relation": "detection-ratio",
"value": "26/59",
"category": "Other",
"comment": "Linux/Mirai.Y!tr.bdr",
"uuid": "5a3ad808-ab94-4518-bf1b-04a602de0b81"
},
{
"type": "datetime",
"object_relation": "last-submission",
"value": "2017-12-15T12:01:40",
"category": "Other",
"comment": "Linux/Mirai.Y!tr.bdr",
"uuid": "5a3ad808-1360-4a31-be33-04a602de0b81"
}
],
"x_misp_meta_category": "misc",
"x_misp_name": "virustotal-report"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--10e3647b-ec40-4bba-9dae-9b62d89a7ff0",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-12-20T21:37:15.000Z",
"modified": "2017-12-20T21:37:15.000Z",
"pattern": "[file:hashes.MD5 = 'eeab715dc67af05280c926dc4c4676f5' AND file:hashes.SHA1 = 'fc6569b13e4f0fb9a541f0eb4b0b179d34aadb4c' AND file:hashes.SHA256 = 'dd6e5607f137b6536097670a1211b4e20821ca136e2db26529948ff0a48555ff']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-12-20T21:37:15Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--eae4f37c-fb66-445a-a462-c399c92638a3",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-12-20T21:37:12.000Z",
"modified": "2017-12-20T21:37:12.000Z",
"labels": [
"misp:name=\"virustotal-report\"",
"misp:meta-category=\"misc\""
],
"x_misp_attributes": [
{
"type": "link",
"object_relation": "permalink",
"value": "https://www.virustotal.com/file/dd6e5607f137b6536097670a1211b4e20821ca136e2db26529948ff0a48555ff/analysis/1513706129/",
"category": "External analysis",
"comment": "Linux/Mirai.Y!tr.bdr",
"uuid": "5a3ad808-7ac8-4434-865d-04a602de0b81"
},
{
"type": "text",
"object_relation": "detection-ratio",
"value": "28/59",
"category": "Other",
"comment": "Linux/Mirai.Y!tr.bdr",
"uuid": "5a3ad808-77cc-4147-805d-04a602de0b81"
},
{
"type": "datetime",
"object_relation": "last-submission",
"value": "2017-12-19T17:55:29",
"category": "Other",
"comment": "Linux/Mirai.Y!tr.bdr",
"uuid": "5a3ad808-0fac-4369-949d-04a602de0b81"
}
],
"x_misp_meta_category": "misc",
"x_misp_name": "virustotal-report"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--af6cbcca-9ed4-4d23-a6a1-4db39c78e3a0",
"created": "2017-12-28T13:36:26.000Z",
"modified": "2017-12-28T13:36:26.000Z",
"relationship_type": "analysed-with",
"source_ref": "indicator--4a76a7c3-a63e-4701-882d-dcada5375372",
"target_ref": "x-misp-object--402734d9-a857-45bd-9ae8-04657966f1c8"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6408a22d-390c-4ccb-97ea-55f466ce9017",
"created": "2017-12-28T13:36:26.000Z",
"modified": "2017-12-28T13:36:26.000Z",
"relationship_type": "analysed-with",
"source_ref": "indicator--10e3647b-ec40-4bba-9dae-9b62d89a7ff0",
"target_ref": "x-misp-object--eae4f37c-fb66-445a-a462-c399c92638a3"
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
]
}
Reference in a new issue View git blame Copy permalink