207 lines
No EOL
7.8 KiB
JSON
207 lines
No EOL
7.8 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "2",
|
|
"date": "2017-04-28",
|
|
"extends_uuid": "",
|
|
"info": "OSINT - OSX Malware is Catching Up, and it wants to Read Your HTTPS Traffic",
|
|
"publish_timestamp": "1493654444",
|
|
"published": true,
|
|
"threat_level_id": "3",
|
|
"timestamp": "1493647580",
|
|
"uuid": "5902f92f-c7f4-4bac-97b5-4fa6950d210f",
|
|
"Orgc": {
|
|
"name": "CIRCL",
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#ffffff",
|
|
"name": "tlp:white"
|
|
},
|
|
{
|
|
"colour": "#00223b",
|
|
"name": "osint:source-type=\"blog-post\""
|
|
},
|
|
{
|
|
"colour": "#6a0084",
|
|
"name": "ms-caro-malware:malware-platform=\"MacOS_X\""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1493367513",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5902f954-0db0-4d9d-a555-4d97950d210f",
|
|
"value": "http://blog.checkpoint.com/2017/04/27/osx-malware-catching-wants-read-https-traffic/",
|
|
"Tag": [
|
|
{
|
|
"colour": "#00223b",
|
|
"name": "osint:source-type=\"blog-post\""
|
|
},
|
|
{
|
|
"colour": "#075200",
|
|
"name": "admiralty-scale:source-reliability=\"b\""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1493647580",
|
|
"to_ids": true,
|
|
"type": "text",
|
|
"uuid": "5902f975-ae78-4b08-b64a-4b1f950d210f",
|
|
"value": "People often assume that if you\u00e2\u20ac\u2122re running OSX, you\u00e2\u20ac\u2122re relatively safe from malware. But this is becoming less and less true, as evidenced by a new strain of malware encountered by the Check Point malware research team. This new malware \u00e2\u20ac\u201c dubbed OSX/Dok \u00e2\u20ac\u201d affects all versions of OSX, has 0 detections on VirusTotal (as of the writing of these words), is signed with a valid developer certificate (authenticated by Apple), and is the first major scale malware to target OSX users via a coordinated email phishing campaign.\r\n\r\nOnce OSX/Dok infection is complete, the attackers gain complete access to all victim communication, including communication encrypted by SSL. This is done by redirecting victim traffic through a malicious proxy server.\r\n\r\nThe malware mostly targets European users. For instance, one phishing message was observed to target a user in Germany by baiting the user with a message regarding supposed inconsistencies in their tax returns (see image, and translation, below).",
|
|
"Tag": [
|
|
{
|
|
"colour": "#00223b",
|
|
"name": "osint:source-type=\"blog-post\""
|
|
},
|
|
{
|
|
"colour": "#075200",
|
|
"name": "admiralty-scale:source-reliability=\"b\""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Sample",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1493367513",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5902f9a0-f6f4-41d2-913c-4735950d210f",
|
|
"value": "7819ae7d72fa045baa77e9c8e063a69df439146b27f9c3bb10aef52dcc77c145"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Sample",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1493367513",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "5902f9a1-83bc-4b26-a3cb-4afe950d210f",
|
|
"value": "4131d4737fe8dfe66d407bfd0a0df18a4a77b89347471cc012da8efc93c661a5"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "LaunchAgent:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1493367513",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "5902f9b8-b51c-4ac6-becc-469b950d210f",
|
|
"value": "/Users/training/Library/LaunchAgents/com.apple.Safari.proxy.plist"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "LaunchAgent:",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1493367513",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "5902f9b9-5a64-4066-9444-4cde950d210f",
|
|
"value": "/Users/training/Library/LaunchAgents/com.apple.Safari.proxy.pac"
|
|
},
|
|
{
|
|
"category": "Antivirus detection",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1493367513",
|
|
"to_ids": false,
|
|
"type": "text",
|
|
"uuid": "5902f9c4-2894-44b3-91f5-4543950d210f",
|
|
"value": "Trojan.OSX.DOK"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1493367513",
|
|
"to_ids": true,
|
|
"type": "hostname",
|
|
"uuid": "5902fa65-bddc-4ac4-bea4-03df950d210f",
|
|
"value": "paoyu7gub72lykuk.onion"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Sample - Xchecked via VT: 4131d4737fe8dfe66d407bfd0a0df18a4a77b89347471cc012da8efc93c661a5",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1493367516",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5902fadc-82c0-438a-9296-4d6102de0b81",
|
|
"value": "d9685bea995e57ae89d10122cb76022554179ff7"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Sample - Xchecked via VT: 4131d4737fe8dfe66d407bfd0a0df18a4a77b89347471cc012da8efc93c661a5",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1493367516",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5902fadc-0324-4206-acb1-4c1402de0b81",
|
|
"value": "14c1cd9c5f263d5ba988838e0c3e3cf6"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "Sample - Xchecked via VT: 4131d4737fe8dfe66d407bfd0a0df18a4a77b89347471cc012da8efc93c661a5",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1493367517",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5902fadd-cf48-423b-8791-45c202de0b81",
|
|
"value": "https://www.virustotal.com/file/4131d4737fe8dfe66d407bfd0a0df18a4a77b89347471cc012da8efc93c661a5/analysis/1493364891/"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Sample - Xchecked via VT: 7819ae7d72fa045baa77e9c8e063a69df439146b27f9c3bb10aef52dcc77c145",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1493367517",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "5902fadd-fe44-479f-a3ec-4c2802de0b81",
|
|
"value": "f5d3425482dc4f4f738277ff3ba315b496894899"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Sample - Xchecked via VT: 7819ae7d72fa045baa77e9c8e063a69df439146b27f9c3bb10aef52dcc77c145",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1493367518",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5902fade-b7f0-4e54-a31c-439802de0b81",
|
|
"value": "e8bdde90574d5bf285d9abb0c8a113a8"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "Sample - Xchecked via VT: 7819ae7d72fa045baa77e9c8e063a69df439146b27f9c3bb10aef52dcc77c145",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1493367518",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5902fade-a3d8-4f52-908f-4ad002de0b81",
|
|
"value": "https://www.virustotal.com/file/7819ae7d72fa045baa77e9c8e063a69df439146b27f9c3bb10aef52dcc77c145/analysis/1493364722/"
|
|
}
|
|
]
|
|
}
|
|
} |