253 lines
No EOL
7.9 KiB
JSON
253 lines
No EOL
7.9 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "2",
|
|
"date": "2016-08-15",
|
|
"extends_uuid": "",
|
|
"info": "OSINT Shakti Trojan: Document Thief by Malwarebytes",
|
|
"publish_timestamp": "1471523877",
|
|
"published": true,
|
|
"threat_level_id": "3",
|
|
"timestamp": "1471523562",
|
|
"uuid": "57b5a864-be78-4eba-af85-4608950d210f",
|
|
"Orgc": {
|
|
"name": "CthulhuSPRL.be",
|
|
"uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": "0",
|
|
"name": "tlp:white",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": "0",
|
|
"name": "OSINT",
|
|
"relationship_type": ""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1471522935",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "57b5a877-9d20-49f7-aa38-4c16950d210f",
|
|
"value": "https://blog.malwarebytes.com/threat-analysis/2016/08/shakti-trojan-stealing-documents/"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1471522935",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "57b5a877-9be4-4767-b8e5-436a950d210f",
|
|
"value": "https://malwr.com/analysis/NjA0OGVmMDdlMzg5NDJjOGI1OTA3YTJkMDllZTk5Y2U/"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1471522935",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "57b5a877-a95c-48cf-be90-4981950d210f",
|
|
"value": "http://www.bleepingcomputer.com/news/security/new-information-stealing-trojan-steals-and-uploads-corporate-files/"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1471522985",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "57b5a8aa-4290-4175-9509-478d950d210f",
|
|
"value": "https://blog.malwarebytes.com/threat-analysis/2016/08/shakti-trojan-technical-analysis/"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Imported via the Freetext Import Tool",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1471523016",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "57b5a8c8-1a70-4ec3-9746-44dc950d210f",
|
|
"value": "Carrier.dll"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Imported via the Freetext Import Tool",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1471523016",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "57b5a8c8-a87c-44bf-9aec-46e8950d210f",
|
|
"value": "Payload.dll"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the Freetext Import Tool",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1471523017",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "57b5a8c9-3110-4536-8e93-4baa950d210f",
|
|
"value": "web4solution.net"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the Freetext Import Tool",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1471523017",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "57b5a8c9-31ec-442a-9e77-4819950d210f",
|
|
"value": "securedesignus.com"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "Imported via the Freetext Import Tool",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1471523017",
|
|
"to_ids": true,
|
|
"type": "domain",
|
|
"uuid": "57b5a8c9-6830-4de5-a4b0-4b00950d210f",
|
|
"value": "securedesignuk.com"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the Freetext Import Tool",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1471523071",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "57b5a8ff-4aa4-4baf-a764-49ad950d210f",
|
|
"value": "Carrier.dll"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the Freetext Import Tool",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1471523071",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "57b5a8ff-c074-4601-92b7-4dbc950d210f",
|
|
"value": "Payload.dll"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Imported via the Freetext Import Tool",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1471523071",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "57b5a8ff-8974-40f4-b6bd-44b6950d210f",
|
|
"value": "8ea35293cbb0712a520c7b89059d5a2a"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Imported via the Freetext Import Tool",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1471523071",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "57b5a8ff-1dd0-413f-8ede-46ab950d210f",
|
|
"value": "6992370821f8fbeea4a96f7be8015967"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "Imported via the Freetext Import Tool",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1471523072",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "57b5a900-db74-4f77-8cff-4754950d210f",
|
|
"value": "d9181d69c40fc95d7d27448f5ece1878"
|
|
},
|
|
{
|
|
"category": "Network activity",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1471523097",
|
|
"to_ids": true,
|
|
"type": "uri",
|
|
"uuid": "57b5a919-cad0-42ff-9825-4d5a950d210f",
|
|
"value": "/external/update"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1471523134",
|
|
"to_ids": true,
|
|
"type": "pdb",
|
|
"uuid": "57b5a93e-f604-442f-8443-49d2950d210f",
|
|
"value": "E:\\Projects\\ComplexStatement\\Shakti\\Code\\Carrier\\Release\\Carrier.pdb"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1471523135",
|
|
"to_ids": true,
|
|
"type": "pdb",
|
|
"uuid": "57b5a93f-9fb4-4436-a220-4a41950d210f",
|
|
"value": "E:\\Projects\\ComplexStatement\\Shakti\\Code\\Payload\\Release\\Payload.pdb"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "observed in 2014 by DrWeb and given a generic name, Trojan.DownLoader11.5634.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1471523281",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "57b5a9d1-46d0-4515-8152-429a950d210f",
|
|
"value": "http://vms.drweb.ru/virus/?i=3793941&virus_name=Trojan.DownLoader11.5634"
|
|
},
|
|
{
|
|
"category": "Artifacts dropped",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1471523354",
|
|
"to_ids": true,
|
|
"type": "filename",
|
|
"uuid": "57b5aa1a-cd14-4bd9-b994-4e4f950d210f",
|
|
"value": "%UserProfile%\\uninst.dll"
|
|
},
|
|
{
|
|
"category": "Attribution",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1471523562",
|
|
"to_ids": false,
|
|
"type": "whois-registrant-email",
|
|
"uuid": "57b5aaea-41e8-41ee-9a00-499c950d210f",
|
|
"value": "ashrafahmed2882@yahoo.com"
|
|
}
|
|
]
|
|
}
|
|
} |