1 line
No EOL
27 KiB
JSON
1 line
No EOL
27 KiB
JSON
{"Event": {"info": "COMpfun successor Reductor: compromise TLS traffic", "Tag": [{"colour": "#12e200", "exportable": true, "name": "misp-galaxy:threat-actor=\"Turla Group\""}, {"colour": "#004646", "exportable": true, "name": "type:OSINT"}, {"colour": "#0071c3", "exportable": true, "name": "osint:lifetime=\"perpetual\""}, {"colour": "#ffffff", "exportable": true, "name": "tlp:white"}, {"colour": "#00223b", "exportable": true, "name": "osint:source-type=\"blog-post\""}, {"colour": "#001cad", "exportable": true, "name": "estimative-language:likelihood-probability=\"very-likely\""}, {"colour": "#0088cc", "exportable": true, "name": "misp-galaxy:tool=\"COMpfun\""}, {"colour": "#0088cc", "exportable": true, "name": "misp-galaxy:tool=\"Reductor\""}], "publish_timestamp": "1570107780", "timestamp": "1570686944", "Object": [{"comment": "", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "uuid": "9499eb17-e165-4ddd-96ff-6a04056a5197", "sharing_group_id": "0", "timestamp": "1570104428", "description": "File object describing a file with meta-information", "template_version": "17", "ObjectReference": [{"comment": "", "object_uuid": "9499eb17-e165-4ddd-96ff-6a04056a5197", "uuid": "5d95e46c-bb7c-4069-a077-44e0950d210f", "timestamp": "1570104428", "referenced_uuid": "2c492ff9-0eaf-47ec-882b-28395b2447c9", "relationship_type": "analysed-with"}], "Attribute": [{"comment": "", "category": "Payload delivery", "uuid": "c16bfce1-a684-41d6-b741-692406f34d04", "timestamp": "1570104396", "to_ids": true, "value": "7911f8d717dc9d7a78d99e687a12d7ad", "disable_correlation": false, "object_relation": "md5", "type": "md5"}, {"comment": "", "category": "Payload delivery", "uuid": "637fa6fe-6e9c-4341-b1b9-1a1eca224902", "timestamp": "1570104396", "to_ids": true, "value": "e49666f7882f299c2845c7e31e3d842a387ef10d", "disable_correlation": false, "object_relation": "sha1", "type": "sha1"}, {"comment": "", "category": "Payload delivery", "uuid": "01612c16-9dd3-4fe3-86b9-44be6da865c8", "timestamp": "1570104396", "to_ids": true, "value": "4e2d038e9d72ee4d660755ba973a31471dda167d1a51bfdfe60abb2b3de78ba1", "disable_correlation": false, "object_relation": "sha256", "type": "sha256"}], "distribution": "5", "meta-category": "file", "name": "file"}, {"comment": "", "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4", "uuid": "2c492ff9-0eaf-47ec-882b-28395b2447c9", "sharing_group_id": "0", "timestamp": "1570104428", "description": "VirusTotal report", "template_version": "2", "Attribute": [{"comment": "", "category": "Other", "uuid": "6f1c02b3-7e03-4457-b0d2-bb57f4594085", "timestamp": "1570104396", "to_ids": false, "value": "2019-05-19 16:41:15", "disable_correlation": false, "object_relation": "last-submission", "type": "datetime"}, {"comment": "", "category": "Payload delivery", "uuid": "3b60de42-cdef-418e-97ce-93717a2412ce", "timestamp": "1570104396", "to_ids": false, "value": "https://www.virustotal.com/file/4e2d038e9d72ee4d660755ba973a31471dda167d1a51bfdfe60abb2b3de78ba1/analysis/1558284075/", "disable_correlation": false, "object_relation": "permalink", "type": "link"}, {"comment": "", "category": "Payload delivery", "uuid": "334ec304-ebb4-4527-badb-85b9d0ada237", "timestamp": "1570104396", "to_ids": false, "value": "26/68", "disable_correlation": true, "object_relation": "detection-ratio", "type": "text"}], "distribution": "5", "meta-category": "misc", "name": "virustotal-report"}, {"comment": "", "template_uuid": "d1ab756a-26b5-4349-9f43-765630f0911c", "uuid": "5d95e5cb-de84-4411-9e52-4c52950d210f", "sharing_group_id": "0", "timestamp": "1570104779", "description": "x509 object describing a X.509 certificate", "template_version": "9", "Attribute": [{"comment": "", "category": "Network activity", "uuid": "5d95e5cc-69a8-4727-820a-4057950d210f", "timestamp": "1570104780", "to_ids": true, "value": "119b2be9c17d8c7c5ab0fa1a17aaf69082bab21d", "disable_correlation": false, "object_relation": "x509-fingerprint-sha1", "type": "x509-fingerprint-sha1"}, {"comment": "", "category": "Other", "uuid": "5d95e5cc-c198-46a8-9f6a-4b0a950d210f", "timestamp": "1570104780", "to_ids": false, "value": "ie-paypal", "disable_correlation": true, "object_relation": "issuer", "type": "text"}, {"comment": "", "category": "Other", "uuid": "5d95e5cc-c684-4c0b-b70e-4190950d210f", "timestamp": "1570104780", "to_ids": false, "value": "20311117T000000-0800", "disable_correlation": true, "object_relation": "validity-not-after", "type": "datetime"}], "distribution": "5", "meta-category": "network", "name": "x509"}, {"comment": "", "template_uuid": "d1ab756a-26b5-4349-9f43-765630f0911c", "uuid": "5d95e621-1790-4a3f-8d53-4a22950d210f", "sharing_group_id": "0", "timestamp": "1570104865", "description": "x509 object describing a X.509 certificate", "template_version": "9", "Attribute": [{"comment": "", "category": "Network activity", "uuid": "5d95e621-a0f0-4dcf-95ba-4483950d210f", "timestamp": "1570104865", "to_ids": true, "value": "546f7a565920aeb0021a1d05525ff0b3df51d020", "disable_correlation": false, "object_relation": "x509-fingerprint-sha1", "type": "x509-fingerprint-sha1"}, {"comment": "", "category": "Other", "uuid": "5d95e621-b160-4a56-800e-485c950d210f", "timestamp": "1570104865", "to_ids": false, "value": "GeoTrust Rsa CA", "disable_correlation": true, "object_relation": "issuer", "type": "text"}, {"comment": "", "category": "Other", "uuid": "5d95e621-d5b8-4b0a-aaba-432d950d210f", "timestamp": "1570104865", "to_ids": false, "value": "20311117T000000-0800", "disable_correlation": true, "object_relation": "validity-not-after", "type": "datetime"}], "distribution": "5", "meta-category": "network", "name": "x509"}, {"comment": "", "template_uuid": "d1ab756a-26b5-4349-9f43-765630f0911c", "uuid": "5d95e659-fdbc-41db-8e88-4990950d210f", "sharing_group_id": "0", "timestamp": "1570104921", "description": "x509 object describing a X.509 certificate", "template_version": "9", "Attribute": [{"comment": "", "category": "Network activity", "uuid": "5d95e659-5208-482d-b886-4a3f950d210f", "timestamp": "1570104921", "to_ids": true, "value": "959eb6c7f45b7c5c761d5b758e65d9ef7ea20cf3", "disable_correlation": false, "object_relation": "x509-fingerprint-sha1", "type": "x509-fingerprint-sha1"}, {"comment": "", "category": "Other", "uuid": "5d95e659-ee88-41b8-bb4b-43df950d210f", "timestamp": "1570104921", "to_ids": false, "value": "GeoTrust Rsa CA", "disable_correlation": true, "object_relation": "issuer", "type": "text"}, {"comment": "", "category": "Other", "uuid": "5d95e659-4a14-4dfc-9fc4-42f0950d210f", "timestamp": "1570104921", "to_ids": false, "value": "20311117T000000-0800", "disable_correlation": true, "object_relation": "validity-not-after", "type": "datetime"}], "distribution": "5", "meta-category": "network", "name": "x509"}, {"comment": "", "template_uuid": "d1ab756a-26b5-4349-9f43-765630f0911c", "uuid": "5d95e68b-16c0-47d1-bd8a-4269950d210f", "sharing_group_id": "0", "timestamp": "1570104971", "description": "x509 object describing a X.509 certificate", "template_version": "9", "Attribute": [{"comment": "", "category": "Network activity", "uuid": "5d95e68c-ae94-4a49-b254-4e59950d210f", "timestamp": "1570104972", "to_ids": true, "value": "992bace0bc815e43626d59d790cef50907c6ea9b", "disable_correlation": false, "object_relation": "x509-fingerprint-sha1", "type": "x509-fingerprint-sha1"}, {"comment": "", "category": "Other", "uuid": "5d95e68c-aac8-42d9-95e1-4351950d210f", "timestamp": "1570104972", "to_ids": false, "value": "VeriSign, Inc.", "disable_correlation": true, "object_relation": "issuer", "type": "text"}, {"comment": "", "category": "Other", "uuid": "5d95e68c-9030-4de9-b5a3-4acc950d210f", "timestamp": "1570104972", "to_ids": false, "value": "20311117T000000-0800", "disable_correlation": true, "object_relation": "validity-not-after", "type": "datetime"}], "distribution": "5", "meta-category": "network", "name": "x509"}, {"comment": "", "template_uuid": "21ad70d8-d397-11e9-9ea7-43b2d5f6a6e3", "uuid": "5d95ee8f-feec-4106-a189-41c7950d210f", "sharing_group_id": "0", "timestamp": "1570107693", "description": "Command functionalities related to a software malicious or not to execute specific commands. Command-line are attached to this object for the related commands.", "template_version": "1", "ObjectReference": [{"comment": "", "object_uuid": "5d95ee8f-feec-4106-a189-41c7950d210f", "uuid": "5d95f01f-f514-4d10-b8ea-4652950d210f", "timestamp": "1570107423", "referenced_uuid": "5d95ef87-54fc-49aa-a417-4740950d210f", "relationship_type": "includes"}, {"comment": "", "object_uuid": "5d95ee8f-feec-4106-a189-41c7950d210f", "uuid": "5d95f040-f99c-4fa3-a791-4231950d210f", "timestamp": "1570107456", "referenced_uuid": "5d95eeae-1724-4536-b98c-49b2950d210f", "relationship_type": "includes"}, {"comment": "", "object_uuid": "5d95ee8f-feec-4106-a189-41c7950d210f", "uuid": "5d95f06e-aed4-4138-a44b-4629950d210f", "timestamp": "1570107502", "referenced_uuid": "5d95eec7-48f8-4b2a-9558-46c5950d210f", "relationship_type": "includes"}, {"comment": "", "object_uuid": "5d95ee8f-feec-4106-a189-41c7950d210f", "uuid": "5d95f088-5da0-480a-afd2-45f0950d210f", "timestamp": "1570107528", "referenced_uuid": "5d95ef16-1204-47ba-8bc9-41dd950d210f", "relationship_type": "includes"}, {"comment": "", "object_uuid": "5d95ee8f-feec-4106-a189-41c7950d210f", "uuid": "5d95f09c-fa98-431e-a573-471e950d210f", "timestamp": "1570107548", "referenced_uuid": "5d95ef9f-972c-4b95-b577-41ef950d210f", "relationship_type": "includes"}, {"comment": "", "object_uuid": "5d95ee8f-feec-4106-a189-41c7950d210f", "uuid": "5d95f0b4-c8c8-42ec-9bed-4a26950d210f", "timestamp": "1570107572", "referenced_uuid": "5d95efbc-3038-48e6-b25c-48a8950d210f", "relationship_type": "includes"}, {"comment": "", "object_uuid": "5d95ee8f-feec-4106-a189-41c7950d210f", "uuid": "5d95f0db-8f44-4df0-a781-423d950d210f", "timestamp": "1570107611", "referenced_uuid": "5d95effb-e4a0-41af-b5a8-48b4950d210f", "relationship_type": "includes"}, {"comment": "", "object_uuid": "5d95ee8f-feec-4106-a189-41c7950d210f", "uuid": "5d95f0ef-f194-457f-aeee-41ef950d210f", "timestamp": "1570107631", "referenced_uuid": "5d95efd6-61e4-458e-8445-42c4950d210f", "relationship_type": "includes"}, {"comment": "", "object_uuid": "5d95ee8f-feec-4106-a189-41c7950d210f", "uuid": "5d95f101-71f4-46dd-84d1-a79c950d210f", "timestamp": "1570107649", "referenced_uuid": "5d95ef38-f244-4c43-a544-41c5950d210f", "relationship_type": "includes"}, {"comment": "", "object_uuid": "5d95ee8f-feec-4106-a189-41c7950d210f", "uuid": "5d95f118-735c-4f40-a317-a79c950d210f", "timestamp": "1570107672", "referenced_uuid": "5d95eeee-23fc-4693-becb-4b7b950d210f", "relationship_type": "includes"}, {"comment": "", "object_uuid": "5d95ee8f-feec-4106-a189-41c7950d210f", "uuid": "5d95f12d-9bbc-4a8e-a5ff-a79c950d210f", "timestamp": "1570107693", "referenced_uuid": "5d95ef5c-eb2c-48f9-a95f-42ea950d210f", "relationship_type": "includes"}], "Attribute": [{"comment": "", "category": "Other", "uuid": "5d95ee8f-dac0-4724-94ca-47b1950d210f", "timestamp": "1570107023", "to_ids": false, "value": "All C2 communications are handled in a standalone malware thread. Reductor sends HTTP POST queries to the /query.php scripts on the C2s listed in its configuration. The POST query contains the target\u2019s unique hardware ID encrypted with AES 128. The C2 returns one of the following encrypted commands.", "disable_correlation": false, "object_relation": "description", "type": "text"}, {"comment": "", "category": "Other", "uuid": "5d95ee8f-16dc-43b1-855c-40e7950d210f", "timestamp": "1570107023", "to_ids": false, "value": "Network", "disable_correlation": true, "object_relation": "trigger", "type": "text"}, {"comment": "", "category": "Other", "uuid": "5d95ee8f-5850-4ebf-a819-4720950d210f", "timestamp": "1570107023", "to_ids": false, "value": "Bundled", "disable_correlation": true, "object_relation": "location", "type": "text"}], "distribution": "5", "meta-category": "misc", "name": "command"}, {"comment": "", "template_uuid": "88ebe222-d3cc-11e9-875d-7f13f460adaf", "uuid": "5d95eeae-1724-4536-b98c-49b2950d210f", "sharing_group_id": "0", "timestamp": "1570107054", "description": "Command line and option related to a software malicious or not to execute specific commands.", "template_version": "1", "Attribute": [{"comment": "", "category": "Other", "uuid": "5d95eeaf-7354-452c-9798-43b6950d210f", "timestamp": "1570107055", "to_ids": false, "value": "Get the host name", "disable_correlation": false, "object_relation": "description", "type": "text"}, {"comment": "", "category": "Other", "uuid": "5d95eeaf-1290-4305-be37-498a950d210f", "timestamp": "1570107055", "to_ids": false, "value": "hostinfo", "disable_correlation": false, "object_relation": "value", "type": "text"}], "distribution": "5", "meta-category": "misc", "name": "command-line"}, {"comment": "", "template_uuid": "88ebe222-d3cc-11e9-875d-7f13f460adaf", "uuid": "5d95eec7-48f8-4b2a-9558-46c5950d210f", "sharing_group_id": "0", "timestamp": "1570107079", "description": "Command line and option related to a software malicious or not to execute specific commands.", "template_version": "1", "Attribute": [{"comment": "", "category": "Other", "uuid": "5d95eec7-cf64-4268-8a63-434a950d210f", "timestamp": "1570107079", "to_ids": false, "value": "Get the timeout value from the corresponding registry value", "disable_correlation": false, "object_relation": "description", "type": "text"}, {"comment": "", "category": "Other", "uuid": "5d95eec7-15a8-4238-adfd-4542950d210f", "timestamp": "1570107079", "to_ids": false, "value": "gettimeout", "disable_correlation": false, "object_relation": "value", "type": "text"}], "distribution": "5", "meta-category": "misc", "name": "command-line"}, {"comment": "", "template_uuid": "88ebe222-d3cc-11e9-875d-7f13f460adaf", "uuid": "5d95eeee-23fc-4693-becb-4b7b950d210f", "sharing_group_id": "0", "timestamp": "1570107118", "description": "Command line and option related to a software malicious or not to execute specific commands.", "template_version": "1", "Attribute": [{"comment": "", "category": "Other", "uuid": "5d95eeef-4b14-435e-9364-4fb2950d210f", "timestamp": "1570107119", "to_ids": false, "value": "Parse strings and set corresponding values in the system registries. So far only one option is supported \u2013 timeout", "disable_correlation": false, "object_relation": "description", "type": "text"}, {"comment": "", "category": "Other", "uuid": "5d95eeef-1d38-409c-8396-4060950d210f", "timestamp": "1570107119", "to_ids": false, "value": "options", "disable_correlation": false, "object_relation": "value", "type": "text"}], "distribution": "5", "meta-category": "misc", "name": "command-line"}, {"comment": "", "template_uuid": "88ebe222-d3cc-11e9-875d-7f13f460adaf", "uuid": "5d95ef16-1204-47ba-8bc9-41dd950d210f", "sharing_group_id": "0", "timestamp": "1570107158", "description": "Command line and option related to a software malicious or not to execute specific commands.", "template_version": "1", "Attribute": [{"comment": "", "category": "Other", "uuid": "5d95ef16-0388-41d5-a2f7-4569950d210f", "timestamp": "1570107158", "to_ids": false, "value": "Transmit the current C2 domains used by target", "disable_correlation": false, "object_relation": "description", "type": "text"}, {"comment": "", "category": "Other", "uuid": "5d95ef16-9d5c-4b14-9227-4fbb950d210f", "timestamp": "1570107158", "to_ids": false, "value": "domainlist", "disable_correlation": false, "object_relation": "value", "type": "text"}], "distribution": "5", "meta-category": "misc", "name": "command-line"}, {"comment": "", "template_uuid": "88ebe222-d3cc-11e9-875d-7f13f460adaf", "uuid": "5d95ef38-f244-4c43-a544-41c5950d210f", "sharing_group_id": "0", "timestamp": "1570107192", "description": "Command line and option related to a software malicious or not to execute specific commands.", "template_version": "1", "Attribute": [{"comment": "", "category": "Other", "uuid": "5d95ef38-d59c-419e-89e3-42d6950d210f", "timestamp": "1570107192", "to_ids": false, "value": "Download the file of interest", "disable_correlation": false, "object_relation": "description", "type": "text"}, {"comment": "", "category": "Other", "uuid": "5d95ef38-86b4-44d0-891a-4d3e950d210f", "timestamp": "1570107192", "to_ids": false, "value": "downfile", "disable_correlation": false, "object_relation": "value", "type": "text"}], "distribution": "5", "meta-category": "misc", "name": "command-line"}, {"comment": "", "template_uuid": "88ebe222-d3cc-11e9-875d-7f13f460adaf", "uuid": "5d95ef5c-eb2c-48f9-a95f-42ea950d210f", "sharing_group_id": "0", "timestamp": "1570107228", "description": "Command line and option related to a software malicious or not to execute specific commands.", "template_version": "1", "Attribute": [{"comment": "", "category": "Other", "uuid": "5d95ef5c-86f4-4135-836e-41bf950d210f", "timestamp": "1570107228", "to_ids": false, "value": "Upload the file of interest", "disable_correlation": false, "object_relation": "description", "type": "text"}, {"comment": "", "category": "Other", "uuid": "5d95ef5c-4734-4a1c-9d21-4c56950d210f", "timestamp": "1570107228", "to_ids": false, "value": "upfile", "disable_correlation": false, "object_relation": "value", "type": "text"}], "distribution": "5", "meta-category": "misc", "name": "command-line"}, {"comment": "", "template_uuid": "88ebe222-d3cc-11e9-875d-7f13f460adaf", "uuid": "5d95ef87-54fc-49aa-a417-4740950d210f", "sharing_group_id": "0", "timestamp": "1570107271", "description": "Command line and option related to a software malicious or not to execute specific commands.", "template_version": "1", "Attribute": [{"comment": "", "category": "Other", "uuid": "5d95ef87-53d8-449a-9c86-47a1950d210f", "timestamp": "1570107271", "to_ids": false, "value": "Create the process that executes mentioned file", "disable_correlation": false, "object_relation": "description", "type": "text"}, {"comment": "", "category": "Other", "uuid": "5d95ef87-deb8-47dc-8bdd-45bb950d210f", "timestamp": "1570107271", "to_ids": false, "value": "execfile", "disable_correlation": false, "object_relation": "value", "type": "text"}], "distribution": "5", "meta-category": "misc", "name": "command-line"}, {"comment": "", "template_uuid": "88ebe222-d3cc-11e9-875d-7f13f460adaf", "uuid": "5d95ef9f-972c-4b95-b577-41ef950d210f", "sharing_group_id": "0", "timestamp": "1570107295", "description": "Command line and option related to a software malicious or not to execute specific commands.", "template_version": "1", "Attribute": [{"comment": "", "category": "Other", "uuid": "5d95ef9f-3878-4f8f-b286-4bdd950d210f", "timestamp": "1570107295", "to_ids": false, "value": "Do nothing. Possibly used to check the connection with the host", "disable_correlation": false, "object_relation": "description", "type": "text"}, {"comment": "", "category": "Other", "uuid": "5d95ef9f-880c-471d-9849-49a3950d210f", "timestamp": "1570107295", "to_ids": false, "value": "nop", "disable_correlation": false, "object_relation": "value", "type": "text"}], "distribution": "5", "meta-category": "misc", "name": "command-line"}, {"comment": "", "template_uuid": "88ebe222-d3cc-11e9-875d-7f13f460adaf", "uuid": "5d95efbc-3038-48e6-b25c-48a8950d210f", "sharing_group_id": "0", "timestamp": "1570107324", "description": "Command line and option related to a software malicious or not to execute specific commands.", "template_version": "1", "Attribute": [{"comment": "", "category": "Other", "uuid": "5d95efbc-e7c8-4d86-9b0d-4c79950d210f", "timestamp": "1570107324", "to_ids": false, "value": "Delete installed digital certificates, files, cookies and system registry values including those related to COM CLSID or LSA notification package persistence", "disable_correlation": false, "object_relation": "description", "type": "text"}, {"comment": "", "category": "Other", "uuid": "5d95efbc-18f4-421c-bc70-4f6d950d210f", "timestamp": "1570107324", "to_ids": false, "value": "kill", "disable_correlation": false, "object_relation": "value", "type": "text"}], "distribution": "5", "meta-category": "misc", "name": "command-line"}, {"comment": "", "template_uuid": "88ebe222-d3cc-11e9-875d-7f13f460adaf", "uuid": "5d95efd6-61e4-458e-8445-42c4950d210f", "sharing_group_id": "0", "timestamp": "1570107350", "description": "Command line and option related to a software malicious or not to execute specific commands.", "template_version": "1", "Attribute": [{"comment": "", "category": "Other", "uuid": "5d95efd7-d120-4621-a7e8-43b4950d210f", "timestamp": "1570107351", "to_ids": false, "value": "Delete file at a specified path", "disable_correlation": false, "object_relation": "description", "type": "text"}, {"comment": "", "category": "Other", "uuid": "5d95efd7-74e0-498c-b936-404e950d210f", "timestamp": "1570107351", "to_ids": false, "value": "deletefile", "disable_correlation": false, "object_relation": "value", "type": "text"}], "distribution": "5", "meta-category": "misc", "name": "command-line"}, {"comment": "", "template_uuid": "88ebe222-d3cc-11e9-875d-7f13f460adaf", "uuid": "5d95effb-e4a0-41af-b5a8-48b4950d210f", "sharing_group_id": "0", "timestamp": "1570107387", "description": "Command line and option related to a software malicious or not to execute specific commands.", "template_version": "1", "Attribute": [{"comment": "", "category": "Other", "uuid": "5d95effc-6a30-4f50-833b-4fef950d210f", "timestamp": "1570107388", "to_ids": false, "value": "Renew the digital certificates installed on target", "disable_correlation": false, "object_relation": "description", "type": "text"}, {"comment": "", "category": "Other", "uuid": "5d95effc-2bd8-4075-b30e-4892950d210f", "timestamp": "1570107388", "to_ids": false, "value": "certlist", "disable_correlation": false, "object_relation": "value", "type": "text"}], "distribution": "5", "meta-category": "misc", "name": "command-line"}], "analysis": "0", "Attribute": [{"comment": "", "category": "External analysis", "uuid": "5d95e3c6-2aa4-45e6-b0ca-46a5950d210f", "timestamp": "1570105090", "to_ids": false, "value": "https://securelist.com/compfun-successor-reductor/93633/", "disable_correlation": false, "object_relation": null, "type": "link"}, {"comment": "", "category": "Payload delivery", "uuid": "5d95e44b-9428-43f9-8caf-4e2c950d210f", "timestamp": "1570104395", "to_ids": true, "value": "27ce434ad1e240075c48a51722f8e87f", "disable_correlation": false, "object_relation": null, "type": "md5"}, {"comment": "", "category": "Payload delivery", "uuid": "5d95e44b-4d9c-46e9-958e-42e9950d210f", "timestamp": "1570104395", "to_ids": true, "value": "4e02b1b1d32e23975f496d1d1e0eb7a6", "disable_correlation": false, "object_relation": null, "type": "md5"}, {"comment": "", "category": "Payload delivery", "uuid": "5d95e44c-1f40-4f7a-842f-4834950d210f", "timestamp": "1570104395", "to_ids": true, "value": "518ab503808e747c5d0dde6bfb54b95a", "disable_correlation": false, "object_relation": null, "type": "md5"}, {"comment": "", "category": "Payload delivery", "uuid": "5d95e44c-d36c-480d-b175-4bc9950d210f", "timestamp": "1570104396", "to_ids": true, "value": "7911f8d717dc9d7a78d99e687a12d7ad", "disable_correlation": false, "object_relation": null, "type": "md5"}, {"comment": "", "category": "Payload delivery", "uuid": "5d95e44c-39dc-46a5-9820-47c8950d210f", "timestamp": "1570104396", "to_ids": true, "value": "9c7e50e7ce36c1b7d8ca2af2082f4cd5", "disable_correlation": false, "object_relation": null, "type": "md5"}, {"comment": "", "category": "Payload delivery", "uuid": "5d95e44c-d07c-4b64-922d-472b950d210f", "timestamp": "1570104396", "to_ids": true, "value": "a0387665fe7e006b5233c66f6bd5bb9d", "disable_correlation": false, "object_relation": null, "type": "md5"}, {"comment": "", "category": "Payload delivery", "uuid": "5d95e44c-f164-4110-854d-43d9950d210f", "timestamp": "1570104396", "to_ids": true, "value": "f6caa1bfcca872f0cbe2e7346b006ab4", "disable_correlation": false, "object_relation": null, "type": "md5"}, {"comment": "", "category": "Network activity", "uuid": "5d95e498-07f0-44dc-a11c-4453950d210f", "timestamp": "1570104472", "to_ids": true, "value": "adstat.pw", "disable_correlation": false, "object_relation": null, "type": "domain"}, {"comment": "", "category": "Network activity", "uuid": "5d95e498-174c-408d-ac07-4aac950d210f", "timestamp": "1570104472", "to_ids": true, "value": "bill-tat.pw", "disable_correlation": false, "object_relation": null, "type": "domain"}, {"comment": "Attribute #7635901 enriched by dns.", "category": "Network activity", "uuid": "5d95e4eb-d450-4d33-981b-49bfe387cbd9", "timestamp": "1570104555", "to_ids": false, "value": "200.63.45.192", "disable_correlation": false, "object_relation": null, "type": "ip-src"}, {"comment": "", "category": "External analysis", "uuid": "5d95e72f-d3c4-42e0-8040-4fe9950d210f", "timestamp": "1570105135", "to_ids": false, "value": "In April 2019, we discovered new malware that compromises encrypted web communications in an impressive way. Analysis of the malware allowed us to confirm that the operators have some control over the target\u2019s network channel and could replace legitimate installers with infected ones on the fly. That places the actor in a very exclusive club, with capabilities that few other actors in the world have.\r\n\r\nWe called these new modules \u2018Reductor\u2019 after a .pdb path left in some samples. Besides typical RAT functions such as uploading, downloading and executing files, Reductor\u2019s authors put a lot of effort into manipulating digital certificates and marking outbound TLS traffic with unique host-related identifiers.\r\n\r\nThe Kaspersky Attribution Engine shows strong code similarities between this family and the COMPfun Trojan. Moreover, further research showed that the original COMpfun Trojan most probably is used as a downloader in one of the distribution schemes. Based on these similarities, we\u2019re quite sure the new malware was developed by the COMPfun authors.\r\n\r\nThe COMpfun malware was initially documented by G-DATA in 2014. Although G-DATA didn\u2019t identify which actor was using this malware, Kaspersky tentatively linked it to the Turla APT, based on the victimology. Our telemetry indicates that the current campaign using Reductor started at the end of April 2019 and remained active at the time of writing (August 2019). We identified targets in Russia and Belarus.\r\n\r\nWe registered two initial infection schemes: Reductor spreads by either infecting popular software distributions (Internet Downloader Manager, WinRAR, etc. and, for at least one victim, through a popular warez website over HTTP); or its decryptor/dropper is spread using COMpfun\u2019s ability to download files on already infected hosts.", "disable_correlation": false, "object_relation": null, "type": "text"}, {"comment": "", "category": "Payload delivery", "uuid": "5d9ec7e0-48e0-4106-ac7e-43e2950d210f", "timestamp": "1570686944", "to_ids": true, "value": "3e93f8b7c46a32236c225926d9f063f2", "disable_correlation": false, "object_relation": null, "type": "md5"}, {"comment": "", "category": "Payload delivery", "uuid": "5d9ec7e0-a730-412b-a02e-4ba1950d210f", "timestamp": "1570686944", "to_ids": true, "value": "5a5de7165faa9ad0ed3b2094ee6cff89", "disable_correlation": false, "object_relation": null, "type": "md5"}], "extends_uuid": "", "published": false, "date": "2019-10-03", "Orgc": {"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f", "name": "CIRCL"}, "threat_level_id": "3", "uuid": "5d95e39a-712c-41b6-b17b-459d950d210f"}} |