111 lines
No EOL
4.4 KiB
JSON
111 lines
No EOL
4.4 KiB
JSON
{
|
|
"Event": {
|
|
"analysis": "2",
|
|
"date": "2016-04-19",
|
|
"extends_uuid": "",
|
|
"info": "OSINT - MULTIGRAIN \u00e2\u20ac\u201c Point of Sale Attackers Make an Unhealthy Addition to the Pantry",
|
|
"publish_timestamp": "1462176002",
|
|
"published": true,
|
|
"threat_level_id": "3",
|
|
"timestamp": "1462175966",
|
|
"uuid": "5718d5d3-25d4-415c-a97b-4920950d210f",
|
|
"Orgc": {
|
|
"name": "CIRCL",
|
|
"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
|
|
},
|
|
"Tag": [
|
|
{
|
|
"colour": "#004646",
|
|
"local": false,
|
|
"name": "type:OSINT",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#ffffff",
|
|
"local": false,
|
|
"name": "tlp:white",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#7af300",
|
|
"local": false,
|
|
"name": "circl:topic=\"services\"",
|
|
"relationship_type": ""
|
|
},
|
|
{
|
|
"colour": "#00abd1",
|
|
"local": false,
|
|
"name": "veris:action:malware:variety=\"Ram scraper\"",
|
|
"relationship_type": ""
|
|
}
|
|
],
|
|
"Attribute": [
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1461245407",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "5718d5df-218c-47c5-a8a6-4e8e950d210f",
|
|
"value": "https://www.fireeye.com/blog/threat-research/2016/04/multigrain_pointo.html"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1461245420",
|
|
"to_ids": false,
|
|
"type": "comment",
|
|
"uuid": "5718d5ec-8fe0-408b-9538-4e90950d210f",
|
|
"value": "FireEye recently discovered a new variant of a point of sale (POS) malware family known as NewPosThings. This variant, which we call \u00e2\u20ac\u0153MULTIGRAIN\u00e2\u20ac\u009d, consists largely of a subset of slightly modified code from NewPosThings. The variant is highly targeted, digitally signed, and exfiltrates stolen payment card data over DNS. The addition of DNS-based exfiltration is new for this malware family; however, other POS malware families such as BernhardPOS and FrameworkPOS have used this technique in the past.\r\n\r\nUsing DNS for data exfiltration provides several advantages to the attacker. Sensitive environments that process card data will often monitor, restrict, or entirely block the HTTP or FTP traffic often used for exfiltration in other environments. While these common internet protocols may be disabled within a restrictive card processing environment, DNS is still necessary to resolve hostnames within the corporate environment and is unlikely to be blocked."
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import.",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1461245616",
|
|
"to_ids": true,
|
|
"type": "md5",
|
|
"uuid": "5718d6b0-bee4-4e88-a620-490a950d210f",
|
|
"value": "f924cec68be776e41726ee765f469d50"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import. - Xchecked via VT: f924cec68be776e41726ee765f469d50",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1462175904",
|
|
"to_ids": true,
|
|
"type": "sha256",
|
|
"uuid": "572708a0-8dd4-4b6f-a812-4f7902de0b81",
|
|
"value": "6abf4544f60ac6117706727c241b97924e0c474f505838d0eb0491fc62b673cd"
|
|
},
|
|
{
|
|
"category": "Payload delivery",
|
|
"comment": "Imported via the freetext import. - Xchecked via VT: f924cec68be776e41726ee765f469d50",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1462175904",
|
|
"to_ids": true,
|
|
"type": "sha1",
|
|
"uuid": "572708a0-8198-489c-863f-44d202de0b81",
|
|
"value": "f7125695a1c59970b7557362c67f81d93d871373"
|
|
},
|
|
{
|
|
"category": "External analysis",
|
|
"comment": "Imported via the freetext import. - Xchecked via VT: f924cec68be776e41726ee765f469d50",
|
|
"deleted": false,
|
|
"disable_correlation": false,
|
|
"timestamp": "1462175904",
|
|
"to_ids": false,
|
|
"type": "link",
|
|
"uuid": "572708a0-6018-4118-810b-409c02de0b81",
|
|
"value": "https://www.virustotal.com/file/6abf4544f60ac6117706727c241b97924e0c474f505838d0eb0491fc62b673cd/analysis/1461918348/"
|
|
}
|
|
]
|
|
}
|
|
} |