Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs

data/ioc/spyware/amnesty/2021-02-24_vietnam/indicators/README.md

@@ -0,0 +1,9 @@
+# Indicators of Compromise
+
+Indicators of compromise of the report [Click and Bait: Vietnamese Human Rights Defenders Targeted with Spyware Attacks ](https://www.amnesty.org/en/latest/research/2021/02/click-and-bait-vietnamese-human-rights-defenders-targeted-with-spyware-attacks/)
+
+Files:
+* `domains.txt`: list of domains
+* `ips.txt`: list of IP addresses
+* `rules.yar`: YARA rules
+* `sha256.txt`: SHA256 of samples

data/ioc/spyware/amnesty/2021-02-24_vietnam/indicators/domains.txt

@@ -0,0 +1,10 @@
+ssl.arkouthrie.com
+widget.shoreoa.com
+s3.hiahornber.com
+tips.jasperpfeiffer.com
+land.rellecharlessper.com
+art.guillermoespana.com
+api.ciscofreak.com
+node.podzone.org
+delicalo.dnsalias.net
+coco.cechire.com

data/ioc/spyware/amnesty/2021-02-24_vietnam/indicators/ips.txt

@@ -0,0 +1,6 @@
+185.174.101.13
+185.157.79.134
+95.168.191.35
+45.76.106.146
+5.149.254.19
+103.114.161.122

data/ioc/spyware/amnesty/2021-02-24_vietnam/indicators/rules.yar

@@ -0,0 +1,62 @@
+rule apt32_macos_dropper {
+    meta:
+        author = "Amnesty Tech"
+
+    strings:
+        $s1 = "setStartup" ascii
+        $s2 = "getSizeDataLoader" ascii
+        $s3 = "GET_LAUNCHNAME" ascii
+        $s4 = "GET_PROCESSNAME" ascii
+        $s5 = "getProcessnameRoot" ascii
+        $s6 = "getProcessnameUser" ascii
+        $s7 = "getProcessPathRoot" ascii
+        $s8 = "getLabelnameRoot" ascii
+        $s9 = "getLabelnameUser" ascii
+        $s10 = "stringFromHex" ascii
+        $s11 = "_b64_decode_ex" ascii
+
+    condition:
+        (uint16(0) == 0xfacf or uint16(0) == 0xface) and 9 of them
+}
+
+rule apt32_macos_backdoor_2018_encryption_key {
+    strings:
+        $key = { 63 49 2f 6e 22 00 10 fe 33 4f 2f c5 05 b2 11 03 ba 5b dd 02 }
+        $ccc = "CCCrypt" ascii
+    condition:
+        (uint16(0) == 0xfacf or uint16(0) == 0xface) and all of them
+}
+
+rule apt32_macos_backdoor_2019_encryption_key {
+    meta:
+        report = "https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/"
+    strings:
+        $key1 = { 9D 72 74 AD 7B CE F0 DE D2 9B DB B4 28 C2 51 DF 8B 35 0B 92 }
+        $key2 = {2c e4 25 29 5e 2a 20 40 9c a5 13 1e 61 1e 51 6f 2c b7 a7 7f }
+        $key3 = { 8b b2 c4 67 56 5c 63 42 8e f0 cf c5 f4 8d 87 ae 58 0c 5b a4 }
+        $ccc = "CCCrypt" ascii
+    condition:
+        (uint16(0) == 0xfacf or uint16(0) == 0xface) and $ccc and any of ($key*)
+}
+
+rule apt32_macos_backdoor_2018 {
+    meta:
+        author = "Amnesty Tech"
+
+    strings:
+        $s1 = "respondDownloadThreadP" ascii
+        $s2 = "checkProcessExist" ascii
+        $s3 = "setFristRandom" ascii
+        $s4 = "getInstalledTime" ascii
+        $s5 = "getSerialNumber" ascii
+        $s6 = "appendPathComponent" ascii
+        $s7 = "initFirstRandom" ascii
+        $s8 = "CFURLToString" ascii
+        $s9 = "GET_DOMAIN_CLIENT_INFO" ascii
+        $s10 = "getFirstRandom_Header" ascii
+        $s11 = "respondLoadLunaThread" ascii
+
+    condition:
+        (uint16(0) == 0xfacf or uint16(0) == 0xface) and 9 of them
+
+}

data/ioc/spyware/amnesty/2021-02-24_vietnam/indicators/sha256.txt

@@ -0,0 +1,15 @@
+952c16674bde3c16aa3935b3e01f3f0fb4cbac7ffa130143cbf6ccaa72733068
+d3a198e18f8c5e9ed54ed4959b471a0f15fbda7d4abf92b7726bc07723e46dd5
+ecb6186a5e722fa360ece37191589305858a0e176321c9339831f2884dcb0405
+1599fe6cc77764c17802cfde1ca77f091bb3ec2a49f6cab1c80ee667ea7c752b
+b8567ce4d0595e6466414999798bcb1dfe01cc5ca1dd058bfc55f92033f0f3d8
+b252a8d2ec5c7080286fe3f0ad193062f506b5c34c4c797f97717e396c0a22d5
+9c14cffd79f863fec0a6c0ed337ea82a9044db09afda53b8ac2aef1d49f74f4f
+5ed6b7b450ead2d0e69faa3069d1e0bd3a6852909092235f75087da0ca05462f
+a890c88b6c64371242b4047830b9189b4546536c6b11576d0738f0ba1840aded
+0c41358adeea24d80b35bac4b4f60d93711e32e287343cb604e1fa79b5e5e465
+5ed6b7b450ead2d0e69faa3069d1e0bd3a6852909092235f75087da0ca05462f
+148e647885712b69258967c5f8798966fb9b8ae24847dda8aeb880cb6f56b6da
+acb33adf7429424170f63fa5490ed580cf502de4a7ef00e4b8c962425cd85052
+5cc8d52fcabfd35042336e095f1f78c2b2884e7826358f5385729cf45ce4d860
+a574720e7b4f420098a0ac0055089000435439eb61ec6de2077ac0f782a506e9