Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs
This commit is contained in:
SsSnake
11
data/ioc/spyware/amnesty/2021-12-16_cytrox/README.md
Normal file
11
data/ioc/spyware/amnesty/2021-12-16_cytrox/README.md
Normal file
@@ -0,0 +1,11 @@
|
||||
# Cytrox Spyware Indicators of Compromise
|
||||
|
||||
This repository contains network and device indicators of compromised (IoCs) related to the IOS and Android spyware tools developed by the cyber-surveillance company Cytrox. These indicators were first published in December 2021 by Meta in their [Threat Report on the Surveillance-for-Hire Industry](https://about.fb.com/news/2021/12/taking-action-against-surveillance-for-hire/) and by Citizen Lab in their report [Pegasus vs. Predator - Dissident’s Doubly-Infected iPhone Reveals Cytrox Mercenary Spyware](https://citizenlab.ca/2021/12/pegasus-vs-predator-dissidents-doubly-infected-iphone-reveals-cytrox-mercenary-spyware/). Additional indicators of compromise were identified by the Amnesty Tech Security Lab as part of an independent investigation.
|
||||
|
||||
The STIX2 file can be used with the [Mobile Verification Toolkit](https://github.com/mvt-project/mvt) to look for potential signs of compromise on Android phones and iPhones.
|
||||
|
||||
It includes the following files:
|
||||
* `config_profiles.txt`: UUID of suspicious configuration profiles dropped by the Cytrox spyware
|
||||
* `cytrox.stix2`: [STIX2](https://oasis-open.github.io/cti-documentation/stix/intro.html) file containing all indicators
|
||||
* `domains.txt`: list of Cytrox domains
|
||||
* `file_paths.txt`: file paths for Cytrox payloads on disk in Android and iOS.
|
||||
@@ -0,0 +1 @@
|
||||
76DAB334-7E17-475D-A5D6-0794EB5818A5
|
||||
8248
data/ioc/spyware/amnesty/2021-12-16_cytrox/cytrox.stix2
Normal file
8248
data/ioc/spyware/amnesty/2021-12-16_cytrox/cytrox.stix2
Normal file
File diff suppressed because it is too large
Load Diff
336
data/ioc/spyware/amnesty/2021-12-16_cytrox/domains.txt
Normal file
336
data/ioc/spyware/amnesty/2021-12-16_cytrox/domains.txt
Normal file
@@ -0,0 +1,336 @@
|
||||
2y4nothing.xyz
|
||||
5m5.io
|
||||
actumali.org
|
||||
addons.news
|
||||
adibjan.net
|
||||
adservices.gr.com
|
||||
adultpcz.xyz
|
||||
advertsservices.com
|
||||
advfb.xyz
|
||||
affise.app
|
||||
almasryelyuom.com
|
||||
alpineai.uk
|
||||
alraeeenews.com
|
||||
alraeesnews.net
|
||||
altsantiri.news
|
||||
amazing.lab
|
||||
ancienthistory.xyz
|
||||
android-apps.tech
|
||||
api-apple-buy.com
|
||||
api-telecommunication.com
|
||||
applepps.com
|
||||
apps-ios.net
|
||||
aramexegypt.com
|
||||
atheere.com
|
||||
audit-pvv.com
|
||||
bank-alahly.com
|
||||
bbcsworld.com
|
||||
bi.tly.gr.com
|
||||
bi.tly.link
|
||||
bit-li.com
|
||||
bit-li.ws
|
||||
bit-ly.link
|
||||
bit-ly.org
|
||||
bitlinkin.xyz
|
||||
bitlly.live
|
||||
bitlyrs.com
|
||||
bitt.fi
|
||||
bity.ws
|
||||
bityl.me
|
||||
blacktrail.xyz
|
||||
bmw.gr.com
|
||||
bookjob.club
|
||||
browsercheck.services
|
||||
bumabara.bid
|
||||
burgerprince.us
|
||||
businesnews.net
|
||||
canyouc.xyz
|
||||
carrefourmisr.com
|
||||
cbbc01.xyz
|
||||
celebrnewz.xyz
|
||||
cellconn.net
|
||||
charmander.xyz
|
||||
chatwithme.store
|
||||
citroen.gr.com
|
||||
ckforward.one
|
||||
clockupdate.com
|
||||
cloudstatistics.net
|
||||
cloudtimesync.com
|
||||
cnn.gr.com
|
||||
conlnk.one
|
||||
connectivitycheck.live
|
||||
connectivitycheck.online
|
||||
connectivitychecker.com
|
||||
contents-domain.com
|
||||
covid19masks.shop
|
||||
crashonline.site
|
||||
cut.red
|
||||
cyber.country
|
||||
danas.bid
|
||||
distedc.com
|
||||
download4you.xyz
|
||||
dragonair.xyz
|
||||
eagerfox.xyz
|
||||
ebill.cosmote.center
|
||||
edolio5.com
|
||||
efsyn.news
|
||||
efsyn.online
|
||||
eg-gov.org
|
||||
egyqaz.com
|
||||
elpais.me
|
||||
emvolio-gov.gr
|
||||
engine.ninja
|
||||
enigmase.xyz
|
||||
enikos.news
|
||||
ereportaz.news
|
||||
espressonews.gr.com
|
||||
etisalategypt.tech
|
||||
etisalatgreen.com
|
||||
ewish.cards
|
||||
fastdownload.me
|
||||
fastuploads.xyz
|
||||
fbc8213450838f7ae251d4519c195138.xyz
|
||||
ferrari.gr.com
|
||||
ffoxnewz.com
|
||||
fimes.gr.com
|
||||
fireup.xyz
|
||||
fisherman.engine.ninja
|
||||
flash.gr.com
|
||||
flexipagez.com
|
||||
forwardeshoptt.com
|
||||
getsignalapps.com
|
||||
getsignalapps.live
|
||||
getupdatesnow.xyz
|
||||
goldenscent.net
|
||||
goldenscint.com
|
||||
goldescent.com
|
||||
gosokm.com
|
||||
guardian-tt.me
|
||||
guardnew.live
|
||||
guardnews.live
|
||||
heaven.army
|
||||
heiiasjournai.com
|
||||
hellasjournal.company
|
||||
hellasjournal.website
|
||||
hellottec.art
|
||||
hempower.shop
|
||||
hopnope.xyz
|
||||
icloudeu.com
|
||||
icloudflair.com
|
||||
iibt.xyz
|
||||
ikea-egypt.net
|
||||
ilnk.xyz
|
||||
in-politics.com
|
||||
inews.gr.com
|
||||
infosms-a.site
|
||||
inservices.digital
|
||||
insider.gr.com
|
||||
instagam.click
|
||||
instagam.in
|
||||
instagam.photos
|
||||
instegram.co
|
||||
insurance.gr.com
|
||||
invoker.icu
|
||||
ios-apps.store
|
||||
iosmnbg.com
|
||||
itcgr.live
|
||||
itly.link
|
||||
itter.me
|
||||
jquery-updater.xyz
|
||||
kathimerini.news
|
||||
kinder.engine.ninja
|
||||
koenigseggg.com
|
||||
kohaicorp.com
|
||||
koora-egypt.com
|
||||
kormoran.bid
|
||||
kranos.gr.com
|
||||
lamborghini-s.shop
|
||||
landingpg.xyz
|
||||
landingpge.xyz
|
||||
leanwithme.xyz
|
||||
lexpress-mg.xyz
|
||||
lexpress.me
|
||||
lifestyleshops.net
|
||||
limk.one
|
||||
link-m.xyz
|
||||
link-protection.com
|
||||
linkit.cloud
|
||||
linkit.digital
|
||||
linktothisa.xyz
|
||||
liponals.store
|
||||
live24.gr.com
|
||||
livingwithbadkidny.xyz
|
||||
llinkedin.net
|
||||
lnkedin.org
|
||||
localegem.net
|
||||
lubentv.com
|
||||
lylink.online
|
||||
makeitshort.xyz
|
||||
md-news-direct.com
|
||||
mifcbook.link
|
||||
miniiosapps.xyz
|
||||
mitube1.link
|
||||
mlinks.ws
|
||||
mobnetlink1.com
|
||||
mobnetlink2.com
|
||||
mobnetlink3.com
|
||||
mozillaupdate.xyz
|
||||
msas.ws
|
||||
mycoffeeshop.shop
|
||||
myfcbk.net
|
||||
mytrips.quest
|
||||
myutbe.net
|
||||
mywebsitevpstest.xyz
|
||||
nabd.site
|
||||
nabde.app
|
||||
nassosblog.gr.com
|
||||
nemshi-news.live
|
||||
nemshi-news.xyz
|
||||
nemshi.net
|
||||
networkenterprise.net
|
||||
newsbeast.gr.com
|
||||
newslive2.xyz
|
||||
newzeto.xyz
|
||||
newzgroup.xyz
|
||||
niceonase.com
|
||||
niceonesa.net
|
||||
nikjol.xyz
|
||||
nissan.gr.com
|
||||
novosti.bid
|
||||
oilgy.xyz
|
||||
olexegy.com
|
||||
olxeg.com
|
||||
omanreal.net
|
||||
omeega.xyz
|
||||
onlineservices.gr.com
|
||||
orangegypt.co
|
||||
orchomenos.news
|
||||
otaupdatesios.com
|
||||
paok-24.com
|
||||
pastepast.net
|
||||
pdfviewer.app
|
||||
playestore.net
|
||||
pocopoc.xyz
|
||||
politika.bid
|
||||
politique-koaci.info
|
||||
prmopromo.com
|
||||
pronews.gr.com
|
||||
protothema.live
|
||||
proupload.xyz
|
||||
ps1link.xyz
|
||||
ps2link.xyz
|
||||
quickupdates.xyz
|
||||
qwert.xyz
|
||||
qwxzyl.com
|
||||
redeitt.com
|
||||
redirecting.live
|
||||
redirecting.page
|
||||
safelyredirecting.com
|
||||
safelyredirecting.digital
|
||||
sepenet.gr.com
|
||||
sephoragroup.com
|
||||
servers-mobile.info
|
||||
serviceupdaterequest.com
|
||||
sextape225.me
|
||||
shortely.xyz
|
||||
shorten.fi
|
||||
shortenurls.me
|
||||
shortmee.one
|
||||
shortwidgets.com
|
||||
shortxyz.com
|
||||
simetricode.uk
|
||||
sinai-new.com
|
||||
sitepref.xyz
|
||||
smsuns.com
|
||||
snapfire.xyz
|
||||
sniper.pet
|
||||
solargoup.xyz
|
||||
solargroup.xyz
|
||||
speedy.sbs
|
||||
speedygonzales.xyz
|
||||
speedymax.shop
|
||||
sports-mdg.xyz
|
||||
sportsnewz.site
|
||||
static-graph.com
|
||||
stonisi.news
|
||||
supportset.net
|
||||
suzuki.gr.com
|
||||
svetovid.bid
|
||||
symoty.com
|
||||
syncservices.one
|
||||
synctimestamp.com
|
||||
syncupdate.site
|
||||
telecomegy-ads.com
|
||||
telenorconn.com
|
||||
tesla-s.shop
|
||||
teslal.shop
|
||||
teslal.xyz
|
||||
teslali.com
|
||||
tgrthgsrgwrthwrtgwr.xyz
|
||||
timestampsync.com
|
||||
timeupdate.xyz
|
||||
timeupdateservice.com
|
||||
tiny.gr.com
|
||||
tinylinks.live
|
||||
tinyulrs.com
|
||||
tinyurl.cloud
|
||||
tiol.xyz
|
||||
tly.gr.com
|
||||
tly.link
|
||||
tokoulouri.live
|
||||
tovima.live
|
||||
trecv.xyz
|
||||
trecvf.xyz
|
||||
tribune-mg.xyz
|
||||
trkc.online
|
||||
tsrt.xyz
|
||||
tvxs.news
|
||||
tw.itter.me
|
||||
twtter.net
|
||||
ube.gr.com
|
||||
uberegypt.cn.com
|
||||
updates4you.xyz
|
||||
updateservice.center
|
||||
updatetime.zone
|
||||
updatingnews.xyz
|
||||
updete.xyz
|
||||
url-promo.club
|
||||
url-tiny.app
|
||||
uservicescheck.com
|
||||
uservicesforyou.com
|
||||
utube.digital
|
||||
viva.gr.com
|
||||
vodafoneegypt.tech
|
||||
vodafonegypt.com
|
||||
vouliwatch.gr.com
|
||||
wavekli.xyz
|
||||
we-site.net
|
||||
weathear.live
|
||||
weathernewz.xyz
|
||||
weathersite.online
|
||||
webaffise.com
|
||||
wha.tsapp.me
|
||||
worldnws.xyz
|
||||
wtc1111.com
|
||||
wtc2222.com
|
||||
wtc3333.com
|
||||
xf.actor
|
||||
xnxx-hub.com
|
||||
xyvok.xyz
|
||||
yallakora-egy.com
|
||||
yo.utube.digital
|
||||
yo.utube.to
|
||||
youarefired.xyz
|
||||
yout.ube.gr.com
|
||||
youtu-be.net
|
||||
youtub.app
|
||||
youtube.gr.live
|
||||
youtube.voto
|
||||
youtubesyncapi.com
|
||||
youtubewatch.co
|
||||
yuom7.net
|
||||
z2a.digital
|
||||
z2adigital.cloud
|
||||
z2digital.cloud
|
||||
zougla.gr.com
|
||||
zougla.news
|
||||
@@ -0,0 +1,6 @@
|
||||
/private/var/tmp/UserEventAgent
|
||||
/private/var/tmp/com.apple.WebKit.Networking
|
||||
/private/var/tmp/hooker
|
||||
/private/var/tmp/takePhoto
|
||||
/data/local/tmp/wd/fs.db
|
||||
/data/local/tmp/wd/
|
||||
41
data/ioc/spyware/amnesty/2021-12-16_cytrox/generate_stix.py
Normal file
41
data/ioc/spyware/amnesty/2021-12-16_cytrox/generate_stix.py
Normal file
@@ -0,0 +1,41 @@
|
||||
import sys
|
||||
import os
|
||||
from stix2.v21 import (Indicator, Malware, Relationship, Bundle, DomainName)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
if os.path.isfile("cytrox.stix2"):
|
||||
os.remove("cytrox.stix2")
|
||||
|
||||
with open("config_profiles.txt") as f:
|
||||
configs = list(set([a.strip() for a in f.read().split()]))
|
||||
|
||||
|
||||
with open("domains.txt") as f:
|
||||
domains = list(set([a.strip() for a in f.read().split()]))
|
||||
|
||||
with open("file_paths.txt") as f:
|
||||
filepaths = list(set([a.strip() for a in f.read().split()]))
|
||||
|
||||
res = []
|
||||
malware = Malware(name="Predator", is_family=False, description="IOCs for Cytrox Predator")
|
||||
res.append(malware)
|
||||
for d in domains:
|
||||
i = Indicator(indicator_types=["malicious-activity"], pattern="[domain-name:value='{}']".format(d), pattern_type="stix")
|
||||
res.append(i)
|
||||
res.append(Relationship(i, 'indicates', malware))
|
||||
|
||||
for f in filepaths:
|
||||
i = Indicator(indicator_types=["malicious-activity"], pattern="[file:path='{}']".format(f), pattern_type="stix")
|
||||
res.append(i)
|
||||
res.append(Relationship(i, 'indicates', malware))
|
||||
|
||||
for c in configs:
|
||||
i = Indicator(indicator_types=["malicious-activity"], pattern="[configuration-profile:id='{}']".format(c), pattern_type="stix")
|
||||
res.append(i)
|
||||
res.append(Relationship(i, 'indicates', malware))
|
||||
|
||||
bundle = Bundle(objects=res)
|
||||
with open("cytrox.stix2", "w+") as f:
|
||||
f.write(bundle.serialize(indent=4))
|
||||
print("cytrox.stix2 file created")
|
||||
Reference in New Issue
Block a user