sssnake/autarch
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs

Browse Source
This commit is contained in:
SsSnake
2026-07-13 15:45:47 -07:00
parent 925216290f
commit e48d577bd5
387 changed files with 211976 additions and 921 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
data/ioc/spyware/citizen_lab/201510_NGO_Burma/iocs.csv Normal file
View File

@@ -0,0 +1,24 @@
uuid,event_id,category,type,value,comment,to_ids,date
581bacca-464c-4997-8812-49798e96ca05,4,Network activity,domain,"usacia.websecexp.com","c2 server from Palo Alto study",1,20151016
581bacca-5998-41ad-afb4-49798e96ca05,4,Network activity,domain,"webhttps.websecexp.com","c2 server from Palo Alto study",1,20151016
581bacca-ad18-4ff6-b8b5-49798e96ca05,4,Network activity,domain,"appeur.gnway.cc","c2 server from Palo Alto study",1,20151016
581bacca-eb70-4443-a7d1-49798e96ca05,4,Network activity,domain,"usafbi.websecexp.com","c2 server from Palo Alto study",1,20151016
581bace8-59d0-4c6e-859a-497a8e96ca05,4,Payload type,text,"9002","",0,20151016
581bacf2-d924-45bd-a930-49798e96ca05,4,Payload type,text,"3102","The variant is labeled 3102, because it always uses the string “3102” in its first communications with a C2 server",0,20151016
581bad0a-7524-46f8-9d57-497a8e96ca05,4,Network activity,ip-dst,"198.44.190.85","This IP is a Virtual Private Server (VPS) hosted in the US and owned by VpsQuan",1,20151016
581bad2c-3a60-4be9-8d21-49798e96ca05,4,Payload delivery,md5,"53f81415ccedf453d6e3ebcdc142b966","Attachments",0,20151016
581bad2c-d2d4-46f4-b0cb-49798e96ca05,4,Payload delivery,md5,"699b3d90b050cae37f65c855ec7f616a","Attachments",0,20151016
581bad2c-e744-4a48-ae12-49798e96ca05,4,Payload delivery,md5,"6701662097e274f3cd089ceec35471d2","Attachments",0,20151016
581bad50-2488-429a-b001-497a8e96ca05,4,Artifacts dropped,md5,"c4c147bdfddffec2eea6bf99661e69ee","ca-bundle.exe",1,20151016
581bad50-7890-4dcf-8436-497a8e96ca05,4,Artifacts dropped,md5,"cec071424d417a095221bf8992819388","XLBugHandler.dll",1,20151016
581bad50-8998-4012-926d-497a8e96ca05,4,Artifacts dropped,md5,"5710d567d98a8f4a6682859ce3a35336","lsass.exe",1,20151016
581bad50-a014-4095-a054-497a8e96ca05,4,Artifacts dropped,md5,"56f0e67d981024ddcc215543698f44fb","mcutil.dll",1,20151016
581bad50-aea8-4d5f-8e0c-497a8e96ca05,4,Artifacts dropped,md5,"884d46c01c762ad6ddd2759fd921bf71","mcf.exe",1,20151016
581bad50-d494-4e55-aa91-497a8e96ca05,4,Artifacts dropped,md5,"7e0081fba718fcd71753d3199a290f03","mcf.ep",1,20151016
581bad60-2a18-44cc-ac40-49798e96ca05,4,Artifacts dropped,md5,"49ceba3347d39870f15f2ab0391af234","xlbug.dat",1,20151016
581bad77-2c58-479e-833e-497a8e96ca05,4,Network activity,domain,"t1.mailsecurityservice.com","",1,20151016
581bad77-cde8-4c65-9449-497a8e96ca05,4,Network activity,domain,"t2.mailsecurityservice.com","",1,20151016
581bad90-56b0-4c8b-ba6b-497a8e96ca05,4,Internal reference,link,"https://citizenlab.org/2015/10/targeted-attacks-ngo-burma/","",0,20151016
5824e57b-8458-4669-b6a0-497a8e96ca05,4,Attribution,whois-registrant-email,"wojiaojilao2@sohu.com","",0,20151016
5824e58f-be40-407d-b91b-497a8e96ca05,4,Network activity,domain,"iyouthen.com","Identified through passive DNS",1,20151016
5824e5f1-d174-487e-9156-497a8e96ca05,4,Payload delivery,url,"http://www.hjclub.info/bbs/uploadfiles/45/ca-bundle.exe","",1,20151016
1 uuid event_id category type value comment to_ids date
2 581bacca-464c-4997-8812-49798e96ca05 4 Network activity domain usacia.websecexp.com c2 server from Palo Alto study 1 20151016
3 581bacca-5998-41ad-afb4-49798e96ca05 4 Network activity domain webhttps.websecexp.com c2 server from Palo Alto study 1 20151016
4 581bacca-ad18-4ff6-b8b5-49798e96ca05 4 Network activity domain appeur.gnway.cc c2 server from Palo Alto study 1 20151016
5 581bacca-eb70-4443-a7d1-49798e96ca05 4 Network activity domain usafbi.websecexp.com c2 server from Palo Alto study 1 20151016
6 581bace8-59d0-4c6e-859a-497a8e96ca05 4 Payload type text 9002 0 20151016
7 581bacf2-d924-45bd-a930-49798e96ca05 4 Payload type text 3102 The variant is labeled 3102, because it always uses the string “3102” in its first communications with a C2 server 0 20151016
8 581bad0a-7524-46f8-9d57-497a8e96ca05 4 Network activity ip-dst 198.44.190.85 This IP is a Virtual Private Server (VPS) hosted in the US and owned by VpsQuan 1 20151016
9 581bad2c-3a60-4be9-8d21-49798e96ca05 4 Payload delivery md5 53f81415ccedf453d6e3ebcdc142b966 Attachments 0 20151016
10 581bad2c-d2d4-46f4-b0cb-49798e96ca05 4 Payload delivery md5 699b3d90b050cae37f65c855ec7f616a Attachments 0 20151016
11 581bad2c-e744-4a48-ae12-49798e96ca05 4 Payload delivery md5 6701662097e274f3cd089ceec35471d2 Attachments 0 20151016
12 581bad50-2488-429a-b001-497a8e96ca05 4 Artifacts dropped md5 c4c147bdfddffec2eea6bf99661e69ee ca-bundle.exe 1 20151016
13 581bad50-7890-4dcf-8436-497a8e96ca05 4 Artifacts dropped md5 cec071424d417a095221bf8992819388 XLBugHandler.dll 1 20151016
14 581bad50-8998-4012-926d-497a8e96ca05 4 Artifacts dropped md5 5710d567d98a8f4a6682859ce3a35336 lsass.exe 1 20151016
15 581bad50-a014-4095-a054-497a8e96ca05 4 Artifacts dropped md5 56f0e67d981024ddcc215543698f44fb mcutil.dll 1 20151016
16 581bad50-aea8-4d5f-8e0c-497a8e96ca05 4 Artifacts dropped md5 884d46c01c762ad6ddd2759fd921bf71 mcf.exe 1 20151016
17 581bad50-d494-4e55-aa91-497a8e96ca05 4 Artifacts dropped md5 7e0081fba718fcd71753d3199a290f03 mcf.ep 1 20151016
18 581bad60-2a18-44cc-ac40-49798e96ca05 4 Artifacts dropped md5 49ceba3347d39870f15f2ab0391af234 xlbug.dat 1 20151016
19 581bad77-2c58-479e-833e-497a8e96ca05 4 Network activity domain t1.mailsecurityservice.com 1 20151016
20 581bad77-cde8-4c65-9449-497a8e96ca05 4 Network activity domain t2.mailsecurityservice.com 1 20151016
21 581bad90-56b0-4c8b-ba6b-497a8e96ca05 4 Internal reference link https://citizenlab.org/2015/10/targeted-attacks-ngo-burma/ 0 20151016
22 5824e57b-8458-4669-b6a0-497a8e96ca05 4 Attribution whois-registrant-email wojiaojilao2@sohu.com 0 20151016
23 5824e58f-be40-407d-b91b-497a8e96ca05 4 Network activity domain iyouthen.com Identified through passive DNS 1 20151016
24 5824e5f1-d174-487e-9156-497a8e96ca05 4 Payload delivery url http://www.hjclub.info/bbs/uploadfiles/45/ca-bundle.exe 1 20151016