sssnake/autarch
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs

Browse Source
This commit is contained in:
SsSnake
2026-07-13 15:45:47 -07:00
parent 925216290f
commit e48d577bd5
387 changed files with 211976 additions and 921 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
data/ioc/spyware/citizen_lab/201603_Shifting_Tactics/iocs.csv Normal file
View File

@@ -0,0 +1,37 @@
uuid,event_id,category,type,value,comment,to_ids,date
11bb35af-5ad7-4a10-844c-fb4482603b0b,11,Network activity,url,"http://accountgoogle.firewall-gateway.com/serviclogin","Decoy webpage",0,20160310
11cf9c54-4d35-4a58-8128-a1076025ff25,11,Network activity,domain,"sys.firewall-gateway.net","C2 domain",1,20160310
1f0bc371-f681-4049-855d-235e6bc5eb8e,11,Network activity,ip-dst,"5.54.19.17","",1,20160310
228f765c-d5ab-4fcf-a190-775b9ed2ad70,11,Network activity,domain,"firewallupdate.firewall-gateway.com","Domain found through passive DNS",1,20160310
23403344-c52e-4c19-9f7b-f5291b451bee,11,Payload delivery,md5,"fef27f432e0ae8218143bc410fda340e","",1,20160310
26fb914b-1601-4049-a8b5-c9afc3a16bc0,11,Network activity,domain,"accountgoogle.firewall-gateway.com","Phishing Campaign Infrastructure",1,20160310
318dd748-c9d9-4f7b-9b42-75a60001f9e1,11,Network activity,ip-dst,"95.154.195.171","",1,20160310
35a7486a-38a7-4d3a-bdd8-1284d464484b,11,Network activity,domain,"firewallupdate.firewall-gateway.net","Domain found through passive DNS",1,20160310
3baf841e-c377-44ba-ba20-dcfd7aa8ba22,11,Network activity,domain,"accounts-google.firewall-gateway.com","Domain found through passive DNS",1,20160310
40edc447-3aaa-4f79-8268-16eddff19b33,11,Network activity,domain,"accountsgoogles.firewall-gateway.com","Domain found through passive DNS",1,20160310
53477c01-59ad-47be-b808-4c6b518523fc,11,Network activity,ip-dst,"109.169.77.230","Resolve domain news[.]firewall-gateway[.]com",1,20160310
581c1169-35f8-439b-ad90-49798e96ca05,11,External analysis,link,"https://citizenlab.org/2016/03/shifting-tactics/","",0,20161104
5824e149-ba7c-4e04-b905-69fe8e96ca05,11,Artifacts dropped,md5,"ea45265fe98b25e719d5a9cc3b412d66","uroyh.exe",1,20160310
5824e1e5-e340-40b0-b3fa-69fe8e96ca05,11,Attribution,threat-actor,"Scarlet Mimic","",0,20160310
5824e33f-4c08-4b5f-8092-497a8e96ca05,11,Payload type,text,"FakeM","",0,20160310
6308d2e1-a83a-44b2-b96f-267bc24efbd1,11,Network activity,domain,"filegoogle.firewall-gateway.com","Phishing Campaign Infrastructure",1,20160310
633179a0-3d6e-4ca5-9b89-02d8522ef275,11,Payload delivery,filename,"Reappraisal_of_India_Tibet_Policy.doc","",0,20160310
6d15c4fe-2de7-4abc-9593-c9eeae9b928f,11,Payload delivery,md5,"3b869c8e23d66ad0527882fc79ff7237","",1,20160310
712c9cc1-2b2b-4636-87d2-12bd313376dc,11,Payload delivery,md5,"1bf438b5744db73eea58379a3b9f30e5","",1,20160310
73e5412a-1252-495d-956d-28cfdd8edaed,11,Network activity,domain,"news.firewall-gateway.com","",1,20160310
86627daf-07c8-467f-babc-426d586e7d4a,11,Network activity,domain,"detail43.myfirewall.org","",1,20160310
8b0a371b-0c73-455d-a7ae-d0a530f23b04,11,Network activity,domain,"drivgoogle.firewall-gateway.com","Domain found through passive DNS",1,20160310
8ce49cb3-e458-4568-b560-04a314ce9539,11,Network activity,ip-dst,"192.253.251.118","",1,20160310
99702482-486a-4b63-8fa9-f094835827b2,11,Payload delivery,md5,"5c030802ad411fea059cc9cc4c118125","uroyh-unpacked.exe",1,20160310
a31a03ec-f99e-4bec-95dc-3574c3512217,11,Network activity,ip-dst,"95.154.195.159","",1,20160310
a95b5c9c-7ec9-42ff-a12c-075b3255de77,11,Payload delivery,md5,"7735e571d0450e2a31e97e4f8e0f66fa","Attached file",1,20160310
ad5c4c3d-6194-4059-9aa1-1593b62d32a9,11,Network activity,ip-dst,"109.169.40.172","",1,20160310
b2cebdea-e90b-416f-9a0f-94a566b32a2a,11,Network activity,ip-dst,"46.127.56.109","",1,20160310
b84e33b7-1958-4507-b7bb-6bb63304842c,11,Network activity,domain,"googlefile.firewall-gateway.net","Domain found through passive DNS",1,20160310
baf16087-e811-438d-bcdd-9779043dfb06,11,Payload delivery,md5,"d2e9412428c3bcf3ec98dba8a78adb7b","iph.bat",1,20160310
c379b263-55d3-464d-b94f-178f02f883a8,11,Network activity,ip-dst,"87.117.229.109","",1,20160310
cda51492-e33b-4521-be3b-35ec4b8bc9b4,11,Network activity,url,"http://accountgoogle.firewall-gateway.com/servicclogin","Decoy webpage",0,20160310
dbabd2ee-213d-4b02-951f-a020cfc3582e,11,Payload delivery,md5,"8b83fc5d3a6a80281269f9e337fe3fff","pshvb.exe",1,20160310
ebbe87e2-7f84-4f68-b766-f63820da7966,11,Network activity,domain,"accountsgoogle.firewall-gateway.com","Domain found through passive DNS",1,20160310
f48470fd-c782-4831-a20d-4704b62f1358,11,Network activity,ip-dst,"78.129.252.159","",1,20160310
fc6d0f74-9e43-44a7-b7b8-0ca5c7c487e6,11,Network activity,url,"http://filegoogle.firewall-gateway.com/servicelogin","Decoy webpage",1,20160310
1 uuid event_id category type value comment to_ids date
2 11bb35af-5ad7-4a10-844c-fb4482603b0b 11 Network activity url http://accountgoogle.firewall-gateway.com/serviclogin Decoy webpage 0 20160310
3 11cf9c54-4d35-4a58-8128-a1076025ff25 11 Network activity domain sys.firewall-gateway.net C2 domain 1 20160310
4 1f0bc371-f681-4049-855d-235e6bc5eb8e 11 Network activity ip-dst 5.54.19.17 1 20160310
5 228f765c-d5ab-4fcf-a190-775b9ed2ad70 11 Network activity domain firewallupdate.firewall-gateway.com Domain found through passive DNS 1 20160310
6 23403344-c52e-4c19-9f7b-f5291b451bee 11 Payload delivery md5 fef27f432e0ae8218143bc410fda340e 1 20160310
7 26fb914b-1601-4049-a8b5-c9afc3a16bc0 11 Network activity domain accountgoogle.firewall-gateway.com Phishing Campaign Infrastructure 1 20160310
8 318dd748-c9d9-4f7b-9b42-75a60001f9e1 11 Network activity ip-dst 95.154.195.171 1 20160310
9 35a7486a-38a7-4d3a-bdd8-1284d464484b 11 Network activity domain firewallupdate.firewall-gateway.net Domain found through passive DNS 1 20160310
10 3baf841e-c377-44ba-ba20-dcfd7aa8ba22 11 Network activity domain accounts-google.firewall-gateway.com Domain found through passive DNS 1 20160310
11 40edc447-3aaa-4f79-8268-16eddff19b33 11 Network activity domain accountsgoogles.firewall-gateway.com Domain found through passive DNS 1 20160310
12 53477c01-59ad-47be-b808-4c6b518523fc 11 Network activity ip-dst 109.169.77.230 Resolve domain news[.]firewall-gateway[.]com 1 20160310
13 581c1169-35f8-439b-ad90-49798e96ca05 11 External analysis link https://citizenlab.org/2016/03/shifting-tactics/ 0 20161104
14 5824e149-ba7c-4e04-b905-69fe8e96ca05 11 Artifacts dropped md5 ea45265fe98b25e719d5a9cc3b412d66 uroyh.exe 1 20160310
15 5824e1e5-e340-40b0-b3fa-69fe8e96ca05 11 Attribution threat-actor Scarlet Mimic 0 20160310
16 5824e33f-4c08-4b5f-8092-497a8e96ca05 11 Payload type text FakeM 0 20160310
17 6308d2e1-a83a-44b2-b96f-267bc24efbd1 11 Network activity domain filegoogle.firewall-gateway.com Phishing Campaign Infrastructure 1 20160310
18 633179a0-3d6e-4ca5-9b89-02d8522ef275 11 Payload delivery filename Reappraisal_of_India_Tibet_Policy.doc 0 20160310
19 6d15c4fe-2de7-4abc-9593-c9eeae9b928f 11 Payload delivery md5 3b869c8e23d66ad0527882fc79ff7237 1 20160310
20 712c9cc1-2b2b-4636-87d2-12bd313376dc 11 Payload delivery md5 1bf438b5744db73eea58379a3b9f30e5 1 20160310
21 73e5412a-1252-495d-956d-28cfdd8edaed 11 Network activity domain news.firewall-gateway.com 1 20160310
22 86627daf-07c8-467f-babc-426d586e7d4a 11 Network activity domain detail43.myfirewall.org 1 20160310
23 8b0a371b-0c73-455d-a7ae-d0a530f23b04 11 Network activity domain drivgoogle.firewall-gateway.com Domain found through passive DNS 1 20160310
24 8ce49cb3-e458-4568-b560-04a314ce9539 11 Network activity ip-dst 192.253.251.118 1 20160310
25 99702482-486a-4b63-8fa9-f094835827b2 11 Payload delivery md5 5c030802ad411fea059cc9cc4c118125 uroyh-unpacked.exe 1 20160310
26 a31a03ec-f99e-4bec-95dc-3574c3512217 11 Network activity ip-dst 95.154.195.159 1 20160310
27 a95b5c9c-7ec9-42ff-a12c-075b3255de77 11 Payload delivery md5 7735e571d0450e2a31e97e4f8e0f66fa Attached file 1 20160310
28 ad5c4c3d-6194-4059-9aa1-1593b62d32a9 11 Network activity ip-dst 109.169.40.172 1 20160310
29 b2cebdea-e90b-416f-9a0f-94a566b32a2a 11 Network activity ip-dst 46.127.56.109 1 20160310
30 b84e33b7-1958-4507-b7bb-6bb63304842c 11 Network activity domain googlefile.firewall-gateway.net Domain found through passive DNS 1 20160310
31 baf16087-e811-438d-bcdd-9779043dfb06 11 Payload delivery md5 d2e9412428c3bcf3ec98dba8a78adb7b iph.bat 1 20160310
32 c379b263-55d3-464d-b94f-178f02f883a8 11 Network activity ip-dst 87.117.229.109 1 20160310
33 cda51492-e33b-4521-be3b-35ec4b8bc9b4 11 Network activity url http://accountgoogle.firewall-gateway.com/servicclogin Decoy webpage 0 20160310
34 dbabd2ee-213d-4b02-951f-a020cfc3582e 11 Payload delivery md5 8b83fc5d3a6a80281269f9e337fe3fff pshvb.exe 1 20160310
35 ebbe87e2-7f84-4f68-b766-f63820da7966 11 Network activity domain accountsgoogle.firewall-gateway.com Domain found through passive DNS 1 20160310
36 f48470fd-c782-4831-a20d-4704b62f1358 11 Network activity ip-dst 78.129.252.159 1 20160310
37 fc6d0f74-9e43-44a7-b7b8-0ca5c7c487e6 11 Network activity url http://filegoogle.firewall-gateway.com/servicelogin Decoy webpage 1 20160310