sssnake/autarch
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs

Browse Source
This commit is contained in:
SsSnake
2026-07-13 15:45:47 -07:00
parent 925216290f
commit e48d577bd5
387 changed files with 211976 additions and 921 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
data/ioc/spyware/citizen_lab/201605_Stealth_Falcon/iocs.csv Normal file
View File

@@ -0,0 +1,35 @@
uuid,event_id,category,type,value,comment,to_ids,date
007694f1-b73a-40a5-bcf5-dded27746669,8,Network activity,url,"http://aax.me/0b152","",0,20161108
19e97c58-4992-4f0b-8f49-6a6378a289eb,8,Payload delivery,sha256,"4320204d577ef8b939115d16110e97ff04cb4f7d1e77ba5ce011d43f74abc7be","message_032456944343.docm",0,20161108
280056b8-69aa-432c-9826-6d5b820eb44e,8,Payload delivery,email-src,"andrew.dwight389@outlook.com","The Case of the Fake Journalist",0,20161108
35aa025c-2f62-4f9d-9fb7-391542226a7a,8,Network activity,domain,"optimizedimghosting.com","The document’s macro was identical to the one sent to Donaghy, except it reported back to, and downloaded Stage Two from a different URL",1,20161108
3813bc78-21d9-40a2-b76e-61016eb71ccb,8,Network activity,domain,"adhostingcache.com","",1,20161108
41c48554-6911-48eb-88a0-411dc4bd9047,8,Payload delivery,sha1,"1c3757006f972ca957d925accf8bbb3023550d1b","message_032456944343.docm",0,20161108
45dbee97-3aa0-487d-bd73-a3c10a511403,8,Network activity,ip-dst,"95.215.44.37","IP linked to adhostingcache.com",0,20161108
537df72e-b2b9-4016-b337-06930c42c455,8,Network activity,url,"http://goo.gl/60HAqJ","redirects to http://aax.me/0b152",0,20161108
58224765-51f8-4d28-9040-49798e96ca05,8,Attribution,threat-actor,"Stealth Falcon","",0,20161108
582247a8-11b4-4da0-9ca1-69fe8e96ca05,8,Payload delivery,domain,"aax.me","",1,20161108
582247d0-d7a0-49c3-a6ae-69fe8e96ca05,8,Payload delivery,url,"http://aax.me/a6faa","Link sent in a phishing email",1,20161108
582247f6-eeec-47b0-b6d8-69fe8e96ca05,8,Payload delivery,url,"https://cloud.openmailbox.org/index.php/s/ujDNWMmg8pdG3AL/authenticate","ownCloud15 instance",0,20161108
5822492e-087c-4fa8-afe1-49798e96ca05,8,Network activity,domain,"simpleadbanners.com","Domains linked to adhostingcache.com",0,20161108
5822492e-1d40-4098-a87b-49798e96ca05,8,Network activity,domain,"clickstatistic.com","Domains linked to adhostingcache.com",0,20161108
5822492e-7490-4c3f-9a10-49798e96ca05,8,Network activity,domain,"bestairlinepricetags.com","Domains linked to adhostingcache.com",0,20161108
5822492e-d888-418e-906d-49798e96ca05,8,Network activity,domain,"fasttravelclearance.com","Domains linked to adhostingcache.com",0,20161108
5822494d-792c-4d8c-9be0-49798e96ca05,8,Network activity,domain,"airlineadverts.com","Domain linked to incapsulawebcache.com",0,20161108
5822494d-7ab0-42bd-bd9d-49798e96ca05,8,Network activity,domain,"ministrynewschannel.com","Domain linked to incapsulawebcache.com",0,20161108
5822494d-bf14-4b41-803a-49798e96ca05,8,Network activity,domain,"ministrynewsinfo.com","Domain linked to incapsulawebcache.com",0,20161108
62fcd7b4-5d95-49bd-a9ff-3c2e1854839b,8,Network activity,url,"http://optimizedimghosting.com/wddf/hrrw/ggrr.txt","The document’s macro was identical to the one sent to Donaghy, except it reported back to, and downloaded Stage Two from a different URL",0,20161108
6c1856f6-0068-4c83-8aba-9fd4bb4277a1,8,Payload delivery,url,"http://aax.me/d0dde","loaded a page containing a redirect to the website of Al Jazeera. Before completing the redirect, it invoked JavaScript to profile the target’s computer.",0,20161108
707eed9b-bb2c-4951-af0d-060b4c860e89,8,External analysis,link,"https://citizenlab.org/2016/05/stealth-falcon/","",0,20161108
70881ae4-3da1-409e-8bd3-7f508092a2c9,8,Payload delivery,sha256,"5a372b45285fe6f3df3ba277ee2de55d4a30fc8ef05de729cf464103632db40f","right2fight.docm (malicious document)",0,20161108
7fd6e683-9615-4f4e-b901-03e7dbb81337,8,Network activity,url,"https://incapsulawebcache.com/cache/cache.nfo","",0,20161108
8010c934-027b-40c5-ba1e-3efca8e52d5a,8,Network activity,domain,"incapsulawebcache.com","stage two server",1,20161108
8682a3ad-80da-4732-bf5a-e675e27c56fe,8,Network activity,domain,"edgecacheimagehosting.com","stage two server",1,20161108
9ca61973-d717-496a-a158-82d9b2e37965,8,Payload delivery,md5,"87e1df6f36b96b56186444e37e2a1ef5","message_032456944343.docm",0,20161108
bc8e2ca7-cd3c-4205-9028-b8b106f12389,8,Payload delivery,email-src,"the_right_to_fight@openmailbox.org","Fake invitation",0,20161108
cd191e4e-a5a1-4009-93b7-92cc6a3d6984,8,Payload delivery,sha1,"f25466e4820404c817eaf75818b7177891735886","right2fight.docm (malicious document)",0,20161108
d9a62cda-db4c-4d70-858c-6bbaaa041e63,8,Network activity,domain,"adhostingcaches.com","registered on December 3rd",1,20161108
decfcbf1-1331-4624-88b7-a88c94637dd0,8,Network activity,url,"http://adhostingcache.com/ehhe/eh4g4/adcache.txt","Gathered information is returned to and the server’s response is executed as a PowerShell command.",0,20161108
e8f3b924-1221-4d08-8fef-f689529a7b6d,8,Network activity,url,"http://aax.me/redirect.js","to profile a user’s system, perhaps to gather intelligence about potentially exploitable vulnerabilities.",0,20161108
f0215c0c-b708-43d8-873e-80a3e8e54cfa,8,Network activity,url,"https://edgecacheimagehosting.com/images/image.nfo","The Stage Two in this case reported back to",0,20161108
f4f40c31-dd17-4dc6-baa3-6beb35c04c00,8,Payload delivery,md5,"80e8ef78b9e28015cde4205aaa65da97","right2fight.docm (malicious document)",0,20161108
1 uuid event_id category type value comment to_ids date
2 007694f1-b73a-40a5-bcf5-dded27746669 8 Network activity url http://aax.me/0b152 0 20161108
3 19e97c58-4992-4f0b-8f49-6a6378a289eb 8 Payload delivery sha256 4320204d577ef8b939115d16110e97ff04cb4f7d1e77ba5ce011d43f74abc7be message_032456944343.docm 0 20161108
4 280056b8-69aa-432c-9826-6d5b820eb44e 8 Payload delivery email-src andrew.dwight389@outlook.com The Case of the Fake Journalist 0 20161108
5 35aa025c-2f62-4f9d-9fb7-391542226a7a 8 Network activity domain optimizedimghosting.com The document’s macro was identical to the one sent to Donaghy, except it reported back to, and downloaded Stage Two from a different URL 1 20161108
6 3813bc78-21d9-40a2-b76e-61016eb71ccb 8 Network activity domain adhostingcache.com 1 20161108
7 41c48554-6911-48eb-88a0-411dc4bd9047 8 Payload delivery sha1 1c3757006f972ca957d925accf8bbb3023550d1b message_032456944343.docm 0 20161108
8 45dbee97-3aa0-487d-bd73-a3c10a511403 8 Network activity ip-dst 95.215.44.37 IP linked to adhostingcache.com 0 20161108
9 537df72e-b2b9-4016-b337-06930c42c455 8 Network activity url http://goo.gl/60HAqJ redirects to http://aax.me/0b152 0 20161108
10 58224765-51f8-4d28-9040-49798e96ca05 8 Attribution threat-actor Stealth Falcon 0 20161108
11 582247a8-11b4-4da0-9ca1-69fe8e96ca05 8 Payload delivery domain aax.me 1 20161108
12 582247d0-d7a0-49c3-a6ae-69fe8e96ca05 8 Payload delivery url http://aax.me/a6faa Link sent in a phishing email 1 20161108
13 582247f6-eeec-47b0-b6d8-69fe8e96ca05 8 Payload delivery url https://cloud.openmailbox.org/index.php/s/ujDNWMmg8pdG3AL/authenticate ownCloud15 instance 0 20161108
14 5822492e-087c-4fa8-afe1-49798e96ca05 8 Network activity domain simpleadbanners.com Domains linked to adhostingcache.com 0 20161108
15 5822492e-1d40-4098-a87b-49798e96ca05 8 Network activity domain clickstatistic.com Domains linked to adhostingcache.com 0 20161108
16 5822492e-7490-4c3f-9a10-49798e96ca05 8 Network activity domain bestairlinepricetags.com Domains linked to adhostingcache.com 0 20161108
17 5822492e-d888-418e-906d-49798e96ca05 8 Network activity domain fasttravelclearance.com Domains linked to adhostingcache.com 0 20161108
18 5822494d-792c-4d8c-9be0-49798e96ca05 8 Network activity domain airlineadverts.com Domain linked to incapsulawebcache.com 0 20161108
19 5822494d-7ab0-42bd-bd9d-49798e96ca05 8 Network activity domain ministrynewschannel.com Domain linked to incapsulawebcache.com 0 20161108
20 5822494d-bf14-4b41-803a-49798e96ca05 8 Network activity domain ministrynewsinfo.com Domain linked to incapsulawebcache.com 0 20161108
21 62fcd7b4-5d95-49bd-a9ff-3c2e1854839b 8 Network activity url http://optimizedimghosting.com/wddf/hrrw/ggrr.txt The document’s macro was identical to the one sent to Donaghy, except it reported back to, and downloaded Stage Two from a different URL 0 20161108
22 6c1856f6-0068-4c83-8aba-9fd4bb4277a1 8 Payload delivery url http://aax.me/d0dde loaded a page containing a redirect to the website of Al Jazeera. Before completing the redirect, it invoked JavaScript to profile the target’s computer. 0 20161108
23 707eed9b-bb2c-4951-af0d-060b4c860e89 8 External analysis link https://citizenlab.org/2016/05/stealth-falcon/ 0 20161108
24 70881ae4-3da1-409e-8bd3-7f508092a2c9 8 Payload delivery sha256 5a372b45285fe6f3df3ba277ee2de55d4a30fc8ef05de729cf464103632db40f right2fight.docm (malicious document) 0 20161108
25 7fd6e683-9615-4f4e-b901-03e7dbb81337 8 Network activity url https://incapsulawebcache.com/cache/cache.nfo 0 20161108
26 8010c934-027b-40c5-ba1e-3efca8e52d5a 8 Network activity domain incapsulawebcache.com stage two server 1 20161108
27 8682a3ad-80da-4732-bf5a-e675e27c56fe 8 Network activity domain edgecacheimagehosting.com stage two server 1 20161108
28 9ca61973-d717-496a-a158-82d9b2e37965 8 Payload delivery md5 87e1df6f36b96b56186444e37e2a1ef5 message_032456944343.docm 0 20161108
29 bc8e2ca7-cd3c-4205-9028-b8b106f12389 8 Payload delivery email-src the_right_to_fight@openmailbox.org Fake invitation 0 20161108
30 cd191e4e-a5a1-4009-93b7-92cc6a3d6984 8 Payload delivery sha1 f25466e4820404c817eaf75818b7177891735886 right2fight.docm (malicious document) 0 20161108
31 d9a62cda-db4c-4d70-858c-6bbaaa041e63 8 Network activity domain adhostingcaches.com registered on December 3rd 1 20161108
32 decfcbf1-1331-4624-88b7-a88c94637dd0 8 Network activity url http://adhostingcache.com/ehhe/eh4g4/adcache.txt Gathered information is returned to and the server’s response is executed as a PowerShell command. 0 20161108
33 e8f3b924-1221-4d08-8fef-f689529a7b6d 8 Network activity url http://aax.me/redirect.js to profile a user’s system, perhaps to gather intelligence about potentially exploitable vulnerabilities. 0 20161108
34 f0215c0c-b708-43d8-873e-80a3e8e54cfa 8 Network activity url https://edgecacheimagehosting.com/images/image.nfo The Stage Two in this case reported back to 0 20161108
35 f4f40c31-dd17-4dc6-baa3-6beb35c04c00 8 Payload delivery md5 80e8ef78b9e28015cde4205aaa65da97 right2fight.docm (malicious document) 0 20161108