Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs
This commit is contained in:
SsSnake
@@ -0,0 +1,41 @@
|
||||
uuid,event_id,category,type,value,comment,to_ids,date
|
||||
5a71edfd-1054-4f90-b881-09238e96ca05,133,Network activity,domain,"tibetnews.info","",1,20180131
|
||||
5a71edfd-1460-419f-bf27-09238e96ca05,133,Network activity,domain,"tibetnews.today","",1,20180131
|
||||
5a71edfd-2d74-416f-b7f1-09238e96ca05,133,Network activity,domain,"daynew.today","",1,20180131
|
||||
5a71edfd-3760-46ea-ac88-09238e96ca05,133,Network activity,domain,"daynews.today","",1,20180131
|
||||
5a71edfd-5044-404c-8b48-09238e96ca05,133,Network activity,domain,"commail.co","",1,20180131
|
||||
5a71edfd-65f0-498f-8143-09238e96ca05,133,Network activity,domain,"comemail.email","",1,20180131
|
||||
5a71edfd-6f60-4192-8e0f-09238e96ca05,133,Network activity,domain,"tibethouse.info","",1,20180131
|
||||
5a71edfd-f620-4e5f-bc15-09238e96ca05,133,Network activity,domain,"tibetfrum.info","",1,20180131
|
||||
5a71edfd-f73c-4213-9784-09238e96ca05,133,Network activity,domain,"comemails.email","",1,20180131
|
||||
5b657bbb-48f4-4cc2-a236-72cf8064ab0b,133,Network activity,ip-dst,"27.126.186.222","",1,20180804
|
||||
5b657bbb-9bdc-4b23-b160-72cf8064ab0b,133,Network activity,ip-dst,"115.126.86.151","",1,20180804
|
||||
5b657bbb-d594-49ae-8e85-72cf8064ab0b,133,Network activity,ip-dst,"45.127.97.222","",1,20180804
|
||||
5b657bbb-e338-4722-af6a-72cf8064ab0b,133,Network activity,ip-dst,"103.55.24.196","",1,20180804
|
||||
5b657bbb-eed0-4569-a919-72cf8064ab0b,133,Network activity,ip-dst,"203.189.232.207","",1,20180804
|
||||
5b657bbb-f600-4013-bb4b-72cf8064ab0b,133,Network activity,ip-dst,"27.126.176.169","",1,20180804
|
||||
5b657c1b-46f4-4103-9646-72cb8064ab0b,133,Network activity,domain,"google.comemails.email","",1,20180804
|
||||
5b657c1b-5dc0-4f64-8569-72cb8064ab0b,133,Network activity,domain,"www.google.comemails.email","",1,20180804
|
||||
5b657c1b-7ab4-4be5-bdfa-72cb8064ab0b,133,Network activity,domain,"google.commail.co","",1,20180804
|
||||
5b657c1b-7b50-4ccb-8487-72cb8064ab0b,133,Network activity,domain,"www.comemail.email","",1,20180804
|
||||
5b657c1b-8868-476a-ad15-72cb8064ab0b,133,Network activity,domain,"mail.google.commail.co","",1,20180804
|
||||
5b657c1b-9da8-4d2a-be4e-72cb8064ab0b,133,Network activity,domain,"google.commail.email","",1,20180804
|
||||
5b657c1b-de48-4c26-a83a-72cb8064ab0b,133,Network activity,domain,"google.comemail.email","",1,20180804
|
||||
5b657c33-0f28-4582-acc2-72cd8064ab0b,133,Attribution,whois-registrant-email,"bqfkdrmnhh0623@gmail.com","",0,20180804
|
||||
5b657c43-9d0c-49d7-97a8-72cc8064ab0b,133,Attribution,whois-registrant-name,"huang ning","",0,20180804
|
||||
5b657c55-0d84-46ef-9e3b-167e8064ab0b,133,Attribution,whois-registrant-phone,"8677687877","",0,20180804
|
||||
5b657c65-3318-46b2-9cd8-15688064ab0b,133,Artifacts dropped,md5,"75b86a01196854919626e87d5bd45a38","",0,20180804
|
||||
5b657c65-56dc-4bb8-800d-15688064ab0b,133,Artifacts dropped,md5,"054bad7ec0e19cec931078d45382fee6","",0,20180804
|
||||
5b657c65-5c00-46f9-b147-15688064ab0b,133,Artifacts dropped,md5,"88e85fb6074ae50a3ccc9b410805ffe5","",0,20180804
|
||||
5b657c65-7318-4bf3-8278-15688064ab0b,133,Artifacts dropped,md5,"058a5d47f8834fccfff8971f0544e387","",0,20180804
|
||||
5b657c65-7f80-448a-992b-15688064ab0b,133,Artifacts dropped,md5,"57ffde3504934e25904bcc57d27f9217","",0,20180804
|
||||
5b657c65-86ec-442d-b077-15688064ab0b,133,Artifacts dropped,md5,"4d85904b15c0adc8664f71bc2c5496bf","",0,20180804
|
||||
5b657c65-8bcc-4a7e-aa47-15688064ab0b,133,Artifacts dropped,md5,"124c475d67aa8391f5220efcc64ca5b3","",0,20180804
|
||||
5b657c65-9788-4a4c-b5a9-15688064ab0b,133,Artifacts dropped,md5,"c25acaa45b0cf65a39c8413fa99e1fe8","",0,20180804
|
||||
5b657c65-b82c-4e03-aa1b-15688064ab0b,133,Artifacts dropped,md5,"b1c114ae9172a3bacc5c6b30c410f354","",0,20180804
|
||||
5b657c65-cb5c-4c8a-b8db-15688064ab0b,133,Artifacts dropped,md5,"72c88c4a9d2316b266a6702374411a99","",0,20180804
|
||||
5b657c65-f658-4b36-9ac8-15688064ab0b,133,Artifacts dropped,md5,"91e976f76cc027931fed4cf70702efff","",0,20180804
|
||||
5b657d14-0654-4e9b-b833-72cf8064ab0b,133,Artifacts dropped,md5,"e1b03f5837533ecc9a05e19650d68e1d","",0,20180804
|
||||
5b657d14-2854-4f64-9d64-72cf8064ab0b,133,Artifacts dropped,md5,"67e866c461c285853b225d2b2c850c4f","",0,20180804
|
||||
5b657d14-8f34-41e0-ba68-72cf8064ab0b,133,Artifacts dropped,md5,"11e0f3e1c7d8855ed7f1dcfce4b7702a","",0,20180804
|
||||
5b657d2e-f628-4a1e-b142-72cb8064ab0b,133,Payload delivery,email-src,"tibetanparliarnent@yahoo.com","",0,20180804
|
||||
|
@@ -0,0 +1,674 @@
|
||||
{"response":[{
|
||||
"Event": {
|
||||
"id": "133",
|
||||
"orgc_id": "2",
|
||||
"org_id": "2",
|
||||
"date": "2018-01-31",
|
||||
"threat_level_id": "2",
|
||||
"info": "Familiar Feeling: A Malware Campaign Targeting the Tibetan Diaspora Resurfaces",
|
||||
"published": true,
|
||||
"uuid": "5a71edc8-26a8-43fb-8271-5c948e96ca05",
|
||||
"attribute_count": "40",
|
||||
"analysis": "2",
|
||||
"timestamp": "1533377838",
|
||||
"distribution": "1",
|
||||
"proposal_email_lock": false,
|
||||
"locked": false,
|
||||
"publish_timestamp": "1533378310",
|
||||
"sharing_group_id": "0",
|
||||
"Org": {
|
||||
"id": "2",
|
||||
"name": "citizenlab",
|
||||
"uuid": "581b5fea-818c-441a-bd1d-49798e96ca05"
|
||||
},
|
||||
"Orgc": {
|
||||
"id": "2",
|
||||
"name": "citizenlab",
|
||||
"uuid": "581b5fea-818c-441a-bd1d-49798e96ca05"
|
||||
},
|
||||
"Attribute": [
|
||||
{
|
||||
"id": "18346",
|
||||
"type": "md5",
|
||||
"category": "Artifacts dropped",
|
||||
"to_ids": false,
|
||||
"uuid": "5b657c65-f658-4b36-9ac8-15688064ab0b",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1533377637",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "91e976f76cc027931fed4cf70702efff",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18347",
|
||||
"type": "md5",
|
||||
"category": "Artifacts dropped",
|
||||
"to_ids": false,
|
||||
"uuid": "5b657c65-7f80-448a-992b-15688064ab0b",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1533377637",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "57ffde3504934e25904bcc57d27f9217",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18348",
|
||||
"type": "md5",
|
||||
"category": "Artifacts dropped",
|
||||
"to_ids": false,
|
||||
"uuid": "5b657c65-3318-46b2-9cd8-15688064ab0b",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1533377637",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "75b86a01196854919626e87d5bd45a38",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18349",
|
||||
"type": "md5",
|
||||
"category": "Artifacts dropped",
|
||||
"to_ids": false,
|
||||
"uuid": "5b657c65-9788-4a4c-b5a9-15688064ab0b",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1533377637",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "c25acaa45b0cf65a39c8413fa99e1fe8",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18350",
|
||||
"type": "md5",
|
||||
"category": "Artifacts dropped",
|
||||
"to_ids": false,
|
||||
"uuid": "5b657c65-86ec-442d-b077-15688064ab0b",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1533377637",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "4d85904b15c0adc8664f71bc2c5496bf",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18351",
|
||||
"type": "md5",
|
||||
"category": "Artifacts dropped",
|
||||
"to_ids": false,
|
||||
"uuid": "5b657c65-5c00-46f9-b147-15688064ab0b",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1533377637",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "88e85fb6074ae50a3ccc9b410805ffe5",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18352",
|
||||
"type": "md5",
|
||||
"category": "Artifacts dropped",
|
||||
"to_ids": false,
|
||||
"uuid": "5b657c65-7318-4bf3-8278-15688064ab0b",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1533377637",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "058a5d47f8834fccfff8971f0544e387",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18353",
|
||||
"type": "md5",
|
||||
"category": "Artifacts dropped",
|
||||
"to_ids": false,
|
||||
"uuid": "5b657c65-8bcc-4a7e-aa47-15688064ab0b",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1533377637",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "124c475d67aa8391f5220efcc64ca5b3",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18354",
|
||||
"type": "md5",
|
||||
"category": "Artifacts dropped",
|
||||
"to_ids": false,
|
||||
"uuid": "5b657c65-56dc-4bb8-800d-15688064ab0b",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1533377637",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "054bad7ec0e19cec931078d45382fee6",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18355",
|
||||
"type": "md5",
|
||||
"category": "Artifacts dropped",
|
||||
"to_ids": false,
|
||||
"uuid": "5b657c65-b82c-4e03-aa1b-15688064ab0b",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1533377637",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "b1c114ae9172a3bacc5c6b30c410f354",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18356",
|
||||
"type": "md5",
|
||||
"category": "Artifacts dropped",
|
||||
"to_ids": false,
|
||||
"uuid": "5b657c65-cb5c-4c8a-b8db-15688064ab0b",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1533377637",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "72c88c4a9d2316b266a6702374411a99",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18357",
|
||||
"type": "md5",
|
||||
"category": "Artifacts dropped",
|
||||
"to_ids": false,
|
||||
"uuid": "5b657d14-2854-4f64-9d64-72cf8064ab0b",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1533377812",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "67e866c461c285853b225d2b2c850c4f",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18358",
|
||||
"type": "md5",
|
||||
"category": "Artifacts dropped",
|
||||
"to_ids": false,
|
||||
"uuid": "5b657d14-0654-4e9b-b833-72cf8064ab0b",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1533377812",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "e1b03f5837533ecc9a05e19650d68e1d",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18359",
|
||||
"type": "md5",
|
||||
"category": "Artifacts dropped",
|
||||
"to_ids": false,
|
||||
"uuid": "5b657d14-8f34-41e0-ba68-72cf8064ab0b",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1533377812",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "11e0f3e1c7d8855ed7f1dcfce4b7702a",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18343",
|
||||
"type": "whois-registrant-email",
|
||||
"category": "Attribution",
|
||||
"to_ids": false,
|
||||
"uuid": "5b657c33-0f28-4582-acc2-72cd8064ab0b",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1533377587",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "bqfkdrmnhh0623@gmail.com",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18344",
|
||||
"type": "whois-registrant-name",
|
||||
"category": "Attribution",
|
||||
"to_ids": false,
|
||||
"uuid": "5b657c43-9d0c-49d7-97a8-72cc8064ab0b",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1533377603",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "huang ning",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18345",
|
||||
"type": "whois-registrant-phone",
|
||||
"category": "Attribution",
|
||||
"to_ids": false,
|
||||
"uuid": "5b657c55-0d84-46ef-9e3b-167e8064ab0b",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1533377621",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "8677687877",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18048",
|
||||
"type": "domain",
|
||||
"category": "Network activity",
|
||||
"to_ids": true,
|
||||
"uuid": "5a71edfd-5044-404c-8b48-09238e96ca05",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1517415933",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "commail.co",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18049",
|
||||
"type": "domain",
|
||||
"category": "Network activity",
|
||||
"to_ids": true,
|
||||
"uuid": "5a71edfd-f620-4e5f-bc15-09238e96ca05",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1517415933",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "tibetfrum.info",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18050",
|
||||
"type": "domain",
|
||||
"category": "Network activity",
|
||||
"to_ids": true,
|
||||
"uuid": "5a71edfd-6f60-4192-8e0f-09238e96ca05",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1517415933",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "tibethouse.info",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18051",
|
||||
"type": "domain",
|
||||
"category": "Network activity",
|
||||
"to_ids": true,
|
||||
"uuid": "5a71edfd-1054-4f90-b881-09238e96ca05",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1517415933",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "tibetnews.info",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18052",
|
||||
"type": "domain",
|
||||
"category": "Network activity",
|
||||
"to_ids": true,
|
||||
"uuid": "5a71edfd-2d74-416f-b7f1-09238e96ca05",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1517415933",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "daynew.today",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18053",
|
||||
"type": "domain",
|
||||
"category": "Network activity",
|
||||
"to_ids": true,
|
||||
"uuid": "5a71edfd-3760-46ea-ac88-09238e96ca05",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1517415933",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "daynews.today",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18054",
|
||||
"type": "domain",
|
||||
"category": "Network activity",
|
||||
"to_ids": true,
|
||||
"uuid": "5a71edfd-1460-419f-bf27-09238e96ca05",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1517415933",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "tibetnews.today",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18055",
|
||||
"type": "domain",
|
||||
"category": "Network activity",
|
||||
"to_ids": true,
|
||||
"uuid": "5a71edfd-f73c-4213-9784-09238e96ca05",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1517415933",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "comemails.email",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18056",
|
||||
"type": "domain",
|
||||
"category": "Network activity",
|
||||
"to_ids": true,
|
||||
"uuid": "5a71edfd-65f0-498f-8143-09238e96ca05",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1517415933",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "comemail.email",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18336",
|
||||
"type": "domain",
|
||||
"category": "Network activity",
|
||||
"to_ids": true,
|
||||
"uuid": "5b657c1b-de48-4c26-a83a-72cb8064ab0b",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1533377563",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "google.comemail.email",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18337",
|
||||
"type": "domain",
|
||||
"category": "Network activity",
|
||||
"to_ids": true,
|
||||
"uuid": "5b657c1b-46f4-4103-9646-72cb8064ab0b",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1533377563",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "google.comemails.email",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18338",
|
||||
"type": "domain",
|
||||
"category": "Network activity",
|
||||
"to_ids": true,
|
||||
"uuid": "5b657c1b-7ab4-4be5-bdfa-72cb8064ab0b",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1533377563",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "google.commail.co",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18339",
|
||||
"type": "domain",
|
||||
"category": "Network activity",
|
||||
"to_ids": true,
|
||||
"uuid": "5b657c1b-9da8-4d2a-be4e-72cb8064ab0b",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1533377563",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "google.commail.email",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18340",
|
||||
"type": "domain",
|
||||
"category": "Network activity",
|
||||
"to_ids": true,
|
||||
"uuid": "5b657c1b-8868-476a-ad15-72cb8064ab0b",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1533377563",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "mail.google.commail.co",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18341",
|
||||
"type": "domain",
|
||||
"category": "Network activity",
|
||||
"to_ids": true,
|
||||
"uuid": "5b657c1b-7b50-4ccb-8487-72cb8064ab0b",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1533377563",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "www.comemail.email",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18342",
|
||||
"type": "domain",
|
||||
"category": "Network activity",
|
||||
"to_ids": true,
|
||||
"uuid": "5b657c1b-5dc0-4f64-8569-72cb8064ab0b",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1533377563",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "www.google.comemails.email",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18330",
|
||||
"type": "ip-dst",
|
||||
"category": "Network activity",
|
||||
"to_ids": true,
|
||||
"uuid": "5b657bbb-48f4-4cc2-a236-72cf8064ab0b",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1533377467",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "27.126.186.222",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18331",
|
||||
"type": "ip-dst",
|
||||
"category": "Network activity",
|
||||
"to_ids": true,
|
||||
"uuid": "5b657bbb-e338-4722-af6a-72cf8064ab0b",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1533377467",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "103.55.24.196",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18332",
|
||||
"type": "ip-dst",
|
||||
"category": "Network activity",
|
||||
"to_ids": true,
|
||||
"uuid": "5b657bbb-eed0-4569-a919-72cf8064ab0b",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1533377467",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "203.189.232.207",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18333",
|
||||
"type": "ip-dst",
|
||||
"category": "Network activity",
|
||||
"to_ids": true,
|
||||
"uuid": "5b657bbb-d594-49ae-8e85-72cf8064ab0b",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1533377467",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "45.127.97.222",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18334",
|
||||
"type": "ip-dst",
|
||||
"category": "Network activity",
|
||||
"to_ids": true,
|
||||
"uuid": "5b657bbb-9bdc-4b23-b160-72cf8064ab0b",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1533377467",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "115.126.86.151",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18335",
|
||||
"type": "ip-dst",
|
||||
"category": "Network activity",
|
||||
"to_ids": true,
|
||||
"uuid": "5b657bbb-f600-4013-bb4b-72cf8064ab0b",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1533377467",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "27.126.176.169",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
},
|
||||
{
|
||||
"id": "18360",
|
||||
"type": "email-src",
|
||||
"category": "Payload delivery",
|
||||
"to_ids": false,
|
||||
"uuid": "5b657d2e-f628-4a1e-b142-72cb8064ab0b",
|
||||
"event_id": "133",
|
||||
"distribution": "5",
|
||||
"timestamp": "1533377838",
|
||||
"comment": "",
|
||||
"sharing_group_id": "0",
|
||||
"deleted": false,
|
||||
"value": "tibetanparliarnent@yahoo.com",
|
||||
"SharingGroup": [],
|
||||
"ShadowAttribute": []
|
||||
}
|
||||
],
|
||||
"ShadowAttribute": [],
|
||||
"Tag": []
|
||||
}
|
||||
}]}
|
||||
101
data/ioc/spyware/citizen_lab/201808_FamiliarFeeling/openioc.ioc
Normal file
101
data/ioc/spyware/citizen_lab/201808_FamiliarFeeling/openioc.ioc
Normal file
@@ -0,0 +1,101 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<ioc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" id="5a71edc8-26a8-43fb-8271-5c948e96ca05" last-modified="2018-01-31T00:00:00" xmlns="http://schemas.mandiant.com/2010/ioc">
|
||||
<short_description>Event #133</short_description>
|
||||
<description>Familiar Feeling: A Malware Campaign Targeting the Tibetan Diaspora Resurfaces</description>
|
||||
<keywords />
|
||||
<authored_by>citizenlab</authored_by>
|
||||
<authored_date>2018-01-31T00:00:00</authored_date>
|
||||
<links />
|
||||
<definition>
|
||||
<Indicator operator="OR" id="5a71edc8-26a8-43fb-8271-5c948e96ca05">
|
||||
<IndicatorItem id="commail.co" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="tibetfrum.info" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="tibethouse.info" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="tibetnews.info" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="daynew.today" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="daynews.today" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="tibetnews.today" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="comemails.email" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="comemail.email" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="google.comemail.email" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="google.comemails.email" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="google.commail.co" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="google.commail.email" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="mail.google.commail.co" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="www.comemail.email" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="www.google.comemails.email" condition="is">
|
||||
<Context document="Network" search="Network/DNS" type="mir" />
|
||||
<Content type="string"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="27.126.186.222" condition="is">
|
||||
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
||||
<Content type="IP"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="103.55.24.196" condition="is">
|
||||
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
||||
<Content type="IP"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="203.189.232.207" condition="is">
|
||||
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
||||
<Content type="IP"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="45.127.97.222" condition="is">
|
||||
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
||||
<Content type="IP"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="115.126.86.151" condition="is">
|
||||
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
||||
<Content type="IP"></Content>
|
||||
</IndicatorItem>
|
||||
<IndicatorItem id="27.126.176.169" condition="is">
|
||||
<Context document="RouteEntryItem" search="RouteEntryItem/Destination" type="mir" />
|
||||
<Content type="IP"></Content>
|
||||
</IndicatorItem>
|
||||
</Indicator>
|
||||
</definition>
|
||||
</ioc>
|
||||
@@ -0,0 +1 @@
|
||||
alert tcp any any -> $HOME_NET any (flow:to_server,established; msg:"Indecent Powershell LOGIN"; content: "LOGIN| 7c 2a 7c |"; pcre:"/LOGIN\|\*\|[0-9\.]+\|\*\|[0-9\.]+\|\*\|/"; sid:1000000;)
|
||||
273
data/ioc/spyware/citizen_lab/201808_FamiliarFeeling/rules.yara
Normal file
273
data/ioc/spyware/citizen_lab/201808_FamiliarFeeling/rules.yara
Normal file
@@ -0,0 +1,273 @@
|
||||
rule powershell_dropper {
|
||||
meta:
|
||||
author = "Etienne Maynier"
|
||||
email = "etienne@citizenlab.ca"
|
||||
|
||||
strings:
|
||||
$a = "$decentID = [System.Convert]::FromBase64String($indecentID)"
|
||||
$b = "if($tmp[1].CPU -gt 0) {} else {[ReverseTCPShell]::run()}"
|
||||
$c = "function Get-RSACode()"
|
||||
$d = "-file %temp%\\233.ps1"
|
||||
|
||||
condition:
|
||||
1 of them
|
||||
}
|
||||
|
||||
rule dropper_strings {
|
||||
meta:
|
||||
author = "Etienne Maynier"
|
||||
email = "etienne@citizenlab.ca"
|
||||
|
||||
strings:
|
||||
$a = "bitsadmin /canceft\\windows\\currebitsadmin /addfibitsadmin /Resumbitsadmin /SetNosoftware"
|
||||
$b = "\\microsotifyCmdLine %s rle %s c:\\windowsbitsadmin /creat\\system32\\net.ex"
|
||||
$c = "rundll32.exe %s Main"
|
||||
$d = "d1fasg34"
|
||||
$e = "FindResource %s error"
|
||||
|
||||
condition:
|
||||
uint16(0) == 0x5A4D and 2 of them
|
||||
}
|
||||
|
||||
rule payload_wab32res_strings {
|
||||
meta:
|
||||
author = "Etienne Maynier"
|
||||
email = "etienne@citizenlab.ca"
|
||||
|
||||
strings:
|
||||
$a1 = "%02d%02d%02d%02d%02d%03d"
|
||||
$a2 = "459B2-3311-54C3- /Processid:{712"
|
||||
$a3 = "CreateProcess %s"
|
||||
$a4 = "FakeRun.dll"
|
||||
$a5 = "Release\\FakeRun.pdb"
|
||||
|
||||
condition:
|
||||
uint16(0) == 0x5A4D and 2 of them
|
||||
}
|
||||
|
||||
rule pcnt_cert {
|
||||
meta:
|
||||
author = "Etienne Maynier"
|
||||
email = "etienne@citizenlab.ca"
|
||||
|
||||
strings:
|
||||
$a = "MIIDWjCCAkICCQCdeJZhGKJakTANBgkqhkiG9w0BAQUFADBvMQswCQYDVQQGEwJV"
|
||||
$b = "UzERMA8GA1UECAwITmVicmFza2ExEDAOBgNVBAcMB0xpbmNvbG4xDTALBgNVBAoM"
|
||||
$c = "BFBDTlQxDTALBgNVBAsMBFBDTlQxHTAbBgkqhkiG9w0BCQEWDnBjbnRAZ21haWwu"
|
||||
$d = "Y29tMB4XDTE4MDEwNjA2MDMyMloXDTI4MDEwNDA2MDMyMlowbzELMAkGA1UEBhMC"
|
||||
$e = "VVMxETAPBgNVBAgMCE5lYnJhc2thMRAwDgYDVQQHDAdMaW5jb2xuMQ0wCwYDVQQK"
|
||||
$f = "DARQQ05UMQ0wCwYDVQQLDARQQ05UMR0wGwYJKoZIhvcNAQkBFg5wY250QGdtYWls"
|
||||
$g = "LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK+ihHezE6jjS2Vl"
|
||||
$h = "/rIIQsrczmbjU/4KYDiLiCcrxN0tht6GzL281KGoW13IiQvKILANmx02IAy5tzij"
|
||||
$i = "0W9ZvFAIRRYVDpoSU+EyXz4LjHgXvw6VeG9v3HV99iSmphkq7mLYee0EPYP6wSdB"
|
||||
|
||||
condition:
|
||||
uint16(0) == 0x5A4D and all of them
|
||||
}
|
||||
|
||||
rule custom_decryption {
|
||||
meta:
|
||||
author = "Etienne Maynier"
|
||||
email = "etienne@citizenlab.ca"
|
||||
|
||||
strings:
|
||||
$encrypt = { 8b d6 81 e2 07 00 00 80 79 05 4a 83 ca f8 42 8a 04 1e 0f be 0c 95 28 7e 46 00 34 01 0f be c0 0f af c8 80 f1 67 88 0c 1e 46 3b f7 7c d3 }
|
||||
$encrypt2 = { 8A 0C 30 8B D0 83 E2 07 80 F1 01 0F BE C9 0F BE 54 95 D0 0F AF D1 80 F2 85 88 14 30 40 }
|
||||
$decrypt_file1 = { 0f b6 01 8b d6 83 e2 07 34 01 0f be c0 83 c6 04 0f be }
|
||||
$decrypt_file2 = { 0f af d0 0f b6 41 01 34 01 0f be c0 88 11 8d 14 0f 83 e2 07 0f be }
|
||||
$decrypt_file3 = { 0f af d0 0f b6 41 02 34 01 0f be c0 88 51 01 8d 14 0b 83 e2 07 0f be }
|
||||
$decrypt_file4 = { 0f af d0 0f b6 41 03 34 01 0f be c0 88 51 02 8b 55 fc 03 d1 83 e2 07 0f be }
|
||||
|
||||
condition:
|
||||
uint16(0) == 0x5A4D and ($encrypt or $encrypt2 or all of ($decrypt_file*))
|
||||
}
|
||||
|
||||
rule tclient_strings {
|
||||
meta:
|
||||
author = "Etienne Maynier"
|
||||
email = "etienne@citizenlab.ca"
|
||||
|
||||
strings:
|
||||
$a = "sdf81msdf7"
|
||||
$b = "software\\klive"
|
||||
$c = "\\Registry\\User\\%s\\Software\\KLive"
|
||||
$d = "%s\\wab32res.dll"
|
||||
$e = "[!]NtDeleteValueKey Error:%ul"
|
||||
$f = "%sDebugLog.TXT"
|
||||
$g = "Server connect to [%s:%d] Sucesse! token = %s"
|
||||
$h = "192.168.70.1"
|
||||
$i = "Start %d connect %s:%d"
|
||||
|
||||
condition:
|
||||
uint16(0) == 0x5A4D and 3 of them
|
||||
}
|
||||
|
||||
rule tclient_string {
|
||||
meta:
|
||||
author= "Etienne Maynier"
|
||||
email = "etienne@citizenlab.ca"
|
||||
|
||||
strings:
|
||||
$a = "showgodmoney1gz"
|
||||
$b = "MDDEFGEGETGIZ"
|
||||
|
||||
condition:
|
||||
uint16(0) == 0x5A4D and 2 of them
|
||||
}
|
||||
|
||||
rule dsng_installer_dll_characteristics {
|
||||
meta:
|
||||
author = "Matt Brooks, @cmatthewbrooks"
|
||||
|
||||
strings:
|
||||
$s1 = "dsng.dll"
|
||||
$s2 = "InstallD" fullword
|
||||
$s3 = "InstallZ" fullword
|
||||
|
||||
condition:
|
||||
//MZ header
|
||||
uint16(0) == 0x5A4D and
|
||||
|
||||
//PE signature
|
||||
uint32(uint32(0x3C)) == 0x00004550 and
|
||||
|
||||
all of them
|
||||
}
|
||||
|
||||
rule dsng_installer_dll_stringset {
|
||||
meta:
|
||||
author = "Matt Brooks, @cmatthewbrooks"
|
||||
|
||||
strings:
|
||||
$s1 = "KCOM Server Security Guard"
|
||||
$s2 = "LoadFlgDllFun"
|
||||
$s3 = "Installv" fullword
|
||||
$s4 = "Dll path %s"
|
||||
$s5 = "MainFunVvv"
|
||||
$s6 = "http://dsas.asdf.com/"
|
||||
|
||||
condition:
|
||||
//MZ header
|
||||
uint16(0) == 0x5A4D and
|
||||
//PE signature
|
||||
uint32(uint32(0x3C)) == 0x00004550 and
|
||||
2 of them
|
||||
}
|
||||
|
||||
rule tibetan_indecent_rtf_meta {
|
||||
meta:
|
||||
author = "Matt Brooks, @cmatthewbrooks"
|
||||
|
||||
strings:
|
||||
$operator = "{\\operator Windows \\'d3\\'c3\\'bb\\'a7}"
|
||||
|
||||
condition:
|
||||
any of them
|
||||
}
|
||||
|
||||
rule tibetan_indecent_ppsx_meta
|
||||
{
|
||||
meta:
|
||||
author = "Matt Brooks, @cmatthewbrooks"
|
||||
|
||||
strings:
|
||||
$createdby = "<dc:creator>Windows User</dc:creator>"
|
||||
$createdate = "<dcterms:created xsi:type=\"dcterms:W3CDTF\">2017-10-23T00:57:05Z</dcterms:created>"
|
||||
|
||||
condition:
|
||||
all of them
|
||||
}
|
||||
|
||||
rule tibetan_indecent_powershell
|
||||
{
|
||||
meta:
|
||||
author = "Matt Brooks, @cmatthewbrooks"
|
||||
|
||||
strings:
|
||||
$decents1 = "$indecentID" ascii wide
|
||||
$decents2 = "$decentID" ascii wide
|
||||
$decents3 = "powershell" ascii wide nocase
|
||||
|
||||
condition:
|
||||
all of them
|
||||
}
|
||||
|
||||
rule tibetan_indecent_pe_loader_pdb
|
||||
{
|
||||
meta:
|
||||
author = "Matt Brooks, @cmatthewbrooks"
|
||||
|
||||
strings:
|
||||
//C:\Users\learn\Desktop\免杀\
|
||||
$pdb = {43 3a 5c 55 73 65 72 73 5c 6c 65 61 72 6e 5c 44 65 73 6b 74 6f 70 5c e5 85 8d e6 9d 80}
|
||||
|
||||
condition:
|
||||
all of them
|
||||
}
|
||||
|
||||
rule tibetan_indecent_powershell_tcpshell_funcs
|
||||
{
|
||||
meta:
|
||||
author = "Matt Brooks, @cmatthewbrooks"
|
||||
|
||||
strings:
|
||||
$class = "public class ReverseTCPShell" ascii wide nocase
|
||||
$func1 = "public static void run" ascii wide nocase
|
||||
$func2 = "public static void runth" ascii wide nocase
|
||||
$func3 = "public static void start" ascii wide nocase
|
||||
$func4 = "public static bool isOnline" ascii wide nocase
|
||||
$func5 = "public static void startCmd" ascii wide nocase
|
||||
$func6 = "public static void CmdExited" ascii wide nocase
|
||||
$func7 = "public static void DataReceived" ascii wide nocase
|
||||
$func8 = "public static void FileReceive" ascii wide nocase
|
||||
$func9 = "public static void CmdManager" ascii wide nocase
|
||||
$func10 = "public static void SortOutputHandler" ascii wide nocase
|
||||
$func11 = "public static void SendLoginInfo" ascii wide nocase
|
||||
$func12 = "public static void Send" ascii wide nocase
|
||||
$func13 = "public static int SendWithSplit" ascii wide nocase
|
||||
|
||||
condition:
|
||||
6 of them
|
||||
|
||||
}
|
||||
|
||||
rule tibetan_indecent_infrastructure_strings
|
||||
{
|
||||
meta:
|
||||
author = "Matt Brooks, @cmatthewbrooks"
|
||||
|
||||
strings:
|
||||
$cc1 = "103.55.24.196" ascii wide nocase
|
||||
$cc2 = "118.99.59.105" ascii wide nocase
|
||||
$cc3 = "27.126.186.222" ascii wide nocase
|
||||
$cc4 = "45.127.97.222" ascii wide nocase
|
||||
$cc5 = "comemail.email" ascii wide nocase
|
||||
$cc6 = "commail.co" ascii wide nocase
|
||||
$cc7 = "daynew.today" ascii wide nocase
|
||||
$cc8 = "daynews.today" ascii wide nocase
|
||||
$cc9 = "tibetfrum.info" ascii wide nocase
|
||||
$cc10 = "tibethouse.info" ascii wide nocase
|
||||
$cc11 = "tibetnews.info" ascii wide nocase
|
||||
$cc12 = "tibetnews.today" ascii wide nocase
|
||||
|
||||
condition:
|
||||
any of them
|
||||
|
||||
}
|
||||
|
||||
rule silent_ppk_strings
|
||||
{
|
||||
meta:
|
||||
author = "Geoff Alexander <geoff@citizenlab.ca>"
|
||||
|
||||
strings:
|
||||
$s1 = "MainCommandJobSub"
|
||||
$s2 = "MainFun002"
|
||||
$s3 = "mRecvPkgFun"
|
||||
$s4 = "while -- ClientConnect"
|
||||
$s5 = "svsdll.log"
|
||||
$s6 = "ppk.dat"
|
||||
|
||||
condition:
|
||||
uint16(0) == 0x5a4d and 4 of ($s*)
|
||||
}
|
||||
1010
data/ioc/spyware/citizen_lab/201808_FamiliarFeeling/stix.xml
Normal file
1010
data/ioc/spyware/citizen_lab/201808_FamiliarFeeling/stix.xml
Normal file
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user