Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs

data/ioc/spyware/mvt/2023-06_01_operation_triangulation/domains.txt

@@ -0,0 +1,76 @@
+
+8181data.com
+adcreatorfree.net
+addatamarket.net
+adsfreetracking.com
+adsspacefree.com
+adtreks.net
+ans7tv.net
+anstv.net
+baba8861.com
+backuprabbit.com
+balancedcistern.com
+beifang6688.com
+bestnewsfeed.net
+bestonlineads.net
+businessvideonews.com
+click-farm.net
+cloudsponcer.com
+cloudyundat.com
+crowd-tracking.com
+cruxness.com
+datamarketplace.net
+dreamshoppingphoto.com
+edgeserverapi.com
+fastads4free.com
+fastfindads.net
+floranewstoday.net
+freeaddelivery.com
+freeadvertisementsonline.com
+futebolnoticia.net
+globalpromonet.com
+growthtransport.com
+haidishabu.com
+healthymarshmellow.com
+improvingfitness.net
+kickoffortea.com
+koppercables.com
+mechanicsfoundry.com
+mediaclickers.net
+mediumgates.com
+mobilegamerstats.com
+mysyncs.com
+networkaccessory.com
+nimbulusdrifting.net
+onlineadvalue.com
+pandabeachmetrics.com
+papershopclip.com
+perksync.com
+pleekerion.com
+qinggang26.com
+quickdatafeed.com
+regionalcdn.net
+scoreclicks.com
+senlin83.com
+smartsavingmarketing.com
+snoweeanalytics.com
+statherder.com
+static3video.com
+stretchingnoun.com
+swimporchingnow.com
+tagclick-cdn.com
+tangpingzy.com
+tempoinformacao.net
+tenvmms.cloud
+titanhound.com
+topographyupdates.com
+tradeadvantages.com
+unlimitedteacup.com
+updateads.net
+updatedadsfree.com
+virtuallaughing.com
+weathercasting.net
+web-trackers.com
+wheelgroupmarketing.com
+windpoweredalgae.com
+yuxbaozh1.com

data/ioc/spyware/mvt/2023-06_01_operation_triangulation/emails.txt

@@ -0,0 +1,36 @@
+travislong544@yahoo.com
+norsarall87@outlook.com
+jesteristhebestband@gmail.com
+christineashleysmith@gmail.com
+homicidalwombat@yahoo.com
+nigelmlevy@gmail.com
+supercatman15@hotmail.com
+shannonkelly404@gmail.com
+superhugger21@gmail.com
+parkourdiva@yahoo.com
+naturelover1972@outlook.com
+sasquatchdreams@outlook.com
+trunkfullofbeans@yahoo.com
+danielhbarnes2@gmail.com
+patriotsman121@gmail.com
+wheelsordoors@yahoo.com
+janahodges324@gmail.com
+mibarham@outlook.com
+tinyjax89@gmail.com
+nonbaguette@yahoo.com
+slbrimms96@outlook.com
+costamaria91@outlook.com
+hyechink97@gmail.com
+greatoleg9393@mail.com
+popanddangle@outlook.com
+maxjar90@mail.com
+chongwonnam@gmail.com
+wopperplopper1@aol.com
+bajablaster101@gmail.com
+carlson31773@outlook.com
+fsozgur@outlook.com
+soccerchk835@gmail.com
+stephamartinez122@gmail.com
+popcornkerner@gmail.com
+pupperoni1989@outlook.com
+biglesterjames5@gmail.com

data/ioc/spyware/mvt/2023-06_01_operation_triangulation/generate_stix.py

@@ -0,0 +1,42 @@
+import sys
+import os
+from stix2.v21 import (Indicator, Malware, Relationship, Bundle, DomainName)
+
+
+if __name__ == "__main__":
+    malware_name = "OperationTriangulation"
+    stix_name = "operation_triangulation.stix2"
+    if os.path.isfile(stix_name):
+        os.remove(stix_name)
+
+    with open("domains.txt") as f:
+        domains = list(set([a.strip() for a in f.read().split()]))
+
+    with open("processes.txt") as f:
+        processes = list(set([a.strip() for a in f.read().split()]))
+
+    with open("emails.txt") as f:
+        emails = list(set([a.strip() for a in f.read().split()]))
+
+    res = []
+    malware = Malware(name=malware_name, is_family=False, description="IOCs related to Operation Triangulation iOS spyware documented by Kaspersky Labs.")
+    res.append(malware)
+    for d in domains:
+        i = Indicator(indicator_types=["malicious-activity"], pattern="[domain-name:value='{}']".format(d), pattern_type="stix")
+        res.append(i)
+        res.append(Relationship(i, 'indicates', malware))
+
+    for p in processes:
+        i = Indicator(indicator_types=["malicious-activity"], pattern="[process:name='{}']".format(p), pattern_type="stix")
+        res.append(i)
+        res.append(Relationship(i, 'indicates', malware))
+
+    for e in emails:
+        i = Indicator(indicator_types=["malicious-activity"], pattern="[email-addr:value='{}']".format(e), pattern_type="stix")
+        res.append(i)
+        res.append(Relationship(i, 'indicates', malware))
+
+    bundle = Bundle(objects=res)
+    with open(stix_name, "w+") as f:
+        f.write(bundle.serialize(indent=4))
+    print("{} file created".format(stix_name))

data/ioc/spyware/mvt/2023-06_01_operation_triangulation/processes.txt

@@ -0,0 +1 @@
+BackupAgent