Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs

data/ioc/spyware/mvt/2023-07-25_wyrmspy_dragonegg/domains.txt

@@ -0,0 +1,7 @@
+dns.win10micros0ft.com
+www.andropwn.xyz
+update.umisen.com
+alxc.tbtianyan.com
+yxwasec.com
+smiss.imwork.net
+huaxin-bantian.duckdns.org

data/ioc/spyware/mvt/2023-07-25_wyrmspy_dragonegg/generate_stix.py

@@ -0,0 +1,51 @@
+import sys
+import os
+from stix2.v21 import (Indicator, Malware, Relationship, Bundle, DomainName)
+
+
+if __name__ == "__main__":
+    malware_name = "WyrmSpy_DragonEgg"
+    stix_name = "wyrmspy_dragonegg.stix2"
+    if os.path.isfile(stix_name):
+        os.remove(stix_name)
+
+    with open("domains.txt") as f:
+        domains = list(set([a.strip() for a in f.read().split()]))
+
+    with open("ip-addresses.txt") as f:
+        ips = list(set([a.strip() for a in f.read().split()]))
+
+    with open("sha256.txt") as f:
+        sha256 = list(set([a.strip() for a in f.read().split()]))
+
+    with open("package_names.txt") as f:
+        package_names = list(set([a.strip() for a in f.read().split()]))
+
+    res = []
+    malware = Malware(name=malware_name, is_family=False, description="IOCs related to WyrmSpy and DragonEgg Android spyware documented by Lookout.")
+    res.append(malware)
+    for d in domains:
+        i = Indicator(indicator_types=["malicious-activity"], pattern="[domain-name:value='{}']".format(d), pattern_type="stix")
+        res.append(i)
+        res.append(Relationship(i, 'indicates', malware))
+
+    for ip in ips:
+        i = Indicator(indicator_types=["malicious-activity"], pattern="[ipv4-addr:value='{}']".format(ip),
+                      pattern_type="stix")
+        res.append(i)
+        res.append(Relationship(i, 'indicates', malware))
+
+    for s in sha256:
+        i = Indicator(indicator_types=["malicious-activity"], pattern="[file:hashes.sha256='{}']".format(s), pattern_type="stix")
+        res.append(i)
+        res.append(Relationship(i, 'indicates', malware))
+
+    for p in package_names:
+        i = Indicator(indicator_types=["malicious-activity"], pattern="[app:id='{}']".format(p), pattern_type="stix")
+        res.append(i)
+        res.append(Relationship(i, 'indicates', malware))
+
+    bundle = Bundle(objects=res)
+    with open(stix_name, "w+") as f:
+        f.write(bundle.serialize(indent=4))
+    print("{} file created".format(stix_name))

data/ioc/spyware/mvt/2023-07-25_wyrmspy_dragonegg/ip-addresses.txt

@@ -0,0 +1,5 @@
+116.205.4.18
+121.42.149.52
+118.193.39.165
+121.201.109.98
+103.43.17.99

data/ioc/spyware/mvt/2023-07-25_wyrmspy_dragonegg/package_names.txt

@@ -0,0 +1,7 @@
+com.android.system.configs.service
+com.hx.rootwifi
+com.adobe.flash.listen.beta
+com.adobe.flash.jni
+com.adobe.flash.dex
+remote.google.rt.googleservice
+xx.an

data/ioc/spyware/mvt/2023-07-25_wyrmspy_dragonegg/sha256.txt

@@ -0,0 +1,34 @@
+b66847d571e471ac78ffa11a82dded5ac6d2f52b25304adbfab90716d22c0905
+6caf068e1c0be245083aa6c3b92bd34909cb57d3d989cf509db18a8be4045fc5
+43193e32872c589785ae720da875e5e20099a5fa36c8aee838034c91986ed34c
+4355b4eb3d73b96577194cbd0ff319e0f4ff02d0cabdde8b15e1abd1840e6481
+6b9a540801613a2abd15b5994def2ac4904a896e14e1ab364b032de5b3d1e098
+8bf60e625d628e39320015de654933947b56621d8a4538f9be55c27ffc29a99c
+db389366540d43ffa1451fae16e0ab34bf266b9c88aff65d919f474e9430d5d6
+9bcaf637cfeab36e5f4301d4f018f7e6b8e9e30db108e7b7668bdb2250110407
+8c01132a0c1c7799e44608247f93d4680935f36df3fc94d59c7da83afe375ff2
+8d7fd7dcf5f0e144f3e3cc96ebf3ab8789d0d8edaeefa65e0f03dac67c1f046f
+82c75b521fd03f6c4074494f0e3c46cc7aa8e5b88c28ebb08401a50109206668
+7a618ac4a0fb2b68df540554ee99aa48caa148b3dd2800777a084a7322efe22f
+36d72fedc17be9936f182b38ca98c40a0f9ba44cac170bd63cbded9568452d25
+1d76df42d77080a96f885ed31ab8a83f4f985e071e715fd54297dab398c4be6b
+6fc9a0881719ddfd1973f7ce62fa000279fda2ab5a03a4676e15c5e838b8c7ff
+af139a04f314ccfb31a1d48ae9a434f26cb5fe1ca173acc479e7dc95a1f90260
+d773c969c1be976410b9d8304fe6c07b142766f7bec2242e0eb5c18d3503eec1
+38e18d79b83e7c0afbe1ac246a7a5fe6b2783adc085e9aeb2ec610e76f5ccaad
+92ce9de120ebd88f0126644697e9840489b2c2497e5c99acfa7dd680d98cf075
+c45a82123c985f2fd18e6763b76443ba6c49d12df3d7fe445a19c8fcdc6de846
+4fd5f3c3e4bc4c354d0e4de0bebfdb85e1bab5e5f1ea24ce18b947377a7e2423
+fa4a0aaa6b8f25e8f177ce2e3202c933c2358d4a45d94427dd54df83778a4225
+79028b82a4715160db89bb6ea7d7e2961e0f0e084b8abc21bb4d677ec4cc8d5a
+9ba0078a12f7cd515303aefdb151d65a2d3cb1188242e72e3bd9e629dc246582
+017f30bf39d897d1b52c6d035dde5d2578d18d774b39fe76daf67f53d9a08ce9
+b29cddc09cf65b4cda6b3898257f978265478af3ed3217c1be2c3fb729233739
+77504bf799b9a35d493b2363e7665b3dc3b9db32f337f03db1aabe4b3c5a5e05
+2594d654e4e820495392424e52c79d8ea89a8063ebb05bc6cf9f8547605db3a1
+48cd527254084d5e80cd86155a9a23702bdbd586752d27c6e3b6260fa8a86eb4
+79a316353747d11ca0ac00e6cbe1e1ce80061d067d9ff3274be33c40d12ca5de
+0bdefeee83c758c45a54b20674208e1fa26a2d47c862abdffd2c39a345379e0a
+68494cde4ee344cba80e8651c579418f2ce534018d88745797f030a3115ed19b
+9ef830205b7cf0d59d495f722fc61cc3a9f938972e24bae05fa8620b43ed264a
+ee90d36b384d92a0c9609eab0a3fe0f2af245c281473b4ff0cdd8caeed34fe97