Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs

data/ioc/spyware/mvt/ResidentBat/generate_stix.py

@@ -0,0 +1,87 @@
+import sys
+import os
+from stix2.v21 import (Indicator, Malware, Relationship, Bundle)
+
+
+from stix2 import CustomObservable
+
+# @CustomObservable('x-new-observable-2', [
+#     ('a_property', properties.StringProperty(required=True)),
+#     ('property_2', properties.IntegerProperty()),
+# ], [
+#     'a_property'
+# ])
+# class NewObservable2():
+#     pass
+
+def hash_format(hash):
+    if len(hash) == 32:
+        return "md5"
+    elif len(hash) == 40:
+        return "sha1"
+    elif len(hash) == 64:
+        return "sha256"
+    else:
+        return None
+
+if __name__ == "__main__":
+    malware_name = "ResidentBat"
+    stix2_file_name = "residentbat.stix2"
+    if os.path.isfile(stix2_file_name):
+        os.remove(stix2_file_name)
+
+    with open("domains.txt") as f:
+        domains = list(set([a.strip() for a in f.read().split()]))
+
+    with open("ip-addresses.txt") as f:
+        ips = list(set([a.strip() for a in f.read().split()]))
+
+    with open("package_names.txt") as f:
+        package_names = list(set([a.strip() for a in f.read().split()]))
+
+    with open("package_cert_hashes.txt") as f:
+        package_cert_hashes = list(set([a.strip() for a in f.read().split()]))
+
+    with open("sha256.txt") as f:
+        sha256_hashes = list(set([a.strip() for a in f.read().split()]))
+
+    res = []
+    malware = Malware(name=malware_name, is_family=False, description="IOCs for ResidentBat")
+    res.append(malware)
+    for d in domains:
+        i = Indicator(indicator_types=["malicious-activity"], pattern="[domain-name:value='{}']".format(d), pattern_type="stix")
+        res.append(i)
+        res.append(Relationship(i, 'indicates', malware))
+
+    for ip in ips:
+        i = Indicator(indicator_types=["malicious-activity"], pattern="[ipv4-addr:value='{}']".format(ip),
+                      pattern_type="stix")
+        res.append(i)
+        res.append(Relationship(i, 'indicates', malware))
+
+    for package_name in package_names:
+        i = Indicator(indicator_types=["malicious-activity"], pattern="[app:id='{}']".format(package_name), pattern_type="stix")
+        res.append(i)
+        res.append(Relationship(i, 'indicates', malware))
+
+    for cert_hash in package_cert_hashes:
+        hash_type = hash_format(cert_hash)
+        if not hash_type:
+            raise ValueError("Unknown hash type for {}".format(cert_hash))
+
+        i = Indicator(indicator_types=["malicious-activity"], pattern=f"[app:cert.{hash_type}='{cert_hash}']", pattern_type="stix")
+        res.append(i)
+        res.append(Relationship(i, 'indicates', malware))
+
+    for sha256_hash in sha256_hashes:
+        if not hash_format(sha256_hash) == "sha256":
+            raise ValueError("File hash is not in SHA256 format: {}".format(sha256_hash))
+        i = Indicator(indicator_types=["malicious-activity"], pattern=f"[file:hashes.sha256='{sha256_hash}']", pattern_type="stix")
+        res.append(i)
+        res.append(Relationship(i, 'indicates', malware))
+
+
+    bundle = Bundle(objects=res)
+    with open(stix2_file_name, "w+") as f:
+        f.write(bundle.serialize(pretty=True, indent=4))
+    print("{} file created".format(stix2_file_name))

data/ioc/spyware/mvt/ResidentBat/ip-addresses.txt

@@ -0,0 +1,24 @@
+62.109.26.144
+91.107.122.180
+5.129.230.104
+82.146.35.54
+62.109.12.75
+79.132.136.191
+83.220.169.120
+5.129.213.114
+5.253.63.176
+62.109.11.98
+62.109.19.123
+185.248.103.85
+5.129.231.158
+185.18.54.246
+91.240.87.211
+185.248.103.128
+185.248.103.247
+188.120.230.46
+37.46.133.87
+5.253.61.156
+79.132.141.31
+37.46.128.62
+91.228.152.4
+91.192.102.69

data/ioc/spyware/mvt/ResidentBat/package_cert_hashes.txt

@@ -0,0 +1,8 @@
+18afc5c6bfaee504a26291f6bf3e6f823dbedd54bba0c4acac2e7c2414b3e24d
+c1884e617348ebbdfe7cfe5fc99945b37296d6ebc6059bb74fbaeea277d32941
+e5016f3cfb937d502dabedc32ca3bdef3bbcce032fb3b1bff3b9c6482895f4fd
+d12616542268d32329f1c4357b5d5a57e954e13d2338d27bb8439794291b8c6d
+3e9f1192e33cb851b48479629c93d29770a4f76af00f1e42a3c6e7f97db62c79
+6782039a81a85264acdc6af0973b225ada6009f76faae7f948a1de040bb32f0c
+a6a067b0d899fb514b7b4597d4fe16fcd4d7e5c361f6c84b3d45ed7e394036c7
+6d6278ffc80ad9dd1b1c6b445847ce108f3ea5ce349f232689e9b8c1fd10801e

data/ioc/spyware/mvt/ResidentBat/package_names.txt

@@ -0,0 +1,8 @@
+com.google.android.service
+com.google.bat
+com.huaweisettingsapp.mkz
+com.linkedln.service
+com.oneplussync.bat
+cm.google.android.apps.assistant
+com.android.framework.safety
+com.hihonor.core.service

data/ioc/spyware/mvt/ResidentBat/sha256.txt

@@ -0,0 +1,9 @@
+07d39205f9ba159236477a02cdb3350fac4f158e0dbf26576bb50604339b1f42
+820c394b22b950335eb5cf21bc7df5c7a33081169f41440c74d67e7a8f196960
+fe05ba40f2d4b15db83524c169d030d097abc6713139ce6068969d97a24aa195
+77126e749a9c1144ae3cebb8deb0b72fc90d4eb73d1072a69a1248b4f518bb47
+c3b92d05b105465881c0f68f5cf6c3edb24d2e5317ffd1256cb68c7921fe0721
+0ed73428c7729806be57989f340a09a323af914f197cc0cbb5509316ca5baf7b
+48e87bfcaa665bfbfcb027227384905878f090bbc19d02f74c41ade3cafb0950
+02dc81ea172e45f0a6fd7241fffd1042f6925c52d2f91dee36085634207be4f1
+0ed73428c7729806be57989f340a09a323af914f197cc0cbb5509316ca5baf7b