Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs

data/ioc/spyware/mvt/candiru/domains.txt

@@ -0,0 +1,125 @@
+ambiguouscommerce.com
+antperspective.com
+aperturebelt.com
+asknapkin.com
+barnsecret.com
+baseagriculture.com
+basicstraw.com
+basinapposite.com
+beneathbreadth.com
+bizarreclassify.com
+blockroster.net
+bondmuscle.com
+breadgroomer.com
+bronzemonth.com
+browniebell.com
+bypassbirch.com
+bypasscalculate.com
+bypasscommerce.com
+calmbase.org
+cartoondrop.net
+chickenstrawberry.com
+citecivilization.com
+closetmeat.com
+commonclever.com
+concretebottle.com
+conquerconfess.com
+containsnow.com
+contradictionblindness.com
+convincechaotic.com
+cooperatedisinfect.net
+cottonbread.com
+cranberrybear.com
+cropcritique.com
+crossoverdue.com
+damageconsider.com
+deardrill.com
+dediccatedconsideration.com
+deducedefend.com
+deliverconcern.net
+densefoot.com
+desireeclipse.com
+detaincharity.net
+deterdiffusion.com
+devotionbelief.com
+distractionfar.com
+drivesplash.com
+drummerjourney.com
+dumplingbell.com
+electric-prime.com
+elifluousscintillam.com
+eminententwine.com
+exhibitexpanse.com
+fallaciousessential.net
+fearevolve.com
+fileswaper.com
+finalsalami.com
+flexibleelevator.com
+foamdirection.com
+forecastgarden.com
+goatsandals.com
+golfconcert.com
+groundbreakinginitative.com
+guitarcalculate.com
+hostilefauna.com
+isolatelecture.com
+jellybat.net
+jobmarcher.com
+journeyjest.net
+kartingrumble.com
+labyrinthextravagance.org
+leafconfuse.net
+lessonhandle.com
+macrodrop.net
+macromint.net
+maturitygenesis.com
+measurecabin.com
+mushroompalm.com
+notableexam.org
+notionnowadays.com
+outdooutcome.com
+parkourbus.com
+patternperiod.com
+penslice.com
+pepperdominate.com
+prawnbasket.com
+predictproper.com
+pressaviation.com
+profligatecensure.com
+rollstrech.com
+romancedrum.com
+sacrificeprincipal.net
+salmonpride.net
+scoreparade.com
+selectedpazzle.com
+shareitwork.com
+signifyslight.com
+spongefruit.com
+stablesurface.com
+strangegarden.org
+stylebrakedown.com
+suggestutterly.com
+sunsetpotential.com
+tacticscheap.net
+tidalscreen.com
+tubeshape.com
+ultimatematter.info
+velvetpremier.com
+windomination.com
+noc-service-streamer.com
+fbcdnads.live
+hilocake.info
+backxercise.com
+winmslaf.xyz
+service-deamon.com
+online-affiliate-mon.com
+codeingasmylife.com
+kenoratravels.com
+weathercheck.digital
+colorpallatess.com
+library-update.com
+online-source-validate.com
+grayhornet.com
+johnshopkin.net
+eulenformacion.com
+pochtarossiy.info

data/ioc/spyware/mvt/candiru/generate_stix.py

@@ -0,0 +1,26 @@
+import sys
+import os
+from stix2.v21 import (Indicator, Malware, Relationship, Bundle, DomainName)
+
+
+if __name__ == "__main__":
+    malware_name = "Candiru"
+    stix_name = "candiru.stix2"
+    if os.path.isfile(stix_name):
+        os.remove(stix_name)
+
+    with open("domains.txt") as f:
+        domains = list(set([a.strip() for a in f.read().split()]))
+
+    res = []
+    malware = Malware(name=malware_name, is_family=False, description="IOCs related to Candiru's DevilsTongue.")
+    res.append(malware)
+    for d in domains:
+        i = Indicator(indicator_types=["malicious-activity"], pattern="[domain-name:value='{}']".format(d), pattern_type="stix")
+        res.append(i)
+        res.append(Relationship(i, 'indicates', malware))
+
+    bundle = Bundle(objects=res)
+    with open(stix_name, "w+") as f:
+        f.write(bundle.serialize(indent=4))
+    print("{} file created".format(stix_name))