Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs

data/ioc/spyware/mvt/intellexa_predator/README.md

@@ -0,0 +1,22 @@
+# Predator Spyware Indicators of Compromise
+
+This repository contains network and device indicators of compromised (IoCs) related to the IOS and Android Predator spyware tools developed by the cyber-surveillance company Intellexa (formerly Cytrox). These indicators were extracted from multiple reports including:
+
+* [Threat Report on the Surveillance-for-Hire Industry](https://about.fb.com/news/2021/12/taking-action-against-surveillance-for-hire/) by Meta
+* ["Pegasus vs. Predator - Dissident’s Doubly-Infected iPhone Reveals Cytrox Mercenary Spyware"](https://citizenlab.ca/2021/12/pegasus-vs-predator-dissidents-doubly-infected-iphone-reveals-cytrox-mercenary-spyware/) report by the Citizen Lab
+* ["Predator in the wires - Ahmed Eltantawy Targeted with Predator Spyware After Announcing Presidential Ambitions"](https://citizenlab.ca/2023/09/predator-in-the-wires-ahmed-eltantawy-targeted-with-predator-spyware-after-announcing-presidential-ambitions/) report by the Citizen Lab
+* [Mercenary mayhem: A technical analysis of Intellexa's PREDATOR spyware](https://blog.talosintelligence.com/mercenary-intellexa-predator/) by Cisco Talos
+* [Predatorgate: Τι έγραφαν τα SMS-παγίδα που έλαβαν επιχειρηματίες, υπουργοί και δημοσιογράφοι](https://insidestory.gr/article/predatorgate-ti-egrafan-ta-sms-pagida-poy-elavan-epiheirimaties-ypoyrgoi-kai-dimosiografoi) by Inside Story
+* [Active Lycantrox infrastructure illumination](https://blog.sekoia.io/active-lycantrox-infrastructure-illumination/) by Sekoia
+* [Predator Spyware Operators Rebuild Multi-Tier Infrastructure to Target Mobile Devices](https://www.recordedfuture.com/predator-spyware-operators-rebuild-multi-tier-infrastructure-target-mobile-devices) by Recorded Future
+* [The Predator spyware ecosystem is not dead](https://blog.sekoia.io/the-predator-spyware-ecosystem-is-not-dead/) by Sekoia
+* [Trust Broken at the Core](https://iverify.io/blog/trust-broken-at-the-core) by iVerify
+* Additional indicators of compromise were identified by the Amnesty Tech Security Lab as part of an independent investigation.
+
+The STIX2 file can be used with the [Mobile Verification Toolkit](https://github.com/mvt-project/mvt) to look for potential signs of compromise on Android phones and iPhones.
+
+It includes the following files:
+* `config_profiles.txt`: UUID of suspicious configuration profiles dropped by the Predator spyware
+* `predator.stix2`: [STIX2](https://oasis-open.github.io/cti-documentation/stix/intro.html) file containing all indicators
+* `domains.txt`: list of Predator domains
+* `file_paths.txt`: file paths for Predator payloads on disk in Android and iOS.

data/ioc/spyware/mvt/intellexa_predator/config_profiles.txt

@@ -0,0 +1 @@
+76DAB334-7E17-475D-A5D6-0794EB5818A5

data/ioc/spyware/mvt/intellexa_predator/domains.txt

@@ -0,0 +1,569 @@
+02s.co
+06g.co
+09a.co
+2-gis.kz
+2y4nothing.xyz
+5m5.io
+9o.gg
+actualite.emergence-mada.com
+actumali.org
+addons.news
+adenuncia.com
+adibjan.net
+adservices.gr.com
+adultpcz.xyz
+advertsservices.com
+advfb.xyz
+affise.app
+africa-confidentiel.fr
+afrinew.net
+air-shopping.net
+allafrika.live
+almal-news.com
+almasryelyuom.com
+almasrylayoum.com
+alpineai.uk
+alraeeenews.com
+alraeesnews.net
+altsantiri.news
+amazing.lab
+ancienthistory.xyz
+android-apps.tech
+angop.co
+aoatlasescort.com
+api-apple-buy.com
+api-telecommunication.com
+applepps.com
+apps-ios.net
+aramexegypt.com
+astanapark.com
+atheere.com
+audit-pvv.com
+bank-alahly.com
+bbcsworld.com
+bbitly.com
+beroxe.com
+bestwesternt.com
+betly.me
+bit-li.com
+bitlinkin.xyz
+bit-li.ws
+bitlly.live
+bi.tly.gr.com
+bi.tly.link
+bit-ly.link
+bit-ly.org
+bitlyrs.com
+bitshort.info
+bitt.fi
+bityl.me
+bity.ws
+blacktrail.xyz
+blitzmedia.live
+blocoinformativo.com
+bmw.gr.com
+bni-madagascar.com
+bookjob.club
+breaknews.live
+brkorage.live
+browsercheck.services
+btlin.life
+buildneeds.net
+bulk-ads.com
+bumabara.bid
+burgerprince.us
+businesnews.net
+businessafricaonline.org
+bw-guardian.com
+cabinet-salyk.kz
+candidaturasminfin.info
+candidaturassonangol.info
+canyouc.xyz
+carrefourmisr.com
+cbbc01.xyz
+c.betly.me
+celebrnewz.xyz
+cellconn.net
+centent-management.net
+charmander.xyz
+chat-support.support
+chatwithme.store
+cibeg.online
+citroen.gr.com
+ckforward.one
+clazc.com
+clckbck.com
+clcti.net
+clockupdate.com
+cloudstatistics.net
+cloudtimesync.com
+clubs-k.com
+cnn.gr.com
+cnn-portugal.com
+coazoa.com
+conlnk.one
+connectivitychecker.com
+connectivitycheck.live
+connectivitycheck.online
+conodeti.com
+contents-domain.com
+copy-note.net
+corporatebusinesssolution.net
+correiosdeangola.info
+cosmote.center
+covid19masks.shop
+crashonline.site
+culniks.info
+cut.red
+cyber.country
+danas.bid
+dealstransfer.net
+despachantonline.com
+despachosnegocios
+dhll.live
+distedc.com
+download4you.xyz
+dragonair.xyz
+dw-news.co
+dzhabarzan.com
+eagerfox.xyz
+ebill.cosmote.center
+edolio5.com
+efsyn.news
+efsyn.online
+eg-gov.org
+egypt-post.com
+egyqaz.com
+ehudaldaa.com
+e-kgd.kz
+elpais.me
+elwatnanews.com
+emvolio-gov.gr
+engine.ninja
+enigmase.xyz
+enikos.news
+ereportaz.news
+escortbabesluxo.com
+espressonews.gr.com
+etisalategypt.tech
+etisalatgreen.com
+eventes.org
+eventnews.live
+ewish.cards
+exclusivo24h.com
+factosdiarios.co
+factosdiarios.online
+fastdownload.me
+fastnews.biz
+fast-notify.com
+fastuploads.xyz
+fbc8213450838f7ae251d4519c195138.xyz
+fdnews.info
+ferrari.gr.com
+ffoxnewz.com
+fimes.gr.com
+fireup.xyz
+fisherman.engine.ninja
+flash.gr.com
+flexipagez.com
+flowercafee.com
+flytaps.com
+folha8.net
+folha9.info
+folha-9.com
+forwardeshoptt.com
+fr-monde.com
+gabzmus.com
+geloraku.id
+get-location.com
+get-location.net
+getsignalapps.com
+getsignalapps.live
+getupdatesnow.xyz
+glbnews.live
+goldenscent.net
+goldenscint.com
+goldescent.com
+gorlovski.com
+gorows.live
+gosokm.com
+gostosadeluxo.com
+growebservice.com
+grupohel.social
+grvnews.live
+guardian-tt.me
+guardnew.live
+guardnews.live
+gulfsports.info
+gulfsports.live
+gulfweather.live
+heaven.army
+heiiasjournai.com
+hellasjournal.company
+hellasjournal.website
+hellottec.art
+hempower.shop
+highclub.life
+hopnope.xyz
+icloudeu.com
+icloudflair.com
+iibt.xyz
+ikea-egypt.net
+ilnk.xyz
+imparcialpress.com
+inews.gr.com
+informacao24.com
+informationrank.net
+informburo.info
+infosms-a.site
+in-politics.com
+inservices.digital
+insider.gr.com
+instagam.click
+instagam.in
+instagam.photos
+instegram.co
+insurance.gr.com
+intercontinentalhg.com
+intnews.world
+invoker.icu
+ios-apps.store
+iosmnbg.com
+itcgr.live
+itly.link
+itter.me
+jakalas.online
+jofki.com
+jornaldeangola.co
+jornaldeangola.info
+jornaldeangola.net
+jornalf8.co
+jornalf8.com
+jquery-updater.xyz
+jumia-egy.com
+kalwaski.xyz
+kapital-news.com
+kathimerini.news
+kejoranews.net
+kinder.engine.ninja
+koenigseggg.com
+kohaicorp.com
+kollesa.com
+koora-egypt.com
+kormoran.bid
+kranos.gr.com
+krisha-kz.com
+kroal.com
+kz-news.cc
+kz-shops.me
+ladiesclubhouse.com
+lamborghini-s.shop
+landingpge.xyz
+landingpg.xyz
+leanwithme.xyz
+leefco.net
+lexpress.me
+lexpress-mg.xyz
+lexpressmg.xyz
+lifestyleshops.net
+lilpastanews.co
+limk.one
+linkit.cloud
+linkit.digital
+link-m.xyz
+link-protection.com
+linktothisa.xyz
+liponals.store
+live24.gr.com
+liveco.live
+livingwithbadkidny.xyz
+llinkedin.net
+lnkedin.org
+localegem.net
+lttlnk.net
+lubentv.com
+lusofonia-mundo.com
+lylink.online
+mada.sahia-mijoro.com
+magnum-kz.com
+makeitshort.xyz
+mastershop.biz
+mb-ph.net
+md-news-direct.com
+midi-madgasikara.co
+mifcbook.link
+miniiosapps.xyz
+mitube1.link
+mlinks.ws
+mmegi.co
+mobnetlink1.com
+mobnetlink2.com
+mobnetlink3.com
+moncn.co
+mozillaupdate.xyz
+msas.ws
+msbsck.com
+mujimbo.co
+mujimbos.co
+mujmbosnoticias.com
+mulherevips.com
+mult.icaixa.info
+mundodenoticias.online
+mycoffeeshop.shop
+myfawry.net
+myfcbk.net
+mytrips.quest
+myutbe.net
+mywebsitevpstest.xyz
+nabde.app
+nabd.site
+nassosblog.gr.com
+nemshi.net
+nemshi-news.live
+nemshi-news.xyz
+networkenterprise.net
+newsbeast.gr.com
+newslive2.xyz
+newspool.net
+newsreuter.com
+newsworldsports.co
+newzeto.xyz
+newzgroup.xyz
+niceonase.com
+niceonesa.net
+nikjol.xyz
+nissan.gr.com
+nm-weather.live
+nospam.kz
+notifications-sec.com
+notify-kz.info
+notify-service.biz
+novojornal.co
+novojornal.info
+novosti.bid
+nur-news.com
+oilgy.xyz
+olexegy.com
+olimpbets.kz
+olxeg.com
+omanreal.net
+omeega.xyz
+ongs.life
+ongsworld.com
+onlineservices.gr.com
+onlinewebinarmarketing.com
+orangegypt.co
+orchomenos.news
+ordas-kz.com
+otaupdatesios.com
+paok-24.com
+pastepast.net
+pasteposta.com
+pdfviewer.app
+pelovkin.com
+people-beeline.com
+peticaonline.comv
+plastictoysworld.com
+platinalines.com
+playestore.net
+plinkypong.com
+pocopoc.xyz
+podcastnow.club
+politika.bid
+politique-koaci.info
+popup-pw.info
+portalxa.com
+post-kz.info
+post-notify.info
+prmopromo.com
+pronews.gr.com
+protothema.live
+proupload.xyz
+ps1link.xyz
+ps2link.xyz
+qamqors.net
+qazsporttv.com
+quick-ads.com
+quickupdates.xyz
+qwert.xyz
+qwxzyl.com
+rcuples.com
+redeitt.com
+redirecting.live
+redirecting.page
+redirto.info
+rozavetrovv.com
+safelyredirecting.com
+safelyredirecting.digital
+schedulefestival.com
+sdntribune.co
+sec-flare.com
+sepenet.gr.com
+sephoragroup.com
+servers-mobile.info
+serviceupdaterequest.com
+sextape225.me
+shanam.org
+shop-collect.com
+shortely.xyz
+shorten.fi
+shortenurls.me
+shortly.work
+shortmee.one
+shortwidgets.com
+shortxyz.com
+showsme.info
+shoxtek.com
+sicnoticia.com
+simetricode.uk
+sinai-new.com
+sitepref.xyz
+skollie.online
+skranski.com
+sky-news.live
+smallme.net
+smcu.me
+smsuns.com
+snapfire.xyz
+sniper.pet
+soccer-bw.com
+solargoup.xyz
+solargroup.xyz
+soq.one
+spacsaver.info
+speedygonzales.xyz
+speedymax.shop
+speedy.sbs
+sportnow.news
+sports-mdg.xyz
+sportsnewz.site
+static-graph.com
+stonisi.news
+suarajubi.com
+suarajubi.net
+suarapapua.co
+supportset.net
+sustanbuild.com
+suzuki.gr.com
+svetovid.bid
+symoty.com
+syncservices.one
+synctimestamp.com
+syncupdate.site
+sysly.sbs
+sysnet.life
+taagangola.co
+t-bit.me
+tclnk.live
+telecomegy-ads.com
+telenorconn.com
+tengrinnews.live
+teslali.com
+teslal.shop
+teslal.xyz
+tesla-s.shop
+tgrthgsrgwrthwrtgwr.xyz
+thintank.co
+tickets-kz.com
+timestampsync.com
+timeupdateservice.com
+timeupdate.xyz
+tiny.gr.com
+tinylinks.live
+tinyulrs.com
+tinyurl.cloud
+tiol.xyz
+tly.gr.com
+tly.link
+tobupmi.com
+tohna.net
+tokoulouri.live
+tovima.live
+traffic-moi-eg.org
+t-ready.me
+trecvf.xyz
+trecv.xyz
+tribune-mg.xyz
+trkc.online
+truelocation.org
+tsapp.me
+tsrt.xyz
+tupuca.co
+tvxs.news
+tw.itter.me
+twtter.net
+ube.gr.com
+uberegypt.cn.com
+ulstur.co
+unitei.co
+universedades.com
+updates4you.xyz
+updateservice.center
+updatetime.zone
+updatingnews.xyz
+updete.xyz
+url-promo.club
+url-tiny.app
+uservicescheck.com
+uservicesforyou.com
+utube.digital
+utube.to
+vaovao.soutien-a-rajoelina.com
+vendaswebs.com
+verifyurl.me
+vestinfo.net
+vestinfo.org
+vestinfos.net
+vinho-online.com
+vinhosadega.com
+visavfsglobal.co
+viva.gr.com
+vlast-news.com
+vodafoneegypt.tech
+vodafonegypt.com
+vouliwatch.gr.com
+vslojasvendas.com
+wa-info.com
+walatparez.com
+wavekli.xyz
+weathear.live
+weather-live.com
+weathernewz.xyz
+weathersite.online
+webaffise.com
+weekendcool.com
+wesalcity.net
+we-site.net
+wha.tsapp.me
+whatssapp.co
+worldnws.xyz
+wtc1111.com
+wtc2222.com
+wtc3333.com
+wts-app.info
+xf.actor
+xnxx-hub.com
+xyvok.xyz
+yallakora-egy.com
+youarefired.xyz
+yo-um7.com
+youtub.app
+yo.utube.digital
+youtub-eg.com
+yout.ube.gr.com
+youtube.gr.live
+youtu-be.net
+youtubesyncapi.com
+yo.utube.to
+youtube.voto
+youtubewatch.co
+yuom7.net
+z2a.digital
+z2adigital.cloud
+z2digital.cloud
+zakorn.com
+zikolo.net
+zoometting.com
+zougla.gr.com
+zougla.news
+ztb-news.com

data/ioc/spyware/mvt/intellexa_predator/file_paths.txt

@@ -0,0 +1,16 @@
+/private/var/tmp/UserEventAgent
+/private/var/tmp/com.apple.WebKit.Networking
+/private/var/tmp/hooker
+/private/var/tmp/takePhoto
+/private/var/logs/keybagd/
+/private/var/tmp/kusama.txt
+/private/var/tmp/etherium.txt
+/private/var/tmp/helper.sock
+/private/var/tmp/etherium.txt
+/private/var/tmp/l/
+/tmp/etherium.txt
+/tmp/kusama.txt
+/tmp/l/
+/data/local/tmp/wd/pred.so
+/data/local/tmp/wd/fs.db
+/data/local/tmp/wd/

data/ioc/spyware/mvt/intellexa_predator/generate_stix.py

@@ -0,0 +1,41 @@
+import sys
+import os
+from stix2.v21 import (Indicator, Malware, Relationship, Bundle, DomainName)
+
+
+if __name__ == "__main__":
+    if os.path.isfile("predator.stix2"):
+        os.remove("predator.stix2")
+
+    with open("config_profiles.txt") as f:
+        configs = list(set([a.strip() for a in f.read().split()]))
+
+
+    with open("domains.txt") as f:
+        domains = list(set([a.strip() for a in f.read().split()]))
+
+    with open("file_paths.txt") as f:
+        filepaths = list(set([a.strip() for a in f.read().split()]))
+
+    res = []
+    malware = Malware(name="Predator", is_family=False, description="IOCs for Intellexa Predator")
+    res.append(malware)
+    for d in domains:
+        i = Indicator(indicator_types=["malicious-activity"], pattern="[domain-name:value='{}']".format(d), pattern_type="stix")
+        res.append(i)
+        res.append(Relationship(i, 'indicates', malware))
+
+    for f in filepaths:
+        i = Indicator(indicator_types=["malicious-activity"], pattern="[file:path='{}']".format(f), pattern_type="stix")
+        res.append(i)
+        res.append(Relationship(i, 'indicates', malware))
+
+    for c in configs:
+        i = Indicator(indicator_types=["malicious-activity"], pattern="[configuration-profile:id='{}']".format(c), pattern_type="stix")
+        res.append(i)
+        res.append(Relationship(i, 'indicates', malware))
+
+    bundle = Bundle(objects=res)
+    with open("predator.stix2", "w+") as f:
+        f.write(bundle.serialize(indent=4))
+    print("predator.stix2 file created")