Export from MISP Threat Report Champing at the Cyberbit: Ethiopian Dissidents Targeted with New Commercial Spyware (MISP Event #125) Threat Report Champing at the Cyberbit: Ethiopian Dissidents Targeted with New Commercial Spyware 125 2017-12-05T00:00:00+00:00 2017-12-06T11:04:35+00:00 Closed Artifacts dropped Artifacts dropped: 568d8c43815fa9608974071c49d68232 (MISP Attribute #17544) Malware Artifacts File Hash Watchlist Artifacts dropped: 568d8c43815fa9608974071c49d68232 (MISP Attribute #17544) MD5 568d8c43815fa9608974071c49d68232 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 80b7121c4ecac1c321ca2e3f507104c2 (MISP Attribute #17545) Malware Artifacts File Hash Watchlist Artifacts dropped: 80b7121c4ecac1c321ca2e3f507104c2 (MISP Attribute #17545) MD5 80b7121c4ecac1c321ca2e3f507104c2 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 8d6ce1a256acf608d82db6539bf73ae7 (MISP Attribute #17546) Malware Artifacts File Hash Watchlist Artifacts dropped: 8d6ce1a256acf608d82db6539bf73ae7 (MISP Attribute #17546) MD5 8d6ce1a256acf608d82db6539bf73ae7 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 840c4299f9cd5d4df46ee708c2c8247c (MISP Attribute #17547) Malware Artifacts File Hash Watchlist Artifacts dropped: 840c4299f9cd5d4df46ee708c2c8247c (MISP Attribute #17547) MD5 840c4299f9cd5d4df46ee708c2c8247c None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 961730964fd76c93603fb8f0d445c6f2 (MISP Attribute #17548) Malware Artifacts File Hash Watchlist Artifacts dropped: 961730964fd76c93603fb8f0d445c6f2 (MISP Attribute #17548) MD5 961730964fd76c93603fb8f0d445c6f2 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 376f28fb0aa650d6220a9d722cdb108d (MISP Attribute #17549) Malware Artifacts File Hash Watchlist Artifacts dropped: 376f28fb0aa650d6220a9d722cdb108d (MISP Attribute #17549) MD5 376f28fb0aa650d6220a9d722cdb108d None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: ca782d91daea6d67dfc49d6e7baf39b0 (MISP Attribute #17550) Malware Artifacts File Hash Watchlist Artifacts dropped: ca782d91daea6d67dfc49d6e7baf39b0 (MISP Attribute #17550) MD5 ca782d91daea6d67dfc49d6e7baf39b0 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 0488cf9c58f895076311bf8e2d93bf63 (MISP Attribute #17551) Malware Artifacts File Hash Watchlist Artifacts dropped: 0488cf9c58f895076311bf8e2d93bf63 (MISP Attribute #17551) MD5 0488cf9c58f895076311bf8e2d93bf63 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: f483fe294b4c3af1e3c8163200d60aae (MISP Attribute #17552) Malware Artifacts File Hash Watchlist Artifacts dropped: f483fe294b4c3af1e3c8163200d60aae (MISP Attribute #17552) MD5 f483fe294b4c3af1e3c8163200d60aae None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 1dcff300018c37a888fbe36f270f43a7 (MISP Attribute #17553) Malware Artifacts File Hash Watchlist Artifacts dropped: 1dcff300018c37a888fbe36f270f43a7 (MISP Attribute #17553) MD5 1dcff300018c37a888fbe36f270f43a7 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: ed42fcd0ae2e1baf3d0eead4fcf9c9da (MISP Attribute #17554) Malware Artifacts File Hash Watchlist Artifacts dropped: ed42fcd0ae2e1baf3d0eead4fcf9c9da (MISP Attribute #17554) MD5 ed42fcd0ae2e1baf3d0eead4fcf9c9da None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 4b6d030664668224a88ca260354e5b4e (MISP Attribute #17555) Malware Artifacts File Hash Watchlist Artifacts dropped: 4b6d030664668224a88ca260354e5b4e (MISP Attribute #17555) MD5 4b6d030664668224a88ca260354e5b4e None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 94d49232f1d77611544371826be16a99 (MISP Attribute #17556) Malware Artifacts File Hash Watchlist Artifacts dropped: 94d49232f1d77611544371826be16a99 (MISP Attribute #17556) MD5 94d49232f1d77611544371826be16a99 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: fd903f9471e7b3f60739b8f29fec041d (MISP Attribute #17557) Malware Artifacts File Hash Watchlist Artifacts dropped: fd903f9471e7b3f60739b8f29fec041d (MISP Attribute #17557) MD5 fd903f9471e7b3f60739b8f29fec041d None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: d3ebb760c9de3486379abc3672dbee8b (MISP Attribute #17558) Malware Artifacts File Hash Watchlist Artifacts dropped: d3ebb760c9de3486379abc3672dbee8b (MISP Attribute #17558) MD5 d3ebb760c9de3486379abc3672dbee8b None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 37c9e979a36b31355e779f10ecaba886 (MISP Attribute #17559) Malware Artifacts File Hash Watchlist Artifacts dropped: 37c9e979a36b31355e779f10ecaba886 (MISP Attribute #17559) MD5 37c9e979a36b31355e779f10ecaba886 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: bb0143290d7c9cb1d186e209e4aa8d87 (MISP Attribute #17560) Malware Artifacts File Hash Watchlist Artifacts dropped: bb0143290d7c9cb1d186e209e4aa8d87 (MISP Attribute #17560) MD5 bb0143290d7c9cb1d186e209e4aa8d87 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: e0804de1f0b4a22dbeddc90fb2854bfe (MISP Attribute #17561) Malware Artifacts File Hash Watchlist Artifacts dropped: e0804de1f0b4a22dbeddc90fb2854bfe (MISP Attribute #17561) MD5 e0804de1f0b4a22dbeddc90fb2854bfe None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 4feae73c2ef347692be0068793fc2c73 (MISP Attribute #17562) Malware Artifacts File Hash Watchlist Artifacts dropped: 4feae73c2ef347692be0068793fc2c73 (MISP Attribute #17562) MD5 4feae73c2ef347692be0068793fc2c73 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 46cab66af42f40c9f65fa20bf071601f (MISP Attribute #17563) Malware Artifacts File Hash Watchlist Artifacts dropped: 46cab66af42f40c9f65fa20bf071601f (MISP Attribute #17563) MD5 46cab66af42f40c9f65fa20bf071601f None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 8a20147b5df86ea6bdd39b9ea84dfc2d (MISP Attribute #17564) Malware Artifacts File Hash Watchlist Artifacts dropped: 8a20147b5df86ea6bdd39b9ea84dfc2d (MISP Attribute #17564) MD5 8a20147b5df86ea6bdd39b9ea84dfc2d None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: c616f271a456eb2c54bdbee67fb88eda (MISP Attribute #17565) Malware Artifacts File Hash Watchlist Artifacts dropped: c616f271a456eb2c54bdbee67fb88eda (MISP Attribute #17565) MD5 c616f271a456eb2c54bdbee67fb88eda None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 19dfff93ad650c02fbffa73faea48a96 (MISP Attribute #17566) Malware Artifacts File Hash Watchlist Artifacts dropped: 19dfff93ad650c02fbffa73faea48a96 (MISP Attribute #17566) MD5 19dfff93ad650c02fbffa73faea48a96 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: eaf569c0d8866df41f6c419b6683946b (MISP Attribute #17567) Malware Artifacts File Hash Watchlist Artifacts dropped: eaf569c0d8866df41f6c419b6683946b (MISP Attribute #17567) MD5 eaf569c0d8866df41f6c419b6683946b None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 2f9911e69ee7eeb2db050f82da85688e (MISP Attribute #17568) Malware Artifacts File Hash Watchlist Artifacts dropped: 2f9911e69ee7eeb2db050f82da85688e (MISP Attribute #17568) MD5 2f9911e69ee7eeb2db050f82da85688e None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 1b6ef8b512ab768d76999d81387eeca6 (MISP Attribute #17569) Malware Artifacts File Hash Watchlist Artifacts dropped: 1b6ef8b512ab768d76999d81387eeca6 (MISP Attribute #17569) MD5 1b6ef8b512ab768d76999d81387eeca6 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 370db91c6eca64f63083d577049bba5b (MISP Attribute #17570) Malware Artifacts File Hash Watchlist Artifacts dropped: 370db91c6eca64f63083d577049bba5b (MISP Attribute #17570) MD5 370db91c6eca64f63083d577049bba5b None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: dd9826b9dc747f625015d24ccd22acd6 (MISP Attribute #17571) Malware Artifacts File Hash Watchlist Artifacts dropped: dd9826b9dc747f625015d24ccd22acd6 (MISP Attribute #17571) MD5 dd9826b9dc747f625015d24ccd22acd6 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 14465588c4b201fcb03366292b1112d8 (MISP Attribute #17572) Malware Artifacts File Hash Watchlist Artifacts dropped: 14465588c4b201fcb03366292b1112d8 (MISP Attribute #17572) MD5 14465588c4b201fcb03366292b1112d8 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: a3125fdc709ff73ecf75447095fe4aa5 (MISP Attribute #17573) Malware Artifacts File Hash Watchlist Artifacts dropped: a3125fdc709ff73ecf75447095fe4aa5 (MISP Attribute #17573) MD5 a3125fdc709ff73ecf75447095fe4aa5 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 9cecb0bd8ccf9be70a1a24c729514bda (MISP Attribute #17574) Malware Artifacts File Hash Watchlist Artifacts dropped: 9cecb0bd8ccf9be70a1a24c729514bda (MISP Attribute #17574) MD5 9cecb0bd8ccf9be70a1a24c729514bda None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: eb45d72b786904fe7e5e2376b845061d (MISP Attribute #17575) Malware Artifacts File Hash Watchlist Artifacts dropped: eb45d72b786904fe7e5e2376b845061d (MISP Attribute #17575) MD5 eb45d72b786904fe7e5e2376b845061d None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: e220361db365f017583705ec341bd15b (MISP Attribute #17576) Malware Artifacts File Hash Watchlist Artifacts dropped: e220361db365f017583705ec341bd15b (MISP Attribute #17576) MD5 e220361db365f017583705ec341bd15b None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 3c124dfd026c71b6035beb5c2499ae26 (MISP Attribute #17577) Malware Artifacts File Hash Watchlist Artifacts dropped: 3c124dfd026c71b6035beb5c2499ae26 (MISP Attribute #17577) MD5 3c124dfd026c71b6035beb5c2499ae26 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: 74d5c71cc073ccedafefcb10fde91e04 (MISP Attribute #17578) Malware Artifacts File Hash Watchlist Artifacts dropped: 74d5c71cc073ccedafefcb10fde91e04 (MISP Attribute #17578) MD5 74d5c71cc073ccedafefcb10fde91e04 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: ae2161510ef99f71afaa7cf69a8f814c (MISP Attribute #17579) Malware Artifacts File Hash Watchlist Artifacts dropped: ae2161510ef99f71afaa7cf69a8f814c (MISP Attribute #17579) MD5 ae2161510ef99f71afaa7cf69a8f814c None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: PerfIPC (MISP Attribute #17590) Malware Artifacts Host Characteristics Artifacts dropped: PerfIPC (MISP Attribute #17590) PerfIPC None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: STORAGE_MUTEX (MISP Attribute #17591) Malware Artifacts Host Characteristics Artifacts dropped: STORAGE_MUTEX (MISP Attribute #17591) STORAGE_MUTEX None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: Global\76467a526e3f430f870f2d48876b77b7 (MISP Attribute #17592) Malware Artifacts Host Characteristics Artifacts dropped: Global\76467a526e3f430f870f2d48876b77b7 (MISP Attribute #17592) Global\76467a526e3f430f870f2d48876b77b7 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: Global\6efa80dda7d8489f931cc9b2eac58777 (MISP Attribute #17593) Malware Artifacts Host Characteristics Artifacts dropped: Global\6efa80dda7d8489f931cc9b2eac58777 (MISP Attribute #17593) Global\6efa80dda7d8489f931cc9b2eac58777 None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: \\.\pipe\BrowseIPC (MISP Attribute #17588) Malware Artifacts Host Characteristics Artifacts dropped: \\.\pipe\BrowseIPC (MISP Attribute #17588) \\.\pipe\BrowseIPC None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Artifacts dropped Artifacts dropped: \\.\pipe\{82221195-6222-4854-8874-016aa4e9dd41} (MISP Attribute #17589) Malware Artifacts Host Characteristics Artifacts dropped: \\.\pipe\{82221195-6222-4854-8874-016aa4e9dd41} (MISP Attribute #17589) \\.\pipe\{82221195-6222-4854-8874-016aa4e9dd41} None Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: pssts1.nozonenet.com (MISP Attribute #17585) Malware Artifacts Domain Watchlist Network activity: pssts1.nozonenet.com (MISP Attribute #17585) pssts1.nozonenet.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: time-local.com (MISP Attribute #17586) Malware Artifacts Domain Watchlist Network activity: time-local.com (MISP Attribute #17586) time-local.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: time-local.net (MISP Attribute #17587) Malware Artifacts Domain Watchlist Network activity: time-local.net (MISP Attribute #17587) time-local.net High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: pupki.co (MISP Attribute #17594) Malware Artifacts Domain Watchlist Network activity: pupki.co (MISP Attribute #17594) pupki.co High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: eastafro.net (MISP Attribute #17595) Malware Artifacts Domain Watchlist Network activity: eastafro.net (MISP Attribute #17595) eastafro.net High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: getadobeplayer.com (MISP Attribute #17596) Malware Artifacts Domain Watchlist Network activity: getadobeplayer.com (MISP Attribute #17596) getadobeplayer.com High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: diretube.co.uk (MISP Attribute #17597) Malware Artifacts Domain Watchlist Network activity: diretube.co.uk (MISP Attribute #17597) diretube.co.uk High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: meskereme.net (MISP Attribute #17598) Malware Artifacts Domain Watchlist Network activity: meskereme.net (MISP Attribute #17598) meskereme.net High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: https://pssts1.nozonenet.com/ts8/ts8.php (MISP Attribute #17580) Malware Artifacts URL Watchlist Network activity: https://pssts1.nozonenet.com/ts8/ts8.php (MISP Attribute #17580) https://pssts1.nozonenet.com/ts8/ts8.php High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: https://time-local.com/ (MISP Attribute #17581) Malware Artifacts URL Watchlist Network activity: https://time-local.com/ (MISP Attribute #17581) https://time-local.com/ High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: https://time-local.net/ (MISP Attribute #17582) Malware Artifacts URL Watchlist Network activity: https://time-local.net/ (MISP Attribute #17582) https://time-local.net/ High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: https://time-local.com/ts.php (MISP Attribute #17583) Malware Artifacts URL Watchlist Network activity: https://time-local.com/ts.php (MISP Attribute #17583) https://time-local.com/ts.php High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Network activity Network activity: https://time-local.net/ts.php (MISP Attribute #17584) Malware Artifacts URL Watchlist Network activity: https://time-local.net/ts.php (MISP Attribute #17584) https://time-local.net/ts.php High Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none Event Threat Level: High MISP Tag: TLP:WHITE citizenlab https://citizenlab.ca/2017/12/champing-cyberbit-ethiopian-dissidents-targeted-commercial-spyware/ ../../../descendant-or-self::node()