new: Tag sources

2018-07-06 15:42:29 +02:00 · 2018-07-06 15:42:29 +02:00 · 17819e3d15
parent eba9a4b692
commit 17819e3d15
76 changed files with 349 additions and 77 deletions
--- a/bgpranking/config/modules/bambenekconsulting_Bamital.json
+++ b/bgpranking/config/modules/bambenekconsulting_Bamital.json
@ -3,5 +3,8 @@
  "name": "Bamital",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Bamital\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Bamital_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Bamital_NS.json
@ -3,5 +3,8 @@
  "name": "Bamital_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Bamital\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Banjori.json
+++ b/bgpranking/config/modules/bambenekconsulting_Banjori.json
@ -3,5 +3,8 @@
  "name": "Banjori",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Banjori\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Banjori_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Banjori_NS.json
@ -3,5 +3,8 @@
  "name": "Banjori_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Banjori\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Bebloh_URLZone.json
+++ b/bgpranking/config/modules/bambenekconsulting_Bebloh_URLZone.json
@ -3,5 +3,8 @@
  "name": "Bebloh/URLZone",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Bebloh\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Bebloh_URLZone_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Bebloh_URLZone_NS.json
@ -3,5 +3,8 @@
  "name": "Bebloh/URLZone_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Bebloh\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Bedep.json
+++ b/bgpranking/config/modules/bambenekconsulting_Bedep.json
@ -3,5 +3,8 @@
  "name": "Bedep",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:tool=\"Bedep\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Bedep_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Bedep_NS.json
@ -3,5 +3,8 @@
  "name": "Bedep_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:tool=\"Bedep\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Beebone.json
+++ b/bgpranking/config/modules/bambenekconsulting_Beebone.json
@ -3,5 +3,8 @@
  "name": "Beebone",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Beebone\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Beebone_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Beebone_NS.json
@ -3,5 +3,8 @@
  "name": "Beebone_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Beebone\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Corebot.json
+++ b/bgpranking/config/modules/bambenekconsulting_Corebot.json
@ -3,5 +3,8 @@
  "name": "Corebot",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Corebot\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Cryptolocker.json
+++ b/bgpranking/config/modules/bambenekconsulting_Cryptolocker.json
@ -3,5 +3,16 @@
  "name": "Cryptolocker",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:ransomware=\"CryptoLocker by NTK Ransomware\"",
+    "misp-galaxy:ransomware=\"MSN CryptoLocker Ransomware\"",
+    "misp-galaxy:ransomware=\"CryptoLocker 5.1\"",
+    "misp-galaxy:ransomware=\"FakeCryptoLocker\"",
+    "misp-galaxy:ransomware=\"PClock3 Ransomware\"",
+    "misp-galaxy:ransomware=\"CryptoLocker3 Ransomware\"",
+    "misp-galaxy:ransomware=\"CryptoLocker 1.0.0\"",
+    "misp-galaxy:ransomware=\"DynA-Crypt Ransomware\"",
+    "misp-galaxy:ransomware=\"CryptoLocker\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Cryptolocker_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Cryptolocker_NS.json
@ -3,5 +3,8 @@
  "name": "Cryptolocker_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:ransomware=\"CryptoLocker\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Dircrypt.json
+++ b/bgpranking/config/modules/bambenekconsulting_Dircrypt.json
@ -3,5 +3,8 @@
  "name": "Dircrypt",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:ransomware=\"DirCrypt\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Dircrypt_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Dircrypt_NS.json
@ -3,5 +3,8 @@
  "name": "Dircrypt_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:ransomware=\"DirCrypt\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Dyre.json
+++ b/bgpranking/config/modules/bambenekconsulting_Dyre.json
@ -3,5 +3,8 @@
  "name": "Dyre",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Dyre\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Dyre_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Dyre_NS.json
@ -3,5 +3,8 @@
  "name": "Dyre_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Dyre\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Fobber.json
+++ b/bgpranking/config/modules/bambenekconsulting_Fobber.json
@ -3,5 +3,8 @@
  "name": "Fobber",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Fobber\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Fobber_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Fobber_NS.json
@ -3,5 +3,8 @@
  "name": "Fobber_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Fobber\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Geodo.json
+++ b/bgpranking/config/modules/bambenekconsulting_Geodo.json
@ -3,5 +3,9 @@
  "name": "Geodo",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:tool=\"Emotet\"",
+    "misp-galaxy:banker=\"Geodo\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Geodo_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Geodo_NS.json
@ -3,5 +3,9 @@
  "name": "Geodo_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:tool=\"Emotet\"",
+    "misp-galaxy:banker=\"Geodo\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Gozi.json
+++ b/bgpranking/config/modules/bambenekconsulting_Gozi.json
@ -3,5 +3,8 @@
  "name": "Gozi",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Gozi\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Gozi_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Gozi_NS.json
@ -3,5 +3,8 @@
  "name": "Gozi_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Gozi\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Hesperbot.json
+++ b/bgpranking/config/modules/bambenekconsulting_Hesperbot.json
@ -3,5 +3,8 @@
  "name": "Hesperbot",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:android=\"Hesperbot\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Hesperbot_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Hesperbot_NS.json
@ -3,5 +3,8 @@
  "name": "Hesperbot_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:android=\"Hesperbot\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Kraken.json
+++ b/bgpranking/config/modules/bambenekconsulting_Kraken.json
@ -3,5 +3,8 @@
  "name": "Kraken",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Kraken\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Kraken_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Kraken_NS.json
@ -3,5 +3,8 @@
  "name": "Kraken_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Kraken\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Locky.json
+++ b/bgpranking/config/modules/bambenekconsulting_Locky.json
@ -3,5 +3,8 @@
  "name": "Locky",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:ransomware=\"Locky\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Locky_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Locky_NS.json
@ -3,5 +3,8 @@
  "name": "Locky_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:ransomware=\"Locky\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Madmax.json
+++ b/bgpranking/config/modules/bambenekconsulting_Madmax.json
@ -3,5 +3,8 @@
  "name": "Madmax",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Madmax\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Madmax_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Madmax_NS.json
@ -3,5 +3,8 @@
  "name": "Madmax_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Madmax\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Mirai.json
+++ b/bgpranking/config/modules/bambenekconsulting_Mirai.json
@ -3,5 +3,9 @@
  "name": "Mirai",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Mirai\"",
+    "misp-galaxy:tool=\"Mirai\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Mirai_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Mirai_NS.json
@ -3,5 +3,9 @@
  "name": "Mirai_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Mirai\"",
+    "misp-galaxy:tool=\"Mirai\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Murofet.json
+++ b/bgpranking/config/modules/bambenekconsulting_Murofet.json
@ -3,5 +3,8 @@
  "name": "Murofet",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Licat\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Murofet_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Murofet_NS.json
@ -3,5 +3,8 @@
  "name": "Murofet_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Licat\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Necurs.json
+++ b/bgpranking/config/modules/bambenekconsulting_Necurs.json
@ -3,5 +3,8 @@
  "name": "Necurs",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:tool=\"Necurs\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Necurs_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Necurs_NS.json
@ -3,5 +3,8 @@
  "name": "Necurs_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:tool=\"Necurs\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Nymaim.json
+++ b/bgpranking/config/modules/bambenekconsulting_Nymaim.json
@ -3,5 +3,8 @@
  "name": "Nymaim",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:tool=\"Nymaim\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Nymaim_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Nymaim_NS.json
@ -3,5 +3,8 @@
  "name": "Nymaim_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:tool=\"Nymaim\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Padcrypt.json
+++ b/bgpranking/config/modules/bambenekconsulting_Padcrypt.json
@ -3,5 +3,8 @@
  "name": "Padcrypt",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:ransomware=\"PadCrypt\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Padcrypt_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Padcrypt_NS.json
@ -3,5 +3,8 @@
  "name": "Padcrypt_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:ransomware=\"PadCrypt\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Pandabanker.json
+++ b/bgpranking/config/modules/bambenekconsulting_Pandabanker.json
@ -3,5 +3,8 @@
  "name": "Pandabanker",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Panda Banker\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Pandabanker_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Pandabanker_NS.json
@ -3,5 +3,8 @@
  "name": "Pandabanker_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Panda Banker\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Pushdo.json
+++ b/bgpranking/config/modules/bambenekconsulting_Pushdo.json
@ -3,5 +3,8 @@
  "name": "Pushdo",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Pushdo\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Pushdo_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Pushdo_NS.json
@ -3,5 +3,8 @@
  "name": "Pushdo_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Pushdo\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Qadars.json
+++ b/bgpranking/config/modules/bambenekconsulting_Qadars.json
@ -3,5 +3,8 @@
  "name": "Qadars",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Qadars\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Qadars_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Qadars_NS.json
@ -3,5 +3,8 @@
  "name": "Qadars_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Qadars\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Qakbot.json
+++ b/bgpranking/config/modules/bambenekconsulting_Qakbot.json
@ -3,5 +3,9 @@
  "name": "Qakbot",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:tool=\"Akbot\"",
+    "misp-galaxy:banker=\"Qakbot\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Qakbot_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Qakbot_NS.json
@ -3,5 +3,9 @@
  "name": "Qakbot_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:tool=\"Akbot\"",
+    "misp-galaxy:banker=\"Qakbot\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Ramnit.json
+++ b/bgpranking/config/modules/bambenekconsulting_Ramnit.json
@ -3,5 +3,9 @@
  "name": "Ramnit",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Ramnit\"",
+    "misp-galaxy:banker=\"Ramnit\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Ramnit_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Ramnit_NS.json
@ -3,5 +3,9 @@
  "name": "Ramnit_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Ramnit\"",
+    "misp-galaxy:banker=\"Ramnit\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Ranbyus.json
+++ b/bgpranking/config/modules/bambenekconsulting_Ranbyus.json
@ -3,5 +3,8 @@
  "name": "Ranbyus",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Ranbyus\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Ranbyus_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Ranbyus_NS.json
@ -3,5 +3,8 @@
  "name": "Ranbyus_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Ranbyus\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Shifu.json
+++ b/bgpranking/config/modules/bambenekconsulting_Shifu.json
@ -3,5 +3,8 @@
  "name": "Shifu",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:tool=\"Shifu\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Shifu_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Shifu_NS.json
@ -3,5 +3,8 @@
  "name": "Shifu_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:tool=\"Shifu\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Simda.json
+++ b/bgpranking/config/modules/bambenekconsulting_Simda.json
@ -3,5 +3,8 @@
  "name": "Simda",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Simda\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Simda_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Simda_NS.json
@ -3,5 +3,8 @@
  "name": "Simda_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Simda\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Sisron.json
+++ b/bgpranking/config/modules/bambenekconsulting_Sisron.json
@ -3,5 +3,8 @@
  "name": "Sisron",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Sisron\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Sisron_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Sisron_NS.json
@ -3,5 +3,8 @@
  "name": "Sisron_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Sisron\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Sphinx.json
+++ b/bgpranking/config/modules/bambenekconsulting_Sphinx.json
@ -3,5 +3,8 @@
  "name": "Sphinx",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Zeus Sphinx\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Sphinx_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Sphinx_NS.json
@ -3,5 +3,8 @@
  "name": "Sphinx_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Zeus Sphinx\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Tinba_TinyBanker.json
+++ b/bgpranking/config/modules/bambenekconsulting_Tinba_TinyBanker.json
@ -3,5 +3,9 @@
  "name": "Tinba_/_TinyBanker",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Tinba\"",
+    "misp-galaxy:tool=\"Tinba\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Tinba_TinyBanker_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Tinba_TinyBanker_NS.json
@ -3,5 +3,9 @@
  "name": "Tinba_/_TinyBanker_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Tinba\"",
+    "misp-galaxy:tool=\"Tinba\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Tinynuke.json
+++ b/bgpranking/config/modules/bambenekconsulting_Tinynuke.json
@ -3,5 +3,8 @@
  "name": "Tinynuke",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"TinyNuke\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Tinynuke_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Tinynuke_NS.json
@ -3,5 +3,8 @@
  "name": "Tinynuke_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"TinyNuke\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Tofsee.json
+++ b/bgpranking/config/modules/bambenekconsulting_Tofsee.json
@ -3,5 +3,8 @@
  "name": "Tofsee",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Gheg\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Tofsee_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Tofsee_NS.json
@ -3,5 +3,8 @@
  "name": "Tofsee_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Gheg\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Vawtrak.json
+++ b/bgpranking/config/modules/bambenekconsulting_Vawtrak.json
@ -3,5 +3,9 @@
  "name": "Vawtrak",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:tool=\"Vawtrak\"",
+    "misp-galaxy:banker=\"Vawtrak\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Vawtrak_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Vawtrak_NS.json
@ -3,5 +3,9 @@
  "name": "Vawtrak_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:tool=\"Vawtrak\"",
+    "misp-galaxy:banker=\"Vawtrak\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Virut.json
+++ b/bgpranking/config/modules/bambenekconsulting_Virut.json
@ -3,5 +3,8 @@
  "name": "Virut",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Virut\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Virut_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Virut_NS.json
@ -3,5 +3,8 @@
  "name": "Virut_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Virut\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Volatile_Cedar_Explosive.json
+++ b/bgpranking/config/modules/bambenekconsulting_Volatile_Cedar_Explosive.json
@ -3,5 +3,9 @@
  "name": "Volatile_Cedar_/_Explosive",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:threat-actor=\"Volatile Cedar\"",
+    "misp-galaxy:tool=\"Explosive\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_Volatile_Cedar_Explosive_NS.json
+++ b/bgpranking/config/modules/bambenekconsulting_Volatile_Cedar_Explosive_NS.json
@ -3,5 +3,9 @@
  "name": "Volatile_Cedar_/_Explosive_NS",
  "vendor": "bambenekconsulting",
  "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:threat-actor=\"Volatile Cedar\"",
+    "misp-galaxy:tool=\"Explosive\""
+  ]
 }
--- a/bgpranking/config/modules/bambenekconsulting_feeds.py
+++ b/bgpranking/config/modules/bambenekconsulting_feeds.py
@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 # -*- coding: utf-8 -*-

 import json
@ -6,34 +6,55 @@ import re
 import requests
 from bs4 import BeautifulSoup

+from pymispgalaxies import Clusters
+
+
+def find_tags(name):
+    if '/' in name:
+        to_search = name.split('/')
+    else:
+        to_search = [name]
+    tags = []
+    for name in to_search:
+        responses = c.search(name.strip(), return_tags=True)
+        for _, t in responses:
+            tags += t
+    return list(set(tags))
+

 def get_paths():
    root = 'http://osint.bambenekconsulting.com'
    r = requests.get(f'{root}/feeds/')
    soup = BeautifulSoup(r.text, 'html.parser')
-
    to_return = []
    for entry in soup.find_all('p'):
        name = entry.b.string
+        tags = find_tags(name)
        if name:
            for link in entry.find_all('a'):
                if link.get('href').endswith('iplist.txt'):
                    path = link.get('href')
                    if link.get('href').endswith('nsiplist.txt'):
                        name = f'{name}_NS'
-                    to_return.append((name, f'{root}{path}'))
+                    to_return.append((name, f'{root}{path}', tags))
    return to_return


 def make_config(entry):
    name = entry[0].replace(' ', '_')
-    config = {'url': entry[1], 'name': name, 'vendor': 'bambenekconsulting', 'impact': 3, 'parser': '.parsers.bambenekconsulting'}
+    config = {'url': entry[1], 'name': name, 'vendor': 'bambenekconsulting',
+              'impact': 3, 'parser': '.parsers.bambenekconsulting'}
+    if len(entry) >= 3 and entry[2]:
+        config['tags'] = entry[2]
+    else:
+        print('No tags:', name)
    filename = re.sub('[^0-9a-zA-Z]+', '_', name)
    with open(f'bambenekconsulting_{filename}.json', 'w') as f:
        json.dump(config, f, indent=2)


 if __name__ == '__main__':
+    c = Clusters()

    for entry in get_paths():
        make_config(entry)
--- a/bgpranking/config/modules/module.schema
+++ b/bgpranking/config/modules/module.schema
@ -19,6 +19,13 @@
      },
      "parser": {
        "type": "string"
+      },
+      "tags": {
+        "type": "array",
+        "uniqueItems": true,
+        "items": {
+          "type": "string"
+        }
      }
  },
  "required": [
--- a/requirements.txt
+++ b/requirements.txt
@ -5,3 +5,6 @@ git+https://github.com/jsommers/pytricia.git
 git+https://github.com/trbs/pid.git
 aiohttp
 requests
+
+git+https://github.com/MISP/PyTaxonomies
+git+https://github.com/MISP/PyMISPGalaxies.git