new: Tag sources

bgpranking/config/modules/bambenekconsulting_Bamital.json

@@ -3,5 +3,8 @@
   "name": "Bamital",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Bamital\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Bamital_NS.json

@@ -3,5 +3,8 @@
   "name": "Bamital_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Bamital\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Banjori.json

@@ -3,5 +3,8 @@
   "name": "Banjori",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Banjori\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Banjori_NS.json

@@ -3,5 +3,8 @@
   "name": "Banjori_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Banjori\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Bebloh_URLZone.json

@@ -3,5 +3,8 @@
   "name": "Bebloh/URLZone",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Bebloh\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Bebloh_URLZone_NS.json

@@ -3,5 +3,8 @@
   "name": "Bebloh/URLZone_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Bebloh\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Bedep.json

@@ -3,5 +3,8 @@
   "name": "Bedep",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:tool=\"Bedep\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Bedep_NS.json

@@ -3,5 +3,8 @@
   "name": "Bedep_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:tool=\"Bedep\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Beebone.json

@@ -3,5 +3,8 @@
   "name": "Beebone",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Beebone\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Beebone_NS.json

@@ -3,5 +3,8 @@
   "name": "Beebone_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Beebone\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Corebot.json

@@ -3,5 +3,8 @@
   "name": "Corebot",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Corebot\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Cryptolocker.json

@@ -3,5 +3,16 @@
   "name": "Cryptolocker",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:ransomware=\"CryptoLocker by NTK Ransomware\"",
+    "misp-galaxy:ransomware=\"MSN CryptoLocker Ransomware\"",
+    "misp-galaxy:ransomware=\"CryptoLocker 5.1\"",
+    "misp-galaxy:ransomware=\"FakeCryptoLocker\"",
+    "misp-galaxy:ransomware=\"PClock3 Ransomware\"",
+    "misp-galaxy:ransomware=\"CryptoLocker3 Ransomware\"",
+    "misp-galaxy:ransomware=\"CryptoLocker 1.0.0\"",
+    "misp-galaxy:ransomware=\"DynA-Crypt Ransomware\"",
+    "misp-galaxy:ransomware=\"CryptoLocker\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Cryptolocker_NS.json

@@ -3,5 +3,8 @@
   "name": "Cryptolocker_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:ransomware=\"CryptoLocker\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Dircrypt.json

@@ -3,5 +3,8 @@
   "name": "Dircrypt",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:ransomware=\"DirCrypt\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Dircrypt_NS.json

@@ -3,5 +3,8 @@
   "name": "Dircrypt_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:ransomware=\"DirCrypt\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Dyre.json

@@ -3,5 +3,8 @@
   "name": "Dyre",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Dyre\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Dyre_NS.json

@@ -3,5 +3,8 @@
   "name": "Dyre_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Dyre\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Fobber.json

@@ -3,5 +3,8 @@
   "name": "Fobber",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Fobber\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Fobber_NS.json

@@ -3,5 +3,8 @@
   "name": "Fobber_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Fobber\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Geodo.json

@@ -3,5 +3,9 @@
   "name": "Geodo",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:tool=\"Emotet\"",
+    "misp-galaxy:banker=\"Geodo\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Geodo_NS.json

@@ -3,5 +3,9 @@
   "name": "Geodo_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:tool=\"Emotet\"",
+    "misp-galaxy:banker=\"Geodo\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Gozi.json

@@ -3,5 +3,8 @@
   "name": "Gozi",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Gozi\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Gozi_NS.json

@@ -3,5 +3,8 @@
   "name": "Gozi_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Gozi\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Hesperbot.json

@@ -3,5 +3,8 @@
   "name": "Hesperbot",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:android=\"Hesperbot\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Hesperbot_NS.json

@@ -3,5 +3,8 @@
   "name": "Hesperbot_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:android=\"Hesperbot\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Kraken.json

@@ -3,5 +3,8 @@
   "name": "Kraken",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Kraken\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Kraken_NS.json

@@ -3,5 +3,8 @@
   "name": "Kraken_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Kraken\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Locky.json

@@ -3,5 +3,8 @@
   "name": "Locky",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:ransomware=\"Locky\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Locky_NS.json

@@ -3,5 +3,8 @@
   "name": "Locky_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:ransomware=\"Locky\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Madmax.json

@@ -3,5 +3,8 @@
   "name": "Madmax",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Madmax\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Madmax_NS.json

@@ -3,5 +3,8 @@
   "name": "Madmax_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Madmax\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Mirai.json

@@ -3,5 +3,9 @@
   "name": "Mirai",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Mirai\"",
+    "misp-galaxy:tool=\"Mirai\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Mirai_NS.json

@@ -3,5 +3,9 @@
   "name": "Mirai_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Mirai\"",
+    "misp-galaxy:tool=\"Mirai\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Murofet.json

@@ -3,5 +3,8 @@
   "name": "Murofet",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Licat\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Murofet_NS.json

@@ -3,5 +3,8 @@
   "name": "Murofet_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Licat\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Necurs.json

@@ -3,5 +3,8 @@
   "name": "Necurs",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:tool=\"Necurs\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Necurs_NS.json

@@ -3,5 +3,8 @@
   "name": "Necurs_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:tool=\"Necurs\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Nymaim.json

@@ -3,5 +3,8 @@
   "name": "Nymaim",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:tool=\"Nymaim\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Nymaim_NS.json

@@ -3,5 +3,8 @@
   "name": "Nymaim_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:tool=\"Nymaim\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Padcrypt.json

@@ -3,5 +3,8 @@
   "name": "Padcrypt",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:ransomware=\"PadCrypt\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Padcrypt_NS.json

@@ -3,5 +3,8 @@
   "name": "Padcrypt_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:ransomware=\"PadCrypt\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Pandabanker.json

@@ -3,5 +3,8 @@
   "name": "Pandabanker",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Panda Banker\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Pandabanker_NS.json

@@ -3,5 +3,8 @@
   "name": "Pandabanker_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Panda Banker\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Pushdo.json

@@ -3,5 +3,8 @@
   "name": "Pushdo",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Pushdo\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Pushdo_NS.json

@@ -3,5 +3,8 @@
   "name": "Pushdo_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Pushdo\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Qadars.json

@@ -3,5 +3,8 @@
   "name": "Qadars",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Qadars\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Qadars_NS.json

@@ -3,5 +3,8 @@
   "name": "Qadars_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Qadars\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Qakbot.json

@@ -3,5 +3,9 @@
   "name": "Qakbot",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:tool=\"Akbot\"",
+    "misp-galaxy:banker=\"Qakbot\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Qakbot_NS.json

@@ -3,5 +3,9 @@
   "name": "Qakbot_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:tool=\"Akbot\"",
+    "misp-galaxy:banker=\"Qakbot\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Ramnit.json

@@ -3,5 +3,9 @@
   "name": "Ramnit",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Ramnit\"",
+    "misp-galaxy:banker=\"Ramnit\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Ramnit_NS.json

@@ -3,5 +3,9 @@
   "name": "Ramnit_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Ramnit\"",
+    "misp-galaxy:banker=\"Ramnit\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Ranbyus.json

@@ -3,5 +3,8 @@
   "name": "Ranbyus",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Ranbyus\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Ranbyus_NS.json

@@ -3,5 +3,8 @@
   "name": "Ranbyus_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Ranbyus\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Shifu.json

@@ -3,5 +3,8 @@
   "name": "Shifu",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:tool=\"Shifu\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Shifu_NS.json

@@ -3,5 +3,8 @@
   "name": "Shifu_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:tool=\"Shifu\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Simda.json

@@ -3,5 +3,8 @@
   "name": "Simda",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Simda\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Simda_NS.json

@@ -3,5 +3,8 @@
   "name": "Simda_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Simda\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Sisron.json

@@ -3,5 +3,8 @@
   "name": "Sisron",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Sisron\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Sisron_NS.json

@@ -3,5 +3,8 @@
   "name": "Sisron_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Sisron\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Sphinx.json

@@ -3,5 +3,8 @@
   "name": "Sphinx",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Zeus Sphinx\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Sphinx_NS.json

@@ -3,5 +3,8 @@
   "name": "Sphinx_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Zeus Sphinx\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Tinba_TinyBanker.json

@@ -3,5 +3,9 @@
   "name": "Tinba_/_TinyBanker",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Tinba\"",
+    "misp-galaxy:tool=\"Tinba\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Tinba_TinyBanker_NS.json

@@ -3,5 +3,9 @@
   "name": "Tinba_/_TinyBanker_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"Tinba\"",
+    "misp-galaxy:tool=\"Tinba\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Tinynuke.json

@@ -3,5 +3,8 @@
   "name": "Tinynuke",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"TinyNuke\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Tinynuke_NS.json

@@ -3,5 +3,8 @@
   "name": "Tinynuke_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:banker=\"TinyNuke\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Tofsee.json

@@ -3,5 +3,8 @@
   "name": "Tofsee",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Gheg\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Tofsee_NS.json

@@ -3,5 +3,8 @@
   "name": "Tofsee_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Gheg\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Vawtrak.json

@@ -3,5 +3,9 @@
   "name": "Vawtrak",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:tool=\"Vawtrak\"",
+    "misp-galaxy:banker=\"Vawtrak\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Vawtrak_NS.json

@@ -3,5 +3,9 @@
   "name": "Vawtrak_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:tool=\"Vawtrak\"",
+    "misp-galaxy:banker=\"Vawtrak\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Virut.json

@@ -3,5 +3,8 @@
   "name": "Virut",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Virut\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Virut_NS.json

@@ -3,5 +3,8 @@
   "name": "Virut_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:botnet=\"Virut\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Volatile_Cedar_Explosive.json

@@ -3,5 +3,9 @@
   "name": "Volatile_Cedar_/_Explosive",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:threat-actor=\"Volatile Cedar\"",
+    "misp-galaxy:tool=\"Explosive\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_Volatile_Cedar_Explosive_NS.json

@@ -3,5 +3,9 @@
   "name": "Volatile_Cedar_/_Explosive_NS",
   "vendor": "bambenekconsulting",
   "impact": 3,
-  "parser": ".parsers.bambenekconsulting"
+  "parser": ".parsers.bambenekconsulting",
+  "tags": [
+    "misp-galaxy:threat-actor=\"Volatile Cedar\"",
+    "misp-galaxy:tool=\"Explosive\""
+  ]
 }

bgpranking/config/modules/bambenekconsulting_feeds.py

@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 # -*- coding: utf-8 -*-
 
 import json
@@ -6,34 +6,55 @@ import re
 import requests
 from bs4 import BeautifulSoup
 
+from pymispgalaxies import Clusters
+
+
+def find_tags(name):
+    if '/' in name:
+        to_search = name.split('/')
+    else:
+        to_search = [name]
+    tags = []
+    for name in to_search:
+        responses = c.search(name.strip(), return_tags=True)
+        for _, t in responses:
+            tags += t
+    return list(set(tags))
+
 
 def get_paths():
     root = 'http://osint.bambenekconsulting.com'
     r = requests.get(f'{root}/feeds/')
     soup = BeautifulSoup(r.text, 'html.parser')
-
     to_return = []
     for entry in soup.find_all('p'):
         name = entry.b.string
+        tags = find_tags(name)
         if name:
             for link in entry.find_all('a'):
                 if link.get('href').endswith('iplist.txt'):
                     path = link.get('href')
                     if link.get('href').endswith('nsiplist.txt'):
                         name = f'{name}_NS'
-                    to_return.append((name, f'{root}{path}'))
+                    to_return.append((name, f'{root}{path}', tags))
     return to_return
 
 
 def make_config(entry):
     name = entry[0].replace(' ', '_')
-    config = {'url': entry[1], 'name': name, 'vendor': 'bambenekconsulting', 'impact': 3, 'parser': '.parsers.bambenekconsulting'}
+    config = {'url': entry[1], 'name': name, 'vendor': 'bambenekconsulting',
+              'impact': 3, 'parser': '.parsers.bambenekconsulting'}
+    if len(entry) >= 3 and entry[2]:
+        config['tags'] = entry[2]
+    else:
+        print('No tags:', name)
     filename = re.sub('[^0-9a-zA-Z]+', '_', name)
     with open(f'bambenekconsulting_{filename}.json', 'w') as f:
         json.dump(config, f, indent=2)
 
 
 if __name__ == '__main__':
+    c = Clusters()
 
     for entry in get_paths():
         make_config(entry)

bgpranking/config/modules/module.schema

@@ -19,6 +19,13 @@
       },
       "parser": {
         "type": "string"
+      },
+      "tags": {
+        "type": "array",
+        "uniqueItems": true,
+        "items": {
+          "type": "string"
+        }
       }
   },
   "required": [

requirements.txt

@@ -5,3 +5,6 @@ git+https://github.com/jsommers/pytricia.git
 git+https://github.com/trbs/pid.git
 aiohttp
 requests
+
+git+https://github.com/MISP/PyTaxonomies
+git+https://github.com/MISP/PyMISPGalaxies.git