MISP
/
misp-galaxy
mirror of https://github.com/MISP/misp-galaxy
2
0
Fork 0
Code Issues Releases Wiki Activity

add botnets to galaxy

pull/160/head
Deborah Servili 2018-02-27 16:04:23 +01:00
parent bfd74bb54d
commit 63f77a81ec
1 changed files with 481 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

481
clusters/botnet.json
View File

@ -8,6 +8,487 @@
"https://www.bleepingcomputer.com/news/security/android-devices-targeted-by-new-monero-mining-botnet/"
]
}
},
{
"value": "Bagle",
"description": "Bagle (also known as Beagle) was a mass-mailing computer worm affecting Microsoft Windows. The first strain, Bagle.A, did not propagate widely. A second variant, Bagle.B, was considerably more virulent.",
"meta": {
"refs": [
"https://en.wikipedia.org/wiki/Bagle_(computer_worm)"
],
"synonyms": [
"Beagle",
"Mitglieder",
"Lodeight"
],
"date": "2004"
}
},
{
"value": "Marina Botnet",
"description": "Around the same time Bagle was sending spam messages all over the world, the Marina Botnet quickly made a name for itself. With over 6 million bots pumping out spam emails every single day, it became apparent these “hacker tools” could get out of hand very quickly. At its peak, Marina Botnet delivered 92 billion spam emails per day.",
"meta": {
"refs": [
"https://en.wikipedia.org/wiki/Botnet"
],
"synonyms": [
"Damon Briant",
"BOB.dc",
"Cotmonger",
"Hacktool.Spammer",
"Kraken"
]
}
},
{
"value": "Torpig",
"description": "Torpig, also known as Anserin or Sinowal is a type of botnet spread through systems compromised by the Mebroot rootkit by a variety of trojan horses for the purpose of collecting sensitive personal and corporate data such as bank account and credit card information. It targets computers that use Microsoft Windows, recruiting a network of zombies for the botnet. Torpig circumvents antivirus software through the use of rootkit technology and scans the infected system for credentials, accounts and passwords as well as potentially allowing attackers full access to the computer. It is also purportedly capable of modifying data on the computer, and can perform man-in-the-browser attacks.",
"meta": {
"refs": [
"https://en.wikipedia.org/wiki/Torpig"
],
"synonyms": [
"Sinowal",
"Anserin"
],
"date": "2005"
}
},
{
"value": "Storm",
"description": "The Storm botnet or Storm worm botnet (also known as Dorf botnet and Ecard malware) is a remotely controlled network of \"zombie\" computers (or \"botnet\") that have been linked by the Storm Worm, a Trojan horse spread through e-mail spam. At its height in September 2007, the Storm botnet was running on anywhere from 1 million to 50 million computer systems, and accounted for 8% of all malware on Microsoft Windows computers. It was first identified around January 2007, having been distributed by email with subjects such as \"230 dead as storm batters Europe,\" giving it its well-known name. The botnet began to decline in late 2007, and by mid-2008, had been reduced to infecting about 85,000 computers, far less than it had infected a year earlier.",
"meta": {
"refs": [
"https://en.wikipedia.org/wiki/Storm_botnet"
],
"synonyms": [
"Nuwar",
"Peacomm",
"Zhelatin",
"Dorf",
"Ecard"
],
"date": "2007"
}
},
{
"value": "Rustock",
"meta": {
"refs": [
"https://en.wikipedia.org/wiki/Rustock_botnet"
],
"synonyms": [
"RKRustok",
"Costrat"
],
"date": "2006"
}
},
{
"value": "Donbot",
"meta": {
"refs": [
"https://en.wikipedia.org/wiki/Donbot_botnet"
],
"synonyms": [
"Buzus",
"Bachsoy"
]
}
},
{
"value": "Cutwail",
"description": "The Cutwail botnet, founded around 2007, is a botnet mostly involved in sending spam e-mails. The bot is typically installed on infected machines by a Trojan component called Pushdo.] It affects computers running Microsoft Windows. related to: Wigon, Pushdo",
"meta": {
"refs": [
"https://en.wikipedia.org/wiki/Cutwail_botnet"
],
"synonyms": [
"Pandex",
"Mutant"
],
"date": "2007"
}
},
{
"value": "Akbot",
"description": "Akbot was a computer virus that infected an estimated 1.3 million computers and added them to a botnet.",
"meta": {
"refs": [
"https://en.wikipedia.org/wiki/Akbot"
],
"date": "2007"
}
},
{
"value": "Srizbi",
"description": "Srizbi BotNet, considered one of the world's largest botnets, and responsible for sending out more than half of all the spam being sent by all the major botnets combined. The botnets consist of computers infected by the Srizbi trojan, which sent spam on command. Srizbi suffered a massive setback in November 2008 when hosting provider Janka Cartel was taken down; global spam volumes reduced up to 93% as a result of this action.",
"meta": {
"refs": [
"https://en.wikipedia.org/wiki/Srizbi_botnet"
],
"synonyms": [
"Cbeplay",
"Exchanger"
],
"date": "March 2007"
}
},
{
"value": "Lethic",
"description": "The Lethic Botnet (initially discovered around 2008) is a botnet consisting of an estimated 210 000 - 310 000 individual machines which are mainly involved in pharmaceutical and replica spam. At the peak of its existence the botnet was responsible for 8-10% of all the spam sent worldwide.",
"meta": {
"refs": [
"https://en.wikipedia.org/wiki/Lethic_botnet"
],
"date": "2008"
}
},
{
"value": "Xarvester",
"meta": {
"refs": [
"https://krebsonsecurity.com/tag/xarvester/"
],
"synonyms": [
"Rlsloup",
"Pixoliz"
]
}
},
{
"value": "Sality",
"description": "Sality is the classification for a family of malicious software (malware), which infects files on Microsoft Windows systems. Sality was first discovered in 2003 and has advanced over the years to become a dynamic, enduring and full-featured form of malicious code. Systems infected with Sality may communicate over a peer-to-peer (P2P) network for the purpose of relaying spam, proxying of communications, exfiltrating sensitive data, compromising web servers and/or coordinating distributed computing tasks for the purpose of processing intensive tasks (e.g. password cracking). Since 2010, certain variants of Sality have also incorporated the use of rootkit functions as part of an ongoing evolution of the malware family. Because of its continued development and capabilities, Sality is considered to be one of the most complex and formidable forms of malware to date.",
"meta": {
"refs": [
"https://en.wikipedia.org/wiki/Sality"
],
"synonyms": [
"Sector",
"Kuku",
"Sality",
"SalLoad",
"Kookoo",
"SaliCode",
"Kukacka"
],
"date": "2008"
}
},
{
"value": "Mariposa",
"description": "The Mariposa botnet, discovered December 2008, is a botnet mainly involved in cyberscamming and denial-of-service attacks. Before the botnet itself was dismantled on 23 December 2009, it consisted of up to 12 million unique IP addresses or up to 1 million individual zombie computers infected with the \"Butterfly (mariposa in Spanish) Bot\", making it one of the largest known botnets.",
"meta": {
"refs": [
"https://en.wikipedia.org/wiki/Mariposa_botnet"
],
"date": "2008"
}
},
{
"value": "Conficker",
"description": "Conficker, also known as Downup, Downadup and Kido, is a computer worm targeting the Microsoft Windows operating system that was first detected in November 2008. It uses flaws in Windows OS software and dictionary attacks on administrator passwords to propagate while forming a botnet, and has been unusually difficult to counter because of its combined use of many advanced malware techniques. The Conficker worm infected millions of computers including government, business and home computers in over 190 countries, making it the largest known computer worm infection since the 2003 Welchia.",
"meta": {
"refs": [
"https://en.wikipedia.org/wiki/Conficker"
],
"synonyms": [
"DownUp",
"DownAndUp",
"DownAdUp",
"Kido"
],
"date": "November 2008"
}
},
{
"value": "Waledac",
"description": "Waledac, also known by its aliases Waled and Waledpak, was a botnet mostly involved in e-mail spam and malware. In March 2010 the botnet was taken down by Microsoft.",
"meta": {
"refs": [
"https://en.wikipedia.org/wiki/Waledac_botnet"
],
"synonyms": [
"Waled",
"Waledpak"
],
"date": "November 2008"
}
},
{
"value": "Maazben",
"description": "A new botnet, dubbed Maazben, has also been observed and is also growing rapidly. MessageLabs Intelligence has been tracking the growth of Maazben since its infancy in late May and early June. Its dominance in terms of the proportion of spam has been accelerating in the last 30 days from just over 0.5% of all spam, peaking at 4.5% of spam when it is most active. Currently spam from Maazben accounts for approximately 1.4% of all spam, but this is likely to increase significantly over time, particularly since both overall spam per minute sent and spam per bot per minute are increasing.",
"meta": {
"refs": [
"https://www.symantec.com/connect/blogs/evaluating-botnet-capacity"
]
}
},
{
"value": "Onewordsub",
"meta": {
"refs": [
"https://www.botnets.fr/wiki/OneWordSub"
]
}
},
{
"value": "Gheg",
"description": "Tofsee, also known as Gheg, is another botnet analyzed by CERT Polska. Its main job is to send spam, but it is able to do other tasks as well. It is possible thanks to the modular design of this malware – it consists of the main binary (the one user downloads and infects with), which later downloads several additional modules from the C2 server – they modify code by overwriting some of the called functions with their own. An example of some actions these modules perform is spreading by posting click-bait messages on Facebook and VKontakte (Russian social network).",
"meta": {
"refs": [
"https://www.cert.pl/en/news/single/tofsee-en/"
],
"synonyms": [
"Tofsee",
"Mondera"
]
}
},
{
"value": "Nucrypt",
"meta": {
"refs": [
"https://www.botnets.fr/wiki.old/index.php?title=Nucrypt&setlang=en"
]
}
},
{
"value": "Wopla",
"meta": {
"refs": [
"https://www.botnets.fr/wiki.old/index.php/Wopla"
]
}
},
{
"value": "Asprox",
"description": "The Asprox botnet (discovered around 2008), also known by its aliases Badsrc and Aseljo, is a botnet mostly involved in phishing scams and performing SQL injections into websites in order to spread malware.",
"meta": {
"refs": [
"https://en.wikipedia.org/wiki/Asprox_botnet"
],
"synonyms": [
"Badsrc",
"Aseljo",
"Danmec",
"Hydraflux"
],
"date": "2008"
}
},
{
"value": "Spamthru",
"description": "Spam Thru represented an expontential jump in the level of sophistication and complexity of these botnets, harnessing a 70,000 strong peer to peer botnet seeded with the Spam Thru Trojan. Spam Thru is also known by the Aliases Backdoor.Win32.Agent.uu, Spam-DComServ and Troj_Agent.Bor. Spam Thru was unique because it had its own antivirus engine designed to remove any other malicious programs residing in the same infected host machine so that it can get unlimited access to the machine’s processing power as well as bandwidth. It also had the potential to be 10 times more productive than most other botnets while evading detection because of in-built defences.",
"meta": {
"refs": [
"http://www.root777.com/security/analysis-of-spam-thru-botnet/"
],
"synonyms": [
"Spam-DComServ",
"Covesmer",
"Xmiler"
]
}
},
{
"value": "Gumblar",
"description": "Gumblar is a malicious JavaScript trojan horse file that redirects a user's Google searches, and then installs rogue security software. Also known as Troj/JSRedir-R this botnet first appeared in 2009.",
"meta": {
"refs": [
"https://en.wikipedia.org/wiki/Gumblar"
],
"date": "2008"
}
},
{
"value": "BredoLab",
"description": "The Bredolab botnet, also known by its alias Oficla, was a Russian botnet mostly involved in viral e-mail spam. Before the botnet was eventually dismantled in November 2010 through the seizure of its command and control servers, it was estimated to consist of millions of zombie computers.",
"meta": {
"refs": [
"https://en.wikipedia.org/wiki/Bredolab_botnet"
],
"date": "May 2009",
"synonyms": [
"Oficla"
]
}
},
{
"value": "Grum",
"description": "The Grum botnet, also known by its alias Tedroo and Reddyb, was a botnet mostly involved in sending pharmaceutical spam e-mails. Once the world's largest botnet, Grum can be traced back to as early as 2008. At the time of its shutdown in July 2012, Grum was reportedly the world's 3rd largest botnet, responsible for 18% of worldwide spam traffic.",
"meta": {
"refs": [
"https://en.wikipedia.org/wiki/Grum_botnet"
],
"date": "2009",
"synonyms": [
"Tedroo",
"Reddyb"
]
}
},
{
"value": "Mega-D",
"description": "The Mega-D, also known by its alias of Ozdok, is a botnet that at its peak was responsible for sending 32% of spam worldwide.",
"meta": {
"refs": [
"https://en.wikipedia.org/wiki/Mega-D_botnet"
],
"synonyms": [
"Ozdok"
]
}
},
{
"value": "Kraken",
"description": "The Kraken botnet was the world's largest botnet as of April 2008. Researchers say that Kraken infected machines in at least 50 of the Fortune 500 companies and grew to over 400,000 bots. It was estimated to send 9 billion spam messages per day. Kraken botnet malware may have been designed to evade anti-virus software, and employed techniques to stymie conventional anti-virus software.",
"meta": {
"refs": [
"https://en.wikipedia.org/wiki/Kraken_botnet"
],
"synonyms": [
"Kracken"
]
}
},
{
"value": "Festi",
"description": "The Festi botnet, also known by its alias of Spamnost, is a botnet mostly involved in email spam and denial of service attacks.",
"meta": {
"refs": [
"https://en.wikipedia.org/wiki/Festi_botnet"
],
"date": "August 2009",
"synonyms": [
"Spamnost"
]
}
},
{
"value": "Vulcanbot",
"description": "Vulcanbot is the name of a botnet predominantly spread in Vietnam, apparently with political motives. It is thought to have begun in late 2009.",
"meta": {
"refs": [
"https://en.wikipedia.org/wiki/Vulcanbot"
],
"date": "March 2010"
}
},
{
"value": "LowSec",
"meta": {
"date": "January 2010",
"synonyms": [
"LowSecurity",
"FreeMoney",
"Ring0.Tools"
]
}
},
{
"value": "TDL4",
"description": "Alureon (also known as TDSS or TDL-4) is a trojan and bootkit created to steal data by intercepting a system's network traffic and searching for: banking usernames and passwords, credit card data, PayPal information, social security numbers, and other sensitive user data. Following a series of customer complaints, Microsoft determined that Alureon caused a wave of BSoDs on some 32-bit Microsoft Windows systems. The update, MS10-015,triggered these crashes by breaking assumptions made by the malware author(s).",
"meta": {
"refs": [
"https://en.wikipedia.org/wiki/Alureon#TDL-4"
],
"date": "2010",
"synonyms": [
"TDSS",
"Alureon"
]
}
},
{
"value": "Zeus",
"description": "Zeus, ZeuS, or Zbot is a Trojan horse malware package that runs on versions of Microsoft Windows. While it can be used to carry out many malicious and criminal tasks, it is often used to steal banking information by man-in-the-browser keystroke logging and form grabbing. It is also used to install the CryptoLocker ransomware. Zeus is spread mainly through drive-by downloads and phishing schemes. First identified in July 2007 when it was used to steal information from the United States Department of Transportation, it became more widespread in March 2009. In June 2009 security company Prevx discovered that Zeus had compromised over 74,000 FTP accounts on websites of such companies as the Bank of America, NASA, Monster.com, ABC, Oracle, Play.com, Cisco, Amazon, and BusinessWeek. Similarly to Koobface, Zeus has also been used to trick victims of tech support scams into giving the scam artists money through pop-up messages that claim the user has a virus, when in reality they might have no viruses at all. The scammers may use programs such as Command prompt or Event viewer to make the user believe that their computer is infected.",
"meta": {
"refs": [
"https://en.wikipedia.org/wiki/Zeus_(malware)"
],
"synonyms": [
"Zbot",
"ZeuS",
"PRG",
"Wsnpoem",
"Gorhax",
"Kneber"
]
}
},
{
"value": "Kelihos",
"description": "The Kelihos botnet, also known as Hlux, is a botnet mainly involved in spamming and the theft of bitcoins.",
"meta": {
"refs": [
"https://en.wikipedia.org/wiki/Kelihos_botnet"
],
"date": "2010",
"synonyms": [
"Hlux"
]
}
},
{
"value": "Ramnit",
"description": "Ramnit is a Computer worm affecting Windows users. It was estimated that it infected 800 000 Windows PCs between September and December 2011. The Ramnit botnet was dismantled by Europol and Symantec securities in 2015. In 2015, this infection was estimated at 3 200 000 PCs.",
"meta": {
"refs": [
"https://en.wikipedia.org/wiki/Botnet"
],
"date": "2011"
}
},
{
"value": "Zer0n3t",
"meta": {
"date": "2013",
"synonyms": [
"Fib3rl0g1c",
"Zer0n3t",
"Zer0Log1x"
]
}
},
{
"value": "Chameleon",
"description": "The Chameleon botnet is a botnet that was discovered on February 28, 2013 by the security research firm, spider.io. It involved the infection of more than 120,000 computers and generated, on average, 6 million US dollars per month from advertising traffic. This traffic was generated on infected systems and looked to advertising parties as regular end users which browsed the Web, because of which it was seen as legitimate web traffic. The affected computers were all Windows PCs with the majority being private PCs (residential systems).",
"meta": {
"refs": [
"https://en.wikipedia.org/wiki/Chameleon_botnet"
],
"date": "2012"
}
},
{
"value": "Mirai",
"description": "Mirai (Japanese for \"the future\", 未来) is a malware that turns networked devices running Linux into remotely controlled \"bots\" that can be used as part of a botnet in large-scale network attacks. It primarily targets online consumer devices such as IP cameras and home routers. The Mirai botnet was first found in August 2016 by MalwareMustDie, a whitehat malware research group, and has been used in some of the largest and most disruptive distributed denial of service (DDoS) attacks, including an attack on 20 September 2016 on computer security journalist Brian Krebs's web site, an attack on French web host OVH, and the October 2016 Dyn cyberattack.",
"meta": {
"refs": [
"https://en.wikipedia.org/wiki/Mirai_(malware)"
],
"date": "August 2016"
}
},
{
"value": "Satori",
"description": "According to a report Li shared with Bleeping Computer today, the Mirai Satori variant is quite different from all previous pure Mirai variants.Previous Mirai versions infected IoT devices and then downloaded a Telnet scanner component that attempted to find other victims and infect them with the Mirai bot.The Satori variant does not use a scanner but uses two embedded exploits that will try to connect to remote devices on ports 37215 and 52869.Effectively, this makes Satori an IoT worm, being able to spread by itself without the need for separate components.",
"meta": {
"refs": [
"https://www.bleepingcomputer.com/news/security/satori-botnet-has-sudden-awakening-with-over-280-000-active-bots/",
"https://blog.fortinet.com/2017/12/12/rise-of-one-more-mirai-worm-variant"
],
"synonyms": [
"Okiru"
]
}
},
{
"value": "BetaBot",
"meta": {
"date": "April 2017"
}
}
],
"name": "Botnet",