MISP
/
misp-galaxy
mirror of https://github.com/MISP/misp-galaxy
2
0
Fork 0
Code Issues Releases Wiki Activity

Updated 

Blaze <-> Terror - Updated Sundown and Nebula status
pull/40/head
Kafeine 2017-04-14 13:44:03 +01:00 committed by GitHub
parent 1ed0558c07
commit 777fc1cde3
1 changed files with 36 additions and 32 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

68
clusters/exploit-kit.json
View File

@ -15,14 +15,15 @@
}
}
,
{ "value": "Blaze EK",
"description": "Blaze EK is a rebranding of Terror EK built on Hunter EK code",
{ "value": "Terror EK",
"description": "Terror EK is a rebranding of Terror EK built on Hunter EK code",
"meta": {
"refs": [
"https://www.trustwave.com/Resources/SpiderLabs-Blog/Terror-Exploit-Kit--More-like-Error-Exploit-Kit/"
],
"synonyms": [
"Terror EK"
"Blaze EK",
"Neptune EK"
]
,
"status": "Active"
@ -111,16 +112,6 @@
"status": "Active"
}
}
,
{ "value": "Nebula",
"description": "Nebula Exploit Kit has been built on Sundown source and features an internal TDS",
"meta": {
"refs": [
"http://malware.dontneedcoffee.com/2017/03/nebula-exploit-kit.html"
],
"status": "Active"
}
}
,
{ "value": "Neutrino",
"description": "Neutrino Exploit Kit has been one of the major exploit kit from its launch in 2013 till september 2016 when it become private (defense name for this variation is Neutrino-v). This EK vanished from march 2014 till november 2014.",
@ -179,7 +170,7 @@
"synonyms": [
"Sundown-b"
],
"status": "Active"
"status": "Retired"
}
},
{
@ -195,23 +186,6 @@
"status": "Active"
}
},
{
"value": "Sundown",
"description": "Sundown Exploit Kit is mainly built out of stolen code from other exploit kits",
"meta": {
"refs": [
"http://malware.dontneedcoffee.com/2015/06/fast-look-at-sundown-ek.html",
"https://www.virusbulletin.com/virusbulletin/2015/06/beta-exploit-pack-one-more-piece-crimeware-infection-road"
],
"synonyms": [
"Beps",
"Xer",
"Beta"
],
"status": "Active",
"colour": "#C03701"
}
},
{
"value": "Angler",
"description": "The Angler Exploit Kit has been the most popular and evolved exploit kit from 2014 to middle of 2016. There was several variation. The historical \"indexm\" variant was used to spread Lurk. A vip version used notabily to spread Poweliks, the \"standard\" commercial version, and a declinaison tied to load selling (mostly bankers) that can be associated to EmpirePPC",
@ -410,6 +384,16 @@
"status": "Unknown - Last seen: 2014-03"
}
},
{ "value": "Nebula",
"description": "Nebula Exploit Kit has been built on Sundown source and features an internal TDS",
"meta": {
"refs": [
"http://malware.dontneedcoffee.com/2017/03/nebula-exploit-kit.html"
],
"status": "Retired - Last seen 2017-03-09"
}
}
,
{
"value": "Niteris",
"description": "Niteris was used mainly to target Russian.",
@ -489,7 +473,27 @@
],
"status": "Retired - Last seen: 2013-09"
}
},
}
,
{
"value": "Sundown",
"description": "Sundown Exploit Kit is mainly built out of stolen code from other exploit kits",
"meta": {
"refs": [
"http://malware.dontneedcoffee.com/2015/06/fast-look-at-sundown-ek.html",
"https://www.virusbulletin.com/virusbulletin/2015/06/beta-exploit-pack-one-more-piece-crimeware-infection-road"
],
"synonyms": [
"Beps",
"Xer",
"Beta"
],
"status": "Retired - Last seen 2017-03-08",
"colour": "#C03701"
}
}
,
{
"value": "Sweet-Orange",
"description": "Sweet Orange",