mirror of https://github.com/MISP/misp-galaxy
update 2 array
Thanat0s
parent
7265af6612
commit
a29a5afbe8
|
|
@ -1,149 +1,172 @@
|
||||||
{
|
{
|
||||||
"values": [
|
"values": [
|
||||||
{
|
{
|
||||||
"value" : "PlugX",
|
"value": "PlugX",
|
||||||
"description" : "Malware",
|
"description": "Malware",
|
||||||
"meta" : {
|
"meta": {
|
||||||
"refs" : [
|
"refs": [
|
||||||
"https://www.trendmicro.com/vinfo/us/threat-encyclopedia/web-attack/112/pulling-the-plug-on-plugx"
|
"https://www.trendmicro.com/vinfo/us/threat-encyclopedia/web-attack/112/pulling-the-plug-on-plugx"
|
||||||
],
|
],
|
||||||
"synonyms" : [
|
"synonyms": [
|
||||||
"Backdoor.FSZO-5117",
|
"Backdoor.FSZO-5117",
|
||||||
"Trojan.Heur.JP.juW@ayZZvMb",
|
"Trojan.Heur.JP.juW@ayZZvMb",
|
||||||
"Trojan.Inject1.6386",
|
"Trojan.Inject1.6386",
|
||||||
"Korplug",
|
"Korplug",
|
||||||
"Agent.dhwf"
|
"Agent.dhwf"
|
||||||
],
|
],
|
||||||
"type" : "rat"
|
"type": [
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"value" : "MSUpdater",
|
|
||||||
"description" : " Trojan (RAT) linked to current targeted attacks and others dating back to at least early 2009",
|
|
||||||
"meta" : {
|
|
||||||
"refs" : [
|
|
||||||
"https://www.zscaler.com/pdf/whitepapers/msupdater_trojan_whitepaper.pdfx"
|
|
||||||
],
|
|
||||||
"type" : "rat"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"value" : "Lazagne",
|
|
||||||
"description" : "A password sthealing tool regularly used by attackers",
|
|
||||||
"meta" : {
|
|
||||||
"refs" : [
|
|
||||||
"https://github.com/AlessandroZ/LaZagne"
|
|
||||||
],
|
|
||||||
"type" : "tool"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"value" : "Poison Ivy",
|
|
||||||
"description" : "Poison Ivy is a RAT which was freely available and first released in 2005.",
|
|
||||||
"meta" : {
|
|
||||||
"refs" : [
|
|
||||||
"https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-poison-ivy.pdf",
|
|
||||||
"https://www.f-secure.com/v-descs/backdoor_w32_poisonivy.shtml"
|
|
||||||
],
|
|
||||||
"synonyms" : [
|
|
||||||
"Backdoor.Win32.PoisonIvy",
|
|
||||||
"Gen:Trojan.Heur.PT"
|
|
||||||
],
|
|
||||||
"type" : "rat"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"value" : "SPIVY",
|
|
||||||
"description" : "In March 2016, Unit 42 observed this new Poison Ivy variant we’ve named SPIVY being deployed via weaponized documents leveraging CVE-2015-2545.",
|
|
||||||
"meta" : {
|
|
||||||
"refs" : [
|
|
||||||
"http://researchcenter.paloaltonetworks.com/2016/04/unit42-new-poison-ivy-rat-variant-targets-hong-kong-pro-democracy-activists/"
|
|
||||||
],
|
|
||||||
"type" :"rat"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"value" : "Torn RAT",
|
|
||||||
"meta" : {
|
|
||||||
"refs" : [
|
|
||||||
"https://www.crowdstrike.com/blog/whois-anchor-panda/"
|
|
||||||
],
|
|
||||||
"synonyms" : [
|
|
||||||
"Anchor Panda"
|
|
||||||
],
|
|
||||||
"type": "rat"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"value" : "OzoneRAT",
|
|
||||||
"meta" : {
|
|
||||||
"refs" : [
|
|
||||||
"https://blog.fortinet.com/2016/08/29/german-speakers-targeted-by-spam-leading-to-ozone-rat"
|
|
||||||
],
|
|
||||||
"synonyms" : [
|
|
||||||
"Ozone RAT",
|
|
||||||
"ozonercp"
|
|
||||||
],
|
|
||||||
"type" : [
|
|
||||||
"rat"
|
"rat"
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"value" : "ZeGhost",
|
"value": "MSUpdater",
|
||||||
"description" : "ZeGhots is a RAT which was freely available and first released in 2014.",
|
"description": " Trojan (RAT) linked to current targeted attacks and others dating back to at least early 2009",
|
||||||
"meta" : {
|
"meta": {
|
||||||
"refs" : [
|
"refs": [
|
||||||
|
"https://www.zscaler.com/pdf/whitepapers/msupdater_trojan_whitepaper.pdfx"
|
||||||
|
],
|
||||||
|
"type": [
|
||||||
|
"rat"
|
||||||
|
]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"value": "Lazagne",
|
||||||
|
"description": "A password sthealing tool regularly used by attackers",
|
||||||
|
"meta": {
|
||||||
|
"refs": [
|
||||||
|
"https://github.com/AlessandroZ/LaZagne"
|
||||||
|
],
|
||||||
|
"type": [
|
||||||
|
"tool"
|
||||||
|
]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"value": "Poison Ivy",
|
||||||
|
"description": "Poison Ivy is a RAT which was freely available and first released in 2005.",
|
||||||
|
"meta": {
|
||||||
|
"refs": [
|
||||||
|
"https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-poison-ivy.pdf",
|
||||||
|
"https://www.f-secure.com/v-descs/backdoor_w32_poisonivy.shtml"
|
||||||
|
],
|
||||||
|
"synonyms": [
|
||||||
|
"Backdoor.Win32.PoisonIvy",
|
||||||
|
"Gen:Trojan.Heur.PT"
|
||||||
|
],
|
||||||
|
"type": [
|
||||||
|
"rat"
|
||||||
|
]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"value": "SPIVY",
|
||||||
|
"description": "In March 2016, Unit 42 observed this new Poison Ivy variant we’ve named SPIVY being deployed via weaponized documents leveraging CVE-2015-2545.",
|
||||||
|
"meta": {
|
||||||
|
"refs": [
|
||||||
|
"http://researchcenter.paloaltonetworks.com/2016/04/unit42-new-poison-ivy-rat-variant-targets-hong-kong-pro-democracy-activists/"
|
||||||
|
],
|
||||||
|
"type": [
|
||||||
|
"rat"
|
||||||
|
]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"value": "Torn RAT",
|
||||||
|
"meta": {
|
||||||
|
"refs": [
|
||||||
|
"https://www.crowdstrike.com/blog/whois-anchor-panda/"
|
||||||
|
],
|
||||||
|
"synonyms": [
|
||||||
|
"Anchor Panda"
|
||||||
|
],
|
||||||
|
"type": [
|
||||||
|
"rat"
|
||||||
|
]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"value": "OzoneRAT",
|
||||||
|
"meta": {
|
||||||
|
"refs": [
|
||||||
|
"https://blog.fortinet.com/2016/08/29/german-speakers-targeted-by-spam-leading-to-ozone-rat"
|
||||||
|
],
|
||||||
|
"synonyms": [
|
||||||
|
"Ozone RAT",
|
||||||
|
"ozonercp"
|
||||||
|
],
|
||||||
|
"type": [
|
||||||
|
"rat"
|
||||||
|
]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"value": "ZeGhost",
|
||||||
|
"description": "ZeGhots is a RAT which was freely available and first released in 2014.",
|
||||||
|
"meta": {
|
||||||
|
"refs": [
|
||||||
"https://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Backdoor%3aWin32%2fZegost.BW"
|
"https://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Backdoor%3aWin32%2fZegost.BW"
|
||||||
],
|
],
|
||||||
"synonyms" : [
|
"synonyms": [
|
||||||
"BackDoor-FBZT!52D84425CDF2",
|
"BackDoor-FBZT!52D84425CDF2",
|
||||||
"Trojan.Win32.Staser.ytq",
|
"Trojan.Win32.Staser.ytq",
|
||||||
"Win32/Zegost.BW"
|
"Win32/Zegost.BW"
|
||||||
],
|
],
|
||||||
"type" : "rat"
|
"type": [
|
||||||
|
"rat"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"value" : "Elise Backdoor",
|
"value": "Elise Backdoor",
|
||||||
"description" : " Trojan (RAT) linked to current targeted attacks and others dating back to at least early 2009",
|
"description": " Trojan (RAT) linked to current targeted attacks and others dating back to at least early 2009",
|
||||||
"meta" : {
|
"meta": {
|
||||||
"refs" : [
|
"refs": [
|
||||||
"http://thehackernews.com/2015/08/elise-malware-hacking.html"
|
"http://thehackernews.com/2015/08/elise-malware-hacking.html"
|
||||||
],
|
],
|
||||||
"synonyms" : [
|
"synonyms": [
|
||||||
"Elise"
|
"Elise"
|
||||||
],
|
],
|
||||||
"type" : "dropper, stealer"
|
"type": [
|
||||||
|
"dropper",
|
||||||
|
"stealer"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"value" : "Trojan.Laziok",
|
"value": "Trojan.Laziok",
|
||||||
"description" : "A new information stealer, Trojan.Laziok, acts as a reconnaissance tool allowing attackers to gather information and tailor their attack methods for each compromised computer.",
|
"description": "A new information stealer, Trojan.Laziok, acts as a reconnaissance tool allowing attackers to gather information and tailor their attack methods for each compromised computer.",
|
||||||
"meta" : {
|
"meta": {
|
||||||
"refs" : [
|
"refs": [
|
||||||
"http://www.symantec.com/connect/blogs/new-reconnaissance-threat-trojanlaziok-targets-energy-sector"
|
"http://www.symantec.com/connect/blogs/new-reconnaissance-threat-trojanlaziok-targets-energy-sector"
|
||||||
],
|
],
|
||||||
"synonyms" : [
|
"synonyms": [
|
||||||
"Laziok"
|
"Laziok"
|
||||||
],
|
],
|
||||||
"type" : "stealer ,reco"
|
"type": [
|
||||||
|
"stealer",
|
||||||
|
"reco"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"value" : "Slempo",
|
"value": "Slempo",
|
||||||
"description" : "Android-based malware",
|
"description": "Android-based malware",
|
||||||
"meta" : {
|
"meta": {
|
||||||
"refs" : [
|
"refs": [
|
||||||
"https://securityintelligence.com/android-malware-about-to-get-worse-gm-bot-source-code-leaked/"
|
"https://securityintelligence.com/android-malware-about-to-get-worse-gm-bot-source-code-leaked/"
|
||||||
],
|
],
|
||||||
"synonyms" : [
|
"synonyms": [
|
||||||
"GM-Bot",
|
"GM-Bot",
|
||||||
"SlemBunk",
|
"SlemBunk",
|
||||||
"Bankosy",
|
"Bankosy",
|
||||||
"Acecard"
|
"Acecard"
|
||||||
],
|
],
|
||||||
"type" : "spyware, android"
|
"type": [
|
||||||
|
"spyware",
|
||||||
|
"android"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
|
|
@ -153,7 +176,7 @@
|
||||||
"refs": [
|
"refs": [
|
||||||
"http://researchcenter.paloaltonetworks.com/2016/04/unit42-python-based-pwobot-targets-european-organizations/"
|
"http://researchcenter.paloaltonetworks.com/2016/04/unit42-python-based-pwobot-targets-european-organizations/"
|
||||||
],
|
],
|
||||||
"synonyms" : [
|
"synonyms": [
|
||||||
"PWOLauncher",
|
"PWOLauncher",
|
||||||
"PWOHTTPD",
|
"PWOHTTPD",
|
||||||
"PWOKeyLogger",
|
"PWOKeyLogger",
|
||||||
|
|
@ -161,7 +184,11 @@
|
||||||
"PWOPyExec",
|
"PWOPyExec",
|
||||||
"PWOQuery"
|
"PWOQuery"
|
||||||
],
|
],
|
||||||
"type" : "dropper, coinminer, spyware"
|
"type": [
|
||||||
|
"dropper",
|
||||||
|
"miner",
|
||||||
|
"spyware"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
|
|
@ -175,7 +202,9 @@
|
||||||
"refs": [
|
"refs": [
|
||||||
"http://blog.trendmicro.com/trendlabs-security-intelligence/lost-door-rat-accessible-customizable-attack-tool/"
|
"http://blog.trendmicro.com/trendlabs-security-intelligence/lost-door-rat-accessible-customizable-attack-tool/"
|
||||||
],
|
],
|
||||||
"type": "rat"
|
"type": [
|
||||||
|
"rat"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
|
|
@ -188,7 +217,9 @@
|
||||||
"refs": [
|
"refs": [
|
||||||
"http://www.fidelissecurity.com/files/files/FTA_1009-njRAT_Uncovered_rev2.pdf"
|
"http://www.fidelissecurity.com/files/files/FTA_1009-njRAT_Uncovered_rev2.pdf"
|
||||||
],
|
],
|
||||||
"type": "rat"
|
"type": [
|
||||||
|
"rat"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
|
|
|
||||||
|
|
@ -74,7 +74,11 @@
|
||||||
"type": "string"
|
"type": "string"
|
||||||
},
|
},
|
||||||
"type": {
|
"type": {
|
||||||
|
"type": "array",
|
||||||
|
"uniqueItems": true,
|
||||||
|
"items": {
|
||||||
"type": "string"
|
"type": "string"
|
||||||
|
}
|
||||||
},
|
},
|
||||||
"impact": {
|
"impact": {
|
||||||
"type": "string"
|
"type": "string"
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue