From f196bad4a148435dfc18d9d8b95c838842a9a437 Mon Sep 17 00:00:00 2001
From: Deborah Servili <deborah.servili@gmail.com>
Date: Wed, 12 Feb 2020 15:39:16 +0100
Subject: [PATCH] add tools used by TA505 + others

---
 clusters/backdoor.json   | 11 ++++++++++-
 clusters/ransomware.json | 15 ++++++++++++++-
 clusters/tool.json       | 15 ++++++++++++++-
 3 files changed, 38 insertions(+), 3 deletions(-)

diff --git a/clusters/backdoor.json b/clusters/backdoor.json
index ac2cc9b7..70de6660 100644
--- a/clusters/backdoor.json
+++ b/clusters/backdoor.json
@@ -90,7 +90,16 @@
       },
       "uuid": "b7ad60a0-d648-4775-adec-c78b1a92fc34",
       "value": "Asruex"
+    },
+    {
+      "meta": {
+        "refs": [
+          "https://securityintelligence.com/news/ta505-delivers-new-gelup-malware-tool-flowerpippi-backdoor-via-spam-campaign/"
+        ]
+      },
+      "uuid": "aefe3603-8f96-425c-9f71-9fe21334f224",
+      "value": "FlowerPippi"
     }
   ],
-  "version": 6
+  "version": 7
 }
diff --git a/clusters/ransomware.json b/clusters/ransomware.json
index 550d0b04..238e8607 100644
--- a/clusters/ransomware.json
+++ b/clusters/ransomware.json
@@ -13696,7 +13696,20 @@
       },
       "uuid": "000fb0bf-8be3-4ff1-8bbd-cc0513bcdd89",
       "value": "RobinHood"
+    },
+    {
+      "description": "Bart ransomware is distributed by the same Russian Cyber Mafia behind Dridex 220 and Locky.  Bart doesn't communicate with a command and control (C&C) server, so it can encrypt files without being connected to a computer.\nBart is spread to end users via phishing emails containing .zip attachments with JavaScript Code and use social engineering to trick users into opening the 'photo' attachments. The zipped files are obfuscated to make it more hard to tell what actions they are performing. See screenshot above for an example of what they look like. If opened, these attachments download and install the intermediary loader RockLoader which downloads Bart onto the machine over HTTPS.\nOnce executed, it will first check the language on the infected computer. If the malware detects Russian, Belorussian, or Ukrainian, the ransomware will terminate and will not proceed with the infection. If it's any other language, it will start scanning the computer for certain file extensions to encrypt.\nBecause Bart does not require communication with C&C infrastructure prior to encrypting files, Bart could possibly encrypt machines sitting behind corporate firewalls that would otherwise block such traffic. Thus, organizations need to ensure that Bart is blocked at the email gateway using rules that block zipped executables.",
+      "meta": {
+        "refs": [
+          "https://www.knowbe4.com/bart-ransomware"
+        ],
+        "synonyms": [
+          "Locky Bart"
+        ]
+      },
+      "uuid": "05d5263f-ec23-4279-bb98-55fc233d7e89",
+      "value": "Bart ransomware"
     }
   ],
-  "version": 79
+  "version": 80
 }
diff --git a/clusters/tool.json b/clusters/tool.json
index cb02fa61..19c1e7d7 100644
--- a/clusters/tool.json
+++ b/clusters/tool.json
@@ -7965,7 +7965,20 @@
       },
       "uuid": "e537e165-ea8b-4e75-8813-6519632d3f6a",
       "value": "LiquorBot"
+    },
+    {
+      "description": "Written in C++ and designed to function as a downloader of other malware, Gelup stood out for its obfuscation techniques. Gelup can also bypass User Account Control (UAC) by mocking trusted directories, abusing auto-elevated executables and using the Dynamic Link Library (DLL) side-loading technique.",
+      "meta": {
+        "refs": [
+          "https://securityintelligence.com/news/ta505-delivers-new-gelup-malware-tool-flowerpippi-backdoor-via-spam-campaign/"
+        ],
+        "synonyms": [
+          "AndroMut"
+        ]
+      },
+      "uuid": "32a6065c-4f4e-4a60-8717-5872b5f21ac4",
+      "value": "Gelup malware tool"
     }
   ],
-  "version": 132
+  "version": 133
 }