MISP
/
misp-galaxy
mirror of https://github.com/MISP/misp-galaxy
2
0
Fork 0
Code Issues Releases Wiki Activity
1,217 Commits
6 Branches
47 Tags
65 MiB
Commit Graph

716 Commits (11a27df82db83d1076fd194dc5ff014a8f85cad1)

Author SHA1 Message Date
Deborah Servili 225ce1f3ee New galaxy Branded Vulnerability 2018-01-09 09:02:29 +01:00
Alexandre Dulaunoy 63b72cdade
add in preventive measures: blacklisting phone numbers 2017-12-28 13:28:49 +01:00
Deborah Servili 9b23956c37 jqallthethings 2017-12-22 10:47:06 +01:00
Deborah Servili d6b16b2177 update Sofacy tools 2017-12-22 10:46:18 +01:00
Deborah Servili f737b7fe0a modify SedKit description 2017-12-22 10:08:54 +01:00
Deborah Servili e787efce72 add SedKit 2017-12-22 10:05:52 +01:00
Deborah Servili 51a4868a3f add "Power"tools 2017-12-21 11:18:32 +01:00
Deborah Servili 56d5ab9afa add satori (Mirai Variant) 2017-12-20 11:25:06 +01:00
Deborah Servili 9aa073a1c4 add PRILEX & CUTLET MAKER 2017-12-19 15:38:33 +01:00
Deborah Servili eb9a49df81 add GratefulPOS 2017-12-19 12:17:42 +01:00
Deborah Servili a9e5cff50f update Android galaxy 2017-12-19 08:56:39 +01:00
Deborah Servili 5f731a428d add source for NewCore RAT 2017-12-18 14:29:34 +01:00
Deborah Servili db8ae5fbfe update OilRig threat actor 2017-12-18 09:26:15 +01:00
Deborah Servili 91e2d56d4d add file spider ransomware 2017-12-15 10:21:23 +01:00
Deborah Servili cfaadb0c71 add OSX.Pirrit 2017-12-15 09:57:39 +01:00
Alexandre Dulaunoy d767e43669
TRISIS is the main name of TRITON as discussed in https://twitter.com/DragosInc/status/941355602512613381 2017-12-14 18:56:36 +01:00
Alexandre Dulaunoy 90e37eb272
TRITON added 2017-12-14 17:13:18 +01:00
Deborah Servili 901d624a52 add SSHDoor 2017-12-14 11:37:05 +01:00
Deborah Servili a2deaed935 add cryptomix variant 2017-12-14 10:58:29 +01:00
Deborah Servili 8836dfdc16 add Quant Loader 2017-12-13 15:51:24 +01:00
Deborah Servili e891373ce8 Add MoneyTaker 2017-12-13 15:15:57 +01:00
Deborah Servili 5cac510818 update threat actor galaxy 2017-12-13 14:57:38 +01:00
Deborah Servili e4d95b9ce8
Merge pull request #133 from Delta-Sierra/master 
add source for BankBot
 2017-12-11 10:39:31 +01:00
Deborah Servili 2c5a116ed5 add source for BankBot 2017-12-11 10:25:41 +01:00
Alexandre Dulaunoy c2e2093f29
Merge branch 'master' of https://github.com/Delta-Sierra/misp-galaxy into Delta-Sierra-master 2017-12-10 10:23:37 +01:00
Alexandre Dulaunoy 2578daabf6
merge conflict solved - wp-vcd added 2017-12-10 10:19:17 +01:00
Alexandre Dulaunoy 5f34b618f8
StrongPity2 added 2017-12-10 09:24:32 +01:00
Deborah Servili 16398ed750 jq 2017-12-08 15:48:59 +01:00
Deborah Servili 12e0af9fa2 add malware/ransomwares 2017-12-08 15:45:44 +01:00
Deborah Servili 8531d4e299 add SLocker 2017-12-07 14:26:41 +01:00
Deborah Servili f1b4cab10b add HC7 ransomware 2017-12-07 11:25:08 +01:00
Deborah Servili 3023039956 add StorageCrypt Ransomware 2017-12-06 12:34:17 +01:00
Deborah Servili d887659e51 add Halloware ransomware 2017-12-05 09:47:50 +01:00
Deborah Servili c2b49e5ecd update cryptomix 2017-12-04 12:21:21 +01:00
Alexandre Dulaunoy 57b7b5baff
add: Tizi malware added 2017-12-03 07:33:19 +01:00
Deborah Servili 695d580d3c add UBoatRAT 2017-11-29 10:09:39 +01:00
Deborah Servili a46903b8dd update ROKRAT 2017-11-28 14:01:06 +01:00
Deborah Servili 1cb62212ca cryptomix - update 2017-11-22 13:46:50 +01:00
Deborah Servili 1bd8293901 add IcedID banker 2017-11-22 11:38:35 +01:00
Deborah Servili a7d117781b cryptomix - add ransomnotes 2017-11-21 14:24:46 +01:00
Deborah Servili bd940d45ad cryptomix - merge duplicates and update 2017-11-21 14:16:41 +01:00
Deborah Servili 6f79153169 add Ordinypt 2017-11-21 12:13:38 +01:00
Deborah Servili ff3cb27a3b jq 2017-11-20 12:33:47 +01:00
Deborah Servili 632f030b28 update tool galaxy 2017-11-20 12:32:35 +01:00
steffenenders 96749fd350
Fixed mixed up description/value for MuddyWater 2017-11-19 19:23:10 +01:00
Deborah Servili e2dbd5a9a3 add MuddyWater + Update HIDDEN COBRA and update its tools 2017-11-17 15:41:44 +01:00
Deborah Servili 24e4b15156 add Silence Trojan 2017-11-14 16:20:08 +01:00
Deborah Servili 09bab156c7 update version number 2017-11-09 12:30:32 +01:00
Deborah Servili 2ed39f3cee Fix typo - Spaaaace~ 2017-11-09 09:39:45 +01:00
Deborah Servili 880c74f469 add ALMA Communicator 2017-11-09 09:25:16 +01:00
Deborah Servili 3369270bdb add Sowbug group 2017-11-08 15:05:37 +01:00
Deborah Servili 5ee2001391 update Falismus RAT 2017-11-08 11:34:55 +01:00
Fredrik Borg 72d8bfc28a fix-iso-code-3 2017-11-07 14:15:40 +01:00
Fredrik Borg afc4972e25 fix iso codes 2017-11-07 14:04:04 +01:00
Fredrik Borg 53a6a8d26f remove duplicate references 2017-11-07 13:34:44 +01:00
Siri Bromander bf0d1d27ca Updated with data from APT Groups and Operations 2017-11-07 11:07:23 +01:00
Fredrik Borg 26192bf39a Bump version number 2017-11-01 18:14:20 +01:00
Fredrik Borg 51f86d5382 Use standard (2 digits) ISO codes for all countries 2017-11-01 12:38:21 +01:00
Raphaël Vinot aa93b0e61d Update banker galaxy 2017-10-27 11:10:26 -04:00
Raphaël Vinot 756af14983 Merge branch 'master' of github.com:MISP/misp-galaxy 2017-10-27 10:50:58 -04:00
Raphaël Vinot eef988e9ad Cosmetic updates 2017-10-27 10:50:47 -04:00
Deborah Servili 7246746bbe add htpRAT 2017-10-27 15:50:22 +02:00
Deborah Servili 2fefd3810d add dimnie 2017-10-27 11:42:01 +02:00
Deborah Servili ad9fff6c3f Merge pull request #103 from Delta-Sierra/master 
add Formbook
 2017-10-27 10:40:00 +02:00
Deborah Servili 2533c1b54e fix typo 2017-10-27 10:33:58 +02:00
Deborah Servili 5597e5af1c add Formbook 2017-10-27 10:30:21 +02:00
Raphaël Vinot 24e7d89ac9 Deduplicate Android cluster 2017-10-26 19:00:57 -04:00
Raphaël Vinot 40e26a59f1 Merge branch 'master' of github.com:MISP/misp-galaxy 2017-10-26 18:54:56 -04:00
Raphaël Vinot 6d0952e4ed Add android and banker galaxies 2017-10-26 18:53:01 -04:00
Alexandre Dulaunoy aed963c52d Merge pull request #102 from Delta-Sierra/master 
delete x_ prefix from mitre_attack_pattern
 2017-10-26 10:36:02 +02:00
Deborah Servili 709b78c2de jq 2017-10-26 10:28:53 +02:00
Deborah Servili 3a41799542 add galaxy icon to mitre-cti tools & regenerate galaxies 2017-10-26 10:28:05 +02:00
Deborah Servili fa8c4ec839 delete x_ prefix from mitre_attack_pattern 2017-10-26 09:44:23 +02:00
Raphaël Vinot 72dbbb28fa Remove the executable flag from the json files, again 2017-10-25 12:29:16 -04:00
Raphaël Vinot c6f9c5261c Merge branch 'master' of github.com:MISP/misp-galaxy 2017-10-25 12:28:01 -04:00
Raphaël Vinot 196f0a7ac8 Remove the executable flag from the json files 2017-10-25 12:25:36 -04:00
Deborah Servili 6aee8e41fd add BadRabbit ransomware 2017-10-25 09:28:03 +02:00
Deborah Servili 5b7e2de87a add cert EU govsectors galaxy 2017-10-24 11:15:05 +02:00
Alexandre Dulaunoy ce0f4d5e4a
SOCKET23 RAT added 2017-10-21 15:14:42 +02:00
Alexandre Dulaunoy 3860b1a78a
JadeRAT added 2017-10-21 13:53:40 +02:00
Deborah Servili 814c19841f jq 2017-10-20 15:32:01 +02:00
Deborah Servili 2fd3d3221d add IoT_reaper 2017-10-20 15:09:20 +02:00
Deborah Servili a6d5383adf add synonym in tool galaxy 2017-10-18 15:43:12 +02:00
Deborah Servili aa5e823801 add sectors galaxy 2017-10-11 09:52:33 +02:00
Deborah Servili fa723b6e90 add lukitus ransomnote to Locky 2017-10-04 09:32:55 +02:00
Deborah Servili 671d7ea456 add lukitus extension to Locky 2017-10-04 09:22:53 +02:00
Deborah Servili fa5cb66a84 fix typo 2017-10-04 08:38:12 +02:00
Deborah Servili 13f0b95654 add year of apparition for Rats + fixing some typos 2017-10-03 16:26:58 +02:00
Deborah Servili 4f73184818 jq 2017-09-29 17:02:12 +02:00
Deborah Servili b33014e0dd add Remote Access/Administration Tools 2017-09-29 16:59:25 +02:00
Daniel Plohmann 02710714bd add APT33 as identified by FireEye 2017-09-29 11:43:38 +02:00
Deborah Servili fecfdd39f3 add Adwind RAT synonyms 2017-09-25 15:18:51 +02:00
Deborah Servili 38f9d2cbfd Fix typo 2017-09-20 10:00:27 +02:00
Deborah Servili c282899db7 add SyncCrypt Ransomwar 2017-09-06 15:23:27 +02:00
Deborah Servili bba45c7fe6 add SynAck Ransomware ransomnote's name 2017-09-06 14:00:00 +02:00
Deborah Servili 5e11faaa92 add SynAck Ransomware 2017-09-06 13:45:24 +02:00
Deborah Servili d07d4fbfa7 fix typo~ 2017-09-06 10:04:57 +02:00
Deborah Servili da5b1d2ed3 add tools and rat 2017-09-06 09:51:52 +02:00
Raphaël Vinot 568557c1af JQ all the things. 2017-08-30 10:08:35 +02:00
Alexandre Dulaunoy 381b608900
Fixed with jq ;-) 2017-08-30 10:04:19 +02:00
Kafeine 4b94d36d2e Merge branch 'master' into master 2017-08-29 12:41:33 +01:00
Kafeine ee3e2b3a14 +WhiteHole +ref for Disdain 2017-08-29 10:36:38 +01:00
Deborah Servili a2035e5840 add ransomwares 2017-08-28 11:14:27 +02:00
Deborah Servili 15ce9fb85d add fireball malware 2017-08-24 16:10:17 +02:00
Deborah Servili 63b7e62de5 add Joao malware 2017-08-24 08:49:42 +02:00
Alexandre Dulaunoy 760f863f8a
EngineBox malware added 2017-08-19 09:38:45 +02:00
Deborah Servili ad22bafdba jq 2017-08-17 15:54:44 +02:00
Deborah Servili 91cd3a6eec update mitre galaxies 2017-08-17 15:53:41 +02:00
iglocska cf780290be Fixed some issues with a misnamed galaxy 2017-08-16 21:40:05 +02:00
Deborah Servili 7e391e8a39 version is integer 2017-08-16 15:23:58 +02:00
Deborah Servili 7cb372bdb5 put uuid as meta 2017-08-16 15:13:18 +02:00
Deborah Servili 447bfe93f3 new generation of mitre galaxies 2017-08-16 12:37:07 +02:00
Deborah Servili fb5560f927 add mitre based galaxies 2017-08-16 12:17:00 +02:00
Deborah Servili d29fb670c0 fix space typo 2017-08-16 10:50:12 +02:00
Kafeine bde18d917f +disdain+captainblack-Neutrino 2017-08-15 20:53:41 +02:00
Deborah Servili 693ea7e58a type is array -shh I'm bad with the format, I know 2017-08-08 15:00:06 +02:00
Deborah Servili 6d7ec00907 type is meta 2017-08-08 12:44:37 +02:00
Deborah Servili fa813f0f20 jq~ 2017-08-08 12:40:35 +02:00
Deborah Servili d6a4e3a5a0 add/update tool galaxy 2017-08-08 12:37:14 +02:00
Deborah Servili 4482e198a0 add GlobeImposter synonym 2017-08-08 08:50:36 +02:00
Raphaël Vinot 3b7ad8ea8c Merge pull request #75 from Delta-Sierra/master 
add svpeng tool
 2017-08-02 11:21:24 +02:00
Deborah Servili ca58a2f8b4 jq 2017-08-02 11:16:21 +02:00
Daniel Plohmann 355a230182 added FIN7 as alias for anunak 2017-08-01 13:29:57 +02:00
Daniel Plohmann b4e49823dd merged barium into axiom (only one redundant reference given) 2017-08-01 13:13:56 +02:00
Deborah Servili 8573d28493 Merge branch 'master' into master 2017-08-01 10:18:18 +02:00
Deborah Servili c8fa7a919f try to merge 'CowerSnail added' 2017-08-01 10:04:25 +02:00
Deborah Servili 52cd886ceb add svpeng tool 2017-08-01 09:44:38 +02:00
Alexandre Dulaunoy fda915f2f6
CowerSnail added 2017-07-30 18:46:20 +02:00
Raphaël Vinot 81d304345f Remove duplicates 2017-07-26 14:57:14 +02:00
Raphaël Vinot 282c3a8101 Merge pull request #74 from Delta-Sierra/master 
adding clusters based on MISP data
 2017-07-26 11:41:00 +02:00
Deborah Servili 497ecc396a clean tool.json 2017-07-26 09:41:08 +02:00
Deborah Servili 7e59f14dca update Spring Dragon threat actor 2017-07-26 09:21:36 +02:00
Raphaël Vinot c971b8e935 Add missing name XtremeRAT 2017-07-25 20:24:00 +02:00
Raphaël Vinot 8598210895 Remove empty string. 2017-07-25 18:02:11 +02:00
Raphaël Vinot a2567a9fc3 Remove duplicates 2017-07-25 13:12:48 +02:00
Deborah Servili a6eb7338b3 adding clusters based on MISP data 2017-07-19 16:25:46 +02:00
Kafeine a39dde6dba Update exploit-kit.json 2017-07-13 09:33:23 +01:00
Alexandre Dulaunoy 3b13a9101c Merge branch 'master' of github.com:MISP/misp-galaxy 2017-07-08 10:16:29 +02:00
Alexandre Dulaunoy a295d40589 Cobalt gang added 2017-07-08 10:16:11 +02:00
Alexandre Dulaunoy 4177bf150c Merge pull request #73 from Delta-Sierra/master 
add cerber synonym
 2017-06-30 10:45:06 +02:00
Deborah Servili a2bc1e97de add cerber synonym 2017-06-30 10:03:57 +02:00
Alexandre Dulaunoy c0786dfb22 El Machete added 2017-06-26 11:44:46 +02:00
Deborah Servili c12009921a add synonym for ammyyadmin 2017-06-21 11:02:57 +02:00
Deborah Servili d01cfb8d1e Add SOREBRECT ransomware 2017-06-21 08:56:03 +02:00
Alexandre Dulaunoy dd2a51037a jq all ;-) 2017-06-20 20:34:04 +02:00
Jaime f92b9cb710 Added FIN8 actor 2017-06-20 11:28:32 -07:00
Deborah Servili aa25157403 alwaaays moooore RAT 2017-06-20 12:26:16 +02:00
Deborah Servili 5f5b71aa93 add rats from https://www.lifewire.com/free-remote-access-software-tools-2625161 2017-06-20 11:16:36 +02:00
Deborah Servili 57f6c2414d add rats 2017-06-20 09:19:19 +02:00
Alexandre Dulaunoy 951ed3b9ed jq 2017-06-16 22:18:51 +02:00
Alexandre Dulaunoy 3219d5de5c Merge pull request #67 from Delta-Sierra/master 
add some rats and tools
 2017-06-16 22:18:14 +02:00
Deborah Servili 91cf7b4cee add some rats sand tools 2017-06-16 15:34:20 +02:00
David André 3dfbb7e1d0 Added Symantec alias for sofacy 2017-06-16 11:22:17 +02:00
danielplohmann 5724f19873 Merge branch 'master' into hidden-cobra-lazarus 2017-06-15 14:13:50 +02:00
Daniel Plohmann (jupiter) f7963c9a8c added Hidden Cobra as alias for Lazarus Group 2017-06-15 14:09:29 +02:00
Daniel Plohmann ff4f428bc1 added ELECTRUM to threat-actor.json (afaik not confirmed as an alias atm) 2017-06-13 13:25:16 +02:00
Daniel Plohmann 9924a8875c added PLATINUM to threat-actor.json (afaik not confirmed as an alias atm) 2017-06-13 13:21:10 +02:00
Deborah Servili e95b0fb6e1 Merge https://github.com/MISP/misp-galaxy 2017-06-09 09:06:23 +02:00
Deborah Servili 0755e11c02 update rat 2017-06-09 09:01:33 +02:00
Alexandre Dulaunoy 91663c4793 Merge pull request #58 from danielplohmann/wildneutron 
added WildNeutron (Morph, Butterfly, Sphinx Moth)
 2017-06-06 10:02:56 +02:00
Deborah Servili aa34718b13 edit threat actor - should fix #59 and #60 2017-06-06 08:40:29 +02:00
Daniel Plohmann (jupiter) 068dc40a78 added WildNeutron (Morph, Butterfly, Sphinx Moth) 2017-06-05 19:13:27 +02:00
Alexandre Dulaunoy 8796017151 Merge pull request #56 from elhoim/patch-1 
Added synonyms for APT10 and one for APT1
 2017-06-02 16:41:20 +02:00
Deborah Servili bf8c050b8b jq 2017-06-02 15:52:43 +02:00
Deborah Servili 17c0ffb255 add RAT listed in https://github.com/kevthehermit/RATDecoders 2017-06-02 15:40:06 +02:00
David André 83833f257c Added synonyms for APT10 and one for APT1 2017-06-02 10:26:45 +02:00
Deborah Servili c9ede88868 add rat galaxy 2017-05-31 16:39:19 +02:00
Alexandre Dulaunoy fab863933e SilverTerrier added 2017-05-30 08:40:26 +02:00
Alexandre Dulaunoy dcfbfdfe47 jq all 2017-05-26 14:59:34 +02:00
Alexandre Dulaunoy d95351a72a Merge branch 'master' of github.com:MISP/misp-galaxy 2017-05-26 14:52:50 +02:00
Alexandre Dulaunoy b562e6b729 Emotet/Geodo added 2017-05-26 14:52:35 +02:00
Deborah Servili 14835361f7 jq 'n ##COMMA## 2017-05-18 14:01:49 +02:00
Deborah Servili 7fee4f3a1b add Uiwik ransomware 2017-05-18 13:59:47 +02:00
Deborah Servili 3b93a773e5 add synonym and cleaning 2017-05-18 11:18:32 +02:00
Deborah Servili 2c4256f42c merge hiddentear & cryptear data 2017-05-18 10:18:45 +02:00
Deborah Servili bc4f1a93ab add synonym - half done 2017-05-18 09:19:48 +02:00
Deborah Servili 6859b2fb4e add synonym - step 1 2017-05-17 12:14:10 +02:00
Deborah Servili c501517e9a add synonym to hancitor 2017-05-17 12:00:26 +02:00
Deborah Servili 66ca4c6f2a add jaff Ransomwarejq-ed 2017-05-17 10:10:27 +02:00
Deborah Servili 44857c2ac3 add jaff Ransomware 2017-05-17 10:08:53 +02:00
Alexandre Dulaunoy 3e62608d3a Remove duplicate ref 2017-05-16 14:52:53 +02:00
Alexandre Dulaunoy e5faf4fba7 Input from Deborah incorporated 2017-05-16 14:47:16 +02:00
Alexandre Dulaunoy 5da5df6384 APT32 added 2017-05-15 09:18:28 +02:00
Alexandre Dulaunoy bd18dc2f4b WannaCry added 2017-05-14 16:37:37 +02:00
Kafeine 2182a790a3 Fix 2017-05-11 11:31:22 +01:00
Kafeine 6d90c3e691 +Bingo -- Hunter > Retired 2017-05-11 11:30:50 +01:00
Alexandre Dulaunoy 248eecaef0 Kazuar: Multiplatform Espionage Backdoor with API Access added 2017-05-04 17:22:28 +02:00
Kafeine 32b0e6f95d Update tds.json 2017-05-04 11:48:49 +01:00
Alexandre Dulaunoy f5d356523e Duplicate references removed 2017-05-03 15:59:24 +02:00
Alexandre Dulaunoy ea611bcded Merge pull request #49 from Delta-Sierra/master 
reformat ransomware galaxy
 2017-05-03 15:56:39 +02:00
Déborah Servili 9ff5f58978 add source to please the schema~ 2017-05-03 15:21:58 +02:00
Déborah Servili 0a9814d6eb change sources for authors 2017-05-03 15:15:34 +02:00
Déborah Servili 2dc6982fae jq on ransomware 2017-05-03 15:09:23 +02:00
Déborah Servili fb5eb32a0e managing duplicate 2017-05-03 15:01:20 +02:00
Déborah Servili 8b10e3aaee managing duplicate 2017-05-03 14:24:53 +02:00
Déborah Servili 24c6c51e4d reformat ransomware galaxy - including http://pastebin.com/raw/GHgpWjar 2017-05-02 14:16:21 +02:00
Déborah Servili 82f4a633c0 reformat ransomware galaxy 2017-05-02 10:00:00 +02:00
Alexandre Dulaunoy 35b94437e8 REDLEAVES malware added 2017-04-28 08:32:34 +02:00
Déborah Servili c08cc781f5 update tools 2017-04-26 12:23:57 +02:00
Alexandre Dulaunoy 3e4973f688 Feodo added 2017-04-25 19:56:06 +02:00
Déborah Servili 6267681362 add Cardinal RAT 2017-04-24 16:04:52 +02:00
Alexandre Dulaunoy 07c82e15a5 FlexiSpy 2017-04-23 23:05:12 +02:00
Alexandre Dulaunoy 52edcb1929 shadow broker leak of NSA tools from https://github.com/misterch0c/shadowbroker 2017-04-15 21:22:32 +02:00
Alexandre Dulaunoy 6149740cd4 First batch of shadow broker leak (NSA name of exploit and tools) from 
https://github.com/misterch0c/shadowbroker
 2017-04-15 19:40:54 +02:00
Alexandre Dulaunoy 3595d04b35 jq all 2017-04-14 16:28:43 +02:00
Alexandre Dulaunoy fa49ca127c Merge pull request #40 from Kafeine/master 
Updated.
 2017-04-14 16:27:15 +02:00
Déborah Servili 7163e8c58c add synonyms for Da Vinci RCS 2017-04-14 15:51:39 +02:00
Déborah Servili 531595c944 ##comma## 2017-04-14 14:52:23 +02:00
Déborah Servili 54512eb840 Add some tools/threat actor 2017-04-14 14:48:39 +02:00
Kafeine 9e5db0be8c fix 2017-04-14 13:47:16 +01:00
Kafeine 321044cdac Update Terror 2017-04-14 13:46:59 +01:00
Kafeine 777fc1cde3 Updated 
Blaze <-> Terror - Updated Sundown and Nebula status
 2017-04-14 13:44:03 +01:00
Déborah Servili 9412519502 correct copypasta mistake 2017-04-12 16:11:57 +02:00
Déborah Servili bbc2b79a5e add tools from https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html 2017-04-12 16:07:48 +02:00
Déborah Servili 8a645f42c9 update tool 2017-04-11 16:06:27 +02:00
Déborah Servili 7b5aaaeff2 json fix 2017-04-11 14:18:29 +02:00
Déborah Servili eee2c6d6b5 update tool's galaxy using http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html 2017-04-11 14:09:44 +02:00
Alexandre Dulaunoy bbf6716c73 Longhorn (CIA) added 2017-04-10 20:22:57 +02:00
Alexandre Dulaunoy ab5b73a3cd Sathurbot added 2017-04-06 20:49:53 +02:00
Alexandre Dulaunoy 8c09223477 The product from NSO Group Technologies added to the list of tools. 
The Pegasus name is used as synonym of Chrysaor ;-)
 2017-04-04 20:42:08 +02:00
Alexandre Dulaunoy 0578d7b7b1 The mysterious ZIRCONIUM activity group added 2017-04-03 19:44:36 +02:00
nyx0 78cdb10aae Add new Sednit name according to https://www.secureworks.com/research/iron-twilight-supports-active-measures 2017-03-31 09:28:50 -04:00
Alexandre Dulaunoy b3f1069686 Trochilus and MoonWind RATs added 2017-03-30 15:01:23 +02:00
Alexandre Dulaunoy f0e42a1818 KHRAT added 2017-03-29 16:37:31 +02:00
chrisdoman dbf989c742 Added descriptions and reference to threat-actor json 2017-03-22 12:52:05 +00:00
Raphaël Vinot 1ed0558c07 Merge branch 'master' into master 2017-03-16 17:38:59 +01:00
Raphaël Vinot e1b5701351 JQ all the things 2017-03-16 17:31:43 +01:00
Raphaël Vinot 0d8d265319 Fix typo. 2017-03-16 17:27:17 +01:00
CERT-Bund 4112a041f7 Added groups, joined groups, added synonyms (see extended description) 
Added: HammerPanda, Barium, Infy, Sima, Groundbait
Joined: StrongPity and Promethium
Synonyms: Lead as Winnti, Moonlight as MoleRats, FalloutTeam as DarkHotel, DustStorm as StonePanda, Skipper and Popeye as Pacifier
 2017-03-16 17:02:55 +01:00
Alexandre Dulaunoy 71ad9099c4 IMEIJ added 2017-03-13 13:59:46 +01:00
Kafeine 73a82418df Empire status, Nebula, Blaze/Terror 2017-03-02 21:29:19 +00:00
Alexandre Dulaunoy e002e62204 missing \n at the end of the file 2017-03-01 14:55:45 +01:00
Chris Doman 9e5c983a65 Ran jq 2017-03-01 13:24:00 +00:00
Chris Doman e934f88b3b Added references 
Mostly added references to existing groups
Capitalised DarkHotel, put a space in APT30 default name (the others
had that)
 2017-03-01 12:53:52 +00:00
Alexandre Dulaunoy a224c7ce5e add: Gamaredon Group added 2017-02-28 09:17:33 +01:00
Christophe Vandeplas 048b831f53 minor correction 2017-02-27 11:00:48 +01:00
Thanat0s 07cc13feb8 remove duplicate of ratdecode import 2017-02-27 00:38:39 +01:00
Thanat0s 9eb2d097f2 add a bunch of rat from ratdecoder list 2017-02-27 00:23:56 +01:00
Thanat0s 849ca3ebbc Pimp Epic turla 2017-02-26 23:38:50 +01:00
Thanat0s f1ea577e95 pimp and agreggate turla 2017-02-26 23:24:51 +01:00
Thanat0s 3774f05237 Somes alias fetch from : https://attack.mitre.org/wiki/Groups 2017-02-26 23:07:42 +01:00
Thanat0s 2d658a6577 pimp comrat 2017-02-26 22:53:51 +01:00
Thanat0s b865342f2e pimp xneteagle 2017-02-26 22:47:16 +01:00
Thanat0s f4584f3900 pimp xscontrol 2017-02-26 22:41:51 +01:00
Thanat0s b400edbe9b Update Xagent from aptnote Bitdefender-Whitepaper-APT-Mac-A4-en-EN-web(02-23-2017) 2017-02-26 20:40:44 +01:00
Thanat0s 51eee31c21 Pimp lecna/Backspace 2017-02-26 20:16:59 +01:00
Thanat0s 0d0ba42f15 Pimp lecna/Backspace 2017-02-26 20:16:46 +01:00
Thanat0s cdc80e5596 Pimp RarStone 2017-02-26 20:02:34 +01:00
Thanat0s ca68abc0e8 Pimp Pirpi. Hard to say:) 2017-02-26 19:56:17 +01:00
Thanat0s 6e78746a6c pimp webc2 2017-02-26 19:37:10 +01:00
Thanat0s 0775bfce62 pimp winnti 2017-02-26 19:26:21 +01:00
Thanat0s 8de827977c Pimp nettraveler 2017-02-26 19:21:41 +01:00
Thanat0s 7d62d8c3e7 cleanup zeus duplicate in alias and name 2017-02-26 17:08:43 +01:00
Thanat0s 93df12be35 update apt28 tools 2017-02-26 17:06:19 +01:00
Thanat0s afe682cf3f Remove duplicate AlienSpy 2017-02-26 16:52:59 +01:00
Thanat0s 47903f8394 add info to the famous mimikatz 2017-02-25 02:28:43 +01:00
Thanat0s d4e3a08995 add moudor info 2017-02-25 02:22:30 +01:00
Thanat0s 3d79a82bf5 Add Tinba banking 2017-02-25 02:08:51 +01:00
Thanat0s 7eb98609a3 udpate trojan.main 2017-02-25 01:42:33 +01:00
Thanat0s 59b5ed6c1b update evilgrab 2017-02-25 01:30:10 +01:00
Thanat0s 724e836ae9 remove coreshell duplicate 2017-02-25 01:18:03 +01:00
Thanat0s e98de5cb5e add derusbi 2017-02-25 01:12:42 +01:00
Thanat0s bce60b0318 merge IEchecker et sasfi 2017-02-25 01:06:19 +01:00
Thanat0s 50d2b1c871 go for caro, add hi-zor 2017-02-25 00:42:44 +01:00
Thanat0s d502d5b5bf fix side victims of schemaupdate 2017-02-24 23:46:44 +01:00
Thanat0s a29a5afbe8 update 2 array 2017-02-24 23:36:45 +01:00
Thanat0s 7265af6612 go 4 string 2017-02-24 16:24:59 +01:00
Thanat0s b124d8a08d Follow the format 2017-02-24 15:52:08 +01:00
Thanat0s 8240e5f661 json typo 2017-02-24 14:05:57 +01:00
Thanat0s 8c2c47810e Locky removed > ransomware 2017-02-24 14:00:42 +01:00
Thanat0s c1848b1a3a json issue 2017-02-24 13:59:14 +01:00
Thanat0s f496c34fda generic plugx names 2017-02-24 13:57:33 +01:00
Thanat0s bb088f97d1 Update 2017-02-24 13:56:33 +01:00
Thanat0s 0513668fcf Remove JOYRat -> team -> https://www.crowdstrike.com/blog/whois-numbered-panda/ 2017-02-24 13:46:12 +01:00
Thanat0s 796382d4ab Remove Lstudio (group using elise) , add info to PWOBOT 2017-02-24 13:39:53 +01:00
Thanat0s c6ac4d847c Remove EK and Ransomwares 2017-02-24 13:25:38 +01:00
Thanat0s b75e9cf59d Gutemberg on first 10 2017-02-23 10:14:18 +01:00
Alexandre Dulaunoy 644e429110 PupyRAT added 2017-02-20 17:34:55 +01:00
Raphaël Vinot 7db66e05dd Strict schema, update clusters accordingly 2017-02-14 11:34:59 +01:00
Raphaël Vinot 910398fe76 Fix validation, remove duplicate. 2017-02-13 18:52:54 +01:00
Alexandre Dulaunoy 6fb89a644f Merge branch 'master' of github.com:MISP/misp-galaxy 2017-02-10 10:10:00 +01:00
Alexandre Dulaunoy 5442a262ab StreamEX added 2017-02-10 10:09:37 +01:00
Alexandre Dulaunoy 87296fe95c Merge pull request #29 from Delta-Sierra/master 
add Erebus ransomware
 2017-02-09 09:20:58 +01:00
Déborah Servili 8817d4869d add Erebus ransomware 2017-02-09 08:46:21 +01:00
Kafeine a9b9b6f6e1 +Pangimop, alias Microsoft for magnitude 2017-02-06 19:31:21 +00:00
Kafeine 286820f19a Fix 2017-02-06 19:29:55 +00:00
Kafeine f557f9c0c0 +Derbit alias for Sundown 2017-02-06 19:28:06 +00:00
Alexandre Dulaunoy f3f5b3b3ac Merge pull request #28 from Kafeine/master 
Added Microsoft Naming
 2017-02-05 18:03:16 +01:00
Kafeine 645c2e527e Indent 2017-02-05 16:58:56 +00:00
root 06da6ce154 Added Microsoft Naming 2017-02-05 17:52:57 +01:00
Alexandre Dulaunoy 30d9233db6 ZeroT added 2017-02-03 22:26:40 +01:00
Alexandre Dulaunoy 762ee63bf7 Merge branch 'master' of github.com:MISP/misp-galaxy 2017-01-31 09:21:32 +01:00
Alexandre Dulaunoy 92bb392653 Flokibot added 2017-01-31 09:21:19 +01:00
Déborah Servili d6cab37977 change author name to 'Various' 2017-01-31 09:11:26 +01:00
Déborah Servili da331d6ca6 add ransomware galaxy 2017-01-30 15:45:20 +01:00
cgi af16b7c6a1 Adding Zeus to tools 2017-01-26 11:23:37 +01:00
Alexandre Dulaunoy d09b25f2a0 fix: BARIUM and LEAD added 2017-01-25 19:58:50 +01:00
Alexandre Dulaunoy abca7a02d0 Greenbug added 2017-01-23 16:20:09 +01:00
Alexandre Dulaunoy 8ed7374028 Tavdig was missing 2017-01-20 15:31:25 +01:00
Alexandre Dulaunoy 8987006c5d LuminosityLink RAT added 2017-01-19 14:16:55 +01:00
Alexandre Dulaunoy 44cc53d956 EyePyramid added 2017-01-19 08:30:46 +01:00
Alexandre Dulaunoy 7a97b1bcb2 Merge branch 'master' of github.com:MISP/misp-galaxy 2017-01-17 20:56:36 +01:00
Alexandre Dulaunoy 18153f3151 GhostAdmin added 2017-01-17 20:55:27 +01:00
Déborah Servili edea2d25ee add APT28's tools 2017-01-16 12:08:20 +01:00
Alexandre Dulaunoy 19406277d4
Equation Group added 2017-01-13 08:23:03 +01:00
Alexandre Dulaunoy 7ede54c76c "the shoemaker's son always goes barefoot" Regin added 2017-01-13 08:18:41 +01:00
Alexandre Dulaunoy 233562ddc4 Merge pull request #17 from Delta-Sierra/master 
begin preventive-measure galaxy
 2017-01-12 14:32:11 +01:00
Déborah Servili 8c740065c0 complete preventive-measure 2017-01-12 11:48:10 +01:00
Alexandre Dulaunoy a42d4c4f4f Shamoon added 2017-01-11 22:46:04 +01:00
Déborah Servili 733f065851 begin preventive-measure galaxy 2017-01-11 16:14:45 +01:00
Alexandre Dulaunoy 649c043ad2
Import manually cert-eu contribution 
- Fix the meta attributes (like the motive field ) to be within meta and not
   outside
 - Remove some "null" values that seems to come from previous tests
 - Pretty-print the Javascript (better for diffing)
 2017-01-09 23:07:57 +01:00
Alexandre Dulaunoy bb47f52d24
MM Core added 2017-01-08 11:23:01 +01:00
Alexandre Dulaunoy 5e5a6119f5 Shiz Trojan + Shifu 2017-01-07 14:48:45 +01:00
Alexandre Dulaunoy fd030a4314 GeminiDuke added 2017-01-06 22:35:50 +01:00
Alexandre Dulaunoy a6cb478a3b Separate APT30 from Naikon group 2017-01-06 22:26:53 +01:00
Alexandre Dulaunoy ea9ebaf5d6 PassCV group added 2017-01-06 13:51:22 +01:00
Alexandre Dulaunoy c3364add3c Cadelle and Chafer groups added 2017-01-06 13:25:30 +01:00
root 45c7f28afd TDS Cluster: EOF 2017-01-05 16:03:04 +01:00
root 7094d30926 EK and TDS clusters : several minor fixes 2017-01-05 14:53:56 +01:00
root 9128289bc5 EK and TDS clusters : Removed empty entries 2017-01-05 14:41:57 +01:00
root 7df3b0b7b6 TDS Cluster: json fix 2017-01-05 14:34:27 +01:00
root d2dc4e8182 EK Cluster : several fixes 2017-01-05 14:28:01 +01:00
root 9efa19fa47 EK Cluster typo fix 2017-01-05 14:20:42 +01:00
root 5dbcac9c30 EK Cluster update 2017-01-05 14:18:14 +01:00
root 9517f26120 Mwi added 2017-01-05 14:12:30 +01:00
root 8389a3e1f3 Init 2017-01-05 14:07:14 +01:00
Alexandre Dulaunoy 8280512e5b Various updates including the addition of Chthonic Banking Trojan 2017-01-04 11:03:39 +01:00
Alexandre Dulaunoy c38f62ae12 Packrat added 2016-12-30 12:47:47 +01:00
Alexandre Dulaunoy 120b2581cf DownRage added 2016-12-30 11:39:23 +01:00
Alexandre Dulaunoy 0418340c21 Java RAT updated 2016-12-27 17:59:30 +01:00
Alexandre Dulaunoy 86e2545b08 Merge branch 'master' of github.com:MISP/misp-galaxy 2016-12-23 13:47:16 +01:00
Alexandre Dulaunoy a368cda3bd Seaduke added 2016-12-23 13:46:53 +01:00
Déborah Servili f03252a555 ##comma## 2016-12-22 14:13:46 +01:00
Déborah Servili 136ed05521 Add microsoft-activity-group cluster 2016-12-22 11:01:15 +01:00
Alexandre Dulaunoy d37db31a75 Operation Iron Tiger added as synonym 2016-12-17 09:51:13 +01:00
Alexandre Dulaunoy 3deb47a9c8 Molerats, PROMETHIUM and NEODYMIUM added 2016-12-17 09:40:47 +01:00
Alexandre Dulaunoy 55f21451cc BlackEnergy malware family added 2016-12-17 09:26:42 +01:00
Alexandre Dulaunoy ff17ac998e TeleBots group added 2016-12-13 19:37:30 +01:00
Alexandre Dulaunoy 3a657ace36 TERBIUM added 2016-12-13 09:11:16 +01:00
Alexandre Dulaunoy d5c3312240 Mirai and BASHLITE added 2016-12-10 12:08:09 +01:00
Iglocska 65b83f7305 Added missing file 2016-12-07 07:53:24 +01:00
Iglocska c890a48e15 fix: Naming normalisation 2016-12-07 07:51:27 +01:00
Alexandre Dulaunoy d834ec1f52 Singular everywhere 2016-12-04 17:37:29 +01:00
Alexandre Dulaunoy f044004924 Singular everywhere 2016-12-04 17:37:06 +01:00
Alexandre Dulaunoy 211f03a1ab Structure ready for MISP 2.4.56 2016-11-30 14:46:31 +01:00
Alexandre Dulaunoy 734eb1c51d Fixed to merge PR #11 2016-11-29 10:58:36 +01:00
Alexandre Dulaunoy 7f02f62c57 meta added as required by MISP 2.4.56 2016-11-28 12:51:55 +01:00
Alexandre Dulaunoy e7cef8bf14 Add a source field for the clusters (required for MISP 2.4.56) 2016-11-27 16:41:45 +01:00
Christophe Vandeplas b68f9fe17e Metushy, Uroburos, Pfinet synonyms added 2016-11-23 14:39:42 +01:00
Alexandre Dulaunoy f0678ac63a Yahoyah added 2016-11-23 10:19:17 +01:00
Alexandre Dulaunoy 4c657eecac Tropic Trooper added 2016-11-23 10:13:07 +01:00
Alexandre Dulaunoy b38799044d KeyBoy malware added 2016-11-21 09:21:55 +01:00
Christophe Vandeplas b97e73b7d3 added Callisto 2016-11-16 10:36:49 +01:00
Christophe Vandeplas ea0f727aac removed duplicates 2016-11-16 10:36:36 +01:00
Christophe Vandeplas 002728de4c Added Rocket Kitten 2016-11-10 11:16:42 +01:00
Alexandre Dulaunoy cf6a8c5b2e Description added for Volatile Cedar 2016-11-07 16:18:02 +01:00
Alexandre Dulaunoy 1b92f13c93 Explosive malware added 2016-11-07 16:17:09 +01:00
Alexandre Dulaunoy 0363dc607b Volatile Cedar added 2016-11-07 16:15:21 +01:00
Alexandre Dulaunoy e885463592 OilRig added 2016-11-07 16:10:04 +01:00
Iglocska dbed3ac17d Merge branch 'master' of https://github.com/MISP/misp-galaxy 2016-11-07 03:35:18 +01:00
Iglocska 556908bfd6 Some small fixes 
- more uniform pluralisation
- Added display name fields
 2016-11-07 03:34:40 +01:00
Alexandre Dulaunoy 1e9e44c89d Empire post-exploitation tool added 2016-11-06 10:51:28 +01:00
Alexandre Dulaunoy 48a62339e8 Threat actors simplified (no more groups) it's already in the value 
field
 2016-10-31 11:44:19 +01:00
Iglocska b6e1c478a7 Some small fixes 2016-10-31 09:39:17 +01:00
Iglocska 90e19ecbac Some small changes 2016-10-31 09:33:41 +01:00
Iglocska bd23721e0a Moving things around 2016-10-30 16:58:37 +01:00