Skip to content

Commit a89a116

Browse files
mhtsai1010mhtsai1010
committed
Merge branch 'sp-dev'
* sp-dev: add sample output of intelmq
2 parents b4b4461 + 50c40b8 commit a89a116

23 files changed

+596
-40
lines changed

‎Abuse.ch/Feodo_Botnet.md

Lines changed: 31 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,11 @@ A swiss guy fighting Cybercrime.
44

55
### Feodo Botnet
66

7-
Feodo (also known as Cridex or Bugat) is a Trojan used to commit ebanking fraud
8-
and steal sensitive information from the victims computer,
9-
such as credit card details or credentials.
7+
Feodo (also known as Cridex or Bugat) is a Trojan used to commit ebanking fraud
8+
and steal sensitive information from the victims computer,
9+
such as credit card details or credentials.
1010

11-
At the moment, Feodo Tracker is tracking four versions of Feodo,
11+
At the moment, Feodo Tracker is tracking four versions of Feodo,
1212
and they are labeled by Feodo Tracker as:
1313

1414
* Version A: Hosted on compromised webservers running an nginx proxy on port
@@ -26,7 +26,7 @@ and they are labeled by Feodo Tracker as:
2626
* Version D: Successor of Cridex. This version is also known as Dridex
2727

2828
#### Domain Name
29-
>
29+
>
3030
* Website
3131
- `https://feodotracker.abuse.ch/`
3232
* Source
@@ -42,7 +42,7 @@ and they are labeled by Feodo Tracker as:
4242
* Comments
4343
- No present data.
4444

45-
#### Sample Output of IntelMQ
45+
##### Sample Output of IntelMQ
4646

4747
```javascript
4848
{
@@ -51,7 +51,7 @@ and they are labeled by Feodo Tracker as:
5151
```
5252

5353
#### IP Address
54-
>
54+
>
5555
* Website
5656
- `https://feodotracker.abuse.ch/`
5757
* Source
@@ -67,9 +67,29 @@ and they are labeled by Feodo Tracker as:
6767
* Comments
6868
- No comment
6969

70+
##### Sample Output of IntelMQ
71+
7072
```javascript
7173
{
72-
null
74+
"malware": {
75+
"name": "cridex"
76+
},
77+
"classification": {
78+
"type": "c&c"
79+
},
80+
"time": {
81+
"source": "2016-07-07T07:58:29+00:00",
82+
"observation": "2016-07-07T07:58:29+00:00"
83+
},
84+
"raw": "MS4xNzguMTc5LjIxNw==",
85+
"feed": {
86+
"url": "https:\/\/feodotracker.abuse.ch\/blocklist\/?download=ipblocklist",
87+
"accuracy": 100,
88+
"name": "Abuse.ch"
89+
},
90+
"source": {
91+
"ip": "1.178.179.217"
92+
}
7393
}
7494
```
7595

@@ -97,7 +117,7 @@ But there's more information in https://feodotracker.abuse.ch/?sort=lastseen :
97117
* Version of Feodo
98118
* Feodo C&C (IP)
99119
* Status
100-
* SBL (Spamhaus Block List)
101-
* ASN
102-
* Country
120+
* SBL (Spamhaus Block List)
121+
* ASN
122+
* Country
103123
* Lastseen (UTC)

‎Abuse.ch/Palevo_Worm.md

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,32 @@ readme [file][1].
2929
* Comments
3030
- Palevo Tracker has been discontinued.
3131

32+
##### Sample Output of IntelMQ
33+
34+
```javascript
35+
{
36+
"raw": "YXJ0YS5yb21haWwzYXJuZXN0LmluZm8=",
37+
"classification": {
38+
"type": "c&c"
39+
},
40+
"source": {
41+
"fqdn": "arta.romail3arnest.info"
42+
},
43+
"time": {
44+
"observation": "2016-07-07T08:09:47+00:00"
45+
},
46+
"feed": {
47+
"url": "https:\/\/palevotracker.abuse.ch\/blocklists.php?download=domainblocklist",
48+
"name": "Abuse.ch",
49+
"accuracy": 100
50+
},
51+
"malware": {
52+
"name": "palevo"
53+
}
54+
}
55+
56+
```
57+
3258
#### IP Address
3359
>
3460
* Website
@@ -45,3 +71,33 @@ readme [file][1].
4571
- Ok
4672
* Comments
4773
- Palevo Tracker has been discontinued.
74+
75+
##### Sample Output of IntelMQ
76+
77+
```javascript
78+
{
79+
"malware": {
80+
"name": "palevo"
81+
},
82+
"source": {
83+
"ip": "103.51.144.193"
84+
},
85+
"time": {
86+
"observation": "2016-07-07T08:11:44+00:00"
87+
},
88+
"raw": "MTAzLjUxLjE0NC4xOTM=",
89+
"classification": {
90+
"type": "c&c"
91+
},
92+
"feed": {
93+
"accuracy": 100,
94+
"url": "https:\/\/palevotracker.abuse.ch\/blocklists.php?download=ipblocklist",
95+
"name": "Abuse.ch"
96+
}
97+
}
98+
```
99+
100+
----
101+
102+
This project is not continued. We plan to remove this intelligence feed in the
103+
future.

‎Abuse.ch/Zeus_Botnet.md

Lines changed: 53 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ The crimeware kit contains the following modules:
1414
* A web interface to administrate and control the botnet (ZeuS Admin Panel)
1515
* A tool to create the trojan binaries and encrypt the config file (called exe
1616
builder)
17-
17+
1818
Normaly, a ZeuS host consists of three componets / URIs:
1919
* a config file (mostly with filextension \*.bin)
2020
* a binary file which contains the newest version of the ZeuS trojan
@@ -62,6 +62,31 @@ public tool available.
6262
* Comments
6363
- No comment
6464

65+
##### Sample Output of IntelMQ
66+
67+
```javascript
68+
{
69+
"time": {
70+
"observation": "2016-07-07T08:13:55+00:00"
71+
},
72+
"classification": {
73+
"type": "c&c"
74+
},
75+
"feed": {
76+
"name": "Abuse.ch",
77+
"accuracy": 100,
78+
"url": "https:\/\/zeustracker.abuse.ch\/blocklist.php?download=baddomains"
79+
},
80+
"malware": {
81+
"name": "zeus"
82+
},
83+
"raw": "MHgueC5nZw==",
84+
"source": {
85+
"fqdn": "0x.x.gg"
86+
}
87+
}
88+
```
89+
6590
#### IP Address
6691
>
6792
* Website
@@ -79,6 +104,33 @@ public tool available.
79104
* Comments
80105
- No comment
81106

107+
##### Sample Output of IntelMQ
108+
109+
```javascript
110+
{
111+
"malware": {
112+
"name": "zeus"
113+
},
114+
"raw": "MTAxLjAuODkuMw==",
115+
"source": {
116+
"ip": "101.0.89.3"
117+
},
118+
"classification": {
119+
"type": "c&c"
120+
},
121+
"time": {
122+
"observation": "2016-07-07T08:16:17+00:00"
123+
},
124+
"feed": {
125+
"name": "Abuse.ch",
126+
"accuracy": 100,
127+
"url": "https:\/\/zeustracker.abuse.ch\/blocklist.php?download=badips"
128+
}
129+
}
130+
```
131+
132+
----
133+
82134
There's only Domain information in in https://zeustracker.abuse.ch/blocklist.php?download=baddomains. It looks like:
83135

84136
############################################################################

‎AlienVault/Malicious_Activities.md

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,16 @@ Alienvault IP Reputation Database
2626
* Comments
2727
- No comment
2828

29+
##### Sample Output of IntelMQ
30+
31+
```javascript
32+
{
33+
null
34+
}
35+
```
36+
37+
----
38+
2939
There's not only IP information in https://reputation.alienvault.com/reputation.data
3040
It looks like:
3141

‎AlienVaultOTX/Malicious_Activities.md

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,3 +25,27 @@ campaigns, and even state sponsored hacking.
2525
- Ok
2626
* Comments
2727
- No API KEY
28+
29+
##### Sample Output of IntelMQ
30+
31+
```javascript
32+
{
33+
"raw": "eyJfaWQiOiAiNTc3MzAwODY3NjFiODIwMTNhYjc4MjkzIiwgImNyZWF0ZWQiOiAiMjAxNi0wNi0yOFQyMjo1NjowNi4zNjUiLCAiZGVzY3JpcHRpb24iOiAiIiwgImluZGljYXRvciI6ICJib3g0MDg0Lm5ldCIsICJ0eXBlIjogImRvbWFpbiJ9",
34+
"time": {
35+
"source": "2016-06-28T22:56:06+00:00",
36+
"observation": "2016-07-07T08:27:18+00:00"
37+
},
38+
"feed": {
39+
"name": "AlienVault OTX",
40+
"accuracy": 100
41+
},
42+
"classification": {
43+
"type": "blacklist"
44+
},
45+
"extra": "{\"author\": \"AlienVault\", \"pulse\": \"Prince of Persia \\u2013 Game Over\"}",
46+
"comment": "Unit 42 published a blog at the beginning of May titled \u201cPrince of Persia,\u201d in which we described the discovery of a decade-long campaign using a formerly unknown malware family, Infy, that targeted government and industry interests worldwide.\nSubsequent to the publishing of this article, through cooperation with the parties responsible for the C2 domains, Unit 42 researchers successfully gained control of multiple C2 domains. This disabled the attacker\u2019s access to their victims in this campaign, provided further insight into the targets currently victimized in this operation, and enabled the notification of affected parties.",
47+
"source": {
48+
"fqdn": "box4084.net"
49+
}
50+
}
51+
```

‎ArborNetworks/Distributed_SSH_Brute_Force_Attacks.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,3 +24,11 @@ Unknown
2424
- Error
2525
* Comments
2626
- 403 Forbidden
27+
28+
##### Sample Output of IntelMQ
29+
30+
```javascript
31+
{
32+
null
33+
}
34+
```

‎Autoshun.org/Malicious_Activities.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,3 +24,11 @@ IPs to prevent users from accidentally crushing their firewall.
2424
- Error
2525
* Comments
2626
- URL Changed
27+
28+
##### Sample Output of IntelMQ
29+
30+
```javascript
31+
{
32+
null
33+
}
34+
```

‎Bitsight/Malicious_Activities.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,3 +23,11 @@ Unknown
2323
- Error
2424
* Comments
2525
- No API Key
26+
27+
##### Sample Output of IntelMQ
28+
29+
```javascript
30+
{
31+
null
32+
}
33+
```

‎Blocklist.de/Attacks_on_the_service_Apache.md

Lines changed: 32 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@
22

33
www.blocklist.de is a free and voluntary service provided by a
44
Fraud/Abuse-specialist, whose servers are often attacked via SSH-, Mail-Login-,
5-
FTP-, Webserver- and other services.
5+
FTP-, Webserver- and other services.
66
The mission is to report any and all attacks to the respective abuse departments
77
of the infected PCs/servers, to ensure that the responsible provider can inform
8-
their customer about the infection and disable the attacker.
8+
their customer about the infection and disable the attacker.
99

1010
### Attacks on the service Apache
1111

@@ -29,6 +29,36 @@ attacks on the service Apache, Apache-DDOS, RFI-Attacks.
2929
* Comments
3030
- No comment
3131

32+
##### Sample Output of IntelMQ
33+
34+
```javascript
35+
{
36+
"source": {
37+
"ip": "1.34.139.38"
38+
},
39+
"time": {
40+
"observation": "2016-07-07T08:46:43+00:00"
41+
},
42+
"event_description": {
43+
"text": "IP reported as having run attacks on the service Apache, Apache-DDoS, RFI-Attacks"
44+
},
45+
"classification": {
46+
"type": "ids alert"
47+
},
48+
"raw": "MS4zNC4xMzkuMzg=",
49+
"feed": {
50+
"name": "BlockList.de",
51+
"accuracy": 100,
52+
"url": "https:\/\/lists.blocklist.de\/lists\/apache.txt"
53+
},
54+
"protocol": {
55+
"application": "http"
56+
}
57+
}
58+
```
59+
60+
----
61+
3262
There's only IP information in https://lists.blocklist.de/lists/apache.txt
3363
It looks like:
3464

0 commit comments

Comments
 (0)