{ "type": "bundle", "spec_version": "2.1", "id": "bundle--854e7c97-1231-4f89-884c-75412b7c8b8e", "created": "2021-07-16T11:41:43.398Z", "modified": "2021-07-16T11:52:37.167Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "objects": [ { "type": "malware", "spec_version": "2.1", "id": "malware--3372c781-3cf3-479a-aaeb-b9748fdfc149", "created": "2021-07-16T11:52:37.154Z", "modified": "2021-07-16T11:52:37.154Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Hexed Noodle", "description": "Android variant of AppleSeed backdoor", "malware_types": [ "remote-access-trojan" ], "is_family": false, "capabilities": [ "communicates-with-c2", "exfiltrates-data", "fingerprints-host", "persists-after-system-reboot" ], "architecture_execution_envs": [ "arm" ], "implementation_languages": [ "java" ], "x_operating_systems": [ "android" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--abe22320-ea3e-4121-a7fd-a778367069f3", "created": "2021-07-16T11:52:37.154Z", "modified": "2021-07-16T11:52:37.154Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Masquerade as Legitimate Application as used by Hexed Noodle", "kill_chain_phases": [ { "kill_chain_name": "mitre-mobile-attack", "phase_name": "initial-access" } ], "description": "Hexed Noodle masquerades as a KISA mobile security app" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7616b636-267a-4c9d-991c-efb80d2b223d", "created": "2021-07-16T11:52:37.154Z", "modified": "2021-07-16T11:52:37.154Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--abe22320-ea3e-4121-a7fd-a778367069f3", "target_ref": "attack-pattern--a93ccb8f-3996-42e2-b7c7-bb599d4e205f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--33bfd7e4-221a-4f85-9a59-b00630063ebe", "created": "2021-07-16T11:52:37.154Z", "modified": "2021-07-16T11:52:37.154Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--3372c781-3cf3-479a-aaeb-b9748fdfc149", "target_ref": "attack-pattern--abe22320-ea3e-4121-a7fd-a778367069f3" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--170fdd9e-0168-4531-b09c-cc025285589a", "created": "2021-07-16T11:52:37.154Z", "modified": "2021-07-16T11:52:37.154Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Gather Victim Host Information: Hardware as used by Hexed Noodle", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "reconnaissance" } ], "description": "Hexed Noodle beacons contain device hardware information and phone number" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7c9e6425-31d3-4099-98c1-f7d487061284", "created": "2021-07-16T11:52:37.155Z", "modified": "2021-07-16T11:52:37.155Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--170fdd9e-0168-4531-b09c-cc025285589a", "target_ref": "attack-pattern--24286c33-d4a4-4419-85c2-1d094a896c26" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ad64d0ec-0519-4d7e-92f0-77d2e57d7ec6", "created": "2021-07-16T11:52:37.155Z", "modified": "2021-07-16T11:52:37.155Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--3372c781-3cf3-479a-aaeb-b9748fdfc149", "target_ref": "attack-pattern--170fdd9e-0168-4531-b09c-cc025285589a" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--27a503e3-7f92-4b99-8e48-2fd0671a0ad9", "created": "2021-07-16T11:52:37.155Z", "modified": "2021-07-16T11:52:37.155Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Command and Scripting Interpreter: Unix Shell as used by Hexed Noodle", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ], "description": "Hexed Noodle system commands are executed by passing them to ‘sh -c’" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7fb59dd7-a5c9-43b1-93f7-58c73d655acf", "created": "2021-07-16T11:52:37.155Z", "modified": "2021-07-16T11:52:37.155Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--27a503e3-7f92-4b99-8e48-2fd0671a0ad9", "target_ref": "attack-pattern--a9d4b653-6915-42af-98b2-5758c4ceee56" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--81cf0a3b-56ea-4409-980c-38ddf8cbd3a6", "created": "2021-07-16T11:52:37.155Z", "modified": "2021-07-16T11:52:37.155Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--3372c781-3cf3-479a-aaeb-b9748fdfc149", "target_ref": "attack-pattern--27a503e3-7f92-4b99-8e48-2fd0671a0ad9" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--968b1ca1-c1d6-4257-b98c-463aaba93e66", "created": "2021-07-16T11:52:37.155Z", "modified": "2021-07-16T11:52:37.155Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "User Execution: Malicious File as used by Hexed Noodle", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ], "description": "The user is required to install the Hexed Noodle APK, accept permissions and launch the app" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fa667687-95f4-45a5-bb3c-beda0dc6d819", "created": "2021-07-16T11:52:37.155Z", "modified": "2021-07-16T11:52:37.155Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--968b1ca1-c1d6-4257-b98c-463aaba93e66", "target_ref": "attack-pattern--232b7f21-adf9-4b42-b936-b9d6f7df856e" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f29b1cbf-8f2a-4b6d-9547-06a9e470eada", "created": "2021-07-16T11:52:37.156Z", "modified": "2021-07-16T11:52:37.156Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--3372c781-3cf3-479a-aaeb-b9748fdfc149", "target_ref": "attack-pattern--968b1ca1-c1d6-4257-b98c-463aaba93e66" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1928384c-c7a6-4a3b-bc60-66a257670989", "created": "2021-07-16T11:52:37.156Z", "modified": "2021-07-16T11:52:37.156Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Broadcast Receivers as used by Hexed Noodle", "kill_chain_phases": [ { "kill_chain_name": "mitre-mobile-attack", "phase_name": "persistence" } ], "description": "Hexed Noodle subscribes to BOOT_COMPLETED, MY_PACKAGE_REPLACED, SMS_RECEIVED and PACKAGE_INSTALL broadcasts" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fdc48cd6-1369-4ca2-8d2f-a6d5bed35f50", "created": "2021-07-16T11:52:37.156Z", "modified": "2021-07-16T11:52:37.156Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--1928384c-c7a6-4a3b-bc60-66a257670989", "target_ref": "attack-pattern--bd4d32f5-eed4-4018-a649-40b229dd1d69" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--66d7b3ef-ba56-4327-bdd3-6329792cf0bb", "created": "2021-07-16T11:52:37.156Z", "modified": "2021-07-16T11:52:37.156Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--3372c781-3cf3-479a-aaeb-b9748fdfc149", "target_ref": "attack-pattern--1928384c-c7a6-4a3b-bc60-66a257670989" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d80c7b95-9779-4a36-9826-02ae9a10acad", "created": "2021-07-16T11:52:37.156Z", "modified": "2021-07-16T11:52:37.156Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Boot or Logon Autostart Execution as used by Hexed Noodle", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ], "description": "The Hexed Noodle app starts on receipt of the BOOT_COMPLETED notification" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c565a56e-4f39-4851-9c79-0c695dd998c3", "created": "2021-07-16T11:52:37.157Z", "modified": "2021-07-16T11:52:37.157Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--d80c7b95-9779-4a36-9826-02ae9a10acad", "target_ref": "attack-pattern--1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--54492fdf-975e-4790-8912-8916d970b722", "created": "2021-07-16T11:52:37.157Z", "modified": "2021-07-16T11:52:37.157Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--3372c781-3cf3-479a-aaeb-b9748fdfc149", "target_ref": "attack-pattern--d80c7b95-9779-4a36-9826-02ae9a10acad" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d2bf02c8-a6d4-4da6-8e58-41a005f359e5", "created": "2021-07-16T11:52:37.157Z", "modified": "2021-07-16T11:52:37.157Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Obfuscated Files or Information as used by Hexed Noodle", "kill_chain_phases": [ { "kill_chain_name": "mitre-mobile-attack", "phase_name": "defense-evasion" } ], "description": "Hexed Noodle configuration is stored in the app as hex encoded strings containing a 16 byte XOR-key prefix – in common with other AppleSeed variants." }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cbbc95bf-9645-406f-a08c-3c95125addf2", "created": "2021-07-16T11:52:37.157Z", "modified": "2021-07-16T11:52:37.157Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--d2bf02c8-a6d4-4da6-8e58-41a005f359e5", "target_ref": "attack-pattern--d13fa042-8f26-44e1-a2a8-af0bf8e2ac9a" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--420f44fa-9a12-4002-9fc9-9ecacf2cb6b7", "created": "2021-07-16T11:52:37.157Z", "modified": "2021-07-16T11:52:37.157Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--3372c781-3cf3-479a-aaeb-b9748fdfc149", "target_ref": "attack-pattern--d2bf02c8-a6d4-4da6-8e58-41a005f359e5" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--4a79c199-9a7a-42d9-91d1-9f51012bc752", "created": "2021-07-16T11:52:37.157Z", "modified": "2021-07-16T11:52:37.157Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Archive Collected Data: Archive via Library as used by Hexed Noodle", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ], "description": "Hexed Noodle data is Zip compressed before encryption using standard libraries" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--05ea4109-2531-4b82-ab9f-b8cc58216c06", "created": "2021-07-16T11:52:37.157Z", "modified": "2021-07-16T11:52:37.157Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--4a79c199-9a7a-42d9-91d1-9f51012bc752", "target_ref": "attack-pattern--41868330-6ee2-4d0f-b743-9f2294c3c9b6" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--da1bf64e-333e-48fb-a50a-a7837a2ef38f", "created": "2021-07-16T11:52:37.157Z", "modified": "2021-07-16T11:52:37.157Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--3372c781-3cf3-479a-aaeb-b9748fdfc149", "target_ref": "attack-pattern--4a79c199-9a7a-42d9-91d1-9f51012bc752" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--4077d0fe-1327-4b81-a3db-d91b74e84246", "created": "2021-07-16T11:52:37.157Z", "modified": "2021-07-16T11:52:37.157Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Data from Local System as used by Hexed Noodle", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ], "description": "Hexed Noodle collects SMS messages and certain filesystem documents" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--21a6012e-1a2c-407c-a4b6-157bac0f63f1", "created": "2021-07-16T11:52:37.157Z", "modified": "2021-07-16T11:52:37.157Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--4077d0fe-1327-4b81-a3db-d91b74e84246", "target_ref": "attack-pattern--3c4a2599-71ee-4405-ba1e-0e28414b4bc5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f08ac65c-03de-4d32-9281-2923f5706e47", "created": "2021-07-16T11:52:37.157Z", "modified": "2021-07-16T11:52:37.157Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--3372c781-3cf3-479a-aaeb-b9748fdfc149", "target_ref": "attack-pattern--4077d0fe-1327-4b81-a3db-d91b74e84246" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--4c4f59ba-1986-42d5-aaf2-97406f04a0c2", "created": "2021-07-16T11:52:37.158Z", "modified": "2021-07-16T11:52:37.158Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Automated Collection as used by Hexed Noodle", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ], "description": "Hexed Noodle regularly scans file and SMS directories for changes to trigger exfiltration" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9107bb2b-3833-492f-b05f-5d292eae0465", "created": "2021-07-16T11:52:37.158Z", "modified": "2021-07-16T11:52:37.158Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--4c4f59ba-1986-42d5-aaf2-97406f04a0c2", "target_ref": "attack-pattern--30208d3e-0d6b-43c8-883e-44462a514619" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ac5e4b7a-66d5-4950-a69d-ac38965bb1da", "created": "2021-07-16T11:52:37.158Z", "modified": "2021-07-16T11:52:37.158Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--3372c781-3cf3-479a-aaeb-b9748fdfc149", "target_ref": "attack-pattern--4c4f59ba-1986-42d5-aaf2-97406f04a0c2" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a80cf384-6eb2-4151-baf6-b060d6b07142", "created": "2021-07-16T11:52:37.158Z", "modified": "2021-07-16T11:52:37.158Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Capture SMS Messages as used by Hexed Noodle", "kill_chain_phases": [ { "kill_chain_name": "mitre-mobile-attack", "phase_name": "collection" } ], "description": "Hexed Noodle collects both stored and incoming SMS messages, possibly enabling the bypass of SMS-based two-factor authentication" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2f75ed7d-5ca1-4a63-993e-7b846adb422c", "created": "2021-07-16T11:52:37.158Z", "modified": "2021-07-16T11:52:37.158Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--a80cf384-6eb2-4151-baf6-b060d6b07142", "target_ref": "attack-pattern--e8b4e1ec-8e3b-484c-9038-4459b1ed8060" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--376434ce-8a58-430b-967e-78c310d97b9a", "created": "2021-07-16T11:52:37.158Z", "modified": "2021-07-16T11:52:37.158Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--3372c781-3cf3-479a-aaeb-b9748fdfc149", "target_ref": "attack-pattern--a80cf384-6eb2-4151-baf6-b060d6b07142" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--82b96f45-de93-49c1-b764-c7f77a93a64a", "created": "2021-07-16T11:52:37.158Z", "modified": "2021-07-16T11:52:37.158Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "File and Directory Discovery as used by Hexed Noodle", "kill_chain_phases": [ { "kill_chain_name": "mitre-mobile-attack", "phase_name": "discovery" } ], "description": "Hexed Noodle contains a command to list filesystem contents" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1a33c8e1-772b-4e5d-9b8c-64e850fdbac3", "created": "2021-07-16T11:52:37.158Z", "modified": "2021-07-16T11:52:37.158Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--82b96f45-de93-49c1-b764-c7f77a93a64a", "target_ref": "attack-pattern--cf28ca46-1fd3-46b4-b1f6-ec0b72361848" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--57c4cf59-1d70-478a-8296-bb3ab761ae1b", "created": "2021-07-16T11:52:37.158Z", "modified": "2021-07-16T11:52:37.158Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--3372c781-3cf3-479a-aaeb-b9748fdfc149", "target_ref": "attack-pattern--82b96f45-de93-49c1-b764-c7f77a93a64a" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--cbeb08a6-9bda-4c50-8f47-b35e1bcf874c", "created": "2021-07-16T11:52:37.158Z", "modified": "2021-07-16T11:52:37.158Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Application Layer Protocol: Web Protocols as used by Hexed Noodle", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "description": "Hexed Noodle uses HTTP requests for tasking and exfiltration " }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--adf5aab8-c0ae-4477-882f-e505100c0ffe", "created": "2021-07-16T11:52:37.158Z", "modified": "2021-07-16T11:52:37.158Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--cbeb08a6-9bda-4c50-8f47-b35e1bcf874c", "target_ref": "attack-pattern--df8b2a25-8bdf-4856-953c-a04372b1c161" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4af094d1-5d96-4b6b-b1c2-7a7b6880bfb4", "created": "2021-07-16T11:52:37.158Z", "modified": "2021-07-16T11:52:37.158Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--3372c781-3cf3-479a-aaeb-b9748fdfc149", "target_ref": "attack-pattern--cbeb08a6-9bda-4c50-8f47-b35e1bcf874c" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--2215499f-5bfb-4484-8960-88012a7701e2", "created": "2021-07-16T11:52:37.159Z", "modified": "2021-07-16T11:52:37.159Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Data Transfer Size Limits as used by Hexed Noodle", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "exfiltration" } ], "description": "Hexed Noodle uploads files in chunks of at most 10MB" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--22eaf6bb-1751-49b3-b6d2-24cb2c38fdd4", "created": "2021-07-16T11:52:37.159Z", "modified": "2021-07-16T11:52:37.159Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--2215499f-5bfb-4484-8960-88012a7701e2", "target_ref": "attack-pattern--c3888c54-775d-4b2f-b759-75a2ececcbfd" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7bcaac2d-0a8f-425c-9fd8-1ae14bfcabdb", "created": "2021-07-16T11:52:37.159Z", "modified": "2021-07-16T11:52:37.159Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--3372c781-3cf3-479a-aaeb-b9748fdfc149", "target_ref": "attack-pattern--2215499f-5bfb-4484-8960-88012a7701e2" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--718fbe03-ffe0-4f4b-a22b-4c010d49b3b3", "created": "2021-07-16T11:52:37.159Z", "modified": "2021-07-16T11:52:37.159Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Exfiltration Over C2 Channel as used by Hexed Noodle", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "exfiltration" } ], "description": "Hexed Noodle exfiltration and tasking are HTTP POST requests to the same server with different parameters" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cacb5ae0-f719-4a99-be31-54de11793946", "created": "2021-07-16T11:52:37.159Z", "modified": "2021-07-16T11:52:37.159Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--718fbe03-ffe0-4f4b-a22b-4c010d49b3b3", "target_ref": "attack-pattern--92d7da27-2d91-488e-a00c-059dc162766d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e5d6fe4d-4204-46e0-a526-b292be2c5248", "created": "2021-07-16T11:52:37.159Z", "modified": "2021-07-16T11:52:37.159Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--3372c781-3cf3-479a-aaeb-b9748fdfc149", "target_ref": "attack-pattern--718fbe03-ffe0-4f4b-a22b-4c010d49b3b3" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--95ae4986-774b-4f50-9705-f6845a6cbd28", "created": "2021-07-16T11:52:37.159Z", "modified": "2021-07-16T11:52:37.159Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Data Encrypted as used by Hexed Noodle", "kill_chain_phases": [ { "kill_chain_name": "mitre-mobile-attack", "phase_name": "exfiltration" } ], "description": "Hexed Noodle exfiltrated data is encrypted, prepended with the 16 byte XOR key and Hex encoded" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b64905e5-414a-4d2f-8726-b1b5b723b7df", "created": "2021-07-16T11:52:37.159Z", "modified": "2021-07-16T11:52:37.159Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--95ae4986-774b-4f50-9705-f6845a6cbd28", "target_ref": "attack-pattern--e3b936a4-6321-4172-9114-038a866362ec" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--37f7ce22-59e0-43d7-8915-dcf60a4daf32", "created": "2021-07-16T11:52:37.159Z", "modified": "2021-07-16T11:52:37.159Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--3372c781-3cf3-479a-aaeb-b9748fdfc149", "target_ref": "attack-pattern--95ae4986-774b-4f50-9705-f6845a6cbd28" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b5122c25-0dc9-4821-a1b3-5bec9b637d5c", "created": "2021-07-16T11:52:37.159Z", "modified": "2021-07-16T11:52:37.159Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Standard Application Layer Protocol as used by Hexed Noodle", "kill_chain_phases": [ { "kill_chain_name": "mitre-mobile-attack", "phase_name": "exfiltration" } ], "description": "Hexed Noodle exfiltrates data using HTTP POST requests" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5f6056b7-f512-412f-a69a-028d949b4d14", "created": "2021-07-16T11:52:37.159Z", "modified": "2021-07-16T11:52:37.159Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--b5122c25-0dc9-4821-a1b3-5bec9b637d5c", "target_ref": "attack-pattern--6a3f6490-9c44-40de-b059-e5940f246673" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f21a867b-a27d-4958-92a0-007a7f0adbdd", "created": "2021-07-16T11:52:37.159Z", "modified": "2021-07-16T11:52:37.159Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--3372c781-3cf3-479a-aaeb-b9748fdfc149", "target_ref": "attack-pattern--b5122c25-0dc9-4821-a1b3-5bec9b637d5c" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--24df49d4-4538-48d4-b6c6-88e7639e40a6", "created": "2021-07-16T11:52:37.160Z", "modified": "2021-07-16T11:52:37.160Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "SMS Control as used by Hexed Noodle", "kill_chain_phases": [ { "kill_chain_name": "mitre-mobile-attack", "phase_name": "impact" } ], "description": "Hexed Noodle enables the operator to send SMS messages from the victim device" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--dd30e3dd-023f-417a-96da-b2eb278ad177", "created": "2021-07-16T11:52:37.160Z", "modified": "2021-07-16T11:52:37.160Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "attack-pattern--24df49d4-4538-48d4-b6c6-88e7639e40a6", "target_ref": "attack-pattern--b327a9c0-e709-495c-aa6e-00b042136e2b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--50ba0126-1676-44a1-af09-2f1fdd57e5d2", "created": "2021-07-16T11:52:37.160Z", "modified": "2021-07-16T11:52:37.160Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "uses", "source_ref": "malware--3372c781-3cf3-479a-aaeb-b9748fdfc149", "target_ref": "attack-pattern--24df49d4-4538-48d4-b6c6-88e7639e40a6" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2a99fe65-d4bb-4d48-b294-02fa4a95f90a", "created": "2021-07-16T11:52:37.160Z", "modified": "2021-07-16T11:52:37.160Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "rule dexstrings_plaincomms_obfushex_a9ff1e {\r\n meta:\r\n author = \"NCSC\"\r\n description = \"Plaintext strings from a Hexed Noodle 'classes.dex' file\"\r\n hash = \"a9ff1ebb548f5bba600d38e709ff331749fa9971\"\r\n\r\n strings:\r\n $exfil1 = \"multipart/form-data; boundary=$$$$$$$$$$$$$$$$\"\r\n $exfil2 = \"Content-Disposition: form-data; name=\\\"binary\\\"; filename=\\\"\"\r\n $reqFormatAParam1 = /\\?m=[a-d]&p1=/\r\n $reqFormatAParam2 = /&p2=[a-c]/\r\n $smsdb = \"slist.ldb\" //\"flist.ldb\" (name of the files db) is obfuscated but the developers have forgotten to wrap this sms database filename\r\n\r\n\r\n condition:\r\n 3 of them\r\n}\r\n", "description": "Plaintext strings from a Hexed Noodle ‘classes.dex’ file", "valid_from": "2021-07-16T11:52:37.160Z", "name": "YARA: dexstrings_plaincomms_obfushex_a9ff1e ", "pattern_type": "yara" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--961c0f0b-10fd-4766-b40e-b37057bfa977", "created": "2021-07-16T11:52:37.160Z", "modified": "2021-07-16T11:52:37.160Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--2a99fe65-d4bb-4d48-b294-02fa4a95f90a", "target_ref": "malware--3372c781-3cf3-479a-aaeb-b9748fdfc149" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--70097238-c373-4894-acb7-01c0efae8920", "created": "2021-07-16T11:52:37.160Z", "modified": "2021-07-16T11:52:37.160Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--2a99fe65-d4bb-4d48-b294-02fa4a95f90a", "target_ref": "attack-pattern--cbeb08a6-9bda-4c50-8f47-b35e1bcf874c" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4bd64180-9c0a-4769-aa03-472f5b85720e", "created": "2021-07-16T11:52:37.160Z", "modified": "2021-07-16T11:52:37.160Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--2a99fe65-d4bb-4d48-b294-02fa4a95f90a", "target_ref": "attack-pattern--82b96f45-de93-49c1-b764-c7f77a93a64a" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0e4c96d4-f792-4fb9-8639-0bcc9eae2fa3", "created": "2021-07-16T11:52:37.161Z", "modified": "2021-07-16T11:52:37.161Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--00c6a61a-4dae-49eb-9fba-a7e965939052", "target_ref": "indicator--ec7e3606-a343-4939-a08b-c568f3bac468" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6a4ab3c9-e3fd-4426-8d54-1221dd43c6fa", "created": "2021-07-16T11:52:37.161Z", "modified": "2021-07-16T11:52:37.161Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--00c6a61a-4dae-49eb-9fba-a7e965939052", "target_ref": "indicator--8ac4ccb4-b4cf-4d0d-8391-ce2f9d0cd553" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--de535343-fb70-497c-92eb-6f6604a31b84", "created": "2021-07-16T11:52:37.161Z", "modified": "2021-07-16T11:52:37.161Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--00c6a61a-4dae-49eb-9fba-a7e965939052", "target_ref": "indicator--0a96af19-d3ca-4270-8257-b9bb85b3e034" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2a0228f2-ed6b-4aa6-a0e1-3d9f76ca759a", "created": "2021-07-16T11:52:37.161Z", "modified": "2021-07-16T11:52:37.161Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--ec7e3606-a343-4939-a08b-c568f3bac468", "target_ref": "indicator--00c6a61a-4dae-49eb-9fba-a7e965939052" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ba590771-8f39-47f7-8b88-659071e73217", "created": "2021-07-16T11:52:37.161Z", "modified": "2021-07-16T11:52:37.161Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--ec7e3606-a343-4939-a08b-c568f3bac468", "target_ref": "indicator--8ac4ccb4-b4cf-4d0d-8391-ce2f9d0cd553" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e12f6dbb-6fd7-4ca5-bda4-88e08d6c4328", "created": "2021-07-16T11:52:37.162Z", "modified": "2021-07-16T11:52:37.162Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--ec7e3606-a343-4939-a08b-c568f3bac468", "target_ref": "indicator--0a96af19-d3ca-4270-8257-b9bb85b3e034" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2087530f-dc87-45ed-800b-5d33baedbbe7", "created": "2021-07-16T11:52:37.162Z", "modified": "2021-07-16T11:52:37.162Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--8ac4ccb4-b4cf-4d0d-8391-ce2f9d0cd553", "target_ref": "indicator--00c6a61a-4dae-49eb-9fba-a7e965939052" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c0a3a3e1-6182-4ab0-8927-c7688dd2c3d0", "created": "2021-07-16T11:52:37.162Z", "modified": "2021-07-16T11:52:37.162Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--8ac4ccb4-b4cf-4d0d-8391-ce2f9d0cd553", "target_ref": "indicator--ec7e3606-a343-4939-a08b-c568f3bac468" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fb777dc5-de3d-47c1-8076-590c71ff3481", "created": "2021-07-16T11:52:37.162Z", "modified": "2021-07-16T11:52:37.162Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--8ac4ccb4-b4cf-4d0d-8391-ce2f9d0cd553", "target_ref": "indicator--0a96af19-d3ca-4270-8257-b9bb85b3e034" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3050dc31-4c8f-403a-b68c-4cb285b5cd00", "created": "2021-07-16T11:52:37.162Z", "modified": "2021-07-16T11:52:37.162Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--0a96af19-d3ca-4270-8257-b9bb85b3e034", "target_ref": "indicator--00c6a61a-4dae-49eb-9fba-a7e965939052" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--99907adf-4c9c-4041-81e4-74b84f621d60", "created": "2021-07-16T11:52:37.162Z", "modified": "2021-07-16T11:52:37.162Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--0a96af19-d3ca-4270-8257-b9bb85b3e034", "target_ref": "indicator--ec7e3606-a343-4939-a08b-c568f3bac468" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d7cf27e1-5118-4757-bd9d-f4565a4efab8", "created": "2021-07-16T11:52:37.162Z", "modified": "2021-07-16T11:52:37.162Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--0a96af19-d3ca-4270-8257-b9bb85b3e034", "target_ref": "indicator--8ac4ccb4-b4cf-4d0d-8391-ce2f9d0cd553" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--98eb5a08-8283-4370-b6d2-c61c1f906d8d", "created": "2021-07-16T11:52:37.162Z", "modified": "2021-07-16T11:52:37.162Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--1f162322-6b3d-4ad7-909c-7af000703f0b", "target_ref": "indicator--8677799e-5e56-4ed4-aeaa-401d08c4644a" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7e13e0be-4bc3-4986-bd0b-a7ac15363ca3", "created": "2021-07-16T11:52:37.162Z", "modified": "2021-07-16T11:52:37.162Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--1f162322-6b3d-4ad7-909c-7af000703f0b", "target_ref": "indicator--4a6df343-2fbb-42e1-b7d4-4fa3a32a73e8" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--79b4d773-a181-4e76-af1f-85fbda93dd43", "created": "2021-07-16T11:52:37.162Z", "modified": "2021-07-16T11:52:37.162Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--1f162322-6b3d-4ad7-909c-7af000703f0b", "target_ref": "indicator--51d03d06-5307-4fa0-9e74-27718fca2d0a" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1c30bb42-f8b7-4798-b029-654aaf4e52cd", "created": "2021-07-16T11:52:37.162Z", "modified": "2021-07-16T11:52:37.162Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--8677799e-5e56-4ed4-aeaa-401d08c4644a", "target_ref": "indicator--1f162322-6b3d-4ad7-909c-7af000703f0b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e8b076f6-27bd-4031-a927-74974e90024d", "created": "2021-07-16T11:52:37.162Z", "modified": "2021-07-16T11:52:37.162Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--8677799e-5e56-4ed4-aeaa-401d08c4644a", "target_ref": "indicator--4a6df343-2fbb-42e1-b7d4-4fa3a32a73e8" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--71499bad-fa43-4b91-87d5-63a44013e823", "created": "2021-07-16T11:52:37.162Z", "modified": "2021-07-16T11:52:37.162Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--8677799e-5e56-4ed4-aeaa-401d08c4644a", "target_ref": "indicator--51d03d06-5307-4fa0-9e74-27718fca2d0a" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e0d4cd00-7cc6-40d9-a0e2-5e76679609e5", "created": "2021-07-16T11:52:37.162Z", "modified": "2021-07-16T11:52:37.162Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--4a6df343-2fbb-42e1-b7d4-4fa3a32a73e8", "target_ref": "indicator--1f162322-6b3d-4ad7-909c-7af000703f0b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d7ab1fb3-d20d-482c-89de-f11dab987538", "created": "2021-07-16T11:52:37.163Z", "modified": "2021-07-16T11:52:37.163Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--4a6df343-2fbb-42e1-b7d4-4fa3a32a73e8", "target_ref": "indicator--8677799e-5e56-4ed4-aeaa-401d08c4644a" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4f3205be-45a7-4a13-8fbe-b8cdca26743a", "created": "2021-07-16T11:52:37.163Z", "modified": "2021-07-16T11:52:37.163Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--4a6df343-2fbb-42e1-b7d4-4fa3a32a73e8", "target_ref": "indicator--51d03d06-5307-4fa0-9e74-27718fca2d0a" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--53635ae6-065a-430e-bba7-82510e1feaca", "created": "2021-07-16T11:52:37.163Z", "modified": "2021-07-16T11:52:37.163Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--51d03d06-5307-4fa0-9e74-27718fca2d0a", "target_ref": "indicator--1f162322-6b3d-4ad7-909c-7af000703f0b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c8b7e395-2a60-4bb1-b7b6-9a7935e57971", "created": "2021-07-16T11:52:37.163Z", "modified": "2021-07-16T11:52:37.163Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--51d03d06-5307-4fa0-9e74-27718fca2d0a", "target_ref": "indicator--8677799e-5e56-4ed4-aeaa-401d08c4644a" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--caebdb17-94df-4724-a0d4-67b0fae843a7", "created": "2021-07-16T11:52:37.163Z", "modified": "2021-07-16T11:52:37.163Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "related-to", "source_ref": "indicator--51d03d06-5307-4fa0-9e74-27718fca2d0a", "target_ref": "indicator--4a6df343-2fbb-42e1-b7d4-4fa3a32a73e8" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--00c6a61a-4dae-49eb-9fba-a7e965939052", "created": "2021-07-16T11:52:37.161Z", "modified": "2021-07-16T11:52:37.161Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:name = 'Kisa Vaccine.apk']", "description": "Android backdoor masquerading as a security app (variant)", "valid_from": "2021-07-16T11:52:37.161Z", "name": "Hexed Noodle sample (Filename: Kisa Vaccine.apk)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--73f7349d-acc6-4350-a15f-22c09d0e243c", "created": "2021-07-16T11:52:37.163Z", "modified": "2021-07-16T11:52:37.163Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--00c6a61a-4dae-49eb-9fba-a7e965939052", "target_ref": "malware--3372c781-3cf3-479a-aaeb-b9748fdfc149" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ec7e3606-a343-4939-a08b-c568f3bac468", "created": "2021-07-16T11:52:37.161Z", "modified": "2021-07-16T11:52:37.161Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'MD5' = 'c2a7b3722c3517b14986092fd61b79e6']", "description": "Android backdoor masquerading as a security app (variant)", "valid_from": "2021-07-16T11:52:37.161Z", "name": "Hexed Noodle sample (MD5: c2a7b3722c3517b14986092fd61b79e6)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5334858c-b0ce-451a-aba7-4dd431470f32", "created": "2021-07-16T11:52:37.163Z", "modified": "2021-07-16T11:52:37.163Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--ec7e3606-a343-4939-a08b-c568f3bac468", "target_ref": "malware--3372c781-3cf3-479a-aaeb-b9748fdfc149" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8ac4ccb4-b4cf-4d0d-8391-ce2f9d0cd553", "created": "2021-07-16T11:52:37.161Z", "modified": "2021-07-16T11:52:37.161Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-1' = 'd5af22de750d7e3fc91dc154163019b7a245651b']", "description": "Android backdoor masquerading as a security app (variant)", "valid_from": "2021-07-16T11:52:37.161Z", "name": "Hexed Noodle sample (SHA-1: d5af22de750d7e3fc91dc154163019b7a245651b)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a60dff55-4ef2-4fd0-9afc-048dbd73a14b", "created": "2021-07-16T11:52:37.163Z", "modified": "2021-07-16T11:52:37.163Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--8ac4ccb4-b4cf-4d0d-8391-ce2f9d0cd553", "target_ref": "malware--3372c781-3cf3-479a-aaeb-b9748fdfc149" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0a96af19-d3ca-4270-8257-b9bb85b3e034", "created": "2021-07-16T11:52:37.161Z", "modified": "2021-07-16T11:52:37.161Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-256' = '98909e68fe603a86de5488b8f8860a33dafdace03eebf56f9d680a84c2b66521']", "description": "Android backdoor masquerading as a security app (variant)", "valid_from": "2021-07-16T11:52:37.161Z", "name": "Hexed Noodle sample (SHA-256: 98909e68fe603a86de5488b8f8860a33dafdace03eebf56f9d680a84c2b66521)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bce8b0a4-dc92-4630-ab60-e74a0abea3d3", "created": "2021-07-16T11:52:37.163Z", "modified": "2021-07-16T11:52:37.163Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--0a96af19-d3ca-4270-8257-b9bb85b3e034", "target_ref": "malware--3372c781-3cf3-479a-aaeb-b9748fdfc149" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1f162322-6b3d-4ad7-909c-7af000703f0b", "created": "2021-07-16T11:52:37.162Z", "modified": "2021-07-16T11:52:37.162Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:name = 'KisaAndroidSecurity.apk']", "description": "Android backdoor masquerading as a security app", "valid_from": "2021-07-16T11:52:37.162Z", "name": "Hexed Noodle sample (Filename: KisaAndroidSecurity.apk)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ea4e4c5b-710c-4d03-84dd-1fac83b8abc3", "created": "2021-07-16T11:52:37.163Z", "modified": "2021-07-16T11:52:37.163Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--1f162322-6b3d-4ad7-909c-7af000703f0b", "target_ref": "malware--3372c781-3cf3-479a-aaeb-b9748fdfc149" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8677799e-5e56-4ed4-aeaa-401d08c4644a", "created": "2021-07-16T11:52:37.162Z", "modified": "2021-07-16T11:52:37.162Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'MD5' = '4626ed60dfc8deaf75477bc06bd39be7']", "description": "Android backdoor masquerading as a security app", "valid_from": "2021-07-16T11:52:37.162Z", "name": "Hexed Noodle sample (MD5: 4626ed60dfc8deaf75477bc06bd39be7)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cea0688c-93a6-4939-be3b-20f4f2614f95", "created": "2021-07-16T11:52:37.163Z", "modified": "2021-07-16T11:52:37.163Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--8677799e-5e56-4ed4-aeaa-401d08c4644a", "target_ref": "malware--3372c781-3cf3-479a-aaeb-b9748fdfc149" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4a6df343-2fbb-42e1-b7d4-4fa3a32a73e8", "created": "2021-07-16T11:52:37.162Z", "modified": "2021-07-16T11:52:37.162Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-1' = 'a9ff1ebb548f5bba600d38e709ff331749fa9971']", "description": "Android backdoor masquerading as a security app", "valid_from": "2021-07-16T11:52:37.162Z", "name": "Hexed Noodle sample (SHA-1: a9ff1ebb548f5bba600d38e709ff331749fa9971)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--02a167ce-3f30-4b68-9856-6b94e6bd93df", "created": "2021-07-16T11:52:37.163Z", "modified": "2021-07-16T11:52:37.163Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--4a6df343-2fbb-42e1-b7d4-4fa3a32a73e8", "target_ref": "malware--3372c781-3cf3-479a-aaeb-b9748fdfc149" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--51d03d06-5307-4fa0-9e74-27718fca2d0a", "created": "2021-07-16T11:52:37.162Z", "modified": "2021-07-16T11:52:37.162Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:hashes.'SHA-256' = '2365a48f7d6cf6dcc83195f06ea11b93c955c3a491c60b50ba42788917ba22e2']", "description": "Android backdoor masquerading as a security app", "valid_from": "2021-07-16T11:52:37.162Z", "name": "Hexed Noodle sample (SHA-256: 2365a48f7d6cf6dcc83195f06ea11b93c955c3a491c60b50ba42788917ba22e2)", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8615d22e-d230-48c9-8f1b-8e69c6961dc1", "created": "2021-07-16T11:52:37.163Z", "modified": "2021-07-16T11:52:37.163Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--51d03d06-5307-4fa0-9e74-27718fca2d0a", "target_ref": "malware--3372c781-3cf3-479a-aaeb-b9748fdfc149" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--fa254dfb-b51d-4952-8c57-09ad544f32c2", "created": "2021-07-16T11:52:37.163Z", "modified": "2021-07-16T11:52:37.163Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[domain-name:value = 'app.at-me.ml']", "description": "C2 domain", "valid_from": "2021-07-16T11:52:37.163Z", "name": "Domain Name: app.at-me.ml", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5fdbb054-4aa3-498c-9a9b-bac5440cf837", "created": "2021-07-16T11:52:37.164Z", "modified": "2021-07-16T11:52:37.164Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--fa254dfb-b51d-4952-8c57-09ad544f32c2", "target_ref": "malware--3372c781-3cf3-479a-aaeb-b9748fdfc149" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--40be2726-038b-4ef5-a03c-dfbf70c3f3ea", "created": "2021-07-16T11:52:37.164Z", "modified": "2021-07-16T11:52:37.164Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--fa254dfb-b51d-4952-8c57-09ad544f32c2", "target_ref": "attack-pattern--170fdd9e-0168-4531-b09c-cc025285589a" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cf79440e-3d85-4465-a379-3cb34a6b0cd7", "created": "2021-07-16T11:52:37.164Z", "modified": "2021-07-16T11:52:37.164Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--fa254dfb-b51d-4952-8c57-09ad544f32c2", "target_ref": "attack-pattern--cbeb08a6-9bda-4c50-8f47-b35e1bcf874c" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--03937c3a-b2bd-4798-97ce-68a8dade7689", "created": "2021-07-16T11:52:37.164Z", "modified": "2021-07-16T11:52:37.164Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--fa254dfb-b51d-4952-8c57-09ad544f32c2", "target_ref": "attack-pattern--2215499f-5bfb-4484-8960-88012a7701e2" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--819865c4-17cd-405f-9efd-91229cdfe617", "created": "2021-07-16T11:52:37.164Z", "modified": "2021-07-16T11:52:37.164Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--fa254dfb-b51d-4952-8c57-09ad544f32c2", "target_ref": "attack-pattern--718fbe03-ffe0-4f4b-a22b-4c010d49b3b3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f4dd7ebf-25a2-4fe1-a11b-101138af0a79", "created": "2021-07-16T11:52:37.164Z", "modified": "2021-07-16T11:52:37.164Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--fa254dfb-b51d-4952-8c57-09ad544f32c2", "target_ref": "attack-pattern--b5122c25-0dc9-4821-a1b3-5bec9b637d5c" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7130b5a8-b2b9-4878-9a9f-34194bdf6bac", "created": "2021-07-16T11:52:37.164Z", "modified": "2021-07-16T11:52:37.164Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--fa254dfb-b51d-4952-8c57-09ad544f32c2", "target_ref": "indicator--ec7e3606-a343-4939-a08b-c568f3bac468" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b84eeaca-277a-4fce-bf0e-9eafb777e2fe", "created": "2021-07-16T11:52:37.164Z", "modified": "2021-07-16T11:52:37.164Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--fa254dfb-b51d-4952-8c57-09ad544f32c2", "target_ref": "indicator--8ac4ccb4-b4cf-4d0d-8391-ce2f9d0cd553" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--084822a9-d616-41a5-b5ac-f1547bbff6d8", "created": "2021-07-16T11:52:37.164Z", "modified": "2021-07-16T11:52:37.164Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--fa254dfb-b51d-4952-8c57-09ad544f32c2", "target_ref": "indicator--0a96af19-d3ca-4270-8257-b9bb85b3e034" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2325f89f-ef02-40b4-8a02-76127a171b17", "created": "2021-07-16T11:52:37.164Z", "modified": "2021-07-16T11:52:37.164Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[domain-name:value = 'download.riseknite.life']", "description": "C2 domain", "valid_from": "2021-07-16T11:52:37.164Z", "name": "Domain Name: download.riseknite.life", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b50d4a9d-9551-4970-984c-4632ae81bb0e", "created": "2021-07-16T11:52:37.164Z", "modified": "2021-07-16T11:52:37.164Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--2325f89f-ef02-40b4-8a02-76127a171b17", "target_ref": "malware--3372c781-3cf3-479a-aaeb-b9748fdfc149" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8470e056-e62b-430f-b475-4516ded9866a", "created": "2021-07-16T11:52:37.164Z", "modified": "2021-07-16T11:52:37.164Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--2325f89f-ef02-40b4-8a02-76127a171b17", "target_ref": "attack-pattern--170fdd9e-0168-4531-b09c-cc025285589a" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ec22d2d2-7bf3-4409-bade-bdd2679c1855", "created": "2021-07-16T11:52:37.164Z", "modified": "2021-07-16T11:52:37.164Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--2325f89f-ef02-40b4-8a02-76127a171b17", "target_ref": "attack-pattern--cbeb08a6-9bda-4c50-8f47-b35e1bcf874c" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f827c4ee-6c9a-48d0-8a62-b57c81fba94f", "created": "2021-07-16T11:52:37.164Z", "modified": "2021-07-16T11:52:37.164Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--2325f89f-ef02-40b4-8a02-76127a171b17", "target_ref": "attack-pattern--2215499f-5bfb-4484-8960-88012a7701e2" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8f6ec135-9b81-455c-bcd6-cabb35faa132", "created": "2021-07-16T11:52:37.164Z", "modified": "2021-07-16T11:52:37.164Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--2325f89f-ef02-40b4-8a02-76127a171b17", "target_ref": "attack-pattern--b5122c25-0dc9-4821-a1b3-5bec9b637d5c" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--09716678-356b-415d-9af5-d838ebe9350a", "created": "2021-07-16T11:52:37.164Z", "modified": "2021-07-16T11:52:37.164Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--2325f89f-ef02-40b4-8a02-76127a171b17", "target_ref": "attack-pattern--718fbe03-ffe0-4f4b-a22b-4c010d49b3b3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b18fce1a-a9f2-4a81-873d-ab661eed3e85", "created": "2021-07-16T11:52:37.165Z", "modified": "2021-07-16T11:52:37.165Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--2325f89f-ef02-40b4-8a02-76127a171b17", "target_ref": "indicator--8677799e-5e56-4ed4-aeaa-401d08c4644a" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ad35a5e8-1c0c-4b5b-b296-003baf3f030e", "created": "2021-07-16T11:52:37.165Z", "modified": "2021-07-16T11:52:37.165Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--2325f89f-ef02-40b4-8a02-76127a171b17", "target_ref": "indicator--4a6df343-2fbb-42e1-b7d4-4fa3a32a73e8" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bf7de084-2d4d-42dc-8c31-2022a74876d3", "created": "2021-07-16T11:52:37.165Z", "modified": "2021-07-16T11:52:37.165Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--2325f89f-ef02-40b4-8a02-76127a171b17", "target_ref": "indicator--51d03d06-5307-4fa0-9e74-27718fca2d0a" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7f25a244-022b-4620-99cb-55d52d2cf998", "created": "2021-07-16T11:52:37.165Z", "modified": "2021-07-16T11:52:37.165Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:name = 'flist.ldb']", "description": "A list of MD5 hashes of file filenames/dates used for avoiding duplicate file exfiltration ", "valid_from": "2021-07-16T11:52:37.165Z", "name": "Filename: flist.ldb", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6a8d6ce0-abff-48f6-8da1-6a5c53a967cc", "created": "2021-07-16T11:52:37.165Z", "modified": "2021-07-16T11:52:37.165Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--7f25a244-022b-4620-99cb-55d52d2cf998", "target_ref": "malware--3372c781-3cf3-479a-aaeb-b9748fdfc149" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b7f7472b-7080-4820-8379-41887d2887e0", "created": "2021-07-16T11:52:37.165Z", "modified": "2021-07-16T11:52:37.165Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--7f25a244-022b-4620-99cb-55d52d2cf998", "target_ref": "attack-pattern--4077d0fe-1327-4b81-a3db-d91b74e84246" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b4773714-7393-426f-852e-07676ab30662", "created": "2021-07-16T11:52:37.165Z", "modified": "2021-07-16T11:52:37.165Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--7f25a244-022b-4620-99cb-55d52d2cf998", "target_ref": "indicator--ec7e3606-a343-4939-a08b-c568f3bac468" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f0712d8a-5dde-4a43-8a06-e1e4c912d6b8", "created": "2021-07-16T11:52:37.165Z", "modified": "2021-07-16T11:52:37.165Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--7f25a244-022b-4620-99cb-55d52d2cf998", "target_ref": "indicator--8ac4ccb4-b4cf-4d0d-8391-ce2f9d0cd553" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6aa1d025-cd39-4104-871d-7f2648590ecd", "created": "2021-07-16T11:52:37.165Z", "modified": "2021-07-16T11:52:37.165Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--7f25a244-022b-4620-99cb-55d52d2cf998", "target_ref": "indicator--0a96af19-d3ca-4270-8257-b9bb85b3e034" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--dda3171d-6f44-4d26-87c7-7b34ed713e06", "created": "2021-07-16T11:52:37.165Z", "modified": "2021-07-16T11:52:37.165Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--7f25a244-022b-4620-99cb-55d52d2cf998", "target_ref": "indicator--8677799e-5e56-4ed4-aeaa-401d08c4644a" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cd831e3f-342c-41e0-8889-4d05099f655d", "created": "2021-07-16T11:52:37.165Z", "modified": "2021-07-16T11:52:37.165Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--7f25a244-022b-4620-99cb-55d52d2cf998", "target_ref": "indicator--4a6df343-2fbb-42e1-b7d4-4fa3a32a73e8" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--87e38122-860c-4784-8cc2-b2635bb6f9bb", "created": "2021-07-16T11:52:37.165Z", "modified": "2021-07-16T11:52:37.165Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--7f25a244-022b-4620-99cb-55d52d2cf998", "target_ref": "indicator--51d03d06-5307-4fa0-9e74-27718fca2d0a" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1f62a8ef-3935-48f9-8658-361ff52d8d58", "created": "2021-07-16T11:52:37.165Z", "modified": "2021-07-16T11:52:37.165Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "pattern": "[file:name = 'slist.ldb']", "description": "A list of MD5 hashes of SMS time/folder/addresses used for avoiding duplicate SMS exfiltration ", "valid_from": "2021-07-16T11:52:37.165Z", "name": "Filename: slist.ldb", "pattern_type": "stix" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bf6cd853-3996-4082-9dbb-cbb7268380d2", "created": "2021-07-16T11:52:37.166Z", "modified": "2021-07-16T11:52:37.166Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--1f62a8ef-3935-48f9-8658-361ff52d8d58", "target_ref": "malware--3372c781-3cf3-479a-aaeb-b9748fdfc149" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6de5cfce-fff1-4b34-be08-322e393ef45e", "created": "2021-07-16T11:52:37.166Z", "modified": "2021-07-16T11:52:37.166Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "indicates", "source_ref": "indicator--1f62a8ef-3935-48f9-8658-361ff52d8d58", "target_ref": "attack-pattern--4077d0fe-1327-4b81-a3db-d91b74e84246" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--deef0c84-2675-4ec2-aa68-2bad8f9e999f", "created": "2021-07-16T11:52:37.166Z", "modified": "2021-07-16T11:52:37.166Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--1f62a8ef-3935-48f9-8658-361ff52d8d58", "target_ref": "indicator--ec7e3606-a343-4939-a08b-c568f3bac468" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0e3e3f4b-976b-427b-90a2-d083ea8b756d", "created": "2021-07-16T11:52:37.166Z", "modified": "2021-07-16T11:52:37.166Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--1f62a8ef-3935-48f9-8658-361ff52d8d58", "target_ref": "indicator--8ac4ccb4-b4cf-4d0d-8391-ce2f9d0cd553" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1f8f6d4f-4462-4ac7-b148-36a238c8bc5f", "created": "2021-07-16T11:52:37.166Z", "modified": "2021-07-16T11:52:37.166Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--1f62a8ef-3935-48f9-8658-361ff52d8d58", "target_ref": "indicator--0a96af19-d3ca-4270-8257-b9bb85b3e034" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d8ace68f-ef2c-445a-9f88-b92668ea29ed", "created": "2021-07-16T11:52:37.166Z", "modified": "2021-07-16T11:52:37.166Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--1f62a8ef-3935-48f9-8658-361ff52d8d58", "target_ref": "indicator--8677799e-5e56-4ed4-aeaa-401d08c4644a" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7d5f1692-2119-465f-b128-b1ff6041d125", "created": "2021-07-16T11:52:37.166Z", "modified": "2021-07-16T11:52:37.166Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--1f62a8ef-3935-48f9-8658-361ff52d8d58", "target_ref": "indicator--4a6df343-2fbb-42e1-b7d4-4fa3a32a73e8" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--58beda91-13f0-4aca-95f6-4fe8f36ba773", "created": "2021-07-16T11:52:37.166Z", "modified": "2021-07-16T11:52:37.166Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "relationship_type": "derived-from", "source_ref": "indicator--1f62a8ef-3935-48f9-8658-361ff52d8d58", "target_ref": "indicator--51d03d06-5307-4fa0-9e74-27718fca2d0a" }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487", "created": "2022-10-01T00:00:00.000Z", "modified": "2022-10-01T00:00:00.000Z", "name": "TLP:CLEAR", "extensions": { "extension-definition--60a3c5c5-0d10-413e-aab3-9e08dde9e88d": { "extension_type": "property-extension", "tlp_2_0" : "clear" } } }, { "type": "identity", "spec_version": "2.1", "id": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "created": "2021-05-20T12:00:00.000Z", "modified": "2021-05-20T12:00:00.000Z", "name": "NCSC", "contact_information": "https://ncsc.gov.uk/section/about-this-website/contact-us" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a93ccb8f-3996-42e2-b7c7-bb599d4e205f", "created": "2017-10-25T14:48:35.247Z", "modified": "2020-04-08T15:19:56.147Z", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Masquerade as Legitimate Application", "description": "An adversary could distribute developed malware by masquerading the malware as a legitimate application. This can be done in two different ways: by embedding the malware in a legitimate application, or by pretending to be a legitimate application.\n\nEmbedding the malware in a legitimate application is done by downloading the application, disassembling it, adding the malicious code, and then re-assembling it.(Citation: Zhou) The app would appear to be the original app, but would contain additional malicious functionality. The adversary could then publish the malicious application to app stores or use another delivery method.\n\nPretending to be a legitimate application relies heavily on lack of scrutinization by the user. Typically, a malicious app pretending to be a legitimate one will have many similar details as the legitimate one, such as name, icon, and description.(Citation: Palo Alto HenBox)\n\nMalicious applications may also masquerade as legitimate applications when requesting access to the accessibility service in order to appear as legitimate to the user, increasing the likelihood that the access will be granted.", "external_references": [ { "source_name": "mitre-mobile-attack", "external_id": "T1444", "url": "https://attack.mitre.org/techniques/T1444" }, { "external_id": "APP-31", "source_name": "NIST Mobile Threat Catalogue", "url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-31.html" }, { "external_id": "APP-14", "source_name": "NIST Mobile Threat Catalogue", "url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-14.html" }, { "url": "http://ieeexplore.ieee.org/document/6234407", "description": "Yajin Zhou and Xuxian Jiang. (2012, May). Dissecting Android Malware: Characterization and Evolution. Retrieved December 9, 2016.", "source_name": "Zhou" }, { "source_name": "Palo Alto HenBox", "url": "https://unit42.paloaltonetworks.com/unit42-henbox-chickens-come-home-roost/", "description": "A. Hinchliffe, M. Harbison, J. Miller-Osborn, et al. (2018, March 13). HenBox: The Chickens Come Home to Roost. Retrieved September 9, 2019." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "kill_chain_phases": [ { "kill_chain_name": "mitre-mobile-attack", "phase_name": "initial-access" }, { "kill_chain_name": "mitre-mobile-attack", "phase_name": "defense-evasion" } ], "x_mitre_is_subtechnique": false, "x_mitre_contributors": [ "Alex Hinchliffe, Palo Alto Networks" ], "x_mitre_old_attack_id": "MOB-T1047", "x_mitre_version": "2.1", "x_mitre_tactic_type": [ "Post-Adversary Device Access" ], "x_mitre_platforms": [ "Android", "iOS" ], "x_mitre_detection": "Users can detect malicious applications by watching for nuances that could indicate the application is not the intended one when it is being installed.", "x_killchain": "mitre-mobile-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--24286c33-d4a4-4419-85c2-1d094a896c26", "created": "2020-10-02T16:40:47.488Z", "modified": "2021-04-15T03:23:21.031Z", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1592.001", "url": "https://attack.mitre.org/techniques/T1592/001" }, { "source_name": "ATT ScanBox", "url": "https://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks", "description": "Blasco, J. (2014, August 28). Scanbox: A Reconnaissance Framework Used with Watering Hole Attacks. Retrieved October 19, 2020." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Hardware", "description": "Adversaries may gather information about the victim's host hardware that can be used during targeting. Information about hardware infrastructure may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: card/biometric readers, dedicated encryption hardware, etc.).\n\nAdversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) (ex: hostnames, server banners, user agent strings) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Adversaries may also compromise sites then include malicious content designed to collect host information from visitors.(Citation: ATT ScanBox) Information about the hardware infrastructure may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Compromise Hardware Supply Chain](https://attack.mitre.org/techniques/T1195/003) or [Hardware Additions](https://attack.mitre.org/techniques/T1200)).", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "reconnaissance" } ], "x_mitre_detection": "Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.", "x_mitre_version": "1.0", "x_mitre_is_subtechnique": true, "x_mitre_platforms": [ "PRE" ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a9d4b653-6915-42af-98b2-5758c4ceee56", "created": "2020-03-09T14:15:05.330Z", "modified": "2020-06-15T16:55:44.483Z", "description": "Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux and macOS systems, though many variations of the Unix shell exist (e.g. sh, bash, zsh, etc.) depending on the specific OS or distribution.(Citation: DieNet Bash)(Citation: Apple ZShell) Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.\n\nUnix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops. Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems.\n\nAdversaries may abuse Unix shells to execute various commands or payloads. Interactive shells may be accessed through command and control channels or during lateral movement such as with [SSH](https://attack.mitre.org/techniques/T1021/004). Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence.", "name": "Unix Shell", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.004", "url": "https://attack.mitre.org/techniques/T1059/004" }, { "source_name": "DieNet Bash", "url": "https://linux.die.net/man/1/bash", "description": "die.net. (n.d.). bash(1) - Linux man page. Retrieved June 12, 2020." }, { "source_name": "Apple ZShell", "url": "https://support.apple.com/HT208050", "description": "Apple. (2020, January 28). Use zsh as the default shell on your Mac. Retrieved June 12, 2020." } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ], "x_mitre_platforms": [ "macOS", "Linux" ], "x_mitre_data_sources": [ "Command: Command Execution", "Process: Process Creation" ], "x_mitre_detection": "Unix shell usage may be common on administrator, developer, or power user systems, depending on job function. If scripting is restricted for normal users, then any attempt to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.\n\nScripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used. Monitor processes and command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information discovery, collection, or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script. ", "x_mitre_permissions_required": [ "User", "root" ], "x_mitre_is_subtechnique": true, "x_mitre_version": "1.0", "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--232b7f21-adf9-4b42-b936-b9d6f7df856e", "created": "2020-03-11T14:49:36.954Z", "modified": "2020-03-11T14:55:56.177Z", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ], "description": "An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001). Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, and .cpl.\n\nAdversaries may employ various forms of [Masquerading](https://attack.mitre.org/techniques/T1036) on the file to increase the likelihood that a user will open it.\n\nWhile [Malicious File](https://attack.mitre.org/techniques/T1204/002) frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after [Internal Spearphishing](https://attack.mitre.org/techniques/T1534).", "name": "Malicious File", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1204.002", "url": "https://attack.mitre.org/techniques/T1204/002" } ], "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_mitre_data_sources": [ "Process: Process Creation", "File: File Creation" ], "x_mitre_detection": "Monitor the execution of and command-line arguments for applications that may be used by an adversary to gain initial access that require user interaction. This includes compression applications, such as those for zip files, that can be used to [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) in payloads.\n\nAnti-virus can potentially detect malicious documents and files that are downloaded and executed on the user's computer. Endpoint sensing or network sensing can potentially detect malicious events once the file is opened (such as a Microsoft Word document or PDF reaching out to the internet or spawning powershell.exe).", "x_mitre_permissions_required": [ "User" ], "x_mitre_is_subtechnique": true, "x_mitre_version": "1.0", "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--bd4d32f5-eed4-4018-a649-40b229dd1d69", "created": "2017-10-25T14:48:30.127Z", "modified": "2020-03-27T15:28:03.858Z", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-mobile-attack", "external_id": "T1402", "url": "https://attack.mitre.org/techniques/T1402" }, { "source_name": "Android Changes to System Broadcasts", "url": "https://developer.android.com/guide/components/broadcasts#changes-system-broadcasts", "description": "Google. (2019, December 27). Broadcasts Overview. Retrieved January 27, 2020." } ], "description": "An intent is a message passed between Android application or system components. Applications can register to receive broadcast intents at runtime, which are system-wide intents delivered to each app when certain events happen on the device, such as network changes or the user unlocking the screen. Malicious applications can then trigger certain actions within the app based on which broadcast intent was received.\n\nFurther, malicious applications can register for intents broadcasted by other applications in addition to the Android system itself. This allows the malware to respond based on actions in other applications. This behavior typically indicates a more intimate knowledge, or potentially the targeting of specific devices, users, or applications.\n\nIn Android 8 (API level 26), broadcast intent behavior was changed, limiting the implicit intents that applications can register for in the manifest. In most cases, applications that register through the manifest will no longer receive the broadcasts. Now, applications must register context-specific broadcast receivers while the user is actively using the app.(Citation: Android Changes to System Broadcasts)", "name": "Broadcast Receivers", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "kill_chain_phases": [ { "kill_chain_name": "mitre-mobile-attack", "phase_name": "persistence" }, { "kill_chain_name": "mitre-mobile-attack", "phase_name": "execution" } ], "x_mitre_platforms": [ "Android" ], "x_mitre_tactic_type": [ "Post-Adversary Device Access" ], "x_mitre_version": "2.0", "x_mitre_old_attack_id": "MOB-T1005", "x_mitre_detection": "Broadcast intent receivers are part of standard OS-level APIs and are therefore typically undetectable to the end user.", "x_mitre_contributors": [ "Alex Hinchliffe, Palo Alto Networks" ], "x_mitre_is_subtechnique": false, "x_killchain": "mitre-mobile-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf", "created": "2020-01-23T17:46:59.535Z", "modified": "2021-04-24T13:50:12.837Z", "description": "Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon.(Citation: Microsoft Run Key)(Citation: MSDN Authentication Packages)(Citation: Microsoft TimeProvider)(Citation: Cylance Reg Persistence Sept 2013)(Citation: Linux Kernel Programming)  These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel.\n\nSince some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.", "name": "Boot or Logon Autostart Execution", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1547", "url": "https://attack.mitre.org/techniques/T1547" }, { "external_id": "CAPEC-564", "source_name": "capec", "url": "https://capec.mitre.org/data/definitions/564.html" }, { "url": "http://msdn.microsoft.com/en-us/library/aa376977", "description": "Microsoft. (n.d.). Run and RunOnce Registry Keys. Retrieved November 12, 2014.", "source_name": "Microsoft Run Key" }, { "url": "https://msdn.microsoft.com/library/windows/desktop/aa374733.aspx", "description": "Microsoft. (n.d.). Authentication Packages. Retrieved March 1, 2017.", "source_name": "MSDN Authentication Packages" }, { "url": "https://msdn.microsoft.com/library/windows/desktop/ms725475.aspx", "description": "Microsoft. (n.d.). Time Provider. Retrieved March 26, 2018.", "source_name": "Microsoft TimeProvider" }, { "url": "https://blog.cylance.com/windows-registry-persistence-part-2-the-run-keys-and-search-order", "description": "Langendorf, S. (2013, September 24). Windows Registry Persistence, Part 2: The Run Keys and Search-Order. Retrieved April 11, 2018.", "source_name": "Cylance Reg Persistence Sept 2013" }, { "source_name": "Linux Kernel Programming", "url": "https://www.tldp.org/LDP/lkmpg/2.4/lkmpg.pdf", "description": "Pomerantz, O., Salzman, P.. (2003, April 4). The Linux Kernel Module Programming Guide. Retrieved April 6, 2018." }, { "url": "https://technet.microsoft.com/en-us/sysinternals/bb963902", "description": "Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.", "source_name": "TechNet Autoruns" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" }, { "kill_chain_name": "mitre-attack", "phase_name": "privilege-escalation" } ], "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_mitre_detection": "Monitor for additions or modifications of mechanisms that could be used to trigger autostart execution, such as relevant additions to the Registry. Look for changes that are not correlated with known updates, patches, or other planned administrative activity. Tools such as Sysinternals Autoruns may also be used to detect system autostart configuration changes that could be attempts at persistence.(Citation: TechNet Autoruns) Changes to some autostart configuration settings may happen under normal conditions when legitimate software is installed. \n\nSuspicious program execution as autostart programs may show up as outlier processes that have not been seen before when compared against historical data.To increase confidence of malicious activity, data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.\n\nMonitor DLL loads by processes, specifically looking for DLLs that are not recognized or not normally loaded into a process. Look for abnormal process behavior that may be due to a process loading a malicious DLL.\n\nMonitor for abnormal usage of utilities and command-line parameters involved in kernel modification or driver installation.", "x_mitre_permissions_required": [ "User", "Administrator", "root" ], "x_mitre_is_subtechnique": false, "x_mitre_version": "1.1", "x_mitre_data_sources": [ "File: File Creation", "Windows Registry: Windows Registry Key Creation", "Windows Registry: Windows Registry Key Modification", "File: File Modification", "Command: Command Execution", "Process: Process Creation", "Module: Module Load", "Kernel: Kernel Module Load", "Driver: Driver Load", "Process: OS API Execution" ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d13fa042-8f26-44e1-a2a8-af0bf8e2ac9a", "created": "2017-10-25T14:48:32.328Z", "modified": "2019-09-23T13:26:01.263Z", "kill_chain_phases": [ { "kill_chain_name": "mitre-mobile-attack", "phase_name": "defense-evasion" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-mobile-attack", "url": "https://attack.mitre.org/techniques/T1406", "external_id": "T1406" }, { "external_id": "APP-21", "source_name": "NIST Mobile Threat Catalogue", "url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-21.html" }, { "url": "http://pages.cs.wisc.edu/~vrastogi/static/papers/rcj13b.pdf", "description": "Vaibhav Rastogi, Yan Chen, and Xuxian Jiang. (2013, May). DroidChameleon: Evaluating Android Anti-malware against Transformation Attacks. Retrieved December 9, 2016.", "source_name": "Rastogi" }, { "url": "http://ieeexplore.ieee.org/document/6234407", "description": "Yajin Zhou and Xuxian Jiang. (2012, May). Dissecting Android Malware: Characterization and Evolution. Retrieved December 9, 2016.", "source_name": "Zhou" }, { "url": "http://blog.trendmicro.com/trendlabs-security-intelligence/cybercriminals-improve-android-malware-stealth-routines-with-obad/", "description": "Veo Zhang. (2013, June 13). Cybercriminals Improve Android Malware Stealth Routines with OBAD. Retrieved December 9, 2016.", "source_name": "TrendMicro-Obad" }, { "url": "http://www.slideshare.net/Shakacon/fruit-vs-zombies-defeat-nonjailbroken-ios-malware-by-claud-xiao", "description": "Claud Xiao. (2016, July). Fruit vs Zombies: Defeat Non-jailbroken iOS Malware. Retrieved December 9, 2016.", "source_name": "Xiao-iOS" } ], "description": "An app could contain malicious code in obfuscated or encrypted form, then deobfuscate or decrypt the code at runtime to evade many app vetting techniques.(Citation: Rastogi) (Citation: Zhou) (Citation: TrendMicro-Obad) (Citation: Xiao-iOS)", "name": "Obfuscated Files or Information", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "x_mitre_platforms": [ "Android", "iOS" ], "x_mitre_tactic_type": [ "Post-Adversary Device Access" ], "x_mitre_version": "2.0", "x_mitre_old_attack_id": "MOB-T1009", "x_mitre_detection": "Malicious obfuscation of files or information can be difficult to detect, and therefore enterprises may be better served focusing on detection at other stages of adversary behavior.", "x_killchain": "mitre-mobile-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--41868330-6ee2-4d0f-b743-9f2294c3c9b6", "created": "2020-02-20T21:08:52.529Z", "modified": "2020-03-29T18:27:30.891Z", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1560.002", "url": "https://attack.mitre.org/techniques/T1560/002" }, { "source_name": "PyPI RAR", "url": "https://pypi.org/project/rarfile/", "description": "mkz. (2020). rarfile 3.1. Retrieved February 20, 2020." }, { "source_name": "libzip", "url": "https://libzip.org/", "description": "D. Baron, T. Klausner. (2020). libzip. Retrieved February 20, 2020." }, { "source_name": "Zlib Github", "url": "https://github.com/madler/zlib", "description": "madler. (2017). zlib. Retrieved February 20, 2020." }, { "url": "https://en.wikipedia.org/wiki/List_of_file_signatures", "description": "Wikipedia. (2016, March 31). List of file signatures. Retrieved April 22, 2016.", "source_name": "Wikipedia File Header Signatures" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Archive via Library", "description": "An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. Many libraries exist that can archive data, including [Python](https://attack.mitre.org/techniques/T1059/006) rarfile (Citation: PyPI RAR), libzip (Citation: libzip), and zlib (Citation: Zlib Github). Most libraries include functionality to encrypt and/or compress data.\n\nSome archival libraries are preinstalled on systems, such as bzip2 on macOS and Linux, and zip on Windows. Note that the libraries are different from the utilities. The libraries can be linked against when compiling, while the utilities require spawning a subshell, or a similar execution mechanism.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ], "x_mitre_version": "1.0", "x_mitre_is_subtechnique": true, "x_mitre_detection": "Monitor processes for accesses to known archival libraries. This may yield a significant number of benign events, depending on how systems in the environment are typically used.\n\nConsider detecting writing of files with extensions and/or headers associated with compressed or encrypted file types. Detection efforts may focus on follow-on exfiltration activity, where compressed or encrypted files can be detected in transit with a network intrusion detection or data loss prevention system analyzing file headers.(Citation: Wikipedia File Header Signatures)", "x_mitre_data_sources": [ "File: File Creation", "Script: Script Execution" ], "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--3c4a2599-71ee-4405-ba1e-0e28414b4bc5", "created": "2017-05-31T21:30:20.537Z", "modified": "2020-05-26T19:21:25.974Z", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1005", "external_id": "T1005" } ], "description": "Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.\n\nAdversaries may do this using a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), such as [cmd](https://attack.mitre.org/software/S0106), which has functionality to interact with the file system to gather information. Some adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on the local system.\n", "name": "Data from Local System", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "x_mitre_version": "1.2", "x_mitre_data_sources": [ "File: File Access", "Command: Command Execution" ], "x_mitre_detection": "Monitor processes and command-line arguments for actions that could be taken to collect files from a system. Remote access tools with built-in features may interact directly with the Windows API to gather data. Data may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).", "x_mitre_system_requirements": [ "Privileges to access certain files and directories" ], "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_mitre_is_subtechnique": false, "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--30208d3e-0d6b-43c8-883e-44462a514619", "created": "2017-05-31T21:31:27.985Z", "modified": "2020-03-31T22:18:43.019Z", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "collection" } ], "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Automated Collection", "description": "Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals. This functionality could also be built into remote access tools. \n\nThis technique may incorporate use of other techniques such as [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) and [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570) to identify and move files.", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1119", "external_id": "T1119" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_system_requirements": [ "Permissions to access directories and files that store information of interest." ], "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_mitre_permissions_required": [ "User" ], "x_mitre_detection": "Depending on the method used, actions could include common file system commands and parameters on the command-line interface within batch files or scripts. A sequence of actions like this may be unusual, depending on the system and network environment. Automated collection may occur along with other techniques such as [Data Staged](https://attack.mitre.org/techniques/T1074). As such, file access monitoring that shows an unusual process performing sequential file opens and potentially copy actions to another location on the file system for many files at once may indicate automated collection behavior. Remote access tools with built-in features may interact directly with the Windows API to gather data. Data may also be acquired through Windows system management tools such as [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) and [PowerShell](https://attack.mitre.org/techniques/T1059/001).", "x_mitre_data_sources": [ "File: File Access", "Command: Command Execution", "Script: Script Execution" ], "x_mitre_version": "1.0", "x_mitre_is_subtechnique": false, "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e8b4e1ec-8e3b-484c-9038-4459b1ed8060", "created": "2017-10-25T14:48:15.920Z", "modified": "2019-09-18T18:28:50.898Z", "kill_chain_phases": [ { "kill_chain_name": "mitre-mobile-attack", "phase_name": "collection" }, { "kill_chain_name": "mitre-mobile-attack", "phase_name": "credential-access" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-mobile-attack", "url": "https://attack.mitre.org/techniques/T1412", "external_id": "T1412" } ], "description": "A malicious application could capture sensitive data sent via SMS, including authentication credentials. SMS is frequently used to transmit codes used for multi-factor authentication.\n\nOn Android, a malicious application must request and obtain permission (either at app install time or run time) in order to receive SMS messages. Alternatively, a malicious application could attempt to perform an operating system privilege escalation attack to bypass the permission requirement.\n\nOn iOS, applications cannot access SMS messages in normal operation, so an adversary would need to attempt to perform an operating system privilege escalation attack to potentially be able to access SMS messages.", "name": "Capture SMS Messages", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "x_mitre_platforms": [ "Android", "iOS" ], "x_mitre_tactic_type": [ "Post-Adversary Device Access" ], "x_mitre_version": "1.1", "x_mitre_old_attack_id": "MOB-T1015", "x_mitre_detection": "On Android, the user can view which applications have permission to access SMS messages through the device settings, and the user can choose to revoke the permission.", "x_killchain": "mitre-mobile-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--cf28ca46-1fd3-46b4-b1f6-ec0b72361848", "created": "2017-10-25T14:48:21.965Z", "modified": "2018-10-17T00:14:20.652Z", "kill_chain_phases": [ { "kill_chain_name": "mitre-mobile-attack", "phase_name": "discovery" } ], "x_mitre_old_attack_id": "MOB-T1023", "x_mitre_version": "1.0", "x_mitre_tactic_type": [ "Post-Adversary Device Access" ], "x_mitre_platforms": [ "Android" ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-mobile-attack", "url": "https://attack.mitre.org/techniques/T1420", "external_id": "T1420" } ], "description": "On Android, command line tools or the Java file APIs can be used to enumerate file system contents. However, Linux file permissions and SELinux policies generally strongly restrict what can be accessed by apps (without taking advantage of a privilege escalation exploit). The contents of the external storage directory are generally visible, which could present concern if sensitive data is inappropriately stored there.\n\niOS's security architecture generally restricts the ability to perform file and directory discovery without use of escalated privileges.", "name": "File and Directory Discovery", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "x_killchain": "mitre-mobile-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--df8b2a25-8bdf-4856-953c-a04372b1c161", "created": "2020-03-15T16:13:46.151Z", "modified": "2020-03-26T20:15:35.821Z", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ], "external_references": [ { "source_name": "mitre-attack", "external_id": "T1071.001", "url": "https://attack.mitre.org/techniques/T1071/001" }, { "url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf", "description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.", "source_name": "University of Birmingham C2" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Web Protocols", "description": "Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. \n\nProtocols such as HTTP and HTTPS that carry web traffic may be very common in environments. HTTP/S packets have many fields and headers in which data can be concealed. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic. ", "x_mitre_version": "1.0", "x_mitre_is_subtechnique": true, "x_mitre_detection": "Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect application layer protocols that do not follow the expected protocol standards regarding syntax, structure, or any other variable adversaries could leverage to conceal data.(Citation: University of Birmingham C2)\n\nMonitor for web traffic to/from known-bad or suspicious domains. ", "x_mitre_data_sources": [ "Network Traffic: Network Traffic Flow", "Network Traffic: Network Traffic Content" ], "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c3888c54-775d-4b2f-b759-75a2ececcbfd", "created": "2017-05-31T21:30:34.523Z", "modified": "2020-07-14T19:47:46.912Z", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Data Transfer Size Limits", "description": "An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.", "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1030", "external_id": "T1030" }, { "url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf", "description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.", "source_name": "University of Birmingham C2" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "exfiltration" } ], "x_mitre_is_subtechnique": false, "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_mitre_network_requirements": true, "x_mitre_detection": "Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). If a process maintains a long connection during which it consistently sends fixed size data packets or a process opens connections and sends fixed sized data packets at regular intervals, it may be performing an aggregate data transfer. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2)", "x_mitre_data_sources": [ "Network Traffic: Network Connection Creation", "Network Traffic: Network Traffic Flow" ], "x_mitre_version": "1.0", "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--92d7da27-2d91-488e-a00c-059dc162766d", "created": "2017-05-31T21:30:41.804Z", "modified": "2020-03-12T15:59:47.470Z", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "exfiltration" } ], "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Exfiltration Over C2 Channel", "description": "Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1041", "url": "https://attack.mitre.org/techniques/T1041" }, { "url": "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf", "description": "Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.", "source_name": "University of Birmingham C2" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_platforms": [ "Linux", "macOS", "Windows" ], "x_mitre_network_requirements": true, "x_mitre_detection": "Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2)", "x_mitre_data_sources": [ "Network Traffic: Network Connection Creation", "Network Traffic: Network Traffic Flow", "Network Traffic: Network Traffic Content", "File: File Access", "Command: Command Execution" ], "x_mitre_version": "2.0", "x_mitre_is_subtechnique": false, "x_killchain": "mitre-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e3b936a4-6321-4172-9114-038a866362ec", "created": "2019-10-10T15:00:44.181Z", "modified": "2019-10-10T15:00:44.181Z", "external_references": [ { "external_id": "T1532", "source_name": "mitre-mobile-attack", "url": "https://attack.mitre.org/techniques/T1532" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Data Encrypted", "description": "Data is encrypted before being exfiltrated in order to hide the information that is being exfiltrated from detection or to make the exfiltration less conspicuous upon inspection by a defender. The encryption is performed by a utility, programming library, or custom algorithm on the data itself and is considered separate from any encryption performed by the command and control or file transfer protocol. Common file formats that can encrypt files are RAR and zip.", "kill_chain_phases": [ { "kill_chain_name": "mitre-mobile-attack", "phase_name": "exfiltration" } ], "x_mitre_version": "1.0", "x_mitre_tactic_type": [ "Post-Adversary Device Access" ], "x_mitre_detection": "Many encryption mechanisms are built into standard application-accessible APIs, and are therefore undetectable to the end user.", "x_mitre_platforms": [ "Android", "iOS" ], "x_killchain": "mitre-mobile-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--6a3f6490-9c44-40de-b059-e5940f246673", "created": "2017-10-25T14:48:33.158Z", "modified": "2019-02-03T14:52:45.266Z", "x_mitre_old_attack_id": "MOB-T1040", "x_mitre_version": "1.1", "x_mitre_tactic_type": [ "Post-Adversary Device Access" ], "x_mitre_platforms": [ "Android", "iOS" ], "kill_chain_phases": [ { "kill_chain_name": "mitre-mobile-attack", "phase_name": "command-and-control" }, { "kill_chain_name": "mitre-mobile-attack", "phase_name": "exfiltration" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-mobile-attack", "url": "https://attack.mitre.org/techniques/T1437", "external_id": "T1437" }, { "url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-29.html", "source_name": "NIST Mobile Threat Catalogue", "external_id": "APP-29" }, { "source_name": "Kaspersky-MobileMalware", "description": "Roman Unuchek and Victor Chebyshev. (2014, February 24). Mobile Malware Evolution: 2013. Retrieved December 22, 2016.", "url": "https://securelist.com/mobile-malware-evolution-2013/58335/" } ], "description": "Adversaries may communicate using a common, standardized application layer protocol such as HTTP, HTTPS, SMTP, or DNS to avoid detection by blending in with existing traffic.\n\nIn the mobile environment, the Google Cloud Messaging (GCM; two-way) and Apple Push Notification Service (APNS; one-way server-to-device) are commonly used protocols on Android and iOS respectively that would blend in with routine device traffic and are difficult for enterprises to inspect. Google reportedly responds to reports of abuse by blocking access to GCM.(Citation: Kaspersky-MobileMalware)", "name": "Standard Application Layer Protocol", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "x_killchain": "mitre-mobile-attack" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b327a9c0-e709-495c-aa6e-00b042136e2b", "created": "2020-09-11T15:14:33.730Z", "modified": "2020-10-22T17:04:15.578Z", "external_references": [ { "source_name": "mitre-mobile-attack", "external_id": "T1582", "url": "https://attack.mitre.org/techniques/T1582" }, { "external_id": "APP-16", "source_name": "NIST Mobile Threat Catalogue", "url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-16.html" }, { "external_id": "CEL-41", "source_name": "NIST Mobile Threat Catalogue", "url": "https://pages.nist.gov/mobile-threat-catalogue/cellular-threats/CEL-41.html" }, { "source_name": "SMS KitKat", "url": "https://android-developers.googleblog.com/2013/10/getting-your-sms-apps-ready-for-kitkat.html", "description": "S.Main, D. Braun. (2013, October 14). Getting Your SMS Apps Ready for KitKat. Retrieved September 11, 2020." }, { "source_name": "Android SmsProvider", "url": "https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/7e7c274/src/com/android/providers/telephony/SmsProvider.java", "description": "Google. (n.d.). SmsProvider.java. Retrieved September 11, 2020." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "SMS Control", "description": "Adversaries may delete, alter, or send SMS messages without user authorization. This could be used to hide C2 SMS messages, spread malware, or various external effects.\n\nThis can be accomplished by requesting the `RECEIVE_SMS` or `SEND_SMS` permissions depending on what the malware is attempting to do. If the app is set as the default SMS handler on the device, the `SMS_DELIVER` broadcast intent can be registered, which allows the app to write to the SMS content provider. The content provider directly modifies the messaging database on the device, which could allow malicious applications with this ability to insert, modify, or delete arbitrary messages on the device.(Citation: SMS KitKat)(Citation: Android SmsProvider)", "kill_chain_phases": [ { "kill_chain_name": "mitre-mobile-attack", "phase_name": "impact" } ], "x_mitre_version": "1.0", "x_mitre_is_subtechnique": false, "x_mitre_tactic_type": [ "Post-Adversary Device Access" ], "x_mitre_detection": "Users can view the default SMS handler in system settings.", "x_mitre_platforms": [ "Android" ], "x_killchain": "mitre-mobile-attack" }, { "type": "report", "spec_version": "2.1", "id": "report--41d7c930-3e17-4dfc-98e6-e51f6dc4e646", "created": "2021-07-16T11:52:37.166Z", "modified": "2021-07-16T11:52:37.166Z", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "created_by_ref": "identity--a2c0f893-512d-4dff-bd00-4e7c6f78fda4", "name": "Malware Analysis Report: Hexed Noodle", "description": "Android variant of AppleSeed backdoor", "published": "2021-07-16T11:52:37.166Z", "external_references": [ { "source_name": "NCSC", "external_id": "NCSC/MAR/Hexed-Noodle" } ], "report_types": [ "malware" ], "object_refs": [ "malware--3372c781-3cf3-479a-aaeb-b9748fdfc149", "attack-pattern--abe22320-ea3e-4121-a7fd-a778367069f3", "relationship--7616b636-267a-4c9d-991c-efb80d2b223d", "relationship--33bfd7e4-221a-4f85-9a59-b00630063ebe", "attack-pattern--170fdd9e-0168-4531-b09c-cc025285589a", "relationship--7c9e6425-31d3-4099-98c1-f7d487061284", "relationship--ad64d0ec-0519-4d7e-92f0-77d2e57d7ec6", "attack-pattern--27a503e3-7f92-4b99-8e48-2fd0671a0ad9", "relationship--7fb59dd7-a5c9-43b1-93f7-58c73d655acf", "relationship--81cf0a3b-56ea-4409-980c-38ddf8cbd3a6", "attack-pattern--968b1ca1-c1d6-4257-b98c-463aaba93e66", "relationship--fa667687-95f4-45a5-bb3c-beda0dc6d819", "relationship--f29b1cbf-8f2a-4b6d-9547-06a9e470eada", "attack-pattern--1928384c-c7a6-4a3b-bc60-66a257670989", "relationship--fdc48cd6-1369-4ca2-8d2f-a6d5bed35f50", "relationship--66d7b3ef-ba56-4327-bdd3-6329792cf0bb", "attack-pattern--d80c7b95-9779-4a36-9826-02ae9a10acad", "relationship--c565a56e-4f39-4851-9c79-0c695dd998c3", "relationship--54492fdf-975e-4790-8912-8916d970b722", "attack-pattern--d2bf02c8-a6d4-4da6-8e58-41a005f359e5", "relationship--cbbc95bf-9645-406f-a08c-3c95125addf2", "relationship--420f44fa-9a12-4002-9fc9-9ecacf2cb6b7", "attack-pattern--4a79c199-9a7a-42d9-91d1-9f51012bc752", "relationship--05ea4109-2531-4b82-ab9f-b8cc58216c06", "relationship--da1bf64e-333e-48fb-a50a-a7837a2ef38f", "attack-pattern--4077d0fe-1327-4b81-a3db-d91b74e84246", "relationship--21a6012e-1a2c-407c-a4b6-157bac0f63f1", "relationship--f08ac65c-03de-4d32-9281-2923f5706e47", "attack-pattern--4c4f59ba-1986-42d5-aaf2-97406f04a0c2", "relationship--9107bb2b-3833-492f-b05f-5d292eae0465", "relationship--ac5e4b7a-66d5-4950-a69d-ac38965bb1da", "attack-pattern--a80cf384-6eb2-4151-baf6-b060d6b07142", "relationship--2f75ed7d-5ca1-4a63-993e-7b846adb422c", "relationship--376434ce-8a58-430b-967e-78c310d97b9a", "attack-pattern--82b96f45-de93-49c1-b764-c7f77a93a64a", "relationship--1a33c8e1-772b-4e5d-9b8c-64e850fdbac3", "relationship--57c4cf59-1d70-478a-8296-bb3ab761ae1b", "attack-pattern--cbeb08a6-9bda-4c50-8f47-b35e1bcf874c", "relationship--adf5aab8-c0ae-4477-882f-e505100c0ffe", "relationship--4af094d1-5d96-4b6b-b1c2-7a7b6880bfb4", "attack-pattern--2215499f-5bfb-4484-8960-88012a7701e2", "relationship--22eaf6bb-1751-49b3-b6d2-24cb2c38fdd4", "relationship--7bcaac2d-0a8f-425c-9fd8-1ae14bfcabdb", "attack-pattern--718fbe03-ffe0-4f4b-a22b-4c010d49b3b3", "relationship--cacb5ae0-f719-4a99-be31-54de11793946", "relationship--e5d6fe4d-4204-46e0-a526-b292be2c5248", "attack-pattern--95ae4986-774b-4f50-9705-f6845a6cbd28", "relationship--b64905e5-414a-4d2f-8726-b1b5b723b7df", "relationship--37f7ce22-59e0-43d7-8915-dcf60a4daf32", "attack-pattern--b5122c25-0dc9-4821-a1b3-5bec9b637d5c", "relationship--5f6056b7-f512-412f-a69a-028d949b4d14", "relationship--f21a867b-a27d-4958-92a0-007a7f0adbdd", "attack-pattern--24df49d4-4538-48d4-b6c6-88e7639e40a6", "relationship--dd30e3dd-023f-417a-96da-b2eb278ad177", "relationship--50ba0126-1676-44a1-af09-2f1fdd57e5d2", "indicator--2a99fe65-d4bb-4d48-b294-02fa4a95f90a", "relationship--961c0f0b-10fd-4766-b40e-b37057bfa977", "relationship--70097238-c373-4894-acb7-01c0efae8920", "relationship--4bd64180-9c0a-4769-aa03-472f5b85720e", "relationship--0e4c96d4-f792-4fb9-8639-0bcc9eae2fa3", "relationship--6a4ab3c9-e3fd-4426-8d54-1221dd43c6fa", "relationship--de535343-fb70-497c-92eb-6f6604a31b84", "relationship--2a0228f2-ed6b-4aa6-a0e1-3d9f76ca759a", "relationship--ba590771-8f39-47f7-8b88-659071e73217", "relationship--e12f6dbb-6fd7-4ca5-bda4-88e08d6c4328", "relationship--2087530f-dc87-45ed-800b-5d33baedbbe7", "relationship--c0a3a3e1-6182-4ab0-8927-c7688dd2c3d0", "relationship--fb777dc5-de3d-47c1-8076-590c71ff3481", "relationship--3050dc31-4c8f-403a-b68c-4cb285b5cd00", "relationship--99907adf-4c9c-4041-81e4-74b84f621d60", "relationship--d7cf27e1-5118-4757-bd9d-f4565a4efab8", "relationship--98eb5a08-8283-4370-b6d2-c61c1f906d8d", "relationship--7e13e0be-4bc3-4986-bd0b-a7ac15363ca3", "relationship--79b4d773-a181-4e76-af1f-85fbda93dd43", "relationship--1c30bb42-f8b7-4798-b029-654aaf4e52cd", "relationship--e8b076f6-27bd-4031-a927-74974e90024d", "relationship--71499bad-fa43-4b91-87d5-63a44013e823", "relationship--e0d4cd00-7cc6-40d9-a0e2-5e76679609e5", "relationship--d7ab1fb3-d20d-482c-89de-f11dab987538", "relationship--4f3205be-45a7-4a13-8fbe-b8cdca26743a", "relationship--53635ae6-065a-430e-bba7-82510e1feaca", "relationship--c8b7e395-2a60-4bb1-b7b6-9a7935e57971", "relationship--caebdb17-94df-4724-a0d4-67b0fae843a7", "indicator--00c6a61a-4dae-49eb-9fba-a7e965939052", "relationship--73f7349d-acc6-4350-a15f-22c09d0e243c", "indicator--ec7e3606-a343-4939-a08b-c568f3bac468", "relationship--5334858c-b0ce-451a-aba7-4dd431470f32", "indicator--8ac4ccb4-b4cf-4d0d-8391-ce2f9d0cd553", "relationship--a60dff55-4ef2-4fd0-9afc-048dbd73a14b", "indicator--0a96af19-d3ca-4270-8257-b9bb85b3e034", "relationship--bce8b0a4-dc92-4630-ab60-e74a0abea3d3", "indicator--1f162322-6b3d-4ad7-909c-7af000703f0b", "relationship--ea4e4c5b-710c-4d03-84dd-1fac83b8abc3", "indicator--8677799e-5e56-4ed4-aeaa-401d08c4644a", "relationship--cea0688c-93a6-4939-be3b-20f4f2614f95", "indicator--4a6df343-2fbb-42e1-b7d4-4fa3a32a73e8", "relationship--02a167ce-3f30-4b68-9856-6b94e6bd93df", "indicator--51d03d06-5307-4fa0-9e74-27718fca2d0a", "relationship--8615d22e-d230-48c9-8f1b-8e69c6961dc1", "indicator--fa254dfb-b51d-4952-8c57-09ad544f32c2", "relationship--5fdbb054-4aa3-498c-9a9b-bac5440cf837", "relationship--40be2726-038b-4ef5-a03c-dfbf70c3f3ea", "relationship--cf79440e-3d85-4465-a379-3cb34a6b0cd7", "relationship--03937c3a-b2bd-4798-97ce-68a8dade7689", "relationship--819865c4-17cd-405f-9efd-91229cdfe617", "relationship--f4dd7ebf-25a2-4fe1-a11b-101138af0a79", "relationship--7130b5a8-b2b9-4878-9a9f-34194bdf6bac", "relationship--b84eeaca-277a-4fce-bf0e-9eafb777e2fe", "relationship--084822a9-d616-41a5-b5ac-f1547bbff6d8", "indicator--2325f89f-ef02-40b4-8a02-76127a171b17", "relationship--b50d4a9d-9551-4970-984c-4632ae81bb0e", "relationship--8470e056-e62b-430f-b475-4516ded9866a", "relationship--ec22d2d2-7bf3-4409-bade-bdd2679c1855", "relationship--f827c4ee-6c9a-48d0-8a62-b57c81fba94f", "relationship--8f6ec135-9b81-455c-bcd6-cabb35faa132", "relationship--09716678-356b-415d-9af5-d838ebe9350a", "relationship--b18fce1a-a9f2-4a81-873d-ab661eed3e85", "relationship--ad35a5e8-1c0c-4b5b-b296-003baf3f030e", "relationship--bf7de084-2d4d-42dc-8c31-2022a74876d3", "indicator--7f25a244-022b-4620-99cb-55d52d2cf998", "relationship--6a8d6ce0-abff-48f6-8da1-6a5c53a967cc", "relationship--b7f7472b-7080-4820-8379-41887d2887e0", "relationship--b4773714-7393-426f-852e-07676ab30662", "relationship--f0712d8a-5dde-4a43-8a06-e1e4c912d6b8", "relationship--6aa1d025-cd39-4104-871d-7f2648590ecd", "relationship--dda3171d-6f44-4d26-87c7-7b34ed713e06", "relationship--cd831e3f-342c-41e0-8889-4d05099f655d", "relationship--87e38122-860c-4784-8cc2-b2635bb6f9bb", "indicator--1f62a8ef-3935-48f9-8658-361ff52d8d58", "relationship--bf6cd853-3996-4082-9dbb-cbb7268380d2", "relationship--6de5cfce-fff1-4b34-be08-322e393ef45e", "relationship--deef0c84-2675-4ec2-aa68-2bad8f9e999f", "relationship--0e3e3f4b-976b-427b-90a2-d083ea8b756d", "relationship--1f8f6d4f-4462-4ac7-b148-36a238c8bc5f", "relationship--d8ace68f-ef2c-445a-9f88-b92668ea29ed", "relationship--7d5f1692-2119-465f-b128-b1ff6041d125", "relationship--58beda91-13f0-4aca-95f6-4fe8f36ba773" ] } ] }