abuse.ch Threat Intelligence Real Time Feed

There are several real time feeds available from abuse.ch. Each feed is distributed through a different channel and exposes a different set of data.

URLhaus

The feed name is urlhaus. URLhaus is a project from abuse.ch with the goal of sharing malicious URLs that are being used for malware distribution. This real time feed provides notification whenever:

  • A new URL gets reported (and subsequently added) to URLhaus;

  • A URL tracked gets removed from URLhaus, either by the initial reporter (submitter) for the URL or by the admin (e.g. in case of a false positive);

  • The information on a URL tracked by URLhaus changes (e.g. tags get added or removed, url_status changes);

  • A payload gets observed in combination with a URL tracked by URLhaus;

  • The information on a payload changes for a URL tracked by URLhaus (e.g. malware family associated with a payload).

URL Additions

This message gets triggered when a new URL gets reported (and subsequently added) to the URLhaus database.

The message has the following format:

{
    "_idx": 123456,
    "_ts": 12345678,
    "uuid": "2F4C0B31-B9A0-4D6B-81FF-43C6300D40CC",
    "type": "url_addition",
    "id": 2272298,
    "url": "http://201.138.189.134:46829/.i",
    "host": "201.138.189.134",
    "url_status": "online",
    "anonymous": false,
    "reporter": "geenensp",
    "tags": [
        "Hajime"
    ]
}

Each field has the following content:

  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the real time infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type defines the type of message.

  • id represents the ID of the URL in the URLhaus database. It uniquely identifies the specific URL tracked. It also can be used to assemble the HTTP link to the URLhaus record page (https:// urlhaus.abuse.ch/url/id/).

  • url is the added URL.

  • host the host associated with this URL (extracted from the URL).

  • url_status is a string that represents the status of the URL. Possible values are ‘online’, ‘offline’, and ‘unknown’. ‘unknown’ is reported when the URL has not yet been checked by URLhaus.

  • anonymous is a boolean value indicating if the reporter of the URL wants to stay anonymous.

  • reporter is the handle of the reporter of the URL or ‘null’ if it should be anonymous. Currently, the handle equals the Twitter handle of the reporter. After migration to a new authentication system for abuse.ch, this handle will change to one from abuse.ch’s own authentication platform.

  • tags are a list of tags associated with the added URL, as shown in URLhaus. Tags are “free field” and defined by the reporter (submitter) for the URL.

URL removals

This message is generated every time a URL is removed from the URLhaus database.

The message had the following format:

{
    "_idx": 123456,
    "_ts": 12345678,
    "uuid": "0994b98e-6618-4344-856e-d893dda63057",
    "type": "url_removal",
    "id": 1882954,
    "url": "http://175.107.6.22:50423/mozi.maaa",
    "removal_note": "Removed by admin"
}

Each field has the following content:

  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the realtime infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type defines the type of message.

  • id represents the ID of the URL in the URLhaus database. This is needed to assemble the HTTP link to the URLhaus record page.

  • url is the URL being added.

  • removal_note is a text string, human-readable, that describes why the URL has been removed.

URL changes

This message is generated every time a URL changes its state.

A state change is defined as the following:

  • when the URL changes;

  • when the status switches from online to offline and vice versa;

  • when any of the tags are changed, added or is removed.

The message has the following format:

{
    "_idx": 123456,
    "_ts": 12345678,
    "uuid": "ba2221cb-3e11-4a4d-a95a-35c0551c18d1",
    "type": "url_change",
    "id": 50428,
    "url": "http://ld.mediaget.com/index4.php?l=en",
    "field": "url_status",
    "value": "offline",
    "action": "change"
}

Each field has the following content:

  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the real time infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type defines the type of message.

  • id represents the ID of the URL in the URLhaus database. This is needed to assemble the HTTP link to the URLhaus record page (https:// urlhaus.abuse.ch/url/id/).

  • url is the URL being modified.

  • field shows which field has been changed. Fields currently supported are: tag, url_status

  • value is the new value of the affected field.

  • action This represents what action happened to the field. The action could be add, remove or change.

New file download

On release, this message will get triggered every time a new file download is available. A new file download is defined whenever URLhaus is able to retrieve a new (unseen) payload from a URL it tracks.

{
    "_idx": 123456,
    "_ts": 12345678,
    "uuid": "f5cdf155-8c93-4389-90fa-116ce977e2f1",
    "type": "file_download",
    "sha256_hash": "477fed0554457b36c085b2e9174edd978e7fe537840eb793d038bec798f8e129",
    "md5_hash": "cc1924283df97f24500f5559c95098ca",
}
  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the real time infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type describes the type of this message and is always “file_download”.

  • sha256_hash is the SHA256 hash of the file.

  • md5_hash is the MD5 hash of the file.

The download links will be released in a future iteration. Contact Spamhaus directly for more information.

Observed payloads

This message gets triggered every time a payload gets observed in combination with a URL, no matter whether the payload has been seen before or not (-> new file download).

The message has the following format:

{
    "_idx": 123456,
    "_ts": 12345678,
    "uuid": "987c3174-7854-40f8-a365-99ad523bd08b",
    "type": "payload_observed",
    "id": 2579654,
    "url": "http://92.52.217.50/1120_002/csrss.exe",
    "mime_type": "application/x-dosexec",
    "file_type": "PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive",
    "file_ext": "exe",
    "file_size": 570442,
    "file_name": null,
    "md5_hash": "6e73708e3d21f04b6f18aa31a68f582e",
    "sha256_hash": "c46e251d3f75d5171ef41c926444aa590b089eca868141b1abad8ec0930b506e",
    "imphash": "e2a592076b17ef8bfb48b7e03965a3fc",
    "ssdeep": "12288:cqp+8Qve8l8AFe57GK1BoBXAPl0666xTzLSS0/K779NKKc06Kux:48Ue8l8HGK12wPl0666pF58h06Kux",
    "tlsh": "T163C4230423D2D22AE9638F72ABA3A9D9DBB2EB0146331507771C3FAF7732552851DB",
    "telfhash": null,
    "malware": null
}

Each field has the following content:

  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the real time infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type describes the type of this message and is always “payload_observed”.

  • id represents the ID of the URL in the URLhaus database. This is needed to assemble the HTTP link to the URLhaus record page (https:// urlhaus.abuse.ch/url/id/).

  • url is the full URL from which the file was downloaded.

  • mime_type is the Multipurpose Internet Mail Extensions (MIME) type of the payload received.

  • file_type is the result of the Unix “file” command (not to be confused with the content-type header from the webserver).

  • file_ext is the guessed file extension (or ‘null’, if not available).

  • file_size is the size (in bytes) of the payload received.

  • file_name is the filename as extracted from the HTTP Content-Disposition header in the response. It’s ‘null’ if the info is not available.

  • md5_hash is the MD5 hash of the payload received.

  • sha256_hash is the SHA256 hash of the payload received.

  • imphash is the imphash of the payload received.

  • ssdeep is the ssdeep of the payload received.

  • tlsh is the tlsh of the payload received.

  • telfhash is the telfhash of the payload received.

  • malware this is the malware family.

The Import Hash (ImpHash) is a hash over the imported functions by Portable Executable (PE) file. More information about imphash is available here: https://secana.github.io/PeNet/articles/imphash.html

ssdeep is a program for computing - Context Triggered Piecewise Hashes (CTPH). More information about ssdeep is available here: https://ssdeep-project.github.io/ssdeep/index.html

TLSH is a fuzzy matching program and library. More information about TLSH is available here: https://tlsh.org/

telfhash is a symbol hash for Executable and Linkable Format (ELF) files; just like imphash is Import Hash for PE files. More information about telfhashis available here: https://github.com/trendmicro/telfhash

malware is the internal naming scheme of abuse.ch that identifies the malware family.

Payload changes

This message gets triggered when the metadata of the payload changes (e.g. the malware family).

The message has the following format:

{
    "_idx": 123456,
    "_ts": 12345678,
    "uuid": "087ff73b-3451-47d0-a226-1971c1927d98",
    "type": "payload_change"
    "md5_hash": "5dbd5adab3974080b52d01cb158e3f00",
    "sha256_hash": "773d9c42e57107d4e4c9286f477659bf22684be2f589cb9cc12ddea6cd1702ac",
    "field": "malware",
    "value": "CoinMiner",
    "action": "add"
}

Each field has the following format:

  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the real time infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type describes the type of this message and is always “payload_change”.

  • md5_hash is the MD5 hash of the payload received.

  • sha256_hash is the SHA256 hash of the payload received.

  • field shows the affected field where the change occurred. Currently, only malware is supported.

  • value is the new value of the affected field.

  • action This represents what action happened to the field. The action could be add, remove or change.

MalwareBazaar

The feed name is malwarebazaar. MalwareBazaar is a project from abuse.ch with the goal of sharing malware samples with the infosec community, AV vendors and threat intelligence providers. This real time feed provides a notification whenever:

  • A new malware sample is uploaded to MalwareBazaar;

  • The metadata of a file changes (e.g. tags, malware);

  • A file gets removed from MalwareBazaar, either by the initial reporter (submitter) of the file or by the admin (e.g. in case of a false positive).

File additions

This message is generated when a new file gets uploaded to MalwareBazaar.

The message has the following format:

{
    "_idx": 123456,
    "_ts": 12345678,
    "uuid": "f97b3a79-40b9-4863-ae40-01636298ee61",
    "type": "file_addition",
    "file_name": "DHL Shipment documents.exe",
    "file_size": 620544,
    "md5_hash": "e5a757537adac180cdbdb96d212e2edc",
    "sha256_hash": "5d027f10fc0bacdc530e40f75be7559f47416fe32ac9bbaa958e40e87cdbcb0a",
    "sha1_hash": "6a2685420e9ec3c8a39fbb134424c2fe1e937a1a",
    "sha3_384_hash": "878d562a7a8133245bdad18f4eba41434f2c39caa70245bbc0741de5d9a5167603054e91c9cc432f4b4d0ed96ccb107e",
    "humanhash": "quiet-nineteen-leopard-stream",
    "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
    "ssdeep": "12288:2lyM2TgHvrmbbainkZRH8ZYvK+eKMc/w2kWhLIQbg0Fmki9bF32:2lEgPrliksZqIawcEQJk3",
    "tlsh": "T18BD4CFDF2ECC5605CC3A0774ECAC1184AAF2BDA53612D6DE5CA3709BC4B239C8758E56",
    "telfhash": null,
    "gimphash": null,
    "dhash_icon": "71f0c8cce8e0f071",
    "mime_type": "application/x-dosexec",
    "file_type": "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows",
    "file_ext": "exe",
    "malware": "Loki",
    "anonymous": false,
    "reporter": "GovCERT_CH",
    "origin_country": "CH",
    "delivery_method": "Distributed via e-mail attachment",
    "tags": [
        "exe",
        "Loki"
    ],
    "comment": null
}

Each field has the following content:

  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the real time infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type defines the type of message. It’s always ‘file_addition’.

  • file_size is the size (in bytes) of the payload received.

  • file_name is the filename as extracted from the HTTP Content-Disposition header in the response.

  • md5_hash is the MD5 hash of the payload received.

  • sha256_hash is the SHA256 hash of the payload received.

  • sha1_hash is the SHA1 hash of the file.

  • sha3_384_hash is the SHA3-384 hash of the file.

  • humanhash is the human-readable hash.

  • imphash is the imphash of the payload received.

  • ssdeep is the ssdeep of the payload received.

  • tlsh is the tlsh of the payload received.

  • telfhash is the telfhash of the payload received.

  • gimphash is the gimphash of the file.

  • dhash_icon is the dhash of the file icon.

  • mime_type is the Multipurpose Internet Mail Extensions (MIME) type of the payload received.

  • file_type is the result from Unix “file” command.

  • file_ext is the guessed file extension (or ‘null’, if not available).

  • malware this is the malware family.

  • tags is a list of tags associated with this file.

  • anonymous is a boolean that indicates whether the submitter of this file wants to remain anonymous or not.

  • reporter is the abuse.ch handle of the submitter of this file (or ‘null’, if not available).

  • origin_country is the two letter Country code of the country from where the submission has been made

  • delivery_method is the method how this payload gots delivered / spread

  • comment is a comment from the reporter of the URL (or ‘null’, if not available).

humanhash provides human-readable representations of digests. More information about humanhash is available here

The download links will be released in a future iteration. Contact Spamhaus directly for more information.

File changes

This message gets triggered when metadata of a file changes (e.g. tags, malware).

Please note that this feed does not include threat intelligence from 3rd parties (e.g. vendors).

The message has the following format:

{
    "_idx": 123456,
    "_ts": 12345678,
    "uuid": "de47c35b-b5c5-4ad9-9f67-adbaab48c20f",
    "type": "file_change",
    "md5_hash": "8eb671d21d3712e417ca8a7a381286cc",
    "sha256_hash": "92c5936c5dc0d02c0f05838c2f7a0ebed0c9c066d6c0b5b87bbdbe47e3fe967a",
    "sha1_hash": "4592e126df0a7e6c7da4e98f3fbe5b45057fc6ac",
    "sha3_384_hash": "a7aec4774933b72c8681081e0dec01e568e4ab8036cfdb2a5f146ede70df083b7ab8559e1ccd5dfef603fff1f440534e",
    "field": "tag",
    "value": "remove",
    "action": "test"
}

Each field has the following format:

  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the real time infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type defines the type of message. It’s always ‘file_change’.

  • md5_hash is the MD5 hash of the payload received.

  • sha256_hash is the SHA256 hash of the payload received.

  • sha1_hash is the SHA1 hash of the file.

  • sha3_384_hash is the SHA3-384 hash of the file.

  • field shows the affected field where the change occurred (supported fields: tag, malware, file_ext).

  • value is the new value of the affected field.

  • action is an enumerated field that describes the action. May contain add, remove, change.

File removals

This message gets triggered when the reporter (user) of a file, or the administrator, removes a file from MalwareBazaar (e.g. due to a false positive).

This message has the following format:

{
    "_idx": 123456,
    "_ts": 12345678,
    "uuid": "ccf41785-a05a-4d77-bf27-cc012bddf7f6",
    "type": "file_removal",
    "md5_hash": "8eb671d21d3712e417ca8a7a381286cc",
    "sha256_hash": "92c5936c5dc0d02c0f05838c2f7a0ebed0c9c066d6c0b5b87bbdbe47e3fe967a",
    "sha1_hash": "4592e126df0a7e6c7da4e98f3fbe5b45057fc6ac",
    "sha3_384_hash": "a7aec4774933b72c8681081e0dec01e568e4ab8036cfdb2a5f146ede70df083b7ab8559e1ccd5dfef603fff1f440534e",
    "removal_note": "Removed by admin"
}

Each field has the following content:

  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the real time infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type defines the type of message. It’s always ‘file_removal’.

  • md5_hash is the MD5 hash of the payload received.

  • sha256_hash is the SHA256 hash of the payload received.

  • sha1_hash is the SHA1 hash of the file.

  • sha3_384_hash is the SHA3-384 hash of the file.

  • removal_note is a text string showing the removal note as inserted by the system or the remover.

YARA matches

This message gets triggered every time a YARA rule matches a file present on MalwareBazaar.

{
  "uuid": "cca72b8c-50e8-4e2a-81bf-cb33a9ed1f0d",
  "type": "yara_match",
  "md5_hash": "d46a243899465e22b61c95ce73d11508",
  "sha256_hash": "e6f2d277d61fd27d2a6452619111c272047ff478247251c9ec5651f5f67e1519",
  "sha1_hash": "3d549aa079ed02ffa6d5b602ccb3b58a48b9f347",
  "sha3_384_hash": "af3ade9df479a0c882a73e5170977edee72aa4a45f2ee6fb6b4dde649a382d5b0129684936c0470f6532f2aa571d41a5",
  "yara": {
    "rule_name": "CAP_HookExKeylogger",
    "author": "Brian C. Bell -- @biebsmalwareguy",
    "description": null,
    "reference": "https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar",
    "tlp": "WHITE"
  }
}

Each field has the following content:

  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the real time infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type defines the type of message. It’s always ‘yara_match’.

  • md5_hash is the MD5 hash of the payload received.

  • sha256_hash is the SHA256 hash of the payload received.

  • sha1_hash is the SHA1 hash of the file.

  • sha3_384_hash is the SHA3-384 hash of the file.

  • yara.rule_name is the name of the matching YARA rule

  • yara.author is the author of the matching YARA rule

  • yara.description is the descrption of the matching YARA rule

  • yara.reference is the reference of the matching YARA rule

  • yara.tlp is the Traffic Light Protocol (TLP) of the matching YARA rul

Code Signing Certificate Blocklist (CSCB) additions

This message gets triggered every time a certificate gets added to MalwareBazaar’s Code Signing Certificate Blocklist (CSCB).

{
  "uuid": "7bcdb475-54b1-4113-8f12-a66e9b3fe389",
  "type": "cscb_addition",
  "subject_cn": "APPI CZ a.s",
  "issuer_cn": "Sectigo RSA Code Signing CA",
  "algorithm": "sha256WithRSAEncryption",
  "valid_from": "Oct 23 00:00:00 2020 GMT",
  "valid_to": "Oct 23 23:59:59 2021 GMT",
  "serial_number": "51CD5393514F7ACE2B407C3DBFB09D8D",
  "thumbprint_algorithm": "SHA256",
  "thumbprint": "D497A1698F4B9A558DED6CFD8BC4B1D881EEB3C04F349B215FFA89946F63C7F0",
  "bl_reason": "Quakbot",
  "malware_samples": [
    {
      "md5_hash": "c0e542a6270d57d5dc2c319a79e91c69",
      "sha256_hash": "1f622642ed6ea23622fb1786f08270c81b635c29b00350f7dc5ba41c76c0e3f7",
      "sha1_hash": "4eada9d3ff43852dbe527d8558358506eba58b6f",
      "sha3_384": "6b895fb5cac1dfd797461ffead69ec4bae30bf228c0a97b99318a8e3754e687b2847461e3a269a010e5dd9c6cc20b59d",
      "signature": "QuakBot",
      "first_seen": "2020-11-01 10:11:16 UTC"
    },
    {
      "md5_hash": "288bc129d402228bb3cac14828d26ecf",
      "sha256_hash": "3b948ca55076ceedc3e6915ff9db3ede5a24341b34ba5529b2baaae918f7cf30",
      "sha1_hash": "d5a6c35bbeb0990bb7d890abdaca1533f31305a2",
      "sha3_384": "2247ad44b4dee89b0847e72f68fc1a0a41b22d26359589df571214ba54f1b95691f7617ced1163879f2af0cee16740b7",
      "signature": "QuakBot",
      "first_seen": "2020-11-01 10:11:26 UTC"
    }
  ]
}

Each field has the following content:

  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the real time infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type defines the type of message. It’s always ‘cscb_addition’.

  • subject_cn is the Subject Common Name (CN)

  • issuer_cn is the Issuer Common Name (CN)

  • algorithm is the Algorithm used

  • valid_from is the Datetime from when this Code Signing Certificate is valid from

  • valid_to is the Datetime to when this Code Signing Certificate is valid to

  • serial_number is the Serial number of the Code Signing Certificate

  • thumbprint_algorithm is the Thumbprint algorithm

  • thumbprint is the Thumbprint

  • bl_reason is the Code Signing Certificate Blocklist (CSCB) listing reason

  • malware_samples is a List of malware samples signed with this Code Signing Certificate

ThreatFox

The feed name is threatfox. ThreatFox is a free platform from abuse.ch with the goal of sharing indicators of compromise (IOCs) associated with malware with the infosec community, AV vendors and threat intelligence providers. This real time feed provides a notification whenever:

  • An IOC is pushed to ThreatFox (no matter whether it has been seen before or not);

  • The meta information of an IOC changes;

  • An IOC gets removed by the initial reporter (submitter) of an IOC, or by the admin (e.g. in case of a false positive).

IOC additions

This message gets triggered when a new IOC is pushed to ThreatFox or an IOC that is already known to ThreatFox gets pushed to the platform again.

The message has the following format:

{
    "_idx": 123456,
    "_ts": 12345678,
    "uuid": "ddd8b411-77e5-4311-b36b-e15ee390ee9f"
    "type": "ioc_addition",
    "id": 795292,
    "ioc": "76.25.142.196:443",
    "confidence_level": 75,
    "ioc_type": "ip:port",
    "threat_type": "botnet_cc",
    "threat_type_description": "ip:port combination that is used for botnet Command&control (C&C)",
    "sightings": 45052,
    "malware": "win.qakbot",
    "malware_printable": "QakBot",
    "malware_alias": [
        "Oakboat",
        "Pinkslipbot",
        "Qbot",
        "Quakbot"
    ],
    "anonymous": false,
    "reporter": "abuse_ch",
    "reward": [
      {
       "credits_from": "anonymous",
       "credits_amount": 10
      },
      {
       "credits_from": "0xrb",
       "credits_amount": 10
      }
    ],
    "tags": [
        "QakBot|#6CA981"
    ],
    "reference": "https://search.censys.io/hosts/45.61.137.200",
    "comment": "QakBot botnet C2 detected by Feodo Tracker"
}

Each field has the following content:

  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the real time infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type defines the type of message. It’s always ‘ioc_addition’.

  • id is the ThreatFox ID of the IOC. You can also use this ID to craft the link to see the entry on the ThreatFox platform (https:// threatfox.abuse.ch/ioc/id/).

  • ioc is the IOC (value).

  • ioc_type is the type of the IOC (example: ip:port). A list of possible values is available through the API: https://threatfox.abuse.ch/api/#types

  • confidence_level is the confidence level of this IOC (set by the reporter). The value is between 0 and 100.

  • threat_type is the type of threat - a list of possible values is available through the API: https://threatfox.abuse.ch/api/#types

  • threat_type_description is a short description, human-readable description, of threat_type.

  • malware is the malware family (using the Malpedia naming scheme).

  • malware_printableis the printable name of malware family (Malpedia)

  • malware_alias are the Malware aliases (Malpedia)

  • sightings indicates how many times this IOC has been reported/observed.

  • anonymous boolean that indicates whether the submitter or this IOC wants to remain anonymous or not.

  • reporter is the abuse.ch handle of the submitter of this file (or ‘null’).

  • reward is a list of rewards (credits) the reporter received from other users for this submission

  • tags is a List of tags associated with this file. A list of current tags is available through the API: https://threatfox.abuse.ch/api/#tag-list

  • reference is the reference (URL)

  • comment is a human-readable string comment from the reporter on this IOC.

IOC changes

This message gets triggered when the metadata of an IOC changes (e.g. tag or malware family).

The message has the following format:

{
     "_idx": 123456,
     "_ts": 12345678,
     "uuid": "dcf90eeb-2093-41db-ac6d-fd879daae478"
     "type": "ioc_change",
     "id": 843106,
     "ioc": "http://wewilltoptheearth.top/index.php",
     "ioc_type": "url",
     "threat_type": "botnet_cc",
     "threat_type_description": "URL that is used for botnet Command&control (C&C)",
     "field": "tag",
     "value": "test",
     "action": "add"
} 

Each field has the following content:

  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the real time infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type defines the type of message. It’s always ‘ioc_change’.

  • id is the ThreatFox ID of the IOC. You can also use this ID to craft the link to see the entry on the ThreatFox platform (https:// threatfox.abuse.ch/ioc/id/).

  • ioc is The IOC (value).

  • ioc_type this is the type of the IOC (example: ip:port). A list of possible values is available through the API: https://threatfox.abuse.ch/api/#types

  • threat_type this is the threat type. A list of possible values is available through the API: https://threatfox.abuse.ch/api/#types

  • threat_type_description this is a short description, human-readable, of threat_type.

  • field shows the affected field where the change occurred.

  • value is the new value of the affected field.

  • action is an enumerated field that describes the action. May contain add, remove, change.

IOC removal

This message gets triggered when a user or administrator removes an IOC from ThreatFox (e.g. due to a false positive).

The message has the following format:

{
    "_idx": 123456,
    "_ts": 12345678,
    "uuid": "6d99f13f-9a87-4e04-8659-59c797f3d7a9"
    "type": "ioc_removal",
    "id": 843107,
    "ioc": "7f8ca86d343ef0a4dae7be8b2872734d1bfa0afec57e31eac9c316e59a331d51",
    "ioc_type": "sha256_hash",
    "threat_type": "payload",
    "threat_type_description": "SHA256 hash of a malware sample (payload)",
    "removal_note": "Removed by admin"
}

Each field has the following content:

  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the real time infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type defines the type of message. It’s always ‘ioc_removal’.

  • id is the ThreatFox ID of the IOC. You can also use this ID to craft the link to see the entry on the ThreatFox platform (https:// threatfox.abuse.ch/ioc/id/).

  • ioc is the IOC (value).

  • ioc_type this is the type of the IOC (example: ip:port). A list of possible values is available through the API: https://threatfox.abuse.ch/api/#types

  • threat_type this is the threat type. A list of possible values is available through the API: https://threatfox.abuse.ch/api/#types

  • threat_type_description this is a short description, human-readable, of threat_type.

  • removal_note is a string containing any removal note.

YARAify

The feed name is yaraify. YARAify is a project from abuse.ch that allows anyone to scan suspicious files such as malware samples or process dumps against a large repository of YARA rules. With YARAhub, the platform also provides a structured way for sharing YARA rules with the community. This real time feed provides a notification whenever:

  • A new file gets uploaded to YARAify;

  • A scan (task) is completed.

File additions

This message gets triggered when a new file gets uploaded to YARAify.

The message has the following format:

{
    "_idx": 123456,
    "_ts": 12345678,
    "uuid": "f283dd3a-63e5-4aac-bd0e-10d933791111"
    "type": "file_addition",
    "md5_hash": "920a857ea802abc379f3a36dfb990264",
    "sha256_hash": "2f530fa495e9677aca321d617fc1a80a2afb8857675afc0acd7af42a9107e475",
    "sha1_hash": "ed870c7ce9b8d632a7fb70c2db0f14830bc49466",
    "sha3_384_hash": "a40aae2bdf7489f8823e78dc3fad46cc8be36340d5c88bfb2e26d1dd62eee8b137a743e9928ac9c0c2cf4c93830f5e74",
    "mime_type": "application/x-dosexec",
    "file_size": 16777216,
    "imphash": null,
    "ssdeep": "49152:O4aKwHmG0sWKK2KCuRlk67MELVknHLE/UJk7puNW32OrshDh0rXUadxYoHCh5yZt:zwOKKbNkzLOnUCpFOLcAuMvFgEWqxs",
    "tlsh": "T104F691A1F744420CE285DBF45C9753E413E8BC058A61CB9BA7E9F20DBE32261FD625B4",
    "telfhash": null,
    "gimphash": null,
    "dhash_icon": null
}

Each field has the following content:

  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the real time infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type defines the type of message. It’s always ‘file_addition’.

  • md5_hash is the MD5 hash of the payload received.

  • sha256_hash is the SHA256 hash of the payload received.

  • sha1_hash is the SHA1 hash of the file.

  • sha3_384_hash is the SHA3-384 hash of the file.

  • file_size is the size (in bytes) of the payload received.

  • imphash is the imphash of the payload received.

  • ssdeep is the ssdeep of the payload received.

  • tlsh is the tlsh of the payload received.

  • telfhash is the telfhash of the payload received.

  • gimphash is the gimphash of the file.

  • dhash_icon is the dhash of the file icon.

  • mime_type is the Multipurpose Internet Mail Extensions (MIME) type of the payload received.

gimphash is a proposed method to calculate an imphash equivalent for Go binaries. More information about gimphashis available here: https://github.com/NextronSystems/gimphash

The download links will be released in a future iteration. Contact Spamhaus directly for more information.

Task results

This message gets triggered when a new scan task is finished on YARAify.

The message has the following format:

{
    "_idx": 123456,
    "_ts": 12345678,
    "uuid": "92e3feac-c4f8-46c4-a221-e3a316c2d1e4"
    "type": "task_result"
    "task_id": "0001e7a0-ff7e-11ec-9250-42010aa4000b",
    "md5_hash": "fc2b98018c3e6b18c57389537e7a439f",
    "sha256_hash": "9fb9c8350d7c7cfc261bc75a0ffe7c6081e57751cfee7cbd4f12a4c58db7ccfb",
    "sha1_hash": "fbfcf4abb3152913d4f5d74b639ad0d3764f8103",
    "sha3_384_hash": "73824476997bdfed31d970aaa6c90f3f8f0090ee40d5beedc672708358bcabdb94d42c2b10c31097b1b15a383aaaffbf",
    "file_name": "input_400000.DEPOSIT INVOICE.exe",
    "clamav_scan": true,
    "unpack": false,
    "unpacked_files_cnt": 0,
    "share_file": true,
    "results": {
        "clamav": [
            "Win.Adware.MultiPlug-2",
            "Win.Adware.MultiPlug-6336421-1",
            "Win.Trojan.Softpulse-433"
        ],
        "yara_static": [
            {
                "rule_name": "RDPWrap",
                "author": "@bartblaze",
                "description": "Test rule",
                "reference": "http://google.com/test",
                "tlp": "WHITE",
                "rule_matching_tlp": null
            },
            ... [more]
       ],
        "yara_unpack": [
            {
                "rule_name": "crime_win64_emotet_unpacked",
                "author": "Rony (r0ny_123)",
                "description": "Test rule",
                "reference": "http://google.com/test",
                "tlp": "WHITE",
                "rule_matching_tlp": null
            },
            ... [more]
        ]
    }
}

Each field has the following format:

  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the real time infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type defines the type of message. It’s always “task_result”.

  • task_id Task ID (UUID4).

  • md5_hash is the MD5 hash of the payload received.

  • sha256_hash is the SHA256 hash of the payload received.

  • sha1_hash is the SHA1 hash of the file.

  • sha3_384_hash is the SHA3-384 hash of the file.

  • file_name is the original file name

  • clamav_scan boolean indicating whether the file has been scanned with ClamAV or not.

  • unpack boolean indicating whether the file has been processed by the Portable Executable (PE) unpacker.

  • unpacked_files_cnt If unpack is True, number of unpacked files collected (if any)

  • share_file boolean indicating whether the user decided to share the sample or not.

  • results.clamav is the matching ClamAV signature.

  • results.yara_static is an array indicating the static YARA rule matching results.

  • results.yara_unpack is the array of the unpacker YARA rule matching results.

Unpacker results

This message gets triggered when a file got unpacked on YARAify.

{
  "uuid": "576987e1-d31f-4d29-99da-25159d9ad8ee",
  "type": "unpacker_results",
  "md5_hash": "c0b29fb1988205013b7723ba6543f416",
  "sha256_hash": "e19b0ba085a6c6f754df5f6f3a2ad8d490eafb62ad14606a943e7de2d0e3e03f",
  "sha1_hash": "232ba158178319926b651783a45cd1a966667f95",
  "sha3_384_hash": "56293c2a25e661d7fbffc8a2b123aa96dabd00ec98d1b1004088573ccc9df9a2d8f48a2eb7d26dde8b9393650456941b",
  "unpacked_file_name": "test.exe",
  "mime_type": "text/plain",
  "file_size": 166,
  "imphash": null,
  "ssdeep": "3:20euRxVNf9eeGoUpdeuHX6YTyI6WqokYN6R/I6QIiADg6TIi00V4GN6S8yVg6dqb:2nuRxV98ZoUtX9yI65okYN6RA6jXg6TW",
  "tlsh": "T18CC048F380E010420460231313EF1E452B5F235C77462623F42C7D808320A3A37A3972",
  "telfhash": null,
  "gimphash": null,
  "dhash_icon": null,
  "parent_file": {
    "md5_hash": "80d2b829aadaf4ef5e27da806a3fce16",
    "sha256_hash": "5f4b796f8ee524790172ed29cc21d32e43d347e3c306781f420d7844e0a776c9",
    "sha1_hash": "f89246976faaf30906f477ed7836bb971c68025c",
    "sha3_384_hash": "be3e577e19eb5279fe6c3ce298737ac942e5a123f7b38e15965e99a4aa2e277ee7fba14e8d7538e336fae6cccd1ad2ba"
  },
  "yara_matches": []
}

Each field has the following format:

  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the real time infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type defines the type of message. It’s always “unpacker_results”.

  • md5_hash is the MD5 hash of the unpacked file

  • sha256_hash is the SHA256 hash of the unpacked file

  • sha1_hash is the SHA1 hash of the unpacked file

  • sha3_384_hash is the SHA3-384 hash of the unpacked file

  • file_name is the file name of the unpacked file

  • file_size is the size in bytes of the unpacked file

  • imphash is the imphash of the unpacked file

  • ssdeep is the ssdeep of the unpacked file

  • tlsh is the TLSH of the unpacked file

  • telfhash is the telfhash name of the unpacked file

  • gimphashis the gimphash of the unpacked file

  • dhash_icon is the dhash of the unpacked file’ icon

  • mime_type is the MIME type of the unpacked file

  • parent_file is the original file (parent) from which this file (child) got unpacked from

  • yara_matches is a list of YARA rules matching this unpacked file

Feodo Tracker

The feed name is feodotracker. Feodo Tracker is a project of abuse.ch with the goal of sharing botnet C&C servers associated with specific, major botnets that facilitate attacks, such as ransomware. This real time feed provides a notification whenever:

  • An active botnet C2 is observed;

  • A botnet C2 is removed from Feodo Tracker by the administrator (e.g. because of a false positive).

Observed C2s

This message gets triggered every time an active C2 gets observed by Feodo Tracker.

This message has the following format:

{
    "_idx": 123456,
    "_ts": 12345678,
    "uuid": "526e9912-6103-4503-adf5-5492cc4ec6e8"
    "type": "observed_c2"
    "ip_address": "51.68.145.174",
    "port": 443,
    "protocol": "TCP",
    "malware_malpedia": "win.bumblebee",
    "as_number": 16276,
    "as_name": "OVH",
    "country": "FR",
    "first_seen": 1657474960,
    "last_checked": 1660824130,
    "last_online": 1660824130
}

Each field has the following content:

  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the real time infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type defines the type of message. It’s always ‘observed_c2’.

  • ip_address is the IPv4 or IPv6 address of the botnet C2.

  • port is the port of the botnet C2.

  • protocol is the protocol the botnet C2 uses.

  • malware_malpedia is the malware family associated with this botnet C2 (using the Malpedia naming scheme).

  • as_number is the Autonomous System (AS) number associated with the botnet C2 (ip_address).

  • as_name is the AS name associated with the botnet C2.

  • country is the geo-located country of the botnet C2 (two-letter country code).

  • first_seen is the Unix timestamp when this botnet C2 has been observed for the first time.

  • last_checked is the Unix timestamp when this botnet C2 has been (re-)validated by Feodo Tracker last time.

  • last_online is the Unix timestamp when this botnet C2 has been seen active (online) for the last time.

C2 removal

This message gets triggered every time a botnet C2 gets removed from Feodo Tracker by the admin (e.g. because of a false positive).

The message has the following format:

{
    "_idx": 123456,
    "_ts": 12345678,
    "uuid": "526e9912-6103-4503-adf5-5492cc4ec6e8"
    "type": "c2_removal"
    "ip_address": "51.68.145.174",
    "port": 443,
    "protocol": "TCP",
    "malware_malpedia": "win.bumblebee",
    "removal_note": "Removed by admin"
}

Each field has the following content:

  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the real time infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type defines the type of message. It’s always ‘c2_removal’.

  • ip_addressis the IPv4 of the botnet C2.

  • port is the port of the botnet C2.

  • protocol is the protocol the botnet C2 uses.

  • malware_malpedia is the malware family associated with this botnet C2 (using the Malpedia naming scheme).

  • removal_note contains the reason why the botnet C2 has been removed.

Sandnet

The feed name is sandnet. Sandnet is a sandbox operated by abuse.ch. It detonates suspicious files in a controlled, virtual environment and collects signals during malware execution. This real time feed provides notification whenever:

  • A new file is observed by Sandnet (prior pre-classification engine, file might be legit);

  • A new sandbox report is available (post classification engine);

  • A file got unpacked by Sandnet;

  • The metadata of a sandbox report changes (e.g. malware);

  • A YARA rule matches a static file;

  • A YARA rule matches a dumped (suspicious) progress during malware execution in the sandbox;

  • A YARA rule matches an unpacked file;

  • An SSL certificate is observed during malware execution;

  • A JA3 fingerprint gets calculated during malware execution;

  • A JA3s fingerprint gets calculated during malware execution;

  • An IDS alert is triggered during malware execution;

  • A DNS resolution is observed during malware execution;

  • An HTTP connection is observed during malware execution;

  • A TCP or UDP connection is observed during malware execution.

All the data are cross-correlated through the md5 hash. This is the field that should be used to link an observation to the original sample file.

New files

This message gets triggered every time a new file is observed by Sandnet (pre-classification engine).

Please note that a new file can be legitimate or can contain malware; at this stage of the processing, it’s not yet known if the file is malicious or not.

The message has the following format:

{
    "_idx": 123456,
    "_ts": 12345678,
    "uuid": "bd6c2aa3-6c96-491c-9880-6bee304757eb",
    "type": "file_addition"
    "md5_hash": "7ec6e3a0f52702fa460e8923abd74439",
    "sha256_hash": "a469b0c6b8ebcf56cd89868736d2f4c37102bbb0b319f63898c30026cb4751fe",
    "filesize": 1364522,
    "file_ext": "exe",
    "imphash": "6f27c6ffd985a2a73508e5dc692561f1",
    "ssdeep": "24576:f382om3Cg/iDfPc/7tNETop2FmYaS0LtVOmvjkiSs9OfccyM4NQd4gOa:fXgTK7th2jaSYtgySWNI4gx",
    "tlsh": "C7553323F3D2E473F65E32321B51A381B6FDEEB495B54282C2A54E07AB30AD05653B47",
    "dhash_icon": "d0d0c0e0e0f0b2b0"
}

Each field has the following content:

  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the real time infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type is the type of this message. Value is “file_addition”.

  • md5_hash is the MD5 hash of the file.

  • sha256_hash is the SHA256 hash of the file.

  • filesize is the file size in bytes.

  • file_ext is the guessed file extension (or ‘null’).

  • imphash is the imphash of the file.

  • ssdeep is the ssdeep of the file.

  • tlsh is the tlsh of the file.

  • dhash_icon is the dhash of the file’s icon.

The download links will be released in a future iteration. Contact Spamhaus directly for more information.

New reports

This message gets triggered every time a new sandbox report from Sandnet is available (post-classification engine).

The message has the following format:

{
    "_idx": 123456,
    "_ts": 12345678,
    "uuid": "ee815707-4bec-4d37-a829-0579a01c2612",
    "type": "report_addition"
    "md5_hash": "1808bbd08170485ffd1e0b0c408f4360",
    "sha256_hash": "0d26a40b7509da792bfd82a4420f7068a6ebc8c7382f924356a556976de81555",
    "malware": "AgentTesla",
    "tcp": {
        "hosts": 1,
        "ok": 1,
        "bad": 0
    },
    "udp": {
        "hosts": 0,
        "ok": 0
    },
    "http": {
        "hosts": 0,
        "get": 0,
        "post": 0
    },
    "https": {
        "hosts": 1,
        "ok": 1,
        "bad": 0
    },
    "dns": {
        "hosts": 1,
        "a": 1,
        "mx": 0,
        "txt": 0
    },
    "ids_events": 0,
    "tags": [
        "powershell",
        "persistence:registry",
        "ch_cookiestealer",
        "ff_cookiestealer",
        "tb_cookiestealer",
        "Telegram"
    ]
}

Each field has the following content:

  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the real time infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type is the type of this message. Always “report_addition”.

  • md5_hash is the MD5 hash of the file.

  • sha256_hash is the SHA256 hash of the file.

  • malware is the malware family name triggering this connection.

  • tcp.hosts is the number of distinct Transmission Control Protocol (TCP) hosts (IPv4 addresses) contacted by the detonating malware.

  • tcp.ok is the number of distinct successful TCP connections initiated by the detonating malware.

  • tcp.bad is the number of distinct unsuccessful TCP connections initiated by the detonating malware.

  • udp.hosts is the number of distinct User Datagram Protocol (UDP) hosts (IPv4 addresses) contacted by the detonating malware.

  • udp.ok is the number of distinct UDP connections initiated by the detonating malware.

  • http.hosts is the number of distinct HTTP hosts (HTTP host header) contacted by the detonating malware.

  • http.get is the number of HTTP GET requests initiated by the detonating malware.

  • http.post is the number of HTTP POST requests initiated by the detonating malware.

  • https.hosts is the number of distinct HTTPs hosts (destination IPv4 addresses) contacted by the detonating malware.

  • https.ok is the number of successful HTTPs connections initiated by the detonating malware.

  • http.bad is the number of unsuccessful HTTPs connections initiated by the detonating malware.

  • dns.hosts is the number of distinct DNS hosts (DNS names) queried by the detonating malware.

  • dns.a is the number of distinct DNS A records queried by the detonating malware.

  • dns.mx is the number of distinct DNS MX records queried by the detonating malware.

  • dns.txt is the number of distinct DNS TXT records queried by the detonating malware.

  • ids_events is the number of distinct events generated by the network Intrusion Detection System (IDS).

  • tags is an array consisting of the list of tags associated with this malware detonation.

Unpacked files

Most malware samples are packed using a packer. Sandnet tries to unpack such samples. This message gets triggered every time an unpacked file is observed by Sandnet.

The message has the following format:

{
    "_idx": 123456,
    "_ts": 12345678,
    "uuid": "ee815707-4bec-4d37-a829-0579a01c2612",
    "type": "unpacked_addition"
    "md5_hash": "7ec6e3a0f52702fa460e8923abd74439",
    "sha256_hash": "a469b0c6b8ebcf56cd89868736d2f4c37102bbb0b319f63898c30026cb4751fe",
    "parent_md5_hash": "10aa0a05adef59cf8a0e982d2b726419",
    "parent_malware": "AgentTesla",
}

Each field has the following content:

  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the real time infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type is the type of this message which is always “unpacked_addition”.

  • md5_hash is the MD5 hash of the file.

  • sha256_hash is the SHA256 hash of the file.

  • parent_md5_hash is the MD5 hash of the parent file (usually the packet file).

  • parent_malware is the malware of the parent file (usually the packet file).

The download links will be released in a future iteration. Contact Spamhaus directly for more information.

New procdumps

This message gets triggered every time a new process dump is observed by Sandnet. Process dumps are generated during malware execution (dumping of suspicious processes).

The message has the following format:

{
    "_idx": 123456,
    "_ts": 12345678,
    "uuid": "7119bd62-ee69-4ff2-8ae7-e289ee26653a",
    "type": "procdump_addition"
    "md5_hash": "f910c5fdeb72b46c96144decb2963c3c",
    "sha256_hash": "07426741c709e153e19eb4dbb0b461344446ce4f30983884ea7357ff282985a4",
    "parent_md5_hash": "20389af005d4760c8521278325e77ae1",
    "parent_malware": "RedLineStealer",
}

Each field has the following content:

  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the real time infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type is the type of this message. The value is always “procdump_addition”.

  • md5_hash is the MD5 hash of the file.

  • sha256_hash is the SHA256 hash of the file.

  • parent_md5_hash is the MD5 hash of the parent file (usually the packet file).

  • parent_malware is the malware of the parent file (usually the packet file).

The download links will be released in a future iteration. Contact Spamhaus directly for more information.

Report changes

This message gets triggered every time the metadata for a sandbox report changes (e.g. when the malware family changes).

The message has the following format:

{
    "_idx": 123456,
    "_ts": 12345678,
    "uuid": "67b7986c-0a3e-4f6f-811d-5da3b05279e3",
    "type": "report_change"
    "md5_hash": "3b084221a74184e18fb609cf3b96b589",
    "sha256_hash": "6a244198510958e8699f44394947fbe58aed00b47710ab8d85bb094dfdfcb4af",
    "field": "malware",
    "value": "Formbook",
    "action": "change"
}

Each field has the following content:

  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the real time infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type is the type of this message. The value is always “report_change”.

  • md5_hash is the MD5 hash of the file.

  • sha256_hash is the SHA256 hash of the file.

  • field is the affected field where the change occurred.

  • value is the new value of the affected field.

  • action shows what is the type of event that triggered this message (add, remove, change).

Observed YARA matches on static files

This message gets triggered every time a YARA rule matches on a static file.

The message has the following format:

{
    "_idx": 123456,
    "_ts": 12345678,
    "uuid": "e6be9b63-443f-428a-b71d-81ec1307c880",
    "type": "observed_static_yara"
    "md5_hash": "0857a4a9fc6a9bf3e95753c0d07de7a1",
    "sha256_hash": "18171768e82f92e884878426b838836319c5ab344d0df96a8d3460a4b7ecc497",
    "malware": "RecordBreaker",
    "static_yara": {
    "rule_name": "RaccoonV2",
    "author": "@_FirehaK <[email protected]>",
    "description": "This rule detects Raccoon Stealer version 2.0 (called Recordbreaker before attribution). It has been spotted spreading through fake software cracks and keygens as far back as April 2022.",
    "reference": "https://www.zerofox.com/blog/brief-raccoon-stealer-version-2-0/",
    "tlp": "WHITE"
}

Each field has the following content:

  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the real time infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type is the type of this message. The value is always “observed_static_yara”.

  • md5_hash is the MD5 hash of the file.

  • sha256_hash is the SHA256 hash of the file.

  • malware is the malware family name.

  • static_yara.rule_name is the YARA rule name.

  • static_yara.author is the author of the YARA rule.

  • static_yara.description contains the description of the YARA rule (set by the author).

  • static_yara.reference contains a reference of the YARA rule (set by the author).

  • static_yara.tlp is the Traffic Light Protocol (TLP) of the YARA rule (set by the author).

Observed YARA matches on process dumps

This message gets triggered every time a YARA rule matches on a dumped process from malware detonation.

The message has the following format:

{
    "_idx": 123456,
    "_ts": 12345678,
    "uuid": "6a4a0c6c-733a-4e78-9412-71e5c85a1c63",
    "type": "observed_procdump_yara"
    "md5_hash": "417af326c733d6b38ab2cdc02c634272",
    "sha256_hash": "be98295ac2751f7292254c7e7e8024c8bc1d1bfe721218785724b86c408e53eb",
    "malware": "Dridex",
    "procdump_yara": {
        "rule_name": "DridexLoader",
        "author": "kevoreilly",
        "description": "Dridex v4 dropper C2 parsing function",
        "reference": null,
        "tlp": "WHITE"
    }
}

Each field has the following content:

  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the real time infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type is the type of this message. The value is always “observed_procdump_yara”.

  • md5_hash is the MD5 hash of the file.

  • sha256_hash is the SHA256 hash of the file.

  • malware is the malware family name.

  • procdump_yara.rule_name is the YARA rule name.

  • procdump_yara.author is the author of the YARA rule.

  • procdump_yara.description contains the description of the YARA rule (set by the author).

  • procdump_yara.reference has a reference of the YARA rule (set by the author).

  • procdump_yara.tlp is the TLP of the YARA rule (set by the author).

Observed YARA matches on unpacked files

This message gets triggered every time a YARA rule matches on an unpacked malware sample.

The message has the following format:

{
    "_idx": 123456,
    "_ts": 12345678,
    "uuid": "6a4a0c6c-733a-4e78-9412-71e5c85a1c63",
    "type": "observed_unpack_yara"
    "md5_hash": "4445dd03ad622d2ac30219398822caca",
    "sha256_hash": "f0f3c0a8992a0f0351dbaee9f5f7cb987bb0bdfedbeb5d5d6c14e13cad633716",
    "malware": "RedLineStealer",
    "unpacked_md5_hash": "e0de2e060fb87720d594e49caf006bc0",
    "procdump_yara": {
        "rule_name": "win_xfilesstealer_auto",
        "author": "Felix Bilstein - yara-signator at cocacoding dot com",
        "description": "Detects win.xfilesstealer.",
        "reference": null,
        "tlp": "WHITE"
    }
}   

Each field has the following content:

  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the real time infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type is the type of this message. The value is always “observed_unpack_yara”.

  • md5_hash is the MD5 hash of the file.

  • sha256_hash is the SHA256 hash of the file.

  • malware is the malware family name.

  • unpacked_md5_hash is the MD5 hash of the unpacked file.

  • procdump_yara.rule_name is the YARA rule name.

  • procdump_yara.author is the author of the YARA rule.

  • procdump_yara.description contains the description of the YARA rule (set by the author).

  • procdump_yara.reference contains the reference of the YARA rule (set by the author).

  • procdump_yara.tlp is the TLP of the YARA rule (set by the author).

Observed SSL certificates

This message gets triggered every time an SSL certificate is observed using malware detonation.

The message has the following format:

{
    "_idx": 123456,
    "_ts": 12345678,
    "uuid": "d8239b7e-af71-4321-b231-dc5f6b58f24b",
    "type": "observed_ssl"
    "md5_hash": "59e0e64389ee0258bba61827a26df8de",
    "sha256_hash": "1244dfb6b3b2c4e54f6b4a60f01d19b0666029e8313adffaf2e301c2631b51d9",
    "malware": "CoinMiner",
    "sha1_fingerprint": "d02a9bbae24269cacec74fb8f4317a8c064cc336",
    "subject_cn": "eiso-france.com",
    "subject": "CN=eiso-france.com",
    "issuerdn_cn": "R3",
    "issuerdn": "C=US, O=Let's Encrypt, CN=R3",
    "issuer_org": "Let's Encrypt",
    "first_seen": 1659509611,
    "connection": {
        "src_port": 49774,
        "dst_ip_address": "87.98.154.146",
        "dst_port": 443,
        "tls_version": "TLS 1.2"
    }
}

Each field has the following content:

  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the real time infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type is the type of this message. The value is always “observed_ssl”.

  • md5_hash is the MD5 hash of the file.

  • sha256_hash is the SHA256 hash of the file.

  • malware is the malware family name triggering this connection.

  • sha1_fingerprint the SHA1 checksum of the SSL certificate.

  • subject_cn is the parsed subject “CN” (common name) value of the SSL certificate.

  • subject is the raw (unparsed) subject of the certificate.

  • issuerdn_cn is the parsed issuer “CN” (common name) value of the SSL certificate.

  • issuerdn is the raw (unparsed) issuer of the cert.

  • issuer_org is the parsed issuer “O” (Organization) value of the SSL certificate.

  • first_seen is the Unix timestamp when the SSL certificate has been observed for the first time.

  • connection.src_port is the source port (TCP) from where the connection originates from.

  • connection.dst_ip_address is the destination IPv4 address to which the connection was made.

  • connection.dst_port is the destination port (TCP) to which the connection was made on the remote host (dst_ip_address).

  • tls_version is the TLS version of the SSL connection.

Observed JA3 fingerprints

JA3 is a method for creating SSL/TLS client fingerprints that should be easy to produce on any platform and can be easily shared for threat intelligence. More information about JA3 is available here: https://github.com/salesforce/ja3

This message gets triggered every time a JA3 fingerprint gets calculated on an SSL connection initiated by a detonating malware.

The message has the following format:

{
    "_idx": 123456,
    "_ts": 12345678,
    "uuid": "d8239b7e-af71-4321-b231-dc5f6b58f24b",
    "type": "observed_ja3"
    "md5_hash": "6ed857b3cb60a782a22185d5caed543d",
    "sha256_hash": "952bb48c90610d873b24fd89a7e7a90f57db0a81891dcd8284390b2699a9de83",
    "malware": "a310Logger",
    "ja3_fingerprint": "3b5074b1b5d032e5620f69f9f700ff0e",
    "first_seen": 1511354566,
    "connection": {
        "dst_ip_address": "99.83.231.61",
        "dst_port": 443
    }
}

Each field has the following content:

  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the real time infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type is the type of this message. The value is always “observed_ja3”.

  • md5_hash is the MD5 hash of the file.

  • sha256_hash is the SHA256 hash of the file.

  • malware is the malware family name triggering this connection.

  • ja3_fingerprint is the JA3 fingerprint of the SSL connection.

  • first_seen is the Unix timestamp when the JA3 fingerprint has been observed for the first time.

  • connection.dst_ip_address is the destination IPv4 address to which the connection was made.

  • connection.dst_port is the destination port (TCP) to which the connection was made on the remote host (dst_ip_address).

Observed JA3s fingerprints

JA3 is used for fingerprinting a TLS client, and JA3s is its counterpart for servers. This method was found to be useful for identifying not only malware clients and servers, but also web API clients and browsers. More information about JA3s is available here: https://engineering.salesforce.com/tls-fingerprinting-with-ja3-and-ja3s-247362855967/

This message gets triggered every time a JA3s fingerprint gets calculated on an SSL connection initiated by a detonating malware.

The message has the following format:

{
    "_idx": 123456,
    "_ts": 12345678,
    "uuid": "84800cea-67d8-457a-bf2b-af30fe263d9d",
    "type": "observed_ja3s"
    "md5_hash": "6e8f735b3c356bc8b847989167baf8c4",
    "sha256_hash": "246458b65696ce3486d38437c12195dfa18b9ac9b1c55cfa6a27142f8698bed3",
    "malware": "Smoke Loader",
    "ja3s_fingerprint": "ec633c737ffac9de2561152ade674fe6",
    "first_seen": 1631870476,
    "connection": {
        "src_ip_address": "157.240.247.35",
        "src_port": 443
    }
}

Each field has the following content:

  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the real time infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type is the type of this message. The value is always “observed_ja3s”.

  • md5_hash is the MD5 hash of the file.

  • sha256_hash is the SHA256 hash of the file.

  • malware is the malware family name triggering this connection.

  • ja3s_fingerprint is the JA3s fingerprint of the SSL connection.

  • first_seen is the Unix timestamp when the JA3s fingerprint has been observed for the first time.

  • connection.dst_ip_address is the destination IPv4 address to which the connection was made.

  • connection.dst_port is the destination port (TCP) to which the connection was made on the remote host (dst_ip_address).

Observed IDS alerts

This message gets triggered every time an alert from the network Intrusion Detection System (IDS) gets observed on network connections initiated by detonating malware.

The message has the following format:

{
    "_idx": 123456,
    "_ts": 12345678,
    "uuid": "f3e37493-60aa-4c52-9ffb-b89404799889",
    "type": "observed_ids_alerts"
    "md5_hash": "6cc93623733e2470bf6517c2ed26760e",
    "sha256_hash": "d8444213ae90d863e1ffe60e0d1fadd626debfe0395e83c4135df1394afd2797",
    "malware": "Formbook",
    "sid": 5012267,
    "alert_msg": "ACH Formbook CnC HTTP GET request",
    "connection": {
        "src_ip_address": null,
        "src_port": 49749,
        "dst_ip_address": "44.227.76.166",
        "dst_port": 80
        "protocol": "TCP"
    }
}

Each field has the following content:

  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the real time infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type is the type of this message. The value is always “observed_ids_alerts”.

  • md5_hash is the MD5 hash of the file.

  • sha256_hash is the SHA256 hash of the file.

  • malware is the malware family name triggering this connection.

  • sid is the unique ID of the matching IDS rule.

  • alert_msg is the context of the IDS alert (alert message).

  • connection.src_ip is the source IPv4 address of the server from which the IDS alert triggered.

  • connection.src_port is the source port (TCP) from which the IDS alert triggered.

  • connection.dst_ip_address is the destination IPv4 address to which the IDS alert triggered.

  • connection.dst_port is the destination port (TCP) to which the IDS alert triggered.

  • connection.protocol is the protocol.

Observed DNS resolutions

This message gets triggered every time a DNS resolution is observed initiated by detonating malware.

The message has the following format:

{
    "_idx": 123456,
    "_ts": 12345678,
    "uuid": "f3e37493-60aa-4c52-9ffb-b89404799889",
    "type": "observed_dns_resolution"
    "md5_hash": "6d2b10173e48ecf5f88f58f271e67ae6",
    "sha256_hash": "4e14acecd68eba74374d5e5941a8f798fe469aa73d096f2972d9cbdb7768ef16",
    "malware": "Blackmoon",
    "dns": {
        "name": "d.nxxxn.ga",
        "type": "A",
        "resource": "91.208.246.16",
        "status": "NOERROR",
        "nameserver_ip_address": null
    }
}

Each field has the following content:

  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the real time infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type is the type of this message. The value is always “observed_dns_resolution”.

  • md5_hash is the MD5 hash of the file.

  • sha256_hash is the SHA256 hash of the file.

  • malware is the malware family name triggering this connection.

  • dns.name is the requested DNS host.

  • dns.type is the requested DNS resource type.

  • dns.resource is the DNS query result (resource of the DNS response).

  • dns.status is the status of the DNS query.

  • dns.name_server_ip_address is the IPv4 address of the DNS server used (in case a different DNS server was used than the system default).

Observed HTTP connections

This message gets triggered every time a HTTP connection is observed initiated by detonating malware. Please note that HTTPs connections are not covered.

The message has the following format:

{
    "_idx": 123456,
    "_ts": 12345678,
    "uuid": "f3e37493-60aa-4c52-9ffb-b89404799889",
    "type": "observed_http_connection"
    "md5_hash": "d24150b85bcd4606f427ca8a79863ae1",
    "sha256_hash": "e4381294339eab5d25bf8a4e6ab5d68652236e66164a26b599e555da4ac4a63d",
    "malware": "RecordBreaker",
    "http_connection": {
        "host_header": "193.56.146.177",
        "method": "GET",
        "url": "/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll",
        "referer": null,
        "status_code": 200,
        "content_type": "application/x-dosexec",
        "filename": null,
        "request_size": 0,
        "response_size": 954545
    },
    "connection": {
        "dst_ip_address": "193.56.146.177",
        "dst_port": 80
    }
}

Each field has the following content:

  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the real time infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type is the type of this message. The value is always “observed_http_connection”.

  • md5_hash is the MD5 hash of the file.

  • sha256_hash is the SHA256 hash of the file.

  • malware is the malware family name triggering this connection.

  • http_connection.host_header is the HTTP host header.

  • http_connection.method is the HTTP method.

  • http_connection.url is the HTTP URL (URI).

  • http_connection.referer is the HTTP referer.

  • http_connection.status_code is the HTTP status code returned by the server.

  • http_connection.content_type is the HTTP content type returned by the server.

  • http_connection.filename is the HTTP disposition filename returned by the server.

  • http_connection.request_size is the HTTP request size (HTTP request body) in bytes.

  • http_connection.response_size is the HTTP response size (HTTP response body) in bytes.

  • connection.dst_ip_address is the Destination IPv4 address to which the HTTP connection was made.

  • connection.dst_port is the Destination port (TCP) to which the HTTP connection was made.

Observed network connections

This message gets triggered every time a network connection attempt (TCP or UDP) is observed during detonating malware.

The message has the following format:

{
    "_idx": 123456,
    "_ts": 12345678,
    "uuid": "78d4e778-2c21-46de-a815-349133a075c2",
    "type": "observed_network_connection"
    "md5_hash": "623407787623886d1d6f864b8e0339f7",
    "sha256_hash": "395cef182b4c888f78afde60c4bdcd87768ab658453cd868122151f846fbeb4a",
    "malware": "RedLineStealer",
    "connection": {
        "dst_ip_address": "193.233.20.28",
        "dst_port": 4125,
        "protocol": "TCP",
        "service": null,
        "connection_state": "RSTO",
        "bytes_sent": 4403706,
        "bytes_received": 6131,
        "as_number": 202973,
        "as_name": "Partner LLC"
    }
}

Each field has the following content:

  • _idx is an integer representing the incremental number of the message.

  • _ts is the Unix timestamp, indicating when the message was received by the real time infrastructure.

  • uuid is an internal, unique identifier for the message. This is the property that should be used to dedupe the incoming flows where necessary.

  • type is the type of this message. The value is always “observed_network_connection”.

  • md5_hash is the MD5 hash of the file.

  • sha256_hash is the SHA256 hash of the file.

  • malware is the malware family name triggering this connection.

  • connection.dst_ip_address is the destination IPv4 address to which the HTTP connection was made.

  • connection.dst_port is the destination port (TCP) to which the connection was made.

  • protocol is the protocol used (TCP or UDP).

  • service the service identified to be associated with this connection

  • connection_state is the status of the connection.

  • bytes_sent is the number of bytes sent to the remote host.

  • bytes_received is the number of bytes received from the remote host.

  • as_number is the Autonomous System (AS) number of the remote host (dst_ip_address).

  • as_name is the AS name of the remote host (dst_ip_address).

The table below documents the possible values of connection_state and their meaning:

Connection state Meaning
S0 Connection attempt seen, no reply
S1 Connection established, not terminate (0 byte counts)
SF Normal established & termination (>0 byte counts)
REJ Connection attempt rejected
S2 Established, ORIG attempts close, no reply from RESP
S3 Established, RESP attempts close, no reply from ORIG
RSTO Established, ORIG aborted (RST)
RSTR Established, RESP aborted (RST)
RSTOS ORIG sent SYN then RST; no RESP SYN-ACK
RSTRH RESP sent SYN-ACK then RST; no ORIG SYN
SH ORIG sent SYN then FIN; no RESP SYN-ACK ("half-open")
SHR RESP sent SYN-ACK then FIN; no ORIG SYN
OTH No SYN, not closed. Midstream traffic. Partial connection

ChangeLog

Updates made on 18 July 2023

Overview:

  • New event types made available via MalwareBazaar and YARAify

  • New fields made available via MalwareBazaar, ThreatFox, and YARAify

  • Fields names updated for three fields within YARAify

New event type available

Event type Name RT Feed
YARA matches MalwareBazaar
Code Signing Certificate Blocklist (CSCB) additions MalwareBazaar
Unpacker results YARAify

New fields available

Field name Under event type RT Feed
origin_country File additions MalwareBazaar
delivery_method File additions MalwareBazaar
_idx YARA matches (new event type) MalwareBazaar
_ts YARA matches (new event type) MalwareBazaar
uuid YARA matches (new event type) MalwareBazaar
type YARA matches (new event type) MalwareBazaar
md5_hash YARA matches (new event type) MalwareBazaar
sha256_hash YARA matches (new event type) MalwareBazaar
sha1_hash YARA matches (new event type) MalwareBazaar
sha3_384_hash YARA matches (new event type) MalwareBazaar
yara.rule_name YARA matches (new event type) MalwareBazaar
yara.author YARA matches (new event type) MalwareBazaar
yara.description YARA matches (new event type) MalwareBazaar
yara.reference YARA matches (new event type) MalwareBazaar
yara.tlp YARA matches (new event type) MalwareBazaar
_idx Code Signing Certificate Blocklist (CSCB) additions (new event type) MalwareBazaar
_ts Code Signing Certificate Blocklist (CSCB) additions (new event type) MalwareBazaar
uuid Code Signing Certificate Blocklist (CSCB) additions (new event type) MalwareBazaar
type Code Signing Certificate Blocklist (CSCB) additions (new event type) MalwareBazaar
subject_cn Code Signing Certificate Blocklist (CSCB) additions (new event type) MalwareBazaar
issuer_cn Code Signing Certificate Blocklist (CSCB) additions (new event type) MalwareBazaar
algorithm Code Signing Certificate Blocklist (CSCB) additions (new event type) MalwareBazaar
valid_from Code Signing Certificate Blocklist (CSCB) additions (new event type) MalwareBazaar
valid_to Code Signing Certificate Blocklist (CSCB) additions (new event type) MalwareBazaar
serial_number Code Signing Certificate Blocklist (CSCB) additions (new event type) MalwareBazaar
thumbprint_algorithm Code Signing Certificate Blocklist (CSCB) additions (new event type) MalwareBazaar
thumbprint Code Signing Certificate Blocklist (CSCB) additions (new event type) MalwareBazaar
bl_reason Code Signing Certificate Blocklist (CSCB) additions (new event type) MalwareBazaar
malware_samples Code Signing Certificate Blocklist (CSCB) additions (new event type) MalwareBazaar
malware_printable IOC additions ThreatFox
malware_alias IOC additions ThreatFox
reward IOC additions ThreatFox
reference IOC additions ThreatFox
_idx Unpacker results (new event type) YARAify
_ts Unpacker results (new event type) YARAify
uuid Unpacker results (new event type) YARAify
type Unpacker results (new event type) YARAify
md5_hash Unpacker results (new event type) YARAify
sha256_hash Unpacker results (new event type) YARAify
sha1_hash Unpacker results (new event type) YARAify
sha3_384_hash Unpacker results (new event type) YARAify
file_name Unpacker results (new event type) YARAify
file_size Unpacker results (new event type) YARAify
imphash Unpacker results (new event type) YARAify
ssdeep Unpacker results (new event type) YARAify
tlsh Unpacker results (new event type) YARAify
telfhash Unpacker results (new event type) YARAify
gimphash Unpacker results (new event type) YARAify
dhash_icon Unpacker results (new event type) YARAify
mime_type Unpacker results (new event type) YARAify
parent_file Unpacker results (new event type) YARAify
yara_matches Unpacker results (new event type) YARAify
description Unpacker results (new event type) YARAify
reference Unpacker results (new event type) YARAify
results.yara_static.description Unpacker results (new event type) YARAify
results.yara_static.reference Unpacker results (new event type) YARAify
results.yara_unpack.description Unpacker results (new event type) YARAify
results.yara_unpack.reference Unpacker results (new event type) YARAify

Field name changes

New field name Old field name Under event type RT Feed
results.clamav result.clamav Unpacker results YARAify
results.yara_static result.static Unpacker results YARAify
results.yara_unpack result.unpack Unpacker results YARAify