cybercrime-tracker.net analyzer

analyzers/CyberCrimeTracker/CyberCrimeTracker.json

@@ -0,0 +1,16 @@
+{
+  "name": "CyberCrime-Tracker",
+  "author": "ph34tur3",
+  "license": "AGPL-V3",
+  "url": "https://github.com/ph34tur3/Cortex-Analyzers",
+  "version": "1.0",
+  "description": "Search cybercrime-tracker.net for c2 servers.",
+  "dataTypeList": ["domain", "fqdn", "ip", "url", "other"],
+  "command": "CyberCrimeTracker/cct.py",
+  "baseConfig": "CyberCrimeTracker",
+  "config": {
+    "check_tlp": true,
+    "max_tlp": 2
+  },
+  "configurationItems": []
+}

analyzers/CyberCrimeTracker/cct.py

@@ -0,0 +1,62 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+from cortexutils.analyzer import Analyzer
+from cybercrimetracker.cybercrimeTrackerAPI import cybercrimeTrackerAPI
+
+
+class CyberCrimeTrackerAnalyzer(Analyzer):
+    """
+    This analyzer searches 
+    http://cybercrime-tracker.net
+    for possible c2 servers.
+    """
+
+    def __init__(self):
+        Analyzer.__init__(self)
+
+    def summary(self, raw):
+        level = 'info'
+        namespace = 'CCT'
+        predicate = 'C2 Search'
+
+        hit_count = len(raw.get('results', []))
+        value = "\"{} hits\"".format(hit_count)
+        if hit_count == 1:
+            value = value[:-2] + "\""
+
+        if hit_count > 0:
+            level = 'malicious'
+
+        taxonomies = []
+        taxonomies.append(self.build_taxonomy(level, namespace, predicate, value))
+        return {
+            "taxonomies": taxonomies
+        }
+
+    def run(self):
+        observable = self.get_data()
+        limit = 40
+        offset = 0
+
+        results = []
+
+        try:
+            while True:
+                new_results = cybercrimeTrackerAPI().search(query=observable, offset=offset, limit=limit)
+                results.extend(new_results)
+
+                current_hit_count = len(new_results)
+                no_more_results = current_hit_count < limit
+                if no_more_results:
+                    break
+                offset += limit
+
+            self.report({
+                'results': results
+            })
+        except Exception:
+            self.error('An error occured while scraping cybercrime-tracker.')
+
+
+if __name__ == '__main__':
+    CyberCrimeTrackerAnalyzer().run()

analyzers/CyberCrimeTracker/requirements.txt

@@ -0,0 +1,2 @@
+cortexutils
+cybercrimetracker

thehive-templates/CyberCrimeTracker_1_0/long.html

@@ -0,0 +1,44 @@
+<!-- Success -->
+<div class="panel panel-danger" ng-if="success && content.results.length > 0">
+    <div class="panel-heading">
+        CyberCrimeTracker C2 Search Report
+    </div>
+    <div class="panel-body">
+        <dl class="dl-horizontal" ng-repeat="r in content.results">
+            <dt>IP:</dt>
+            <dd>{{r.ip}}</dd>
+            <dt>URL:</dt>
+            <dd>{{r.url}}</dd>
+            <dt>Date:</dt>
+            <dd>{{r.date}}</dd>
+            <dt>Type:</dt>
+            <dd>{{r.type}}</dd>
+            <dt>VirusTotal (Latest Scan):</dt>
+            <dd>{{r.vt_latest_scan}}</dd>
+            <dt>VirusTotal (IP Info):</dt>
+            <dd>{{r.vt_ip}}</dd>
+        </dl>
+    </div>
+</div>
+
+<div class="panel panel-info" ng-if="success && content.results.length == 0">
+    <div class="panel-heading">
+        CyberCrimeTracker C2 Search Report
+    </div>
+    <div class="panel-body">
+        <b>No matches.</b>
+    </div>
+</div>
+
+<!-- General error  -->
+<div class="panel panel-danger" ng-if="!success">
+    <div class="panel-heading">
+        <strong>{{(artifact.data || artifact.attachment.name) | fang}}</strong>
+    </div>
+    <div class="panel-body">
+        <dl class="dl-horizontal" ng-if="content.errorMessage">
+            <dt><i class="fa fa-warning"></i> CyberCrimeTracker: </dt>
+            <dd class="wrap">{{content.errorMessage}}</dd>
+        </dl>
+    </div>
+</div>

thehive-templates/CyberCrimeTracker_1_0/short.html

@@ -0,0 +1,3 @@
+<span class="label" ng-repeat="t in content.taxonomies" ng-class="{'info': 'label-info', 'safe': 'label-success', 'suspicious': 'label-warning', 'malicious':'label-danger'}[t.level]">
+    {{t.namespace}}:{{t.predicate}}={{t.value}}
+</span>