Cofense Intelligence CDF

The web format of this guide reflects the most current release.  Guides for older iterations are available in PDF format.  

This integration can be installed in the My Integration section of your ThreatQ instance. See the Adding an Integration topic for more details.

Cofense Intelligence

The Cofense Intelligence feed retrieves objects from Cofense Intelligence and enrich them with related data.

GET https://www.threathq.com/apiv1/threat/search?threatType=malware

Sample Response:

{
  "success": true,
  "data": {
    "page": {
      "currentPage": 0,
      "currentElements": 1,
      "totalPages": 1,
      "totalElements": 1
    },
    "threats": [
      {
        "id": 38663,
        "relatedSearchTags": [],
        "feeds": [
          {
            "id": 23,
            "permissions": {
              "WRITE": false,
              "OWNER": false,
              "READ": true
            },
            "displayName": "Cofense"
          }
        ],
        "blockSet": [
          {
            "deliveryMechanism": {
              "mechanismName": "GuLoader",
              "description": "Malware Downloader"
            },
            "impact": "Major",
            "confidence": 0,
            "blockType": "URL",
            "roleDescription": "Location from which a payload is obtained",
            "role": "Payload",
            "data": "https://drive.google.com/u/0/uc?id=1NsGADL4jYjlnVLwjmdivMe3I5yTTalVy&export=download",
            "data_1": {
              "url": "https://drive.google.com/u/0/uc?id=1NsGADL4jYjlnVLwjmdivMe3I5yTTalVy&export=download",
              "domain": "google.com",
              "query": "id=1NsGADL4jYjlnVLwjmdivMe3I5yTTalVy&export=download",
              "path": "/u/0/uc",
              "protocol": "https",
              "host": "drive.google.com"
            }
          },
          {
            "malwareFamily": {
              "familyName": "Remcos Remote Access Trojan",
              "description": "Remcos is a remote access trojan or RAT, used to take control of a user’s system. It has multiple capabilities, chief among them is the ability for key logging, information stealing, and audio/visual monitoring."
            },
            "impact": "Moderate",
            "confidence": 0,
            "blockType": "Domain Name",
            "roleDescription": "Command and control location used by malware",
            "role": "C2",
            "data": "dns.pepsi25.xyz",
            "data_1": "dns.pepsi25.xyz"
          }
        ],
        "campaignBrandSet": [
          {
            "totalCount": 1,
            "brand": {
              "id": 599,
              "text": "UPS"
            }
          }
        ],
        "extractedStringSet": [],
        "domainSet": [],
        "senderEmailSet": [],
        "executableSet": [
          {
            "malwareFamily": {
              "familyName": "Remcos Remote Access Trojan",
              "description": "Remcos is a remote access trojan or RAT, used to take control of a user’s system. It has multiple capabilities, chief among them is the ability for key logging, information stealing, and audio/visual monitoring."
            },
            "vendorDetections": [],
            "fileName": "Juei",
            "type": "Download",
            "dateEntered": 1588944174529,
            "severityLevel": "Major",
            "md5Hex": "6dd7c57fd11acea9111b023c27e7eb56"
          },
          {
            "deliveryMechanism": {
              "mechanismName": "GuLoader",
              "description": "Malware Downloader"
            },
            "vendorDetections": [],
            "fileName": "README.EXE",
            "type": "Attachment",
            "ssdeep": "12288:unUo0e4kMU/NOJF19U9aZqr18iN1uwIoVBXiDjN5dLro6gVZ4glUSamtZsCNisW0:4U96dNOz15Zqr1t3IoTy1CLlGmjs+",
            "dateEntered": 1588941795872,
            "severityLevel": "Major",
            "md5Hex": "b6c8d83223ea073c01d40fafe866466b",
            "sha1Hex": "3341cb5f684cb690e3a92dc8884fcb0c28bf47a3",
            "sha224Hex": "4087a2cee7405842aeb47a0a364e2791d6ca52612bc4865cc42a3dbb",
            "sha256Hex": "ae3295c31bb70b2970c9acb33c40bae503de989ed9d696842a44c866e7bafa55",
            "sha384Hex": "b099de38567532dc9675a31d2d6cd1e57bd613d0649c3ec0f9a5ce4ca7efd935113e26c6182ca1b5892a342e1cfcc490",
            "sha512Hex": "b23ada84e5a6cf6260b05423e637481dbfa9fde7c1462d2b9682715bb8e1865e3e0fffd4978b7a4df17c82384655eebfdfc6b9a6a00380b0dbf366fc66ded354",
            "fileNameExtension": "EXE"
          }
        ],
        "senderIpSet": [],
        "senderNameSet": [],
        "spamUrlSet": [],
        "subjectSet": [
          {
            "totalCount": 1,
            "subject": "UPS - Pending delivery"
          }
        ],
        "campaignLanguageSet": [
          {
            "languageDefinition": {
              "isoCode": "en",
              "name": "English",
              "nativeName": "English",
              "family": "Indo-European"
            }
          }
        ],
        "lastPublished": 1588946280590,
        "firstPublished": 1588946277933,
        "label": "Shipping - GuLoader, Remcos RAT",
        "executiveSummary": "UPS-spoofed emails deliver Remcos RAT via GuLoader.",
        "hasReport": true,
        "reportURL": "https://www.threathq.com/api/l/activethreatreport/38663/html",
        "apiReportURL": "https://www.threathq.com/apiv1/t3/malware/38663/html",
        "threatDetailURL": "https://www.threathq.com/p42/search/default?m=38663",
        "threatType": "MALWARE",
        "malwareFamilySet": [
          {
            "familyName": "Remcos Remote Access Trojan",
            "description": "Remcos is a remote access trojan or RAT, used to take control of a user’s system. It has multiple capabilities, chief among them is the ability for key logging, information stealing, and audio/visual monitoring."
          }
        ],
        "deliveryMechanisms": [
          {
            "mechanismName": "GuLoader",
            "description": "Malware Downloader"
          }
        ],
        "naicsCodes": []
      },
	  ...
    ]
  }
}

ThreatQuotient provides the following default mapping for this feed:

Cofense Intelligence Credential Phishing

The Cofense Intelligence Credential Phishing feed retrieves objects from Cofense Intelligence and enrich them with related data with the possibility to filter based on the malware family.

GET https://www.threathq.com/apiv1/threat/search?malwareFamily=null

Sample Response:

{
    "success": true,
    "data": {
        "page": {
            "currentPage": 0,
            "currentElements": 30,
            "totalPages": 2706,
            "totalElements": 81153
        },
        "threats": [
            {
                "id": 5496,
                "relatedSearchTags": [],
                "feeds": [
                    {
                        "id": 23,
                        "permissions": {
                            "READ": true,
                            "WRITE": false,
                            "OWNER": false
                        },
                        "displayName": "Cofense"
                    }
                ],
                "blockSet": [
                    {
                        "malwareFamily": {
                            "familyName": "CTB Ransomware",
                            "description": "Encryption ransomware"
                        },
                        "impact": "Major",
                        "confidence": 100,
                        "blockType": "Domain Name",
                        "roleDescription": "Command and control location used by malware",
                        "role": "C2",
                        "data": "zsn5qtrgfpu4tmpg.tor2web.fi",
                        "data_1": "zsn5qtrgfpu4tmpg.tor2web.fi"
                    }
                ],
                "campaignBrandSet": [
                    {
                        "totalCount": 1,
                        "brand": {
                            "id": 577,
                            "text": "Vodafone"
                        }
                    }
                ],
                "extractedStringSet": [],
                "domainSet": [],
                "senderEmailSet": [],
                "executableSet": [
                    {
                        "malwareFamily": {
                            "familyName": "CTB Ransomware",
                            "description": "Encryption ransomware"
                        },
                        "vendorDetections": [],
                        "fileName": "Fattura AG00003378.pdf.exe",
                        "type": "Attachment",
                        "dateEntered": 1456437633008,
                        "severityLevel": "Major",
                        "md5Hex": "efb280be9a0f11f5eafc7fd49310cf4e",
                        "sha224Hex": "720c963d5a1134e849dda8b1cc26c2435555480a742a5fea734bbd8b",
                        "sha256Hex": "a202b605ec8a1fcac91194d8145fe857ae9da9d5224787c372de74ed38738055",
                        "sha384Hex": "20318fd2f17129241e34aefe2995e53f9f8d543fa2feecc5094f968dd675e0457cbdb6aa73c2280919a6aeb0aba388b6",
                        "sha512Hex": "15bf417519387655cf558e073c6868d70d222089e147357fdd0cb07f9a77d55ce87bf5ca2f9dbc55ab7bc82436fe15869254189d552f92defa87637b355e2c5a",
                        "sha1Hex": "14dd6b59fb38a3c312ae5c380bee0b9f400162d4",
                        "fileNameExtension": "exe"
                    }
                ],
                "senderIpSet": [],
                "senderNameSet": [],
                "spamUrlSet": [],
                "subjectSet": [
                    {
                        "totalCount": 1,
                        "subject": "Vodafone - Recapito Elettronico Fattura nr. AG00003378"
                    }
                ],
                "campaignLanguageSet": [],
                "campaignScreenshotSet": [],
                "lastPublished": 1660157848556,
                "firstPublished": 1456438512972,
                "label": "Vodafone - CTB Locker Encryption Ransomware",
                "executiveSummary": "Imitating a Vodafone template, these Italian-language emails refer to an electronic invoice instructing the recipient to view the attachment. The attachment is a .zip archive containing an executable file representing the CTB Locker encryption ransomware that encrypts files on the victim machine and changes the desktop background to a payment data image. The payment locations for this malware are located on the Tor web and request payment in Bitcoins, making it impossible to track any payments.",
                "hasReport": true,
                "reportURL": "https://www.threathq.com/api/l/activethreatreport/5496/html",
                "apiReportURL": "https://www.threathq.com/apiv1/t3/malware/5496/html",
                "threatDetailURL": "https://www.threathq.com/p42/search/default?m=5496",
                "threatType": "MALWARE",
                "deliveryMechanisms": [],
                "malwareFamilySet": [
                    {
                        "familyName": "CTB Ransomware",
                        "description": "Encryption ransomware"
                    }
                ],
                "secureEmailGatewaySet": [],
                "naicsCodes": []
            }
        ]
    }
}

ThreatQuotient provides the following default mapping for this feed:

PDF Guides