From f2ea3f4459358fcfeb5cc8c603f8690739a767f8 Mon Sep 17 00:00:00 2001 From: dottor_morte Date: Thu, 8 Feb 2024 04:38:45 -0500 Subject: [PATCH] add anydesk, hackingteam --- leaked/anydesk_leaked_certificate.yml | 12 ++++++++++++ leaked/hangil_it_leaked_certificate.yml | 11 +++++++++++ malicious/hacking_team_malicious_certificate.yml | 11 +++++++++++ 3 files changed, 34 insertions(+) create mode 100644 leaked/anydesk_leaked_certificate.yml create mode 100644 leaked/hangil_it_leaked_certificate.yml create mode 100644 malicious/hacking_team_malicious_certificate.yml diff --git a/leaked/anydesk_leaked_certificate.yml b/leaked/anydesk_leaked_certificate.yml new file mode 100644 index 0000000..057df6a --- /dev/null +++ b/leaked/anydesk_leaked_certificate.yml @@ -0,0 +1,12 @@ +name: anydesk_leaked_certificate +meta: + status: revoked + source: leaked + description: | + AnyDesk Revoked Certificates after public statement: https://anydesk.com/en/public-statement + references: "https://github.com/Neo23x0/signature-base/blob/master/yara/gen_anydesk_compromised_cert_feb23.yar" + date: 07-02-2024 + author: Florian Roth +issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 +serial: ["0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8"] +timestamp: 1706486400 diff --git a/leaked/hangil_it_leaked_certificate.yml b/leaked/hangil_it_leaked_certificate.yml new file mode 100644 index 0000000..4034f28 --- /dev/null +++ b/leaked/hangil_it_leaked_certificate.yml @@ -0,0 +1,11 @@ +name: hangil_it_leaked_certificate +meta: + status: revoked + source: leaked + description: | + Leaked Hangil IT Co., Ltd certificate utilised by various malware. + references: "" + date: 15-11-2023 + author: Riccardo Ancarani +issuer: Sectigo Public Code Signing CA R36 +serial: ["01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45"] diff --git a/malicious/hacking_team_malicious_certificate.yml b/malicious/hacking_team_malicious_certificate.yml new file mode 100644 index 0000000..d8b4f69 --- /dev/null +++ b/malicious/hacking_team_malicious_certificate.yml @@ -0,0 +1,11 @@ +name: hacking_team_malicious_certificate +meta: + status: expired + source: malicious + description: | + Certificate utilised by Hacking Team. + references: https://www.trendmicro.com/vinfo/fr/security/news/vulnerabilities-and-exploits/the-hacking-team-leak-zero-days-patches-and-more-zero-days + date: 15-11-2023 + author: WithSecure +issuer: VeriSign Class 3 Code Signing 2010 CA +serial: ["0f:1b:43:48:4a:13:69:c8:30:38:dc:24:e7:77:8b:7d"]