家族团伙研判信息查询
接口说明
该接口用于查询指定威胁家族 / 攻击团伙的完整详情信息。传入家族团伙的名称,接口返回该威胁家族或攻击团伙的基础资料,包含团伙别名、威胁标签、攻击行为描述、活动时间、归属分类、关联的其他团伙、关联样本线索等情报内容。用于威胁研判,查看某一个 APT 组织、恶意病毒家族的背景与相关线索。
请求地址
https://api.ti.360.net/v2/family_campaign/?type=family&value={value}
请求方法
GET
请求参数
| 参数名 | 类型 | 位置 | 说明 |
|---|---|---|---|
| type | string | query | 查询对象的可选类型:family、campaign,这里固定为family |
| value | string | query | 查询家族名称 |
备注:如果url中存在空格、中文等特殊字符,需要urlencode处理
响应参数
当 type类型为family时:字段说明见下表
| 一级字段 | 二级字段 | 三级字段 | 四级字段 | 类型 | 可选值 | 说明 |
|---|---|---|---|---|---|---|
| errno | int | 状态码(详见状态码说明表) | ||||
| msg | string | 结果说明 | ||||
| result | object | 查询结果 | ||||
| 360 | object | 360源家族查询结果 | ||||
| key | string | 查询对象值 | ||||
| hit | boolean | True/False | 是否命中了家族信息,如果返回False,表示未查到家族信息,info中返回的值都为默认空值,其中malicious_type和targeted返回unknown | |||
| info | object | 家族详细信息 | ||||
| alias | array | 家族别名 | ||||
| attack_impact | string | 攻击影响 | ||||
| c2_function | string | 远控功能 | ||||
| communication_ways | array | 传播方式 | ||||
| description | string | 威胁简介 | ||||
| features | array | 技术特点 | ||||
| malicious_type | string | 恶意类型 | ||||
| sub_malicious_types | array | 恶意辅助类型 | ||||
| name | string | 家族名称 | ||||
| platforms | array | 影响平台 | ||||
| reference | string | 参考链接 | ||||
| response_proposal | string | 处置建议 | ||||
| targeted | boolean | True/False | 是否定向攻击,查询不到返回"unknown" |
当 type类型为campaign时:字段说明见下表
| 一级字段 | 二级字段 | 三级字段 | 四级字段 | 类型 | 可选值 | 说明 |
|---|---|---|---|---|---|---|
| errno | int | 状态码(详见状态码说明表) | ||||
| msg | string | 结果说明 | ||||
| result | object | 查询结果 | ||||
| 360 | object | 360源团伙查询结果 | ||||
| key | string | 查询对象值 | ||||
| hit | boolean | True/False | 是否命中了团伙信息,如果返回False,表示未查到团伙信息,info中返回的值都为默认空值,其中malicious_type返回unknown | |||
| info | object | 家族详细信息 | ||||
| alias | array | 团伙别名 | ||||
| affect_region | string | 影响区域 | ||||
| attack_industry | string | 影响行业 | ||||
| attack_motive | string | 攻击动机 | ||||
| background_region | string | 团伙背景 | ||||
| description | array | 威胁简介 | ||||
| malicious_type | string | 恶意类型 | ||||
| first_seen | string | 最早活动时间 | ||||
| name | array | 团伙名称 | ||||
| reference | string | 参考链接 |
请求示例
支持cUrl、Python、Java、PHP、Go语言的请求,示例如下
#!/usr/bin/env bash
set -euo pipefail
API_KEY="" # apikey
SALT="" # salt
TYPE="family"
VALUE="Ripprbot"
TIMESTAMP=$(date +%s)
SIGN=$(printf '%s' "${TYPE}${TIMESTAMP}${SALT}" | openssl dgst -md5 -hex | awk '{print $NF}')
curl --location --request GET "https://api.ti.360.net/v2/family_campaign/?type=${TYPE}&value=${VALUE}" \
--header "X-Api-Key: ${API_KEY}" \
--header "timestamp: ${TIMESTAMP}" \
--header "sign: ${SIGN}"import time
import hashlib
import requests
def do_get():
timestamp = int(time.time())
api_key= API_KEY
salt= SALT
timestamp = int(time.time())
sign = hashlib.md5(("family"+str(timestamp) + salt).encode()).hexdigest()
headers = {
'X-Api-Key': api_key,
'sign': sign,
'timestamp': str(timestamp)
}
api = f"https://api.ti.360.net/v2/family_campaign/?type=family&value=Ripprbot"
response = requests.request("GET", api, headers=headers)
return response.text
if __name__ == "__main__":
result = do_get()
print(result)import java.net.URI;
import java.net.URLEncoder;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
public class Demo {
static String md5(String input) throws Exception {
byte[] digest = MessageDigest.getInstance("MD5")
.digest(input.getBytes(StandardCharsets.UTF_8));
StringBuilder sb = new StringBuilder();
for (byte b : digest) {
sb.append(String.format("%02x", b & 0xff));
}
return sb.toString();
}
public static void main(String[] args) throws Exception {
String apiKey = ""; // apikey
String salt = ""; // salt
String type = "family";
String value = "Ripprbot";
String timestamp = String.valueOf(System.currentTimeMillis() / 1000);
String sign = md5(type + timestamp + salt);
String url = "https://api.ti.360.net/v2/family_campaign/?type="
+ URLEncoder.encode(type, StandardCharsets.UTF_8)
+ "&value=" + URLEncoder.encode(value, StandardCharsets.UTF_8);
HttpRequest request = HttpRequest.newBuilder()
.uri(URI.create(url))
.header("X-Api-Key", apiKey)
.header("timestamp", timestamp)
.header("sign", sign)
.GET()
.build();
HttpClient client = HttpClient.newHttpClient();
HttpResponse<String> response = client.send(
request, HttpResponse.BodyHandlers.ofString(StandardCharsets.UTF_8));
System.out.println(response.body());
}
}<?php
$apiKey = ""; // apikey
$salt = ""; // salt
$type = "family";
$value = "Ripprbot";
$timestamp = (string) time();
$sign = md5($type . $timestamp . $salt);
$url = "https://api.ti.360.net/v2/family_campaign/?type=" . urlencode($type)
. "&value=" . urlencode($value);
$ch = curl_init($url);
curl_setopt_array($ch, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => [
"X-Api-Key: {$apiKey}",
"timestamp: {$timestamp}",
"sign: {$sign}",
],
]);
$response = curl_exec($ch);
if ($response === false) {
echo curl_error($ch), PHP_EOL;
} else {
echo $response, PHP_EOL;
}
curl_close($ch);package main
import (
"crypto/md5"
"encoding/hex"
"fmt"
"io"
"net/http"
"net/url"
"time"
)
func md5Hex(s string) string {
sum := md5.Sum([]byte(s))
return hex.EncodeToString(sum[:])
}
func main() {
apiKey := "" // apikey
salt := "" // salt
typeName := "family"
value := "Ripprbot"
timestamp := fmt.Sprintf("%d", time.Now().Unix())
sign := md5Hex(typeName + timestamp + salt)
api := "https://api.ti.360.net/v2/family_campaign/?type=" + url.QueryEscape(typeName) +
"&value=" + url.QueryEscape(value)
req, err := http.NewRequest(http.MethodGet, api, nil)
if err != nil {
panic(err)
}
req.Header.Set("X-Api-Key", apiKey)
req.Header.Set("timestamp", timestamp)
req.Header.Set("sign", sign)
resp, err := http.DefaultClient.Do(req)
if err != nil {
panic(err)
}
defer resp.Body.Close()
respBody, err := io.ReadAll(resp.Body)
if err != nil {
panic(err)
}
fmt.Println(string(respBody))
}响应示例
{
"errno": 2000,
"msg": "查询成功",
"result": {
"360": {
"key": "Ripprbot",
"hit": true,
"info": {
"name": "Ripprbot",
"alias": [
"Rippr",
"Ripprbot.436",
"Ripprbot.tor",
"Ripprbot.xor",
"rippr",
"ripprbot",
"Ripprbot",
"Ripprbot.c",
"Ripprbot.randxor"
],
"attack_impact": [],
"c2_function": "",
"communication_ways": [],
"description": "Rippr是一个网络犯罪组织,至少已经活跃了18个月,该组织的名字源于其长期运营的僵尸网络ripprbot,Rippr在2022年4月28日对北京健康宝发起DDoS攻击。Rippr属于Fbot团伙,支持Tor C2,主要功能为DDoS攻击。",
"features": [],
"malicious_type": "僵尸网络",
"platforms": [
"linux"
],
"reference": "",
"response_proposal": "1. 阻断对恶意IOC的访问n2. 排查IOC请求来源n3. 清理IOC相关环境及可能的恶意程序、脚本",
"sub_malicious_types": [],
"targeted": false
}
}
}
}