541 lines
22 KiB
JSON
541 lines
22 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--013585af-ba0a-480a-8f2f-48df896d9229",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-08-19T12:40:21.000Z",
|
||
|
|
"modified": "2022-08-19T12:40:21.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--013585af-ba0a-480a-8f2f-48df896d9229",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-08-19T12:40:21.000Z",
|
||
|
|
"modified": "2022-08-19T12:40:21.000Z",
|
||
|
|
"name": "OSINT - JSSLoader: the shellcode edition",
|
||
|
|
"published": "2022-08-19T12:40:55Z",
|
||
|
|
"object_refs": [
|
||
|
|
"indicator--33ff2767-0cd0-4f23-8d5e-ef4e7c599a31",
|
||
|
|
"indicator--328fe82a-fbab-4589-9a7b-11e5caef263a",
|
||
|
|
"indicator--42764a9c-4661-481b-acd0-66649ddcf5cb",
|
||
|
|
"indicator--6b066e8f-f78f-43f4-9331-8cdd54c8e719",
|
||
|
|
"indicator--3d35309b-d8b1-4c14-b565-2d158cbc6b59",
|
||
|
|
"indicator--92e60ec9-126c-4708-b444-04ade49d2d2c",
|
||
|
|
"indicator--2281dea8-11e1-4763-976a-f312d7fb0154",
|
||
|
|
"indicator--9a498744-8261-428a-98bf-49d000228346",
|
||
|
|
"indicator--b765a67f-1c41-4c2f-92c0-c654b37adff5",
|
||
|
|
"indicator--e081fdb9-1972-4090-bfc4-123e792897a1",
|
||
|
|
"indicator--6d0ce48e-c437-46de-ae24-7472fbea594b",
|
||
|
|
"indicator--1406da62-389f-4c9b-8112-8a2eeb651c48",
|
||
|
|
"indicator--8d74be00-dc29-43aa-8497-db3684056d65",
|
||
|
|
"indicator--79754502-9a01-49f3-858f-9696336fd465",
|
||
|
|
"indicator--d72a4609-ff18-46b7-8921-eac3740002d4",
|
||
|
|
"indicator--00698b4e-497c-459d-94fa-e12da80c9008",
|
||
|
|
"indicator--cfdc5e5b-057b-49cd-b9db-646250947783",
|
||
|
|
"x-misp-object--aaff4760-ea84-46a6-a79a-27919f325ed3",
|
||
|
|
"observed-data--9560a135-3e58-4c09-bade-b3109a40ec35",
|
||
|
|
"user-account--9560a135-3e58-4c09-bade-b3109a40ec35",
|
||
|
|
"observed-data--c41f294b-2395-4d53-a671-577483c9180b",
|
||
|
|
"user-account--c41f294b-2395-4d53-a671-577483c9180b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"misp-galaxy:mitre-intrusion-set=\"FIN7 - G0046\"",
|
||
|
|
"misp-galaxy:threat-actor=\"FIN7\"",
|
||
|
|
"type:OSINT",
|
||
|
|
"osint:lifetime=\"perpetual\"",
|
||
|
|
"osint:certainty=\"50\"",
|
||
|
|
"tlp:clear"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--33ff2767-0cd0-4f23-8d5e-ef4e7c599a31",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-08-19T11:56:44.000Z",
|
||
|
|
"modified": "2022-08-19T11:56:44.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'cc2171d14d0d3c4d117155185f7c911f781aac15b57adef6c32eb0149d5da3ba']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-08-19T11:56:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--328fe82a-fbab-4589-9a7b-11e5caef263a",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-08-19T11:56:44.000Z",
|
||
|
|
"modified": "2022-08-19T11:56:44.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'bf1371e2d79115fc7cfc89266cd7a59c02b04a74e1246435392eb5e20c661d8f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-08-19T11:56:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--42764a9c-4661-481b-acd0-66649ddcf5cb",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-08-19T11:56:44.000Z",
|
||
|
|
"modified": "2022-08-19T11:56:44.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b08e713196b712c42da2df9da7836d270306065fbf6d4720f25d80e4104daf38']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-08-19T11:56:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--6b066e8f-f78f-43f4-9331-8cdd54c8e719",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-08-19T11:56:44.000Z",
|
||
|
|
"modified": "2022-08-19T11:56:44.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7a234d1a2415834290a3a9c7274aadb7253dcfe24edb10b22f1a4a33fd027a08']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-08-19T11:56:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--3d35309b-d8b1-4c14-b565-2d158cbc6b59",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-08-19T11:56:44.000Z",
|
||
|
|
"modified": "2022-08-19T11:56:44.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7a17ef218eebfdd4d3e70add616adcd5b78105becd6616c88b79b261d1a78fdf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-08-19T11:56:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--92e60ec9-126c-4708-b444-04ade49d2d2c",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-08-19T11:56:44.000Z",
|
||
|
|
"modified": "2022-08-19T11:56:44.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '410cd107dfd37752936bd20d022ea614cd373aa9d37db255f65dc434e653236a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-08-19T11:56:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--2281dea8-11e1-4763-976a-f312d7fb0154",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-08-19T11:56:44.000Z",
|
||
|
|
"modified": "2022-08-19T11:56:44.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '35f5c781d61d398ce47a8881228346a81afb4915bf083518bf2b4cc8d6a2685b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-08-19T11:56:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--9a498744-8261-428a-98bf-49d000228346",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-08-19T11:58:24.000Z",
|
||
|
|
"modified": "2022-08-19T11:58:24.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '529f476f952fd1526d2038cb0012e5bdd8a702f3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-08-19T11:58:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--b765a67f-1c41-4c2f-92c0-c654b37adff5",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-08-19T11:58:24.000Z",
|
||
|
|
"modified": "2022-08-19T11:58:24.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '0eaf6289dd7ebe8ae0879a4a72d1518e1d4ffac9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-08-19T11:58:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--e081fdb9-1972-4090-bfc4-123e792897a1",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-08-19T11:58:24.000Z",
|
||
|
|
"modified": "2022-08-19T11:58:24.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'f1aff007c04c6fd3739dbeac537edaaa']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-08-19T11:58:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--6d0ce48e-c437-46de-ae24-7472fbea594b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-08-19T11:58:24.000Z",
|
||
|
|
"modified": "2022-08-19T11:58:24.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '4a1e60be00e59617d53122d70c64506c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-08-19T11:58:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--1406da62-389f-4c9b-8112-8a2eeb651c48",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-08-19T11:58:24.000Z",
|
||
|
|
"modified": "2022-08-19T11:58:24.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '4961aec62fac8beeafffa5bfc841fab8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-08-19T11:58:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--8d74be00-dc29-43aa-8497-db3684056d65",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-08-19T11:58:24.000Z",
|
||
|
|
"modified": "2022-08-19T11:58:24.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '2956c03bff952b22387eed8172a26ba5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-08-19T11:58:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--79754502-9a01-49f3-858f-9696336fd465",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-08-19T11:58:24.000Z",
|
||
|
|
"modified": "2022-08-19T11:58:24.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '1e12ac069c1898ffe271ebdfcbd689c1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-08-19T11:58:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--d72a4609-ff18-46b7-8921-eac3740002d4",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-08-19T11:59:12.000Z",
|
||
|
|
"modified": "2022-08-19T11:59:12.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'd2742d7c4b7454745795c547594bb4f9dbddecfe']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-08-19T11:59:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--00698b4e-497c-459d-94fa-e12da80c9008",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-08-19T11:59:12.000Z",
|
||
|
|
"modified": "2022-08-19T11:59:12.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '9d0f6c8be3214eee1dda6ebb4bb41ef97cfe28b4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-08-19T11:59:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--cfdc5e5b-057b-49cd-b9db-646250947783",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-08-19T11:59:12.000Z",
|
||
|
|
"modified": "2022-08-19T11:59:12.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '5c7b4da950b0f1845b38ef1aa11ca41b4731c766']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-08-19T11:59:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--aaff4760-ea84-46a6-a79a-27919f325ed3",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-08-19T12:05:45.000Z",
|
||
|
|
"modified": "2022-08-19T12:05:45.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "link",
|
||
|
|
"value": "https://malwarebytes.app.box.com/s/ym6r7o5hq0rx2nxjbctfv2sw5vx386ni",
|
||
|
|
"category": "External analysis",
|
||
|
|
"uuid": "fadbc54c-4adb-46b8-9d9e-b001f35b0f44"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "summary",
|
||
|
|
"value": "JSSLoader: the shellcode edition",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ddcaf51a-7f89-4427-b93d-82804562da14"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "Report",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8555a473-687e-475b-943b-1d9cdb633669"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--9560a135-3e58-4c09-bade-b3109a40ec35",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-08-19T12:11:14.000Z",
|
||
|
|
"modified": "2022-08-19T12:11:14.000Z",
|
||
|
|
"first_observed": "2022-08-19T12:11:14Z",
|
||
|
|
"last_observed": "2022-08-19T12:11:14Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"user-account--9560a135-3e58-4c09-bade-b3109a40ec35"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"github-user\"",
|
||
|
|
"misp:meta-category=\"misc\"",
|
||
|
|
"misp:to_ids=\"False\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "user-account",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "user-account--9560a135-3e58-4c09-bade-b3109a40ec35",
|
||
|
|
"account_login": "hasherezade",
|
||
|
|
"account_type": "github",
|
||
|
|
"x_misp_repository": "https://gist.github.com/hasherezade/6eb355c2c81e640e7470fafe4db3f069"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--c41f294b-2395-4d53-a671-577483c9180b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-08-19T12:13:37.000Z",
|
||
|
|
"modified": "2022-08-19T12:13:37.000Z",
|
||
|
|
"first_observed": "2022-08-19T12:13:37Z",
|
||
|
|
"last_observed": "2022-08-19T12:13:37Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"user-account--c41f294b-2395-4d53-a671-577483c9180b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"github-user\"",
|
||
|
|
"misp:meta-category=\"misc\"",
|
||
|
|
"misp:to_ids=\"False\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "user-account",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "user-account--c41f294b-2395-4d53-a671-577483c9180b",
|
||
|
|
"account_login": "hasherezade",
|
||
|
|
"account_type": "github",
|
||
|
|
"x_misp_repository": "https://gist.github.com/hasherezade/4048e435cda43be374277afb06744ab1"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|