2023-04-21 14:44:17 +00:00
{
"type" : "bundle" ,
"id" : "bundle--559d537c-f570-4e97-8154-98d9950d210b" ,
"objects" : [
{
"type" : "identity" ,
"spec_version" : "2.1" ,
"id" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2020-08-03T06:31:12.000Z" ,
"modified" : "2020-08-03T06:31:12.000Z" ,
"name" : "CthulhuSPRL.be" ,
"identity_class" : "organization"
} ,
{
"type" : "report" ,
"spec_version" : "2.1" ,
"id" : "report--559d537c-f570-4e97-8154-98d9950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2020-08-03T06:31:12.000Z" ,
"modified" : "2020-08-03T06:31:12.000Z" ,
"name" : "OSINT Morpho: Profiting from high-level corporate attacks by Symantec" ,
"published" : "2020-08-03T06:34:53Z" ,
"object_refs" : [
"observed-data--559d539e-3848-4a7a-a61a-579a950d210b" ,
"url--559d539e-3848-4a7a-a61a-579a950d210b" ,
"observed-data--559d539e-1e30-42bd-add3-579a950d210b" ,
"url--559d539e-1e30-42bd-add3-579a950d210b" ,
"x-misp-attribute--559d53a7-885c-4439-91d2-4f5d950d210b" ,
"indicator--559e20a1-70a4-430f-b7c4-a038950d210b" ,
"indicator--559e20b3-ac64-41f5-881a-4db2950d210b" ,
"indicator--559e20cc-3b88-4598-8dfd-eae3950d210b" ,
"indicator--559e20dc-8188-4564-aa28-4feb950d210b" ,
"indicator--559e20ee-bb88-40d4-96a7-a037950d210b" ,
"indicator--559e20fc-2154-465d-a50e-e09a950d210b" ,
"indicator--559e2111-9998-4ca2-ba49-4861950d210b" ,
"indicator--559e2131-66b8-4b07-97e2-e09a950d210b" ,
"indicator--559e2176-9470-4372-b288-45b9950d210b" ,
"indicator--559e2176-8708-4641-a871-43c1950d210b" ,
"indicator--559e2177-e0fc-478a-9412-4bf1950d210b" ,
"indicator--559e2177-6d28-44c8-9b18-41d1950d210b" ,
"indicator--559e229f-6234-4f9d-a587-49de950d210b" ,
"indicator--559e229f-b908-4716-ac97-418b950d210b" ,
"indicator--559e229f-25d8-4ce8-b3e1-40a6950d210b" ,
"indicator--559e229f-8e58-4706-a012-4fb4950d210b" ,
"indicator--559e229f-6e30-4831-bc56-4e54950d210b" ,
"indicator--559e22a0-9884-48fa-b96d-42b0950d210b" ,
"indicator--559e22a0-2324-490c-a1b3-40ea950d210b" ,
"indicator--559e22a0-a37c-46a2-aa27-47e0950d210b" ,
"indicator--559e22a0-45c0-4bd2-b6aa-49f9950d210b" ,
"indicator--559e22a0-9048-416b-b549-4ee2950d210b" ,
"indicator--559e22a0-5e64-4f0e-abc1-4820950d210b" ,
"indicator--559e22a1-e808-42aa-952c-4b87950d210b" ,
"indicator--559e22a1-2844-4ff3-8ce3-4fa5950d210b" ,
"indicator--559e22a1-cfac-4f92-9226-49a0950d210b" ,
"indicator--559e22a1-97b8-4437-9246-4173950d210b" ,
"indicator--559e22a1-9300-428a-8642-44ed950d210b" ,
"indicator--559e22a1-f5cc-41ff-9e59-401a950d210b" ,
"indicator--559e22a2-a3b8-4da5-8dd0-4fb6950d210b" ,
"indicator--559e22a2-411c-4b2b-900b-4d20950d210b" ,
"indicator--559e22a2-5698-449a-a2e9-4ee6950d210b" ,
"indicator--559e22a2-3a28-4047-bcc1-4b85950d210b" ,
"indicator--559e22a2-1d24-4ca2-adbc-40be950d210b" ,
"indicator--559e22a2-3df4-4350-8444-41f8950d210b" ,
"indicator--559e22a3-7f28-4a03-883b-46db950d210b" ,
"indicator--559e22a3-bce8-4a85-a9d9-480e950d210b" ,
"indicator--559e22a3-99b0-49ac-9f0e-4f6b950d210b" ,
"indicator--559e22a3-b928-4fd6-8424-4775950d210b" ,
"indicator--559e22a3-357c-419f-9f9a-4381950d210b" ,
"indicator--559e22a3-640c-4502-98b8-4394950d210b" ,
"indicator--559e22a4-c05c-4ed7-a801-450a950d210b" ,
"indicator--559e22a4-a60c-44bd-bbf2-41fb950d210b" ,
"indicator--559e22a4-49c0-4b9b-a7d5-4244950d210b" ,
"indicator--559e22a4-d564-4cb3-9f36-46f8950d210b" ,
"indicator--559e22a4-0bd4-47db-b133-472f950d210b" ,
"indicator--559e22a4-8508-4c6d-9c4f-4b55950d210b" ,
"indicator--559e22a5-d3bc-4475-b0db-49fd950d210b" ,
"indicator--559e22a5-f8cc-4d7e-92a0-4cd6950d210b" ,
"indicator--559e22a5-7ed0-4845-8e5b-4be8950d210b" ,
"indicator--559e22a5-5f08-4268-819c-4736950d210b" ,
"indicator--559e22a5-744c-4f64-b245-471b950d210b" ,
"indicator--559e22a5-cf90-4254-a283-42b9950d210b" ,
"indicator--559e22a6-91d8-450b-bdce-46df950d210b" ,
"indicator--559e22a6-c660-4ea1-9a11-46d0950d210b" ,
"indicator--559e22a6-8144-43f8-9676-4921950d210b" ,
"indicator--559e22a6-c90c-43cf-8ccf-42f7950d210b" ,
"indicator--559e22a6-5f4c-4bae-8709-4e08950d210b" ,
"indicator--559e22a6-7970-46de-bfb5-4fee950d210b" ,
"indicator--559e22a7-4ea4-4a79-b9de-4c33950d210b" ,
"indicator--559e22a7-bba0-4fbc-b479-466d950d210b" ,
"indicator--559e22d0-e8b0-4992-947b-44b8950d210b" ,
"indicator--559e22d0-f144-4775-9fd4-483b950d210b" ,
"indicator--559e22f1-0f1c-48b6-900c-a038950d210b" ,
"indicator--559e22f1-bf04-4e8d-b839-a038950d210b" ,
"indicator--559e22f2-f898-4624-8cca-a038950d210b" ,
"indicator--559e22f2-3030-4832-8da7-a038950d210b" ,
"indicator--559e22f2-ae4c-4264-b113-a038950d210b" ,
"indicator--559e232d-b48c-4c45-800d-4b34950d210b" ,
"x-misp-attribute--559e2341-1b68-406c-84c5-4c62950d210b" ,
"x-misp-attribute--559e2445-1780-408a-a19c-42f4950d210b" ,
"x-misp-attribute--559e2445-32ec-4657-b803-4ce4950d210b" ,
"x-misp-attribute--559e2445-1f1c-4665-9b46-4b73950d210b" ,
"x-misp-attribute--559e2445-fb10-4967-bec2-4665950d210b" ,
"x-misp-attribute--559e2445-a434-43a7-b45f-4a90950d210b" ,
"x-misp-attribute--559e2446-ce48-4a27-b1af-44f3950d210b" ,
"x-misp-attribute--559f6755-80e8-44bc-9190-d94a950d210b" ,
"indicator--560a8311-c798-492e-818a-4caf950d210b" ,
"indicator--560a8311-6628-485f-8530-4caf950d210b" ,
"observed-data--560a8312-e670-49a3-8fee-4caf950d210b" ,
"url--560a8312-e670-49a3-8fee-4caf950d210b" ,
"indicator--560a8312-89b0-4e30-9fa7-4caf950d210b" ,
"indicator--560a8312-6414-4e82-bfd0-4caf950d210b" ,
"observed-data--560a8313-83cc-45df-905f-4caf950d210b" ,
"url--560a8313-83cc-45df-905f-4caf950d210b" ,
"indicator--560a8313-a258-48de-b71e-4caf950d210b" ,
"indicator--560a8313-f004-435c-9313-4caf950d210b" ,
"observed-data--560a8314-fbc8-492c-bc94-4caf950d210b" ,
"url--560a8314-fbc8-492c-bc94-4caf950d210b" ,
"indicator--560a8314-d274-42eb-acc8-4caf950d210b" ,
"indicator--560a8314-b004-4c81-a944-4caf950d210b" ,
"observed-data--560a8315-e55c-4aec-bd84-4caf950d210b" ,
"url--560a8315-e55c-4aec-bd84-4caf950d210b" ,
"indicator--560a8315-abd0-46aa-9116-4caf950d210b" ,
"indicator--560a8315-00a4-42d4-81a1-4caf950d210b" ,
"observed-data--560a8316-85ec-418d-a594-4caf950d210b" ,
"url--560a8316-85ec-418d-a594-4caf950d210b" ,
"indicator--560a8316-1c10-464d-b502-4caf950d210b" ,
"indicator--560a8317-9d64-4faa-a6df-4caf950d210b" ,
"observed-data--560a8317-a63c-42a1-a6cd-4caf950d210b" ,
"url--560a8317-a63c-42a1-a6cd-4caf950d210b" ,
"indicator--560a8317-e030-4412-9bd0-4caf950d210b" ,
"indicator--560a8318-3fd4-47be-886f-4caf950d210b" ,
"observed-data--560a8318-5500-45fe-adaf-4caf950d210b" ,
"url--560a8318-5500-45fe-adaf-4caf950d210b" ,
"indicator--560a8318-2394-4b3c-8da9-4caf950d210b" ,
"indicator--560a8319-9444-4cb6-8d83-4caf950d210b" ,
"observed-data--560a8319-e2a8-4339-a36e-4caf950d210b" ,
"url--560a8319-e2a8-4339-a36e-4caf950d210b" ,
"indicator--560a8319-8714-4bd0-a38f-4caf950d210b" ,
"indicator--560a831a-c794-46b8-b30f-4caf950d210b" ,
"observed-data--560a831a-d0cc-4511-a83a-4caf950d210b" ,
"url--560a831a-d0cc-4511-a83a-4caf950d210b" ,
"indicator--560a831a-e06c-462d-b089-4caf950d210b" ,
"indicator--560a831b-7228-4c80-a531-4caf950d210b" ,
"observed-data--560a831b-2818-46a8-acb2-4caf950d210b" ,
"url--560a831b-2818-46a8-acb2-4caf950d210b" ,
"indicator--560a831b-acfc-4d35-9543-4caf950d210b" ,
"indicator--560a831c-5534-43a2-a94a-4caf950d210b" ,
"observed-data--560a831c-9404-44e3-b6a5-4caf950d210b" ,
"url--560a831c-9404-44e3-b6a5-4caf950d210b" ,
"indicator--560a831c-2e34-4fb1-aaf8-4caf950d210b" ,
"indicator--560a831d-f5dc-4ee0-b521-4caf950d210b" ,
"observed-data--560a831d-b258-4d4f-be96-4caf950d210b" ,
"url--560a831d-b258-4d4f-be96-4caf950d210b" ,
"indicator--560a831d-d694-48a7-93f2-4caf950d210b" ,
"indicator--560a831e-9cd8-4a38-8acd-4caf950d210b" ,
"observed-data--560a831e-5dc8-440e-9c2c-4caf950d210b" ,
"url--560a831e-5dc8-440e-9c2c-4caf950d210b" ,
"indicator--560a831e-52b8-4a6a-87a6-4caf950d210b" ,
"indicator--560a831f-2874-469a-bf82-4caf950d210b" ,
"observed-data--560a831f-743c-4994-8890-4caf950d210b" ,
"url--560a831f-743c-4994-8890-4caf950d210b" ,
"indicator--560a8320-c720-456b-af5f-4caf950d210b" ,
"indicator--560a8320-fd48-4fe6-acd8-4caf950d210b" ,
"observed-data--560a8320-8054-46f8-9954-4caf950d210b" ,
"url--560a8320-8054-46f8-9954-4caf950d210b" ,
"indicator--560a8321-ad04-4dc8-9bd7-4caf950d210b" ,
"indicator--560a8321-d414-48bc-83ee-4caf950d210b" ,
"observed-data--560a8321-8e40-404f-b37c-4caf950d210b" ,
"url--560a8321-8e40-404f-b37c-4caf950d210b" ,
"indicator--560a8322-d02c-4c55-8798-4caf950d210b" ,
"indicator--560a8322-d204-4a57-af5e-4caf950d210b" ,
"observed-data--560a8322-7310-4e0f-af2a-4caf950d210b" ,
"url--560a8322-7310-4e0f-af2a-4caf950d210b" ,
"indicator--560a8323-dfbc-47fa-8272-4caf950d210b" ,
"indicator--560a8323-69ac-4c4f-ad7e-4caf950d210b" ,
"observed-data--560a8323-4868-45fe-a5df-4caf950d210b" ,
"url--560a8323-4868-45fe-a5df-4caf950d210b" ,
"indicator--560a8324-00c0-400e-aa5c-4caf950d210b" ,
"indicator--560a8324-d7a8-4f9b-9060-4caf950d210b" ,
"observed-data--560a8324-3544-4138-abf1-4caf950d210b" ,
"url--560a8324-3544-4138-abf1-4caf950d210b" ,
"indicator--560a8325-bad4-4ea1-bb31-4caf950d210b" ,
"indicator--560a8325-afd0-4ece-b4af-4caf950d210b" ,
"observed-data--560a8325-96ac-4952-83a3-4caf950d210b" ,
"url--560a8325-96ac-4952-83a3-4caf950d210b" ,
"indicator--560a8326-0e80-46ba-85a1-4caf950d210b" ,
"indicator--560a8326-05a0-4ec8-9c74-4caf950d210b" ,
"observed-data--560a8326-b3f4-4e88-b8d6-4caf950d210b" ,
"url--560a8326-b3f4-4e88-b8d6-4caf950d210b"
] ,
"labels" : [
"Threat-Report" ,
"misp:tool=\"MISP-STIX-Converter\"" ,
"type:OSINT" ,
"misp-galaxy:threat-actor=\"WildNeutron\""
] ,
"object_marking_refs" : [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--559d539e-3848-4a7a-a61a-579a950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-08T16:45:18.000Z" ,
"modified" : "2015-07-08T16:45:18.000Z" ,
"first_observed" : "2015-07-08T16:45:18Z" ,
"last_observed" : "2015-07-08T16:45:18Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--559d539e-3848-4a7a-a61a-579a950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--559d539e-3848-4a7a-a61a-579a950d210b" ,
"value" : "http://www.symantec.com/connect/blogs/morpho-profiting-high-level-corporate-attacks"
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--559d539e-1e30-42bd-add3-579a950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-08T16:45:18.000Z" ,
"modified" : "2015-07-08T16:45:18.000Z" ,
"first_observed" : "2015-07-08T16:45:18Z" ,
"last_observed" : "2015-07-08T16:45:18Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--559d539e-1e30-42bd-add3-579a950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--559d539e-1e30-42bd-add3-579a950d210b" ,
"value" : "http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/morpho-corporate-spies-out-for-financial-gain.pdf"
} ,
{
"type" : "x-misp-attribute" ,
"spec_version" : "2.1" ,
"id" : "x-misp-attribute--559d53a7-885c-4439-91d2-4f5d950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-08T16:45:27.000Z" ,
"modified" : "2015-07-08T16:45:27.000Z" ,
"labels" : [
"misp:type=\"text\"" ,
"misp:category=\"External analysis\""
] ,
"x_misp_category" : "External analysis" ,
"x_misp_type" : "text" ,
"x_misp_value" : "Morpho"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e20a1-70a4-430f-b7c4-a038950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2020-08-03T06:26:12.000Z" ,
"modified" : "2020-08-03T06:26:12.000Z" ,
"pattern" : "[rule Bannerjack\r\n{\r\n meta:\r\n author = \"Symantec Security Response\"\r\n date = \"2015-07-01\"\r\n description = \"Morpho BannerJack hacktool\"\r\n strings:\r\n $str_1 = \"Usage: ./banner-jack [options]\"\r\n $str_2 = \"-f: file.csv\"\r\n $str_3 = \"-s: ip start\"\r\n $str_4 = \"-R: timeout read (optional, default %d secs)\"\r\n condition:\r\n all of them\r\n}]" ,
"pattern_type" : "yara" ,
2023-12-14 14:30:15 +00:00
"pattern_version" : "2.1" ,
2023-04-21 14:44:17 +00:00
"valid_from" : "2020-08-03T06:26:12Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"yara\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e20b3-ac64-41f5-881a-4db2950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2020-08-03T06:30:48.000Z" ,
"modified" : "2020-08-03T06:30:48.000Z" ,
"pattern" : "[rule Eventlog\r\n{\r\n meta:\r\n author = \"Symantec Security Response\"\r\n date = \"2015-07-01\"\r\n description = \"Morpho Eventlog hacktool\"\r\n strings:\r\n $str_1 = \"wevtsvc.dll\"\r\n $str_2 = \"Stealing %S.evtx handle ...\"\r\n $str_3 = \"ElfChnk\"\r\n $str_4 = \"-Dr Dump all logs from a channel or .evtx file (raw\"\r\n condition:\r\n all of them\r\n}]" ,
"pattern_type" : "yara" ,
2023-12-14 14:30:15 +00:00
"pattern_version" : "2.1" ,
2023-04-21 14:44:17 +00:00
"valid_from" : "2020-08-03T06:30:48Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"yara\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e20cc-3b88-4598-8dfd-eae3950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2020-08-03T06:29:56.000Z" ,
"modified" : "2020-08-03T06:29:56.000Z" ,
"pattern" : "[rule Hacktool\r\n{\r\n meta:\r\n author = \"Symantec Security Response\"\r\n date = \"2015-07-01\"\r\n description = \"Morpho hacktool\"\r\n strings:\r\n $str_1 = \"\\\\\\\\.\\\\pipe\\\\winsession\" wide\r\n $str_2 = \"WsiSvc\" wide\r\n $str_3 = \"ConnectNamedPipe\"\r\n $str_4 = \"CreateNamedPipeW\"\r\n $str_5 = \"CreateProcessAsUserW\"\r\n condition:\r\n all of them\r\n}]" ,
"pattern_type" : "yara" ,
2023-12-14 14:30:15 +00:00
"pattern_version" : "2.1" ,
2023-04-21 14:44:17 +00:00
"valid_from" : "2020-08-03T06:29:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"yara\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e20dc-8188-4564-aa28-4feb950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2020-08-03T06:26:16.000Z" ,
"modified" : "2020-08-03T06:26:16.000Z" ,
"pattern" : "[rule Multipurpose\r\n{\r\n meta:\r\n author = \"Symantec Security Response\"\r\n date = \"2015-07-01\"\r\n description = \"Morpho Multipurpose hacktool\"\r\n\r\n strings:\r\n $str_1 = \"dump %d|%d|%d|%d|%d|%d|%s|%d\"\r\n $str_2 = \"kerberos%d.dll\"\r\n $str_3 = \"\\\\\\\\.\\\\pipe\\\\lsassp\"\r\n $str_4 = \"pth <PID:USER:DOMAIN:NTLM>: change\"\r\n condition:\r\n all of them\r\n}]" ,
"pattern_type" : "yara" ,
2023-12-14 14:30:15 +00:00
"pattern_version" : "2.1" ,
2023-04-21 14:44:17 +00:00
"valid_from" : "2020-08-03T06:26:16Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"yara\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e20ee-bb88-40d4-96a7-a037950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2020-08-03T06:26:40.000Z" ,
"modified" : "2020-08-03T06:26:40.000Z" ,
"pattern" : "[rule Securetunnel\r\n{\r\n meta:\r\n author = \"Symantec Security Response\"\r\n date = \"2015-07-01\"\r\n description = \"Morpho Securetunnel hacktool\"\r\n strings:\r\n $str_1 = \"KRB5CCNAME\"\r\n $str_2 = \"SSH _ AUTH _ SOCK\"\r\n $str_3 = \"f:l:u:cehR\"\r\n $str_4 = \".o+=*BOX@%&#/^SE\"\r\n condition:\r\n all of them\r\n}]" ,
"pattern_type" : "yara" ,
2023-12-14 14:30:15 +00:00
"pattern_version" : "2.1" ,
2023-04-21 14:44:17 +00:00
"valid_from" : "2020-08-03T06:26:40Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"yara\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e20fc-2154-465d-a50e-e09a950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2020-08-03T06:26:29.000Z" ,
"modified" : "2020-08-03T06:26:29.000Z" ,
"pattern" : "[rule Proxy\r\n{\r\n meta:\r\n author = \"Symantec Security Response\"\r\n date = \"2015-07-01\"\r\n description = \"Morpho proxy hacktool\"\r\n strings:\r\n $str_1 = \"-u user : proxy username\"\r\n $str_2 = \"--pleh : displays help\"\r\n $str_3 = \"-x ip/host : proxy ip or host\"\r\n $str_4 = \"-m : bypass mutex check\"\r\n condition:\r\n all of them\r\n }]" ,
"pattern_type" : "yara" ,
2023-12-14 14:30:15 +00:00
"pattern_version" : "2.1" ,
2023-04-21 14:44:17 +00:00
"valid_from" : "2020-08-03T06:26:29Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"yara\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e2111-9998-4ca2-ba49-4861950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2017-11-20T14:57:35.000Z" ,
"modified" : "2017-11-20T14:57:35.000Z" ,
"pattern" : "[rule jiripbot_ascii_str_decrypt\r\n{\r\n meta:\r\n author = \"Symantec Security Response\"\r\n date = \"2015-07-01\"\r\n description = \"Morpho Jiripbot hacktool\"\r\n strings:\r\n $decrypt_func = {\r\n 85 FF\r\n 75 03\r\n 33 C0\r\n C3\r\n 8B C7\r\n 8D 50 01\r\n 8A 08\r\n 40\r\n 84 C9\r\n 75 F9\r\n 2B C2\r\n 53\r\n 8B D8\r\n 80 7C 3B FF ??\r\n 75 3E\r\n 83 3D ?? ?? ?? ?? 00\r\n 56\r\n BE ?? ?? ?? ??\r\n 75 11\r\n 56\r\n FF 15 ?? ?? ?? ??\r\n C7 05 ?? ?? ?? ?? 01 00 00 00\r\n 56\r\n FF 15 ?? ?? ?? ??\r\n 33 C0\r\n 85 DB\r\n 74 09\r\n 80 34 38 ??\r\n 40\r\n 3B C3\r\n 72 F7\r\n 56\r\n FF 15 ?? ?? ?? ??\r\n 5E\r\n 8B C7\r\n 5B\r\n C3\r\n }\r\n condition:\r\n $decrypt_func\r\n}]" ,
"pattern_type" : "yara" ,
2023-12-14 14:30:15 +00:00
"pattern_version" : "2.1" ,
2023-04-21 14:44:17 +00:00
"valid_from" : "2017-11-20T14:57:35Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"yara\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e2131-66b8-4b07-97e2-e09a950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2017-04-29T08:09:09.000Z" ,
"modified" : "2017-04-29T08:09:09.000Z" ,
"pattern" : "[rule jiripbot_unicode_str_decrypt\r\n{\r\n meta:\r\n author = \"Symantec Security Response\"\r\n date = \"2015-07-01\"\r\n description = \"Morpho Jiripbot Unicode hacktool\"\r\n strings:\r\n $decrypt = {\r\n 85 ??\r\n 75 03\r\n 33 C0\r\n C3\r\n 8B ??\r\n 8D 50 02\r\n 66 8B 08\r\n 83 C0 02\r\n 66 85 C9\r\n 75 F5\r\n 2B C2\r\n D1 F8\r\n 57\r\n 8B F8\r\n B8 ?? ?? ?? ??\r\n 66 39 44 7E FE\r\n 75 43\r\n 83 3D ?? ?? ?? ?? 00\r\n 53\r\n BB ?? ?? ?? ??\r\n 75 11\r\n 53\r\n FF 15 ?? ?? ?? ??\r\n C7 05 ?? ?? ?? ?? 01 00 00 00\r\n 53\r\n FF 15 ?? ?? ?? ??\r\n 33 C0\r\n 85 FF\r\n 74 0E\r\n B9 ?? 00 00 00\r\n 66 31 0C 46\r\n 40\r\n 3B C7\r\n 72 F2\r\n 53\r\n FF 15 ?? ?? ?? ??\r\n 5B\r\n 8B C6\r\n 5F\r\n C3\r\n }\r\n condition:\r\n $decrypt\r\n}]" ,
"pattern_type" : "yara" ,
2023-12-14 14:30:15 +00:00
"pattern_version" : "2.1" ,
2023-04-21 14:44:17 +00:00
"valid_from" : "2017-04-29T08:09:09Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"yara\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e2176-9470-4372-b288-45b9950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:23:34.000Z" ,
"modified" : "2015-07-09T07:23:34.000Z" ,
"description" : "SSH over port 443" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '46.183.217.132']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:23:34Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e2176-8708-4641-a871-43c1950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:23:34.000Z" ,
"modified" : "2015-07-09T07:23:34.000Z" ,
"description" : "SSH over port 443" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '46.165.237.75']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:23:34Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e2177-e0fc-478a-9412-4bf1950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:23:35.000Z" ,
"modified" : "2015-07-09T07:23:35.000Z" ,
"description" : "SSH over port 443" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '217.23.3.112']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:23:35Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e2177-6d28-44c8-9b18-41d1950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:23:35.000Z" ,
"modified" : "2015-07-09T07:23:35.000Z" ,
"description" : "SSH over port 443" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '178.162.197.9']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:23:35Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e229f-6234-4f9d-a587-49de950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:31.000Z" ,
"modified" : "2015-07-09T07:28:31.000Z" ,
"pattern" : "[file:hashes.SHA256 = '0ac7b594aaae21b61af2f3aabdc5eda9b6811eca52dcbf4691c4ec6dfd2d5cd8']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:31Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e229f-b908-4716-ac97-418b950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:31.000Z" ,
"modified" : "2015-07-09T07:28:31.000Z" ,
"pattern" : "[file:hashes.SHA256 = '14bfc2bf8a80a19ff2c1480f513c96b8e8adc89a8d75d7c0064f810f1a7a2e61']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:31Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e229f-25d8-4ce8-b3e1-40a6950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:31.000Z" ,
"modified" : "2015-07-09T07:28:31.000Z" ,
"pattern" : "[file:hashes.SHA256 = '1677573bb02cc073e248e4a14334db90be8052d0b236e446e29582f50441fa33']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:31Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e229f-8e58-4706-a012-4fb4950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:31.000Z" ,
"modified" : "2015-07-09T07:28:31.000Z" ,
"pattern" : "[file:hashes.SHA256 = '178b25ddca2bd5ea1b8c3432291d4d0b5b725e16961f5e4596fb9267a700fa2f']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:31Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e229f-6e30-4831-bc56-4e54950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:31.000Z" ,
"modified" : "2015-07-09T07:28:31.000Z" ,
"pattern" : "[file:hashes.SHA256 = '1a9f679016e38d399ff33efcfe7dc6560ec658d964297dbe377ff7c68e0dfbaf']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:31Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a0-9884-48fa-b96d-42b0950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:32.000Z" ,
"modified" : "2015-07-09T07:28:32.000Z" ,
"pattern" : "[file:hashes.SHA256 = '1c81bc28ad91baed60ca5e7fee68fbcb976cf8a483112fa81aab71a18450a6b0']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:32Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a0-2324-490c-a1b3-40ea950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:32.000Z" ,
"modified" : "2015-07-09T07:28:32.000Z" ,
"pattern" : "[file:hashes.SHA256 = '1c9af096e4c7daa440af136f2b1439089a827101098cfe25b8c19fc7321eaad9']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:32Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a0-a37c-46a2-aa27-47e0950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:32.000Z" ,
"modified" : "2015-07-09T07:28:32.000Z" ,
"pattern" : "[file:hashes.SHA256 = '25fe7dd1e2b19514346cb2b8b5e91ae110c6adb9df5a440b8e7bbc5e8bc74227']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:32Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a0-45c0-4bd2-b6aa-49f9950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:32.000Z" ,
"modified" : "2015-07-09T07:28:32.000Z" ,
"pattern" : "[file:hashes.SHA256 = '29906c51217d15b9bbbcc8130f64dabdb69bd32baa7999500c7a230c218e8b0a']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:32Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a0-9048-416b-b549-4ee2950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:32.000Z" ,
"modified" : "2015-07-09T07:28:32.000Z" ,
"pattern" : "[file:hashes.SHA256 = '2a8cb295f85f8d1d5aae7744899875ebb4e6c3ef74fbc5bfad6e7723c192c5cf']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:32Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a0-5e64-4f0e-abc1-4820950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:32.000Z" ,
"modified" : "2015-07-09T07:28:32.000Z" ,
"pattern" : "[file:hashes.SHA256 = '2b5065a3d0e0b8252a987ef5f29d9e1935c5863f5718b83440e68dc53c21fa94']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:32Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a1-e808-42aa-952c-4b87950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:33.000Z" ,
"modified" : "2015-07-09T07:28:33.000Z" ,
"pattern" : "[file:hashes.SHA256 = '2bd5f7e0382956a7c135cdeb96edfdbccfcfc1955d26e317e2328ea83ace7cee']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:33Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a1-2844-4ff3-8ce3-4fa5950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:33.000Z" ,
"modified" : "2015-07-09T07:28:33.000Z" ,
"pattern" : "[file:hashes.SHA256 = '2d3ea11c5aea7e8a60cd4f530c1e234a2aa2df900d90122dd2fcf1fa9f47b935']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:33Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a1-cfac-4f92-9226-49a0950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:33.000Z" ,
"modified" : "2015-07-09T07:28:33.000Z" ,
"pattern" : "[file:hashes.SHA256 = '3756ddcb5d52f938dd9e07d61fae21b70e665f01bbb2cbe04164e82892b86e2f']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:33Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a1-97b8-4437-9246-4173950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:33.000Z" ,
"modified" : "2015-07-09T07:28:33.000Z" ,
"pattern" : "[file:hashes.SHA256 = '3cfdd3cd1089c4152c0d4c7955210d489565f28fb0af9861b195db34e7ad2502']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:33Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a1-9300-428a-8642-44ed950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:33.000Z" ,
"modified" : "2015-07-09T07:28:33.000Z" ,
"pattern" : "[file:hashes.SHA256 = '4327ce696b5bce9e9b2a691b4e915796218c00998363c7602d8461dd0c1c8fbb']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:33Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a1-f5cc-41ff-9e59-401a950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:33.000Z" ,
"modified" : "2015-07-09T07:28:33.000Z" ,
"pattern" : "[file:hashes.SHA256 = '45f363e498312a34fa99af3c1cdd635fcebefaa3222dff348a9ab8ca25530797']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:33Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a2-a3b8-4da5-8dd0-4fb6950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:34.000Z" ,
"modified" : "2015-07-09T07:28:34.000Z" ,
"pattern" : "[file:hashes.SHA256 = '48c0bd55e1cf3f75e911ef66a9ccb9436c1571c982c5281d2d8bf00a99f0ee1a']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:34Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a2-411c-4b2b-900b-4d20950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:34.000Z" ,
"modified" : "2015-07-09T07:28:34.000Z" ,
"pattern" : "[file:hashes.SHA256 = '49e4198c94b80483302e11c2e7d83e0ac2379f081ee3a3aa32d96d690729f2d6']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:34Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a2-5698-449a-a2e9-4ee6950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:34.000Z" ,
"modified" : "2015-07-09T07:28:34.000Z" ,
"pattern" : "[file:hashes.SHA256 = '534004a473761e60d0db8afbc99390b19c32e7c5af3445ecd63f43ba6187ded4']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:34Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a2-3a28-4047-bcc1-4b85950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:34.000Z" ,
"modified" : "2015-07-09T07:28:34.000Z" ,
"pattern" : "[file:hashes.SHA256 = '54a8afb10a0569785d4a530ff25b07320881c139e813e58cb5a621da85f8a9f5']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:34Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a2-1d24-4ca2-adbc-40be950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:34.000Z" ,
"modified" : "2015-07-09T07:28:34.000Z" ,
"pattern" : "[file:hashes.SHA256 = '5ab4c378fd8b3254808d66c22bbaacc035874f1c9b4cee511b96458fedff64ed']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:34Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a2-3df4-4350-8444-41f8950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:34.000Z" ,
"modified" : "2015-07-09T07:28:34.000Z" ,
"pattern" : "[file:hashes.SHA256 = '683f5b476f8ffe87ec22b8bab57f74da4a13ecc3a5c2cbf951999953c2064fc9']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:34Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a3-7f28-4a03-883b-46db950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:35.000Z" ,
"modified" : "2015-07-09T07:28:35.000Z" ,
"pattern" : "[file:hashes.SHA256 = '6fb43afb191b09c7b62da7a5ddafdc1a9a4c46058fd376c045d69dd0a2ea71a6']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:35Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a3-bce8-4a85-a9d9-480e950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:35.000Z" ,
"modified" : "2015-07-09T07:28:35.000Z" ,
"pattern" : "[file:hashes.SHA256 = '758e6b519f6c0931ff93542b767524fc1eab589feb5cfc3854c77842f9785c92']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:35Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a3-99b0-49ac-9f0e-4f6b950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:35.000Z" ,
"modified" : "2015-07-09T07:28:35.000Z" ,
"pattern" : "[file:hashes.SHA256 = '781eb1e17349009fbae46aea5c59d8e5b68ae0b42335cb035742f6b0f4e4087e']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:35Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a3-b928-4fd6-8424-4775950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:35.000Z" ,
"modified" : "2015-07-09T07:28:35.000Z" ,
"pattern" : "[file:hashes.SHA256 = '796b1523573c889833f154aeb59532d2a9784e4747b25681a97ec00b9bb4fb19']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:35Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a3-357c-419f-9f9a-4381950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:35.000Z" ,
"modified" : "2015-07-09T07:28:35.000Z" ,
"pattern" : "[file:hashes.SHA256 = '7aa1716426614463b8c20716acf8fd6461052a354b88c31ad2cc8b8a3b3e6868']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:35Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a3-640c-4502-98b8-4394950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:35.000Z" ,
"modified" : "2015-07-09T07:28:35.000Z" ,
"pattern" : "[file:hashes.SHA256 = '81955e36dd46f3b05a1d7e47ffd53b7d1455406d952c890b5210a698dd97e938']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:35Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a4-c05c-4ed7-a801-450a950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:36.000Z" ,
"modified" : "2015-07-09T07:28:36.000Z" ,
"pattern" : "[file:hashes.SHA256 = '8ca7ed720babb32a6f381769ea00e16082a563704f8b672cb21cf11843f4da7a']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:36Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a4-a60c-44bd-bbf2-41fb950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:36.000Z" ,
"modified" : "2015-07-09T07:28:36.000Z" ,
"pattern" : "[file:hashes.SHA256 = '8db5c2b645eee393d0f676fe457cd2cd3e4b144bbe86a61e4f4fd48d9de4aeae']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:36Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a4-49c0-4b9b-a7d5-4244950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:36.000Z" ,
"modified" : "2015-07-09T07:28:36.000Z" ,
"pattern" : "[file:hashes.SHA256 = '90b5fec973d31cc149d0e2683872785fa61770deec6925006e9142374c315fde']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:36Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a4-d564-4cb3-9f36-46f8950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:36.000Z" ,
"modified" : "2015-07-09T07:28:36.000Z" ,
"pattern" : "[file:hashes.SHA256 = '9bff19ca48b43b148ff95e054efc39882d868527cdd4f036389a6f11750adddc']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:36Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a4-0bd4-47db-b133-472f950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:36.000Z" ,
"modified" : "2015-07-09T07:28:36.000Z" ,
"pattern" : "[file:hashes.SHA256 = '9d077a37b94bf69b94426041e5d5bf1fe56c482ca358191ca911ae041305f3ed']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:36Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a4-8508-4c6d-9c4f-4b55950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:36.000Z" ,
"modified" : "2015-07-09T07:28:36.000Z" ,
"pattern" : "[file:hashes.SHA256 = '9fab34fa2d31a56609b56874e1265969dbfa6c17d967cca5ecce0e0760670a60']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:36Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a5-d3bc-4475-b0db-49fd950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:37.000Z" ,
"modified" : "2015-07-09T07:28:37.000Z" ,
"pattern" : "[file:hashes.SHA256 = 'a14d31eb965ea8a37ebcc3b5635099f2ca08365646437c770212d534d504ff3c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:37Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a5-f8cc-4d7e-92a0-4cd6950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:37.000Z" ,
"modified" : "2015-07-09T07:28:37.000Z" ,
"pattern" : "[file:hashes.SHA256 = 'b4005530193bc523d3e0193c3c53e2737ae3bf9f76d12c827c0b5cd0dcbaae45']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:37Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a5-7ed0-4845-8e5b-4be8950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:37.000Z" ,
"modified" : "2015-07-09T07:28:37.000Z" ,
"pattern" : "[file:hashes.SHA256 = 'b81484220a46c853dc996c19db9416493662d943b638915ed2b3a4a0471cc8d8']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:37Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a5-5f08-4268-819c-4736950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:37.000Z" ,
"modified" : "2015-07-09T07:28:37.000Z" ,
"pattern" : "[file:hashes.SHA256 = 'bc177e879fd941911eb2ea404febffa2042310c632d9922205949155e9b35cb6']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:37Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a5-744c-4f64-b245-471b950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:37.000Z" ,
"modified" : "2015-07-09T07:28:37.000Z" ,
"pattern" : "[file:hashes.SHA256 = 'c2c761cde3175f6e40ed934f2e82c76602c81e2128187bab61793ddb3bc686d0']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:37Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a5-cf90-4254-a283-42b9950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:37.000Z" ,
"modified" : "2015-07-09T07:28:37.000Z" ,
"pattern" : "[file:hashes.SHA256 = 'c54f31f190b06649dff91f6b915273b88ee27a2f8e766d54ee4213671fc09f90']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:37Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a6-91d8-450b-bdce-46df950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:38.000Z" ,
"modified" : "2015-07-09T07:28:38.000Z" ,
"pattern" : "[file:hashes.SHA256 = 'c83bb0330d69f6ad4c79d4a0ce1891e6f34091aecfeaf72cf80b2532268a0abc']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:38Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a6-c660-4ea1-9a11-46d0950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:38.000Z" ,
"modified" : "2015-07-09T07:28:38.000Z" ,
"pattern" : "[file:hashes.SHA256 = 'ccc851cbd600592f1ed2c2969a30b87f0bf29046cdfa1590d8f09cfe454608a5']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:38Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a6-8144-43f8-9676-4921950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:38.000Z" ,
"modified" : "2015-07-09T07:28:38.000Z" ,
"pattern" : "[file:hashes.SHA256 = 'cfacc5389683518ecdd78002c975af6870fa5876337600e0b362abbbab0a19d2']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:38Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a6-c90c-43cf-8ccf-42f7950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:38.000Z" ,
"modified" : "2015-07-09T07:28:38.000Z" ,
"pattern" : "[file:hashes.SHA256 = 'd15b8071994bad01226a06f2802cbfe86a5483803244de4e99b91f130535d972']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:38Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a6-5f4c-4bae-8709-4e08950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:38.000Z" ,
"modified" : "2015-07-09T07:28:38.000Z" ,
"pattern" : "[file:hashes.SHA256 = 'da41d27070488316cbf9776e9468fae34f2e14651280e3ec1fb8524fda0873de']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:38Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a6-7970-46de-bfb5-4fee950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:38.000Z" ,
"modified" : "2015-07-09T07:28:38.000Z" ,
"pattern" : "[file:hashes.SHA256 = 'efbc082796df566261b07f51a325503231e5a7ce41617d3dfff3640b0be06162']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:38Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a7-4ea4-4a79-b9de-4c33950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:39.000Z" ,
"modified" : "2015-07-09T07:28:39.000Z" ,
"pattern" : "[file:hashes.SHA256 = 'fcaab8f77e4c9ba922d825b837acfffc9f231c3abb21015369431afae679d644']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:39Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22a7-bba0-4fbc-b479-466d950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:28:39.000Z" ,
"modified" : "2015-07-09T07:28:39.000Z" ,
"pattern" : "[file:hashes.SHA256 = 'fd616d1298653119fb4fbd88c0d39b881181398d2011320dc9c8c698897848c4']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:28:39Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22d0-e8b0-4992-947b-44b8950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:29:20.000Z" ,
"modified" : "2015-07-09T07:29:20.000Z" ,
"pattern" : "[domain-name:value = 'ddosprotected.eu']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:29:20Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"hostname\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22d0-f144-4775-9fd4-483b950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:29:20.000Z" ,
"modified" : "2015-07-09T07:29:20.000Z" ,
"pattern" : "[domain-name:value = 'drfx.chickenkiller.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:29:20Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"hostname\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22f1-0f1c-48b6-900c-a038950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:29:53.000Z" ,
"modified" : "2015-07-09T07:29:53.000Z" ,
"pattern" : "[domain-name:value = 'digitalinsight-ltd.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:29:53Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22f1-bf04-4e8d-b839-a038950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:29:53.000Z" ,
"modified" : "2015-07-09T07:29:53.000Z" ,
"pattern" : "[domain-name:value = 'clust12-akmai.net']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:29:53Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22f2-f898-4624-8cca-a038950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:29:54.000Z" ,
"modified" : "2015-07-09T07:29:54.000Z" ,
"pattern" : "[domain-name:value = 'jdk-update.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:29:54Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22f2-3030-4832-8da7-a038950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:29:54.000Z" ,
"modified" : "2015-07-09T07:29:54.000Z" ,
"pattern" : "[domain-name:value = 'corp-aapl.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:29:54Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e22f2-ae4c-4264-b113-a038950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:29:54.000Z" ,
"modified" : "2015-07-09T07:29:54.000Z" ,
"pattern" : "[domain-name:value = 'cloudprotect.eu']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:29:54Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--559e232d-b48c-4c45-800d-4b34950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:30:53.000Z" ,
"modified" : "2015-07-09T07:30:53.000Z" ,
"pattern" : "[domain-name:value = 'jdk.20e8ad99287f7fc244651237cbe8292a.org']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-07-09T07:30:53Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"hostname\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-attribute" ,
"spec_version" : "2.1" ,
"id" : "x-misp-attribute--559e2341-1b68-406c-84c5-4c62950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:31:13.000Z" ,
"modified" : "2015-07-09T07:31:13.000Z" ,
"labels" : [
"misp:type=\"comment\"" ,
"misp:category=\"Network activity\""
] ,
"x_misp_category" : "Network activity" ,
"x_misp_type" : "comment" ,
"x_misp_value" : "The following shows the format of Backdoor.Jiripbot\u00e2\u20ac\u2122s DGA domains:\r\njdk\\.[a-f0-9]{32}\\.org e.g. jdk.20e8ad99287f7fc244651237cbe8292a.org"
} ,
{
"type" : "x-misp-attribute" ,
"spec_version" : "2.1" ,
"id" : "x-misp-attribute--559e2445-1780-408a-a19c-42f4950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:35:33.000Z" ,
"modified" : "2015-07-09T07:35:33.000Z" ,
"labels" : [
"misp:type=\"text\"" ,
"misp:category=\"Antivirus detection\""
] ,
"x_misp_category" : "Antivirus detection" ,
"x_misp_comment" : "Symantec" ,
"x_misp_type" : "text" ,
"x_misp_value" : "Backdoor.Jiripbot"
} ,
{
"type" : "x-misp-attribute" ,
"spec_version" : "2.1" ,
"id" : "x-misp-attribute--559e2445-32ec-4657-b803-4ce4950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:35:33.000Z" ,
"modified" : "2015-07-09T07:35:33.000Z" ,
"labels" : [
"misp:type=\"text\"" ,
"misp:category=\"Antivirus detection\""
] ,
"x_misp_category" : "Antivirus detection" ,
"x_misp_comment" : "Symantec" ,
"x_misp_type" : "text" ,
"x_misp_value" : "Hacktool.Multipurpose"
} ,
{
"type" : "x-misp-attribute" ,
"spec_version" : "2.1" ,
"id" : "x-misp-attribute--559e2445-1f1c-4665-9b46-4b73950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:35:33.000Z" ,
"modified" : "2015-07-09T07:35:33.000Z" ,
"labels" : [
"misp:type=\"text\"" ,
"misp:category=\"Antivirus detection\""
] ,
"x_misp_category" : "Antivirus detection" ,
"x_misp_comment" : "Symantec" ,
"x_misp_type" : "text" ,
"x_misp_value" : "Hacktool.Securetunnel"
} ,
{
"type" : "x-misp-attribute" ,
"spec_version" : "2.1" ,
"id" : "x-misp-attribute--559e2445-fb10-4967-bec2-4665950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:35:33.000Z" ,
"modified" : "2015-07-09T07:35:33.000Z" ,
"labels" : [
"misp:type=\"text\"" ,
"misp:category=\"Antivirus detection\""
] ,
"x_misp_category" : "Antivirus detection" ,
"x_misp_comment" : "Symantec" ,
"x_misp_type" : "text" ,
"x_misp_value" : "Hacktool.Eventlog"
} ,
{
"type" : "x-misp-attribute" ,
"spec_version" : "2.1" ,
"id" : "x-misp-attribute--559e2445-a434-43a7-b45f-4a90950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:35:33.000Z" ,
"modified" : "2015-07-09T07:35:33.000Z" ,
"labels" : [
"misp:type=\"text\"" ,
"misp:category=\"Antivirus detection\""
] ,
"x_misp_category" : "Antivirus detection" ,
"x_misp_comment" : "Symantec" ,
"x_misp_type" : "text" ,
"x_misp_value" : "Hacktool.Bannerjack"
} ,
{
"type" : "x-misp-attribute" ,
"spec_version" : "2.1" ,
"id" : "x-misp-attribute--559e2446-ce48-4a27-b1af-44f3950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-09T07:35:34.000Z" ,
"modified" : "2015-07-09T07:35:34.000Z" ,
"labels" : [
"misp:type=\"text\"" ,
"misp:category=\"Antivirus detection\""
] ,
"x_misp_category" : "Antivirus detection" ,
"x_misp_comment" : "Symantec" ,
"x_misp_type" : "text" ,
"x_misp_value" : "Hacktool.Proxy.A"
} ,
{
"type" : "x-misp-attribute" ,
"spec_version" : "2.1" ,
"id" : "x-misp-attribute--559f6755-80e8-44bc-9190-d94a950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-07-10T06:33:57.000Z" ,
"modified" : "2015-07-10T06:33:57.000Z" ,
"labels" : [
"misp:type=\"text\"" ,
"misp:category=\"External analysis\""
] ,
"x_misp_category" : "External analysis" ,
"x_misp_type" : "text" ,
"x_misp_value" : "Wild Neutron"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a8311-c798-492e-818a-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:24:49.000Z" ,
"modified" : "2015-09-29T12:24:49.000Z" ,
"description" : "- Xchecked via VT: fd616d1298653119fb4fbd88c0d39b881181398d2011320dc9c8c698897848c4" ,
"pattern" : "[file:hashes.SHA1 = 'a22290d32d8a01e9b58da9bc5c8c047764e89336']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:24:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a8311-6628-485f-8530-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:24:49.000Z" ,
"modified" : "2015-09-29T12:24:49.000Z" ,
"description" : "- Xchecked via VT: fd616d1298653119fb4fbd88c0d39b881181398d2011320dc9c8c698897848c4" ,
"pattern" : "[file:hashes.MD5 = '1a352beadff958f13b09fde8a89f36f1']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:24:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--560a8312-e670-49a3-8fee-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:24:50.000Z" ,
"modified" : "2015-09-29T12:24:50.000Z" ,
"first_observed" : "2015-09-29T12:24:50Z" ,
"last_observed" : "2015-09-29T12:24:50Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--560a8312-e670-49a3-8fee-4caf950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--560a8312-e670-49a3-8fee-4caf950d210b" ,
"value" : "https://www.virustotal.com/file/fd616d1298653119fb4fbd88c0d39b881181398d2011320dc9c8c698897848c4/analysis/1442486779/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a8312-89b0-4e30-9fa7-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:24:50.000Z" ,
"modified" : "2015-09-29T12:24:50.000Z" ,
"description" : "- Xchecked via VT: da41d27070488316cbf9776e9468fae34f2e14651280e3ec1fb8524fda0873de" ,
"pattern" : "[file:hashes.SHA1 = '6a4a1076d7ad25d9a3f0052096e1e6697653db6c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:24:50Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a8312-6414-4e82-bfd0-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:24:50.000Z" ,
"modified" : "2015-09-29T12:24:50.000Z" ,
"description" : "- Xchecked via VT: da41d27070488316cbf9776e9468fae34f2e14651280e3ec1fb8524fda0873de" ,
"pattern" : "[file:hashes.MD5 = '7ae1b2ad1e40d0b19ce76a64348fa534']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:24:50Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--560a8313-83cc-45df-905f-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:24:51.000Z" ,
"modified" : "2015-09-29T12:24:51.000Z" ,
"first_observed" : "2015-09-29T12:24:51Z" ,
"last_observed" : "2015-09-29T12:24:51Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--560a8313-83cc-45df-905f-4caf950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--560a8313-83cc-45df-905f-4caf950d210b" ,
"value" : "https://www.virustotal.com/file/da41d27070488316cbf9776e9468fae34f2e14651280e3ec1fb8524fda0873de/analysis/1442486617/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a8313-a258-48de-b71e-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:24:51.000Z" ,
"modified" : "2015-09-29T12:24:51.000Z" ,
"description" : "- Xchecked via VT: cfacc5389683518ecdd78002c975af6870fa5876337600e0b362abbbab0a19d2" ,
"pattern" : "[file:hashes.SHA1 = '3b8f6dbaa55c63ef87e96a9eb983a2890a6d9da7']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:24:51Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a8313-f004-435c-9313-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:24:51.000Z" ,
"modified" : "2015-09-29T12:24:51.000Z" ,
"description" : "- Xchecked via VT: cfacc5389683518ecdd78002c975af6870fa5876337600e0b362abbbab0a19d2" ,
"pattern" : "[file:hashes.MD5 = 'ece3cc272134b4ea0b3839228883a14c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:24:51Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--560a8314-fbc8-492c-bc94-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:24:52.000Z" ,
"modified" : "2015-09-29T12:24:52.000Z" ,
"first_observed" : "2015-09-29T12:24:52Z" ,
"last_observed" : "2015-09-29T12:24:52Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--560a8314-fbc8-492c-bc94-4caf950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--560a8314-fbc8-492c-bc94-4caf950d210b" ,
"value" : "https://www.virustotal.com/file/cfacc5389683518ecdd78002c975af6870fa5876337600e0b362abbbab0a19d2/analysis/1442486690/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a8314-d274-42eb-acc8-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:24:52.000Z" ,
"modified" : "2015-09-29T12:24:52.000Z" ,
"description" : "- Xchecked via VT: ccc851cbd600592f1ed2c2969a30b87f0bf29046cdfa1590d8f09cfe454608a5" ,
"pattern" : "[file:hashes.SHA1 = '7f9c67959c273c76271d5d58a1049ced1c3b0e23']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:24:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a8314-b004-4c81-a944-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:24:52.000Z" ,
"modified" : "2015-09-29T12:24:52.000Z" ,
"description" : "- Xchecked via VT: ccc851cbd600592f1ed2c2969a30b87f0bf29046cdfa1590d8f09cfe454608a5" ,
"pattern" : "[file:hashes.MD5 = '342887a7ec6b9f709adcb81fef0d30a3']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:24:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--560a8315-e55c-4aec-bd84-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:24:53.000Z" ,
"modified" : "2015-09-29T12:24:53.000Z" ,
"first_observed" : "2015-09-29T12:24:53Z" ,
"last_observed" : "2015-09-29T12:24:53Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--560a8315-e55c-4aec-bd84-4caf950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--560a8315-e55c-4aec-bd84-4caf950d210b" ,
"value" : "https://www.virustotal.com/file/ccc851cbd600592f1ed2c2969a30b87f0bf29046cdfa1590d8f09cfe454608a5/analysis/1442486074/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a8315-abd0-46aa-9116-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:24:53.000Z" ,
"modified" : "2015-09-29T12:24:53.000Z" ,
"description" : "- Xchecked via VT: c54f31f190b06649dff91f6b915273b88ee27a2f8e766d54ee4213671fc09f90" ,
"pattern" : "[file:hashes.SHA1 = '30359201338053af55109266ebcea3b0060b7d61']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:24:53Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a8315-00a4-42d4-81a1-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:24:53.000Z" ,
"modified" : "2015-09-29T12:24:53.000Z" ,
"description" : "- Xchecked via VT: c54f31f190b06649dff91f6b915273b88ee27a2f8e766d54ee4213671fc09f90" ,
"pattern" : "[file:hashes.MD5 = '2cafcd57e7fcb1649da9fef9664ea4da']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:24:53Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--560a8316-85ec-418d-a594-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:24:54.000Z" ,
"modified" : "2015-09-29T12:24:54.000Z" ,
"first_observed" : "2015-09-29T12:24:54Z" ,
"last_observed" : "2015-09-29T12:24:54Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--560a8316-85ec-418d-a594-4caf950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--560a8316-85ec-418d-a594-4caf950d210b" ,
"value" : "https://www.virustotal.com/file/c54f31f190b06649dff91f6b915273b88ee27a2f8e766d54ee4213671fc09f90/analysis/1442486621/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a8316-1c10-464d-b502-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:24:54.000Z" ,
"modified" : "2015-09-29T12:24:54.000Z" ,
"description" : "- Xchecked via VT: c2c761cde3175f6e40ed934f2e82c76602c81e2128187bab61793ddb3bc686d0" ,
"pattern" : "[file:hashes.SHA1 = '3d11dfaf87753b8a0622023607dcae6fa8bddc12']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:24:54Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a8317-9d64-4faa-a6df-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:24:54.000Z" ,
"modified" : "2015-09-29T12:24:54.000Z" ,
"description" : "- Xchecked via VT: c2c761cde3175f6e40ed934f2e82c76602c81e2128187bab61793ddb3bc686d0" ,
"pattern" : "[file:hashes.MD5 = '331e0b7f94708c39a07c6da38a665fdb']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:24:54Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--560a8317-a63c-42a1-a6cd-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:24:55.000Z" ,
"modified" : "2015-09-29T12:24:55.000Z" ,
"first_observed" : "2015-09-29T12:24:55Z" ,
"last_observed" : "2015-09-29T12:24:55Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--560a8317-a63c-42a1-a6cd-4caf950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--560a8317-a63c-42a1-a6cd-4caf950d210b" ,
"value" : "https://www.virustotal.com/file/c2c761cde3175f6e40ed934f2e82c76602c81e2128187bab61793ddb3bc686d0/analysis/1442486656/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a8317-e030-4412-9bd0-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:24:55.000Z" ,
"modified" : "2015-09-29T12:24:55.000Z" ,
"description" : "- Xchecked via VT: b4005530193bc523d3e0193c3c53e2737ae3bf9f76d12c827c0b5cd0dcbaae45" ,
"pattern" : "[file:hashes.SHA1 = 'e8c3660c87a2265ddb01dcffcd1d0bb040ab247a']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:24:55Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a8318-3fd4-47be-886f-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:24:56.000Z" ,
"modified" : "2015-09-29T12:24:56.000Z" ,
"description" : "- Xchecked via VT: b4005530193bc523d3e0193c3c53e2737ae3bf9f76d12c827c0b5cd0dcbaae45" ,
"pattern" : "[file:hashes.MD5 = 'f0fff29391e7c2e7b13eb4a806276a84']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:24:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--560a8318-5500-45fe-adaf-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:24:56.000Z" ,
"modified" : "2015-09-29T12:24:56.000Z" ,
"first_observed" : "2015-09-29T12:24:56Z" ,
"last_observed" : "2015-09-29T12:24:56Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--560a8318-5500-45fe-adaf-4caf950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--560a8318-5500-45fe-adaf-4caf950d210b" ,
"value" : "https://www.virustotal.com/file/b4005530193bc523d3e0193c3c53e2737ae3bf9f76d12c827c0b5cd0dcbaae45/analysis/1442486077/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a8318-2394-4b3c-8da9-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:24:56.000Z" ,
"modified" : "2015-09-29T12:24:56.000Z" ,
"description" : "- Xchecked via VT: a14d31eb965ea8a37ebcc3b5635099f2ca08365646437c770212d534d504ff3c" ,
"pattern" : "[file:hashes.SHA1 = 'c0721460f4ee074b25fb0b1ed8dae4d2cb7517c9']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:24:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a8319-9444-4cb6-8d83-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:24:57.000Z" ,
"modified" : "2015-09-29T12:24:57.000Z" ,
"description" : "- Xchecked via VT: a14d31eb965ea8a37ebcc3b5635099f2ca08365646437c770212d534d504ff3c" ,
"pattern" : "[file:hashes.MD5 = 'fe2439ef0ace518e1c1a32585099dab8']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:24:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--560a8319-e2a8-4339-a36e-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:24:57.000Z" ,
"modified" : "2015-09-29T12:24:57.000Z" ,
"first_observed" : "2015-09-29T12:24:57Z" ,
"last_observed" : "2015-09-29T12:24:57Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--560a8319-e2a8-4339-a36e-4caf950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--560a8319-e2a8-4339-a36e-4caf950d210b" ,
"value" : "https://www.virustotal.com/file/a14d31eb965ea8a37ebcc3b5635099f2ca08365646437c770212d534d504ff3c/analysis/1442486694/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a8319-8714-4bd0-a38f-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:24:57.000Z" ,
"modified" : "2015-09-29T12:24:57.000Z" ,
"description" : "- Xchecked via VT: 9d077a37b94bf69b94426041e5d5bf1fe56c482ca358191ca911ae041305f3ed" ,
"pattern" : "[file:hashes.SHA1 = 'e540b71e8a4eafc5f26ab379ca5376ac01f05add']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:24:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a831a-c794-46b8-b30f-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:24:58.000Z" ,
"modified" : "2015-09-29T12:24:58.000Z" ,
"description" : "- Xchecked via VT: 9d077a37b94bf69b94426041e5d5bf1fe56c482ca358191ca911ae041305f3ed" ,
"pattern" : "[file:hashes.MD5 = 'e92ff1d7b66a112bfc29d5ccb98aeadc']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:24:58Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--560a831a-d0cc-4511-a83a-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:24:58.000Z" ,
"modified" : "2015-09-29T12:24:58.000Z" ,
"first_observed" : "2015-09-29T12:24:58Z" ,
"last_observed" : "2015-09-29T12:24:58Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--560a831a-d0cc-4511-a83a-4caf950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--560a831a-d0cc-4511-a83a-4caf950d210b" ,
"value" : "https://www.virustotal.com/file/9d077a37b94bf69b94426041e5d5bf1fe56c482ca358191ca911ae041305f3ed/analysis/1442486781/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a831a-e06c-462d-b089-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:24:58.000Z" ,
"modified" : "2015-09-29T12:24:58.000Z" ,
"description" : "- Xchecked via VT: 8ca7ed720babb32a6f381769ea00e16082a563704f8b672cb21cf11843f4da7a" ,
"pattern" : "[file:hashes.SHA1 = '3d75a14f3552d881061449d53577614430ff9e26']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:24:58Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a831b-7228-4c80-a531-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:24:59.000Z" ,
"modified" : "2015-09-29T12:24:59.000Z" ,
"description" : "- Xchecked via VT: 8ca7ed720babb32a6f381769ea00e16082a563704f8b672cb21cf11843f4da7a" ,
"pattern" : "[file:hashes.MD5 = '1582d68144de2808b518934f0a02bfd6']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:24:59Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--560a831b-2818-46a8-acb2-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:24:59.000Z" ,
"modified" : "2015-09-29T12:24:59.000Z" ,
"first_observed" : "2015-09-29T12:24:59Z" ,
"last_observed" : "2015-09-29T12:24:59Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--560a831b-2818-46a8-acb2-4caf950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--560a831b-2818-46a8-acb2-4caf950d210b" ,
"value" : "https://www.virustotal.com/file/8ca7ed720babb32a6f381769ea00e16082a563704f8b672cb21cf11843f4da7a/analysis/1442486067/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a831b-acfc-4d35-9543-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:24:59.000Z" ,
"modified" : "2015-09-29T12:24:59.000Z" ,
"description" : "- Xchecked via VT: 781eb1e17349009fbae46aea5c59d8e5b68ae0b42335cb035742f6b0f4e4087e" ,
"pattern" : "[file:hashes.SHA1 = 'cc941c08b2ff523651aefda9d2df3ee052a3b5cf']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:24:59Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a831c-5534-43a2-a94a-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:25:00.000Z" ,
"modified" : "2015-09-29T12:25:00.000Z" ,
"description" : "- Xchecked via VT: 781eb1e17349009fbae46aea5c59d8e5b68ae0b42335cb035742f6b0f4e4087e" ,
"pattern" : "[file:hashes.MD5 = '95ffe4ab4b158602917dd2a999a8caf8']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:25:00Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--560a831c-9404-44e3-b6a5-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:25:00.000Z" ,
"modified" : "2015-09-29T12:25:00.000Z" ,
"first_observed" : "2015-09-29T12:25:00Z" ,
"last_observed" : "2015-09-29T12:25:00Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--560a831c-9404-44e3-b6a5-4caf950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--560a831c-9404-44e3-b6a5-4caf950d210b" ,
"value" : "https://www.virustotal.com/file/781eb1e17349009fbae46aea5c59d8e5b68ae0b42335cb035742f6b0f4e4087e/analysis/1442486072/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a831c-2e34-4fb1-aaf8-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:25:00.000Z" ,
"modified" : "2015-09-29T12:25:00.000Z" ,
"description" : "- Xchecked via VT: 758e6b519f6c0931ff93542b767524fc1eab589feb5cfc3854c77842f9785c92" ,
"pattern" : "[file:hashes.SHA1 = '050eb34e35feb95b78bfeba3dea70d8dd27a5064']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:25:00Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a831d-f5dc-4ee0-b521-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:25:01.000Z" ,
"modified" : "2015-09-29T12:25:01.000Z" ,
"description" : "- Xchecked via VT: 758e6b519f6c0931ff93542b767524fc1eab589feb5cfc3854c77842f9785c92" ,
"pattern" : "[file:hashes.MD5 = '0fa3657af06a8cc8ef14c445acd92c0f']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:25:01Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--560a831d-b258-4d4f-be96-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:25:01.000Z" ,
"modified" : "2015-09-29T12:25:01.000Z" ,
"first_observed" : "2015-09-29T12:25:01Z" ,
"last_observed" : "2015-09-29T12:25:01Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--560a831d-b258-4d4f-be96-4caf950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--560a831d-b258-4d4f-be96-4caf950d210b" ,
"value" : "https://www.virustotal.com/file/758e6b519f6c0931ff93542b767524fc1eab589feb5cfc3854c77842f9785c92/analysis/1442486070/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a831d-d694-48a7-93f2-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:25:01.000Z" ,
"modified" : "2015-09-29T12:25:01.000Z" ,
"description" : "- Xchecked via VT: 683f5b476f8ffe87ec22b8bab57f74da4a13ecc3a5c2cbf951999953c2064fc9" ,
"pattern" : "[file:hashes.SHA1 = '6493bb7decbb6142d9ddb041af0dd385de1d3756']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:25:01Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a831e-9cd8-4a38-8acd-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:25:02.000Z" ,
"modified" : "2015-09-29T12:25:02.000Z" ,
"description" : "- Xchecked via VT: 683f5b476f8ffe87ec22b8bab57f74da4a13ecc3a5c2cbf951999953c2064fc9" ,
"pattern" : "[file:hashes.MD5 = '14ba21a3a0081ef60e676fd4945a8bdc']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:25:02Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--560a831e-5dc8-440e-9c2c-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:25:02.000Z" ,
"modified" : "2015-09-29T12:25:02.000Z" ,
"first_observed" : "2015-09-29T12:25:02Z" ,
"last_observed" : "2015-09-29T12:25:02Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--560a831e-5dc8-440e-9c2c-4caf950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--560a831e-5dc8-440e-9c2c-4caf950d210b" ,
"value" : "https://www.virustotal.com/file/683f5b476f8ffe87ec22b8bab57f74da4a13ecc3a5c2cbf951999953c2064fc9/analysis/1442486069/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a831e-52b8-4a6a-87a6-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:25:02.000Z" ,
"modified" : "2015-09-29T12:25:02.000Z" ,
"description" : "- Xchecked via VT: 5ab4c378fd8b3254808d66c22bbaacc035874f1c9b4cee511b96458fedff64ed" ,
"pattern" : "[file:hashes.SHA1 = '35d6935dc04df08031f11696ea407eba9003888a']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:25:02Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a831f-2874-469a-bf82-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:25:03.000Z" ,
"modified" : "2015-09-29T12:25:03.000Z" ,
"description" : "- Xchecked via VT: 5ab4c378fd8b3254808d66c22bbaacc035874f1c9b4cee511b96458fedff64ed" ,
"pattern" : "[file:hashes.MD5 = '0af7a57ec3311128b58281a4deb425ab']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:25:03Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--560a831f-743c-4994-8890-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:25:03.000Z" ,
"modified" : "2015-09-29T12:25:03.000Z" ,
"first_observed" : "2015-09-29T12:25:03Z" ,
"last_observed" : "2015-09-29T12:25:03Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--560a831f-743c-4994-8890-4caf950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--560a831f-743c-4994-8890-4caf950d210b" ,
"value" : "https://www.virustotal.com/file/5ab4c378fd8b3254808d66c22bbaacc035874f1c9b4cee511b96458fedff64ed/analysis/1442486788/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a8320-c720-456b-af5f-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:25:04.000Z" ,
"modified" : "2015-09-29T12:25:04.000Z" ,
"description" : "- Xchecked via VT: 4327ce696b5bce9e9b2a691b4e915796218c00998363c7602d8461dd0c1c8fbb" ,
"pattern" : "[file:hashes.SHA1 = 'fdfa0c4757b843c2728b876861390566dbcdba54']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:25:04Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a8320-fd48-4fe6-acd8-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:25:04.000Z" ,
"modified" : "2015-09-29T12:25:04.000Z" ,
"description" : "- Xchecked via VT: 4327ce696b5bce9e9b2a691b4e915796218c00998363c7602d8461dd0c1c8fbb" ,
"pattern" : "[file:hashes.MD5 = '828b19af6f4b94667960cb85079b458b']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:25:04Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--560a8320-8054-46f8-9954-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:25:04.000Z" ,
"modified" : "2015-09-29T12:25:04.000Z" ,
"first_observed" : "2015-09-29T12:25:04Z" ,
"last_observed" : "2015-09-29T12:25:04Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--560a8320-8054-46f8-9954-4caf950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--560a8320-8054-46f8-9954-4caf950d210b" ,
"value" : "https://www.virustotal.com/file/4327ce696b5bce9e9b2a691b4e915796218c00998363c7602d8461dd0c1c8fbb/analysis/1442486786/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a8321-ad04-4dc8-9bd7-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:25:05.000Z" ,
"modified" : "2015-09-29T12:25:05.000Z" ,
"description" : "- Xchecked via VT: 3cfdd3cd1089c4152c0d4c7955210d489565f28fb0af9861b195db34e7ad2502" ,
"pattern" : "[file:hashes.SHA1 = 'd026039b985949f1f0d222b38d9fa0defb025309']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:25:05Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a8321-d414-48bc-83ee-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:25:05.000Z" ,
"modified" : "2015-09-29T12:25:05.000Z" ,
"description" : "- Xchecked via VT: 3cfdd3cd1089c4152c0d4c7955210d489565f28fb0af9861b195db34e7ad2502" ,
"pattern" : "[file:hashes.MD5 = '0bf56a08d031b08163b0a19576e56292']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:25:05Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--560a8321-8e40-404f-b37c-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:25:05.000Z" ,
"modified" : "2015-09-29T12:25:05.000Z" ,
"first_observed" : "2015-09-29T12:25:05Z" ,
"last_observed" : "2015-09-29T12:25:05Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--560a8321-8e40-404f-b37c-4caf950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--560a8321-8e40-404f-b37c-4caf950d210b" ,
"value" : "https://www.virustotal.com/file/3cfdd3cd1089c4152c0d4c7955210d489565f28fb0af9861b195db34e7ad2502/analysis/1442486784/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a8322-d02c-4c55-8798-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:25:06.000Z" ,
"modified" : "2015-09-29T12:25:06.000Z" ,
"description" : "- Xchecked via VT: 2b5065a3d0e0b8252a987ef5f29d9e1935c5863f5718b83440e68dc53c21fa94" ,
"pattern" : "[file:hashes.SHA1 = '8e4e662682f0f7f7fa59d39a2fc023a1843238a0']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:25:06Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a8322-d204-4a57-af5e-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:25:06.000Z" ,
"modified" : "2015-09-29T12:25:06.000Z" ,
"description" : "- Xchecked via VT: 2b5065a3d0e0b8252a987ef5f29d9e1935c5863f5718b83440e68dc53c21fa94" ,
"pattern" : "[file:hashes.MD5 = '425b40d687e34623f54ff58a079fc9af']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:25:06Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--560a8322-7310-4e0f-af2a-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:25:06.000Z" ,
"modified" : "2015-09-29T12:25:06.000Z" ,
"first_observed" : "2015-09-29T12:25:06Z" ,
"last_observed" : "2015-09-29T12:25:06Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--560a8322-7310-4e0f-af2a-4caf950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--560a8322-7310-4e0f-af2a-4caf950d210b" ,
"value" : "https://www.virustotal.com/file/2b5065a3d0e0b8252a987ef5f29d9e1935c5863f5718b83440e68dc53c21fa94/analysis/1442486660/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a8323-dfbc-47fa-8272-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:25:07.000Z" ,
"modified" : "2015-09-29T12:25:07.000Z" ,
"description" : "- Xchecked via VT: 2a8cb295f85f8d1d5aae7744899875ebb4e6c3ef74fbc5bfad6e7723c192c5cf" ,
"pattern" : "[file:hashes.SHA1 = '29804cb689f1949e5f127378351f72fada48c1e0']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:25:07Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a8323-69ac-4c4f-ad7e-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:25:07.000Z" ,
"modified" : "2015-09-29T12:25:07.000Z" ,
"description" : "- Xchecked via VT: 2a8cb295f85f8d1d5aae7744899875ebb4e6c3ef74fbc5bfad6e7723c192c5cf" ,
"pattern" : "[file:hashes.MD5 = 'b7efead869c3d92f1086c43cb99ab0a2']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:25:07Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--560a8323-4868-45fe-a5df-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:25:07.000Z" ,
"modified" : "2015-09-29T12:25:07.000Z" ,
"first_observed" : "2015-09-29T12:25:07Z" ,
"last_observed" : "2015-09-29T12:25:07Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--560a8323-4868-45fe-a5df-4caf950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--560a8323-4868-45fe-a5df-4caf950d210b" ,
"value" : "https://www.virustotal.com/file/2a8cb295f85f8d1d5aae7744899875ebb4e6c3ef74fbc5bfad6e7723c192c5cf/analysis/1442486615/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a8324-00c0-400e-aa5c-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:25:08.000Z" ,
"modified" : "2015-09-29T12:25:08.000Z" ,
"description" : "- Xchecked via VT: 29906c51217d15b9bbbcc8130f64dabdb69bd32baa7999500c7a230c218e8b0a" ,
"pattern" : "[file:hashes.SHA1 = 'd838b54b755d6ec7be71f46c244cb3ecd180f2e5']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:25:08Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a8324-d7a8-4f9b-9060-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:25:08.000Z" ,
"modified" : "2015-09-29T12:25:08.000Z" ,
"description" : "- Xchecked via VT: 29906c51217d15b9bbbcc8130f64dabdb69bd32baa7999500c7a230c218e8b0a" ,
"pattern" : "[file:hashes.MD5 = '2c9cbe71dc98897aeaef4d6d3afc7eb3']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:25:08Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--560a8324-3544-4138-abf1-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:25:08.000Z" ,
"modified" : "2015-09-29T12:25:08.000Z" ,
"first_observed" : "2015-09-29T12:25:08Z" ,
"last_observed" : "2015-09-29T12:25:08Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--560a8324-3544-4138-abf1-4caf950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--560a8324-3544-4138-abf1-4caf950d210b" ,
"value" : "https://www.virustotal.com/file/29906c51217d15b9bbbcc8130f64dabdb69bd32baa7999500c7a230c218e8b0a/analysis/1442486782/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a8325-bad4-4ea1-bb31-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:25:09.000Z" ,
"modified" : "2015-09-29T12:25:09.000Z" ,
"description" : "- Xchecked via VT: 1c9af096e4c7daa440af136f2b1439089a827101098cfe25b8c19fc7321eaad9" ,
"pattern" : "[file:hashes.SHA1 = 'c2b09f227d141befeab81df132c9abbad4b73c46']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:25:09Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a8325-afd0-4ece-b4af-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:25:09.000Z" ,
"modified" : "2015-09-29T12:25:09.000Z" ,
"description" : "- Xchecked via VT: 1c9af096e4c7daa440af136f2b1439089a827101098cfe25b8c19fc7321eaad9" ,
"pattern" : "[file:hashes.MD5 = '5c42ec22da050bbc82e4a86d4dd0e086']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:25:09Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--560a8325-96ac-4952-83a3-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:25:09.000Z" ,
"modified" : "2015-09-29T12:25:09.000Z" ,
"first_observed" : "2015-09-29T12:25:09Z" ,
"last_observed" : "2015-09-29T12:25:09Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--560a8325-96ac-4952-83a3-4caf950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--560a8325-96ac-4952-83a3-4caf950d210b" ,
"value" : "https://www.virustotal.com/file/1c9af096e4c7daa440af136f2b1439089a827101098cfe25b8c19fc7321eaad9/analysis/1442486777/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a8326-0e80-46ba-85a1-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:25:10.000Z" ,
"modified" : "2015-09-29T12:25:10.000Z" ,
"description" : "- Xchecked via VT: 1677573bb02cc073e248e4a14334db90be8052d0b236e446e29582f50441fa33" ,
"pattern" : "[file:hashes.SHA1 = 'f42e316292f59ea51f4c40d1c574747eec227796']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:25:10Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--560a8326-05a0-4ec8-9c74-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:25:10.000Z" ,
"modified" : "2015-09-29T12:25:10.000Z" ,
"description" : "- Xchecked via VT: 1677573bb02cc073e248e4a14334db90be8052d0b236e446e29582f50441fa33" ,
"pattern" : "[file:hashes.MD5 = 'a16e58bba851ea00e4ea79f9763df6f1']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2015-09-29T12:25:10Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--560a8326-b3f4-4e88-b8d6-4caf950d210b" ,
"created_by_ref" : "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f" ,
"created" : "2015-09-29T12:25:10.000Z" ,
"modified" : "2015-09-29T12:25:10.000Z" ,
"first_observed" : "2015-09-29T12:25:10Z" ,
"last_observed" : "2015-09-29T12:25:10Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--560a8326-b3f4-4e88-b8d6-4caf950d210b"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--560a8326-b3f4-4e88-b8d6-4caf950d210b" ,
"value" : "https://www.virustotal.com/file/1677573bb02cc073e248e4a14334db90be8052d0b236e446e29582f50441fa33/analysis/1442486775/"
} ,
{
"type" : "marking-definition" ,
"spec_version" : "2.1" ,
"id" : "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ,
"created" : "2017-01-20T00:00:00.000Z" ,
"definition_type" : "tlp" ,
"name" : "TLP:WHITE" ,
"definition" : {
"tlp" : "white"
}
}
]
}
