1514 lines
63 KiB
JSON
1514 lines
63 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--55dc126c-1580-44c0-a6bd-44ba950d210b",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:13.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:13.000Z",
|
||
|
|
"name": "CthulhuSPRL.be",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--55dc126c-1580-44c0-a6bd-44ba950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:13.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:13.000Z",
|
||
|
|
"name": "OSINT Tinted CVE decoy spearphising attempt on Central Bank of Armenia employees by BlueCoat",
|
||
|
|
"published": "2015-08-25T08:27:39Z",
|
||
|
|
"object_refs": [
|
||
|
|
"observed-data--55dc1284-0214-4e92-b432-4aa0950d210b",
|
||
|
|
"url--55dc1284-0214-4e92-b432-4aa0950d210b",
|
||
|
|
"observed-data--55dc1284-4178-42eb-b4ff-4fb8950d210b",
|
||
|
|
"url--55dc1284-4178-42eb-b4ff-4fb8950d210b",
|
||
|
|
"indicator--55dc12b1-ef28-4244-a9c4-4b22950d210b",
|
||
|
|
"indicator--55dc12b1-6b18-4f37-bc47-412e950d210b",
|
||
|
|
"indicator--55dc12b1-a2bc-4bfc-825c-441a950d210b",
|
||
|
|
"indicator--55dc12b2-2374-4443-941f-4680950d210b",
|
||
|
|
"indicator--55dc12b2-477c-4867-b2e6-48ec950d210b",
|
||
|
|
"indicator--55dc12b2-1170-4086-8dca-4d57950d210b",
|
||
|
|
"indicator--55dc12b2-df8c-465d-9a2a-4f28950d210b",
|
||
|
|
"indicator--55dc12b3-e9a4-4762-88d8-4f67950d210b",
|
||
|
|
"indicator--55dc12b3-c9a4-4558-8504-4eb0950d210b",
|
||
|
|
"indicator--55dc12b3-4638-4f10-92e9-43cc950d210b",
|
||
|
|
"indicator--55dc12b3-5aa0-47d9-b839-4907950d210b",
|
||
|
|
"vulnerability--55dc12b3-b42c-4196-8282-477f950d210b",
|
||
|
|
"indicator--55dc12b3-0b58-4338-837d-4c68950d210b",
|
||
|
|
"indicator--55dc12b4-d1e4-4c30-bdd5-42df950d210b",
|
||
|
|
"indicator--55dc12b4-0f28-4fa9-96a4-4550950d210b",
|
||
|
|
"indicator--55dc12b4-b46c-4980-9b10-4bf3950d210b",
|
||
|
|
"indicator--55dc12b4-f614-44e2-b795-4694950d210b",
|
||
|
|
"indicator--55dc12b4-d9b4-456f-8801-40ca950d210b",
|
||
|
|
"indicator--55dc26a6-06a4-4164-aa04-46da950d210b",
|
||
|
|
"indicator--55dc26a6-d7d0-4ed4-9ab6-4d19950d210b",
|
||
|
|
"observed-data--55dc26a6-6830-4074-84b1-42fc950d210b",
|
||
|
|
"url--55dc26a6-6830-4074-84b1-42fc950d210b",
|
||
|
|
"indicator--55dc26a6-4f88-42e9-a03d-41fb950d210b",
|
||
|
|
"indicator--55dc26a6-f378-4f5e-a873-41ed950d210b",
|
||
|
|
"observed-data--55dc26a7-b5d0-49cb-a04e-4907950d210b",
|
||
|
|
"url--55dc26a7-b5d0-49cb-a04e-4907950d210b",
|
||
|
|
"indicator--55dc26a7-6e70-4c1f-bd2e-4f6c950d210b",
|
||
|
|
"indicator--55dc26a7-876c-4530-893c-4b7c950d210b",
|
||
|
|
"observed-data--55dc26a7-6cd8-4124-8389-418e950d210b",
|
||
|
|
"url--55dc26a7-6cd8-4124-8389-418e950d210b",
|
||
|
|
"indicator--55dc26a7-97e8-4090-a8e8-4fd6950d210b",
|
||
|
|
"indicator--55dc26a8-f4ec-40dc-9dd0-403c950d210b",
|
||
|
|
"observed-data--55dc26a8-e98c-4225-92fe-43a8950d210b",
|
||
|
|
"url--55dc26a8-e98c-4225-92fe-43a8950d210b",
|
||
|
|
"indicator--55dc26a8-9130-4142-8f5d-4a23950d210b",
|
||
|
|
"indicator--55dc26a8-b198-4d73-a47e-4edc950d210b",
|
||
|
|
"observed-data--55dc26a8-e41c-41d3-a50a-4cc6950d210b",
|
||
|
|
"url--55dc26a8-e41c-41d3-a50a-4cc6950d210b",
|
||
|
|
"indicator--55dc26a9-92a8-4331-91e3-4584950d210b",
|
||
|
|
"indicator--55dc26a9-5ea4-491e-9784-4833950d210b",
|
||
|
|
"observed-data--55dc26a9-e828-42cb-85ac-41f3950d210b",
|
||
|
|
"url--55dc26a9-e828-42cb-85ac-41f3950d210b",
|
||
|
|
"indicator--55dc26a9-8728-4e47-bd1d-4f1a950d210b",
|
||
|
|
"indicator--55dc26a9-5564-4b7b-877b-4d8d950d210b",
|
||
|
|
"observed-data--55dc26aa-0b64-42e3-8e41-4622950d210b",
|
||
|
|
"url--55dc26aa-0b64-42e3-8e41-4622950d210b",
|
||
|
|
"indicator--55dc26aa-ec74-426c-a6c4-42cc950d210b",
|
||
|
|
"indicator--55dc26aa-917c-4bc8-8086-44e8950d210b",
|
||
|
|
"observed-data--55dc26aa-a814-44f5-9b0d-4e81950d210b",
|
||
|
|
"url--55dc26aa-a814-44f5-9b0d-4e81950d210b",
|
||
|
|
"indicator--55dc26aa-1bbc-40b4-90ba-4bc0950d210b",
|
||
|
|
"indicator--55dc26ab-a638-4c01-8672-405a950d210b",
|
||
|
|
"observed-data--55dc26ab-0e64-4d60-beba-4869950d210b",
|
||
|
|
"url--55dc26ab-0e64-4d60-beba-4869950d210b",
|
||
|
|
"indicator--55dc26ab-8974-4131-851d-45d3950d210b",
|
||
|
|
"indicator--55dc26ab-cc44-4546-b6b8-4c4b950d210b",
|
||
|
|
"observed-data--55dc26ac-7270-49cf-b1f2-4f77950d210b",
|
||
|
|
"url--55dc26ac-7270-49cf-b1f2-4f77950d210b",
|
||
|
|
"indicator--55dc26ac-6f28-4fda-a10b-4579950d210b",
|
||
|
|
"indicator--55dc26ac-03d0-442d-ae2f-4d88950d210b",
|
||
|
|
"observed-data--55dc26ac-2144-4579-8b14-41f5950d210b",
|
||
|
|
"url--55dc26ac-2144-4579-8b14-41f5950d210b",
|
||
|
|
"indicator--55dc26ac-cac8-4c3b-bad3-467d950d210b",
|
||
|
|
"indicator--55dc26ad-6c68-47e1-8556-4b6c950d210b",
|
||
|
|
"observed-data--55dc26ad-0fac-4d01-a88d-4d47950d210b",
|
||
|
|
"url--55dc26ad-0fac-4d01-a88d-4d47950d210b",
|
||
|
|
"indicator--55dc26ad-787c-49be-83fc-4f05950d210b",
|
||
|
|
"indicator--55dc26ad-5284-4bf2-bd8c-4d1a950d210b",
|
||
|
|
"observed-data--55dc26ad-6d6c-48d3-a8cf-4a70950d210b",
|
||
|
|
"url--55dc26ad-6d6c-48d3-a8cf-4a70950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"type:OSINT"
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--55dc1284-0214-4e92-b432-4aa0950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T07:00:20.000Z",
|
||
|
|
"modified": "2015-08-25T07:00:20.000Z",
|
||
|
|
"first_observed": "2015-08-25T07:00:20Z",
|
||
|
|
"last_observed": "2015-08-25T07:00:20Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--55dc1284-0214-4e92-b432-4aa0950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--55dc1284-0214-4e92-b432-4aa0950d210b",
|
||
|
|
"value": "https://www.bluecoat.com/security-blog/2015-08-21/tinted-cve-decoy-spearphising-attempt-central-bank-armenia-employees"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--55dc1284-4178-42eb-b4ff-4fb8950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T07:00:20.000Z",
|
||
|
|
"modified": "2015-08-25T07:00:20.000Z",
|
||
|
|
"first_observed": "2015-08-25T07:00:20Z",
|
||
|
|
"last_observed": "2015-08-25T07:00:20Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--55dc1284-4178-42eb-b4ff-4fb8950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--55dc1284-4178-42eb-b4ff-4fb8950d210b",
|
||
|
|
"value": "https://otx.alienvault.com/pulse/55d775fd67db8c7bb9cb63fb/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc12b1-ef28-4244-a9c4-4b22950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T07:01:05.000Z",
|
||
|
|
"modified": "2015-08-25T07:01:05.000Z",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '192.52.166.66']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T07:01:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc12b1-6b18-4f37-bc47-412e950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T07:01:05.000Z",
|
||
|
|
"modified": "2015-08-25T07:01:05.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '2d2840b305c944c882ce5e37cd74cfbc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T07:01:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc12b1-a2bc-4bfc-825c-441a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T07:01:05.000Z",
|
||
|
|
"modified": "2015-08-25T07:01:05.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '339b61c3ca3596ab6da4c2a605247fbb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T07:01:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc12b2-2374-4443-941f-4680950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T07:01:06.000Z",
|
||
|
|
"modified": "2015-08-25T07:01:06.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '5322b34cb2db39d19f870b3dd17b796b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T07:01:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc12b2-477c-4867-b2e6-48ec950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T07:01:06.000Z",
|
||
|
|
"modified": "2015-08-25T07:01:06.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '554c74582f38dfe21640b3ce125238c4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T07:01:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc12b2-1170-4086-8dca-4d57950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T07:01:06.000Z",
|
||
|
|
"modified": "2015-08-25T07:01:06.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '63a5aea388e454f6186fabab8cd96ff7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T07:01:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc12b2-df8c-465d-9a2a-4f28950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T07:01:06.000Z",
|
||
|
|
"modified": "2015-08-25T07:01:06.000Z",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '78.128.92.112']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T07:01:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc12b3-e9a4-4762-88d8-4f67950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T07:01:07.000Z",
|
||
|
|
"modified": "2015-08-25T07:01:07.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '7f31e18efad384ed1b6f14be1860dc33']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T07:01:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc12b3-c9a4-4558-8504-4eb0950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T07:01:07.000Z",
|
||
|
|
"modified": "2015-08-25T07:01:07.000Z",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '84.200.4.226']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T07:01:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc12b3-4638-4f10-92e9-43cc950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T07:01:07.000Z",
|
||
|
|
"modified": "2015-08-25T07:01:07.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '8c1922960c1dd9290931079e1f56f08b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T07:01:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc12b3-5aa0-47d9-b839-4907950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T07:01:07.000Z",
|
||
|
|
"modified": "2015-08-25T07:01:07.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '95e200169e95b73c885c032796246cfb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T07:01:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "vulnerability",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "vulnerability--55dc12b3-b42c-4196-8282-477f950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T07:01:07.000Z",
|
||
|
|
"modified": "2015-08-25T07:01:07.000Z",
|
||
|
|
"name": "CVE-2012-0158",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"vulnerability\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
],
|
||
|
|
"external_references": [
|
||
|
|
{
|
||
|
|
"source_name": "cve",
|
||
|
|
"external_id": "CVE-2012-0158"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc12b3-0b58-4338-837d-4c68950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T07:01:07.000Z",
|
||
|
|
"modified": "2015-08-25T07:01:07.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'a680ffb948da8d801eeb4f1a2a275665']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T07:01:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc12b4-d1e4-4c30-bdd5-42df950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T07:01:08.000Z",
|
||
|
|
"modified": "2015-08-25T07:01:08.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'adobe-dns-3-adobe.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T07:01:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc12b4-0f28-4fa9-96a4-4550950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T07:01:08.000Z",
|
||
|
|
"modified": "2015-08-25T07:01:08.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c16f6825fd1dc4795761c211adf4616a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T07:01:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc12b4-b46c-4980-9b10-4bf3950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T07:01:08.000Z",
|
||
|
|
"modified": "2015-08-25T07:01:08.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c9b105ec2412ac0e2ace20bfa71e1450']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T07:01:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc12b4-f614-44e2-b795-4694950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T07:01:08.000Z",
|
||
|
|
"modified": "2015-08-25T07:01:08.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'f2e407846e0937ab9184c0a9bb77aa95']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T07:01:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc12b4-d9b4-456f-8801-40ca950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T07:01:08.000Z",
|
||
|
|
"modified": "2015-08-25T07:01:08.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'f5db00b0fd7a9593ed6a773a5f63b105']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T07:01:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc26a6-06a4-4164-aa04-46da950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:14.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:14.000Z",
|
||
|
|
"description": "- Xchecked via VT: f5db00b0fd7a9593ed6a773a5f63b105",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '83a423acb1de3676befeaf745cc3dbc975743fe64c944dbe4a609e0bb3287730']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T08:26:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc26a6-d7d0-4ed4-9ab6-4d19950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:14.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:14.000Z",
|
||
|
|
"description": "- Xchecked via VT: f5db00b0fd7a9593ed6a773a5f63b105",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '850e9a10e6d20d33c8d2c765e22771e8919fc3ee']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T08:26:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--55dc26a6-6830-4074-84b1-42fc950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:14.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:14.000Z",
|
||
|
|
"first_observed": "2015-08-25T08:26:14Z",
|
||
|
|
"last_observed": "2015-08-25T08:26:14Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--55dc26a6-6830-4074-84b1-42fc950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--55dc26a6-6830-4074-84b1-42fc950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/83a423acb1de3676befeaf745cc3dbc975743fe64c944dbe4a609e0bb3287730/analysis/1440427821/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc26a6-4f88-42e9-a03d-41fb950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:14.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:14.000Z",
|
||
|
|
"description": "- Xchecked via VT: f2e407846e0937ab9184c0a9bb77aa95",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '69e414e970482d627fe5b808df5c719bef27bbb6276c3abb78233d21fdab1a83']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T08:26:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc26a6-f378-4f5e-a873-41ed950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:14.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:14.000Z",
|
||
|
|
"description": "- Xchecked via VT: f2e407846e0937ab9184c0a9bb77aa95",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '905d0842cc246a772c595b8cf4a4e9e517683eb7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T08:26:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--55dc26a7-b5d0-49cb-a04e-4907950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:15.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:15.000Z",
|
||
|
|
"first_observed": "2015-08-25T08:26:15Z",
|
||
|
|
"last_observed": "2015-08-25T08:26:15Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--55dc26a7-b5d0-49cb-a04e-4907950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--55dc26a7-b5d0-49cb-a04e-4907950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/69e414e970482d627fe5b808df5c719bef27bbb6276c3abb78233d21fdab1a83/analysis/1438876521/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc26a7-6e70-4c1f-bd2e-4f6c950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:15.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:15.000Z",
|
||
|
|
"description": "- Xchecked via VT: c9b105ec2412ac0e2ace20bfa71e1450",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9a00f0edc87a44d10369fdb9f35ebe1b1df57e01719a5b48ac3eddc068f77f87']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T08:26:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc26a7-876c-4530-893c-4b7c950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:15.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:15.000Z",
|
||
|
|
"description": "- Xchecked via VT: c9b105ec2412ac0e2ace20bfa71e1450",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '3cef1ca36a78cba308fb29a46b20e5ca22d03289']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T08:26:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--55dc26a7-6cd8-4124-8389-418e950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:15.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:15.000Z",
|
||
|
|
"first_observed": "2015-08-25T08:26:15Z",
|
||
|
|
"last_observed": "2015-08-25T08:26:15Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--55dc26a7-6cd8-4124-8389-418e950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--55dc26a7-6cd8-4124-8389-418e950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/9a00f0edc87a44d10369fdb9f35ebe1b1df57e01719a5b48ac3eddc068f77f87/analysis/1440427821/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc26a7-97e8-4090-a8e8-4fd6950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:15.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:15.000Z",
|
||
|
|
"description": "- Xchecked via VT: c16f6825fd1dc4795761c211adf4616a",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'df0839dfaa115f8cc6dc67bde7b3ecadd31a5e0c03b500e667aa72a1f1d138ab']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T08:26:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc26a8-f4ec-40dc-9dd0-403c950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:16.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:16.000Z",
|
||
|
|
"description": "- Xchecked via VT: c16f6825fd1dc4795761c211adf4616a",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '36093a6004a9502079b054041badc43c69a0bdeb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T08:26:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--55dc26a8-e98c-4225-92fe-43a8950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:16.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:16.000Z",
|
||
|
|
"first_observed": "2015-08-25T08:26:16Z",
|
||
|
|
"last_observed": "2015-08-25T08:26:16Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--55dc26a8-e98c-4225-92fe-43a8950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--55dc26a8-e98c-4225-92fe-43a8950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/df0839dfaa115f8cc6dc67bde7b3ecadd31a5e0c03b500e667aa72a1f1d138ab/analysis/1439335705/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc26a8-9130-4142-8f5d-4a23950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:16.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:16.000Z",
|
||
|
|
"description": "- Xchecked via VT: a680ffb948da8d801eeb4f1a2a275665",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1642dde3699c9c939b8ee34a88c722ce67083ddea16ecf0376e588c35cf32177']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T08:26:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc26a8-b198-4d73-a47e-4edc950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:16.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:16.000Z",
|
||
|
|
"description": "- Xchecked via VT: a680ffb948da8d801eeb4f1a2a275665",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a77336620df96642691c1e5b6c91511bfa76a5be']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T08:26:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--55dc26a8-e41c-41d3-a50a-4cc6950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:16.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:16.000Z",
|
||
|
|
"first_observed": "2015-08-25T08:26:16Z",
|
||
|
|
"last_observed": "2015-08-25T08:26:16Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--55dc26a8-e41c-41d3-a50a-4cc6950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--55dc26a8-e41c-41d3-a50a-4cc6950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/1642dde3699c9c939b8ee34a88c722ce67083ddea16ecf0376e588c35cf32177/analysis/1440065579/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc26a9-92a8-4331-91e3-4584950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:17.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:17.000Z",
|
||
|
|
"description": "- Xchecked via VT: 95e200169e95b73c885c032796246cfb",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9df339e10668e549c00c84515cfbf3f943a6adfcc57883e15cec617fb24c3d8c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T08:26:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc26a9-5ea4-491e-9784-4833950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:17.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:17.000Z",
|
||
|
|
"description": "- Xchecked via VT: 95e200169e95b73c885c032796246cfb",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '237784574afb8868213c900c18a114d3fa528b95']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T08:26:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--55dc26a9-e828-42cb-85ac-41f3950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:17.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:17.000Z",
|
||
|
|
"first_observed": "2015-08-25T08:26:17Z",
|
||
|
|
"last_observed": "2015-08-25T08:26:17Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--55dc26a9-e828-42cb-85ac-41f3950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--55dc26a9-e828-42cb-85ac-41f3950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/9df339e10668e549c00c84515cfbf3f943a6adfcc57883e15cec617fb24c3d8c/analysis/1440184658/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc26a9-8728-4e47-bd1d-4f1a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:17.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:17.000Z",
|
||
|
|
"description": "- Xchecked via VT: 8c1922960c1dd9290931079e1f56f08b",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c5c5045b04714af7d9ee51b654951e4b05bbae1c4074a00c9a1d4d5008de1fbe']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T08:26:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc26a9-5564-4b7b-877b-4d8d950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:17.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:17.000Z",
|
||
|
|
"description": "- Xchecked via VT: 8c1922960c1dd9290931079e1f56f08b",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'ec5dadaacae763d0e55ce6a78c9a5f57b01a5135']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T08:26:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--55dc26aa-0b64-42e3-8e41-4622950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:18.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:18.000Z",
|
||
|
|
"first_observed": "2015-08-25T08:26:18Z",
|
||
|
|
"last_observed": "2015-08-25T08:26:18Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--55dc26aa-0b64-42e3-8e41-4622950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--55dc26aa-0b64-42e3-8e41-4622950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/c5c5045b04714af7d9ee51b654951e4b05bbae1c4074a00c9a1d4d5008de1fbe/analysis/1439806800/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc26aa-ec74-426c-a6c4-42cc950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:18.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:18.000Z",
|
||
|
|
"description": "- Xchecked via VT: 7f31e18efad384ed1b6f14be1860dc33",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '75c230b4e0f3630d36643606d83ed7490cf6bd6a77abd9c49d09ac60bb3f59db']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T08:26:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc26aa-917c-4bc8-8086-44e8950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:18.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:18.000Z",
|
||
|
|
"description": "- Xchecked via VT: 7f31e18efad384ed1b6f14be1860dc33",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'efc0555418a6ed641047d29178d0da3aefa7adeb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T08:26:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--55dc26aa-a814-44f5-9b0d-4e81950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:18.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:18.000Z",
|
||
|
|
"first_observed": "2015-08-25T08:26:18Z",
|
||
|
|
"last_observed": "2015-08-25T08:26:18Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--55dc26aa-a814-44f5-9b0d-4e81950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--55dc26aa-a814-44f5-9b0d-4e81950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/75c230b4e0f3630d36643606d83ed7490cf6bd6a77abd9c49d09ac60bb3f59db/analysis/1440065567/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc26aa-1bbc-40b4-90ba-4bc0950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:18.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:18.000Z",
|
||
|
|
"description": "- Xchecked via VT: 63a5aea388e454f6186fabab8cd96ff7",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'bf7a6ecbf7939743563e82342b2c1a8cb9e0412c974fd6e78f936d6140961c14']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T08:26:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc26ab-a638-4c01-8672-405a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:19.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:19.000Z",
|
||
|
|
"description": "- Xchecked via VT: 63a5aea388e454f6186fabab8cd96ff7",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '4e8ee08ff4f8dc06aff8de2e476afafba58bdc11']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T08:26:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--55dc26ab-0e64-4d60-beba-4869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:19.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:19.000Z",
|
||
|
|
"first_observed": "2015-08-25T08:26:19Z",
|
||
|
|
"last_observed": "2015-08-25T08:26:19Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--55dc26ab-0e64-4d60-beba-4869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--55dc26ab-0e64-4d60-beba-4869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/bf7a6ecbf7939743563e82342b2c1a8cb9e0412c974fd6e78f936d6140961c14/analysis/1440184641/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc26ab-8974-4131-851d-45d3950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:19.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:19.000Z",
|
||
|
|
"description": "- Xchecked via VT: 554c74582f38dfe21640b3ce125238c4",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '741440aa42b9926fad1134382316992b7a1f783e29115ef787debbb5655ed7e6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T08:26:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc26ab-cc44-4546-b6b8-4c4b950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:19.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:19.000Z",
|
||
|
|
"description": "- Xchecked via VT: 554c74582f38dfe21640b3ce125238c4",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a09f520dded0d5292a5fa48e80de02f9af718d06']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T08:26:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--55dc26ac-7270-49cf-b1f2-4f77950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:20.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:20.000Z",
|
||
|
|
"first_observed": "2015-08-25T08:26:20Z",
|
||
|
|
"last_observed": "2015-08-25T08:26:20Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--55dc26ac-7270-49cf-b1f2-4f77950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--55dc26ac-7270-49cf-b1f2-4f77950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/741440aa42b9926fad1134382316992b7a1f783e29115ef787debbb5655ed7e6/analysis/1440480192/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc26ac-6f28-4fda-a10b-4579950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:20.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:20.000Z",
|
||
|
|
"description": "- Xchecked via VT: 5322b34cb2db39d19f870b3dd17b796b",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5aa9c81afe8cdebae554e858c2aab25e207a65a103071f25c3564b08046e43fc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T08:26:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc26ac-03d0-442d-ae2f-4d88950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:20.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:20.000Z",
|
||
|
|
"description": "- Xchecked via VT: 5322b34cb2db39d19f870b3dd17b796b",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a734193f550dda5c1ffd9fec3a0186a0a793449c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T08:26:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--55dc26ac-2144-4579-8b14-41f5950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:20.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:20.000Z",
|
||
|
|
"first_observed": "2015-08-25T08:26:20Z",
|
||
|
|
"last_observed": "2015-08-25T08:26:20Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--55dc26ac-2144-4579-8b14-41f5950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--55dc26ac-2144-4579-8b14-41f5950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/5aa9c81afe8cdebae554e858c2aab25e207a65a103071f25c3564b08046e43fc/analysis/1438340654/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc26ac-cac8-4c3b-bad3-467d950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:20.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:20.000Z",
|
||
|
|
"description": "- Xchecked via VT: 339b61c3ca3596ab6da4c2a605247fbb",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '515019bb74bed64686e43995e826ea77811d7700745350c1b24d58d88697525e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T08:26:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc26ad-6c68-47e1-8556-4b6c950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:21.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:21.000Z",
|
||
|
|
"description": "- Xchecked via VT: 339b61c3ca3596ab6da4c2a605247fbb",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '6090853934833d0814f9239e6746161491cccb44']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T08:26:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--55dc26ad-0fac-4d01-a88d-4d47950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:21.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:21.000Z",
|
||
|
|
"first_observed": "2015-08-25T08:26:21Z",
|
||
|
|
"last_observed": "2015-08-25T08:26:21Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--55dc26ad-0fac-4d01-a88d-4d47950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--55dc26ad-0fac-4d01-a88d-4d47950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/515019bb74bed64686e43995e826ea77811d7700745350c1b24d58d88697525e/analysis/1439556561/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc26ad-787c-49be-83fc-4f05950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:21.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:21.000Z",
|
||
|
|
"description": "- Xchecked via VT: 2d2840b305c944c882ce5e37cd74cfbc",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a262dc9e5855447ebd3052b06d714c76fc0656a5b426944e3b27b4a8a2eb2a7c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T08:26:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55dc26ad-5284-4bf2-bd8c-4d1a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:21.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:21.000Z",
|
||
|
|
"description": "- Xchecked via VT: 2d2840b305c944c882ce5e37cd74cfbc",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'b79e6a21d8c2813ec2279727746bdb685180751a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-08-25T08:26:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--55dc26ad-6d6c-48d3-a8cf-4a70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-08-25T08:26:21.000Z",
|
||
|
|
"modified": "2015-08-25T08:26:21.000Z",
|
||
|
|
"first_observed": "2015-08-25T08:26:21Z",
|
||
|
|
"last_observed": "2015-08-25T08:26:21Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--55dc26ad-6d6c-48d3-a8cf-4a70950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--55dc26ad-6d6c-48d3-a8cf-4a70950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/a262dc9e5855447ebd3052b06d714c76fc0656a5b426944e3b27b4a8a2eb2a7c/analysis/1440427820/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|