999 lines
43 KiB
JSON
999 lines
43 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--5603c00a-e4d0-42e1-a0b7-85ab950d210b",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:30:40.000Z",
|
||
|
|
"modified": "2015-09-24T09:30:40.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--5603c00a-e4d0-42e1-a0b7-85ab950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:30:40.000Z",
|
||
|
|
"modified": "2015-09-24T09:30:40.000Z",
|
||
|
|
"name": "OSINT - Guaranteed Clicks: Mobile App Company Takes Control of Android Phones",
|
||
|
|
"published": "2015-09-24T09:31:59Z",
|
||
|
|
"object_refs": [
|
||
|
|
"observed-data--5603c021-4ca0-4fa9-8839-85ab950d210b",
|
||
|
|
"url--5603c021-4ca0-4fa9-8839-85ab950d210b",
|
||
|
|
"indicator--5603c0fa-1ad4-434c-af63-960e950d210b",
|
||
|
|
"indicator--5603c0fb-5eb8-4e97-8f67-960e950d210b",
|
||
|
|
"indicator--5603c0fb-d66c-440d-84c7-960e950d210b",
|
||
|
|
"indicator--5603c0fb-7db4-4dc4-8278-960e950d210b",
|
||
|
|
"indicator--5603c0fc-8798-4437-a81f-960e950d210b",
|
||
|
|
"indicator--5603c0fc-5294-45ec-a43f-960e950d210b",
|
||
|
|
"indicator--5603c0fd-dfc4-4c7d-b420-960e950d210b",
|
||
|
|
"indicator--5603c0fd-08a8-47b6-be19-960e950d210b",
|
||
|
|
"indicator--5603c0fe-0004-4fb9-ad04-960e950d210b",
|
||
|
|
"indicator--5603c0fe-726c-47b5-83a7-960e950d210b",
|
||
|
|
"indicator--5603c115-6914-4c2c-9b78-937a950d210b",
|
||
|
|
"indicator--5603c115-cad4-48b9-8da4-937a950d210b",
|
||
|
|
"observed-data--5603c115-5d84-4823-a75f-937a950d210b",
|
||
|
|
"url--5603c115-5d84-4823-a75f-937a950d210b",
|
||
|
|
"indicator--5603c116-4ec8-4426-b62f-937a950d210b",
|
||
|
|
"indicator--5603c116-e0a0-474c-bfbd-937a950d210b",
|
||
|
|
"observed-data--5603c116-3ea4-4cdd-b173-937a950d210b",
|
||
|
|
"url--5603c116-3ea4-4cdd-b173-937a950d210b",
|
||
|
|
"indicator--5603c117-ef18-4a50-9f3c-937a950d210b",
|
||
|
|
"indicator--5603c117-ec1c-45cb-946e-937a950d210b",
|
||
|
|
"observed-data--5603c118-d910-4a0f-80ef-937a950d210b",
|
||
|
|
"url--5603c118-d910-4a0f-80ef-937a950d210b",
|
||
|
|
"indicator--5603c118-0cf0-44a1-83eb-937a950d210b",
|
||
|
|
"indicator--5603c118-5814-449d-a196-937a950d210b",
|
||
|
|
"observed-data--5603c119-0e04-41f2-9bbd-937a950d210b",
|
||
|
|
"url--5603c119-0e04-41f2-9bbd-937a950d210b",
|
||
|
|
"indicator--5603c119-c3cc-443f-a009-937a950d210b",
|
||
|
|
"indicator--5603c119-4bd0-4ff5-87b4-937a950d210b",
|
||
|
|
"observed-data--5603c11a-fcec-4fc2-a04e-937a950d210b",
|
||
|
|
"url--5603c11a-fcec-4fc2-a04e-937a950d210b",
|
||
|
|
"indicator--5603c11a-6914-4589-adaa-937a950d210b",
|
||
|
|
"indicator--5603c11a-5c88-4d87-b3b6-937a950d210b",
|
||
|
|
"observed-data--5603c11b-67e0-4c7a-ab1c-937a950d210b",
|
||
|
|
"url--5603c11b-67e0-4c7a-ab1c-937a950d210b",
|
||
|
|
"indicator--5603c11b-1080-4a87-8599-937a950d210b",
|
||
|
|
"indicator--5603c11b-ed78-442e-b2ab-937a950d210b",
|
||
|
|
"observed-data--5603c11c-2364-4b72-b9fd-937a950d210b",
|
||
|
|
"url--5603c11c-2364-4b72-b9fd-937a950d210b",
|
||
|
|
"indicator--5603c24f-ea00-471f-b2de-9393950d210b",
|
||
|
|
"indicator--5603c2a9-8690-4bc7-8ad1-963b950d210b",
|
||
|
|
"indicator--5603c2a9-fe84-4073-8397-963b950d210b",
|
||
|
|
"indicator--5603c2aa-ad04-4e0f-80ad-963b950d210b",
|
||
|
|
"indicator--5603c2aa-d9a4-40ab-80ea-963b950d210b",
|
||
|
|
"indicator--5603c2c0-8d0c-4158-81a1-85a9950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"type:OSINT"
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5603c021-4ca0-4fa9-8839-85ab950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:19:29.000Z",
|
||
|
|
"modified": "2015-09-24T09:19:29.000Z",
|
||
|
|
"first_observed": "2015-09-24T09:19:29Z",
|
||
|
|
"last_observed": "2015-09-24T09:19:29Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5603c021-4ca0-4fa9-8839-85ab950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5603c021-4ca0-4fa9-8839-85ab950d210b",
|
||
|
|
"value": "https://www.fireeye.com/blog/threat-research/2015/09/guaranteed_clicksm.html"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5603c0fa-1ad4-434c-af63-960e950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:23:06.000Z",
|
||
|
|
"modified": "2015-09-24T09:23:06.000Z",
|
||
|
|
"description": "Package name - samples",
|
||
|
|
"pattern": "[file:name = 'com.locker.maboo.tow' AND file:hashes.SHA256 = '12b8da40ec9e53a83a7c4b1d490db397730123efa5e8ed39ee596d3bae42f80d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-24T09:23:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5603c0fb-5eb8-4e97-8f67-960e950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:23:07.000Z",
|
||
|
|
"modified": "2015-09-24T09:23:07.000Z",
|
||
|
|
"description": "Package name - samples",
|
||
|
|
"pattern": "[file:name = 'com.tmdfkslakssspp111.ivityfffds1133' AND file:hashes.SHA256 = '8b5b898c7ad2fc6b516800f411b7181877a89124a94ba8a9fa0e974972c67553']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-24T09:23:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5603c0fb-d66c-440d-84c7-960e950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:23:07.000Z",
|
||
|
|
"modified": "2015-09-24T09:23:07.000Z",
|
||
|
|
"description": "Package name - samples",
|
||
|
|
"pattern": "[file:name = 'com1.xiaoao2.FruitSingle' AND file:hashes.SHA256 = 'd65696c077b480bb0afab2390f1efd37d701ca2f6cbaa91977d4ac76957438c7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-24T09:23:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5603c0fb-7db4-4dc4-8278-960e950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:23:07.000Z",
|
||
|
|
"modified": "2015-09-24T09:23:07.000Z",
|
||
|
|
"description": "Package name - samples",
|
||
|
|
"pattern": "[file:name = 'com.mobilefish.pig.enpais' AND file:hashes.SHA256 = '3a5bbe5454124ba5fbaa0dc7786fd2361dd903f84ccf65be65b0b0b77d432e6e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-24T09:23:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5603c0fc-8798-4437-a81f-960e950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:23:08.000Z",
|
||
|
|
"modified": "2015-09-24T09:23:08.000Z",
|
||
|
|
"description": "Package name - samples",
|
||
|
|
"pattern": "[file:name = 'com.adad.flashlight' AND file:hashes.SHA256 = 'b05013bbabf0a24a2c8b9c7b3f3ad79b065c6daaaec51c2e61790b05932dbb58']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-24T09:23:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5603c0fc-5294-45ec-a43f-960e950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:23:08.000Z",
|
||
|
|
"modified": "2015-09-24T09:23:08.000Z",
|
||
|
|
"description": "Package name - samples",
|
||
|
|
"pattern": "[file:name = 'com.liuximnb.videokl2' AND file:hashes.SHA256 = '396324dc3f34785aca1ece255a6f142f52e831b22bf96906c2a10b61b1da4713']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-24T09:23:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5603c0fd-dfc4-4c7d-b420-960e950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:23:09.000Z",
|
||
|
|
"modified": "2015-09-24T09:23:09.000Z",
|
||
|
|
"description": "Package name - samples",
|
||
|
|
"pattern": "[file:name = 'com.4puBX.Bu1q0' AND file:hashes.SHA256 = '98bdad683b0ae189ed0fa56fb1e147c93e96e085dff90565ee246a4f6c4e2850']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-24T09:23:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5603c0fd-08a8-47b6-be19-960e950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:23:09.000Z",
|
||
|
|
"modified": "2015-09-24T09:23:09.000Z",
|
||
|
|
"description": "Package name - samples",
|
||
|
|
"pattern": "[file:name = 'com.sQ1z7.JXhkN' AND file:hashes.SHA256 = 'f46c21a2976af7ba23e0af54943eacdaad2fd0b3108fde6d1502879fe9c83d07']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-24T09:23:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5603c0fe-0004-4fb9-ad04-960e950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:23:10.000Z",
|
||
|
|
"modified": "2015-09-24T09:23:10.000Z",
|
||
|
|
"description": "Package name - samples",
|
||
|
|
"pattern": "[file:name = 'com.cg.wifienhancer' AND file:hashes.SHA256 = 'b3c3d131200369d1c28285010b99d591f9a9c0629b0ba9fedd1b4ffe0170cf4c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-24T09:23:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5603c0fe-726c-47b5-83a7-960e950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:23:10.000Z",
|
||
|
|
"modified": "2015-09-24T09:23:10.000Z",
|
||
|
|
"description": "Package name - samples",
|
||
|
|
"pattern": "[file:name = 'com.BmiZX.p6l9v' AND file:hashes.SHA256 = '0a63ca301d97930eb8352c0772fb39015e4b89cd82e72391213ee82414e60cf8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-24T09:23:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5603c115-6914-4c2c-9b78-937a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:23:33.000Z",
|
||
|
|
"modified": "2015-09-24T09:23:33.000Z",
|
||
|
|
"description": "Package name - samples - Xchecked via VT: f46c21a2976af7ba23e0af54943eacdaad2fd0b3108fde6d1502879fe9c83d07",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'd07f56b2f51dfbe8638f927dbf18edc4b9c74f3b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-24T09:23:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5603c115-cad4-48b9-8da4-937a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:23:33.000Z",
|
||
|
|
"modified": "2015-09-24T09:23:33.000Z",
|
||
|
|
"description": "Package name - samples - Xchecked via VT: f46c21a2976af7ba23e0af54943eacdaad2fd0b3108fde6d1502879fe9c83d07",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd407f8fd7369bb73fe87c99ee4b86f18']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-24T09:23:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5603c115-5d84-4823-a75f-937a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:23:33.000Z",
|
||
|
|
"modified": "2015-09-24T09:23:33.000Z",
|
||
|
|
"first_observed": "2015-09-24T09:23:33Z",
|
||
|
|
"last_observed": "2015-09-24T09:23:33Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5603c115-5d84-4823-a75f-937a950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5603c115-5d84-4823-a75f-937a950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/f46c21a2976af7ba23e0af54943eacdaad2fd0b3108fde6d1502879fe9c83d07/analysis/1443012182/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5603c116-4ec8-4426-b62f-937a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:23:34.000Z",
|
||
|
|
"modified": "2015-09-24T09:23:34.000Z",
|
||
|
|
"description": "Package name - samples - Xchecked via VT: 396324dc3f34785aca1ece255a6f142f52e831b22bf96906c2a10b61b1da4713",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '7f29a5012107aebf89cb00b792540791df32fd75']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-24T09:23:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5603c116-e0a0-474c-bfbd-937a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:23:34.000Z",
|
||
|
|
"modified": "2015-09-24T09:23:34.000Z",
|
||
|
|
"description": "Package name - samples - Xchecked via VT: 396324dc3f34785aca1ece255a6f142f52e831b22bf96906c2a10b61b1da4713",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'a4431ef1d9a275a39831fac2d255fb9c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-24T09:23:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5603c116-3ea4-4cdd-b173-937a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:23:34.000Z",
|
||
|
|
"modified": "2015-09-24T09:23:34.000Z",
|
||
|
|
"first_observed": "2015-09-24T09:23:34Z",
|
||
|
|
"last_observed": "2015-09-24T09:23:34Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5603c116-3ea4-4cdd-b173-937a950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5603c116-3ea4-4cdd-b173-937a950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/396324dc3f34785aca1ece255a6f142f52e831b22bf96906c2a10b61b1da4713/analysis/1443012179/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5603c117-ef18-4a50-9f3c-937a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:23:35.000Z",
|
||
|
|
"modified": "2015-09-24T09:23:35.000Z",
|
||
|
|
"description": "Package name - samples - Xchecked via VT: b05013bbabf0a24a2c8b9c7b3f3ad79b065c6daaaec51c2e61790b05932dbb58",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'ada4466924a7fb08dbe2a7650f2d0e789b984284']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-24T09:23:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5603c117-ec1c-45cb-946e-937a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:23:35.000Z",
|
||
|
|
"modified": "2015-09-24T09:23:35.000Z",
|
||
|
|
"description": "Package name - samples - Xchecked via VT: b05013bbabf0a24a2c8b9c7b3f3ad79b065c6daaaec51c2e61790b05932dbb58",
|
||
|
|
"pattern": "[file:hashes.MD5 = '3788d40651151f0fcf441b7fceaf7f2a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-24T09:23:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5603c118-d910-4a0f-80ef-937a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:23:36.000Z",
|
||
|
|
"modified": "2015-09-24T09:23:36.000Z",
|
||
|
|
"first_observed": "2015-09-24T09:23:36Z",
|
||
|
|
"last_observed": "2015-09-24T09:23:36Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5603c118-d910-4a0f-80ef-937a950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5603c118-d910-4a0f-80ef-937a950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/b05013bbabf0a24a2c8b9c7b3f3ad79b065c6daaaec51c2e61790b05932dbb58/analysis/1442581837/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5603c118-0cf0-44a1-83eb-937a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:23:36.000Z",
|
||
|
|
"modified": "2015-09-24T09:23:36.000Z",
|
||
|
|
"description": "Package name - samples - Xchecked via VT: 3a5bbe5454124ba5fbaa0dc7786fd2361dd903f84ccf65be65b0b0b77d432e6e",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c97cbc54f0a0f313092f1a2a33dd2850974cd3cd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-24T09:23:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5603c118-5814-449d-a196-937a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:23:36.000Z",
|
||
|
|
"modified": "2015-09-24T09:23:36.000Z",
|
||
|
|
"description": "Package name - samples - Xchecked via VT: 3a5bbe5454124ba5fbaa0dc7786fd2361dd903f84ccf65be65b0b0b77d432e6e",
|
||
|
|
"pattern": "[file:hashes.MD5 = '8c5ff2b37657fe28bcbc6b6eac0165fd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-24T09:23:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5603c119-0e04-41f2-9bbd-937a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:23:37.000Z",
|
||
|
|
"modified": "2015-09-24T09:23:37.000Z",
|
||
|
|
"first_observed": "2015-09-24T09:23:37Z",
|
||
|
|
"last_observed": "2015-09-24T09:23:37Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5603c119-0e04-41f2-9bbd-937a950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5603c119-0e04-41f2-9bbd-937a950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/3a5bbe5454124ba5fbaa0dc7786fd2361dd903f84ccf65be65b0b0b77d432e6e/analysis/1443012180/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5603c119-c3cc-443f-a009-937a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:23:37.000Z",
|
||
|
|
"modified": "2015-09-24T09:23:37.000Z",
|
||
|
|
"description": "Package name - samples - Xchecked via VT: d65696c077b480bb0afab2390f1efd37d701ca2f6cbaa91977d4ac76957438c7",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '5bd07c5b8c8e1b8c7d62b525b1d98ef7efaa3ac7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-24T09:23:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5603c119-4bd0-4ff5-87b4-937a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:23:37.000Z",
|
||
|
|
"modified": "2015-09-24T09:23:37.000Z",
|
||
|
|
"description": "Package name - samples - Xchecked via VT: d65696c077b480bb0afab2390f1efd37d701ca2f6cbaa91977d4ac76957438c7",
|
||
|
|
"pattern": "[file:hashes.MD5 = '396ca4c3594c705d3289ad8e59a995d7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-24T09:23:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5603c11a-fcec-4fc2-a04e-937a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:23:38.000Z",
|
||
|
|
"modified": "2015-09-24T09:23:38.000Z",
|
||
|
|
"first_observed": "2015-09-24T09:23:38Z",
|
||
|
|
"last_observed": "2015-09-24T09:23:38Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5603c11a-fcec-4fc2-a04e-937a950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5603c11a-fcec-4fc2-a04e-937a950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/d65696c077b480bb0afab2390f1efd37d701ca2f6cbaa91977d4ac76957438c7/analysis/1443012179/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5603c11a-6914-4589-adaa-937a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:23:38.000Z",
|
||
|
|
"modified": "2015-09-24T09:23:38.000Z",
|
||
|
|
"description": "Package name - samples - Xchecked via VT: 8b5b898c7ad2fc6b516800f411b7181877a89124a94ba8a9fa0e974972c67553",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '7be4297d98b41a5974af610351b58c677f364125']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-24T09:23:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5603c11a-5c88-4d87-b3b6-937a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:23:38.000Z",
|
||
|
|
"modified": "2015-09-24T09:23:38.000Z",
|
||
|
|
"description": "Package name - samples - Xchecked via VT: 8b5b898c7ad2fc6b516800f411b7181877a89124a94ba8a9fa0e974972c67553",
|
||
|
|
"pattern": "[file:hashes.MD5 = '138d642a9c793ff54959812c376a0835']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-24T09:23:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5603c11b-67e0-4c7a-ab1c-937a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:23:39.000Z",
|
||
|
|
"modified": "2015-09-24T09:23:39.000Z",
|
||
|
|
"first_observed": "2015-09-24T09:23:39Z",
|
||
|
|
"last_observed": "2015-09-24T09:23:39Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5603c11b-67e0-4c7a-ab1c-937a950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5603c11b-67e0-4c7a-ab1c-937a950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/8b5b898c7ad2fc6b516800f411b7181877a89124a94ba8a9fa0e974972c67553/analysis/1443012180/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5603c11b-1080-4a87-8599-937a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:23:39.000Z",
|
||
|
|
"modified": "2015-09-24T09:23:39.000Z",
|
||
|
|
"description": "Package name - samples - Xchecked via VT: 12b8da40ec9e53a83a7c4b1d490db397730123efa5e8ed39ee596d3bae42f80d",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'ddce1aee88946f2312d5fbc56f4dd866a44fd6e2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-24T09:23:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5603c11b-ed78-442e-b2ab-937a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:23:39.000Z",
|
||
|
|
"modified": "2015-09-24T09:23:39.000Z",
|
||
|
|
"description": "Package name - samples - Xchecked via VT: 12b8da40ec9e53a83a7c4b1d490db397730123efa5e8ed39ee596d3bae42f80d",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c9d2b9e3f7dd7e01612679f44b65462d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-24T09:23:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5603c11c-2364-4b72-b9fd-937a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:23:40.000Z",
|
||
|
|
"modified": "2015-09-24T09:23:40.000Z",
|
||
|
|
"first_observed": "2015-09-24T09:23:40Z",
|
||
|
|
"last_observed": "2015-09-24T09:23:40Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5603c11c-2364-4b72-b9fd-937a950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5603c11c-2364-4b72-b9fd-937a950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/12b8da40ec9e53a83a7c4b1d490db397730123efa5e8ed39ee596d3bae42f80d/analysis/1443012180/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5603c24f-ea00-471f-b2de-9393950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:28:47.000Z",
|
||
|
|
"modified": "2015-09-24T09:28:47.000Z",
|
||
|
|
"description": "it downloads an APK from the following URL and dynamically loads logic to execute",
|
||
|
|
"pattern": "[url:value = 'http://down.onowcdn.com/onekeysdk/tr_new/rt_0907_129.apk']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-24T09:28:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5603c2a9-8690-4bc7-8ad1-963b950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:30:17.000Z",
|
||
|
|
"modified": "2015-09-24T09:30:17.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'aedxdrcb.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-24T09:30:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5603c2a9-fe84-4073-8397-963b950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:30:17.000Z",
|
||
|
|
"modified": "2015-09-24T09:30:17.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'hdyfhpoi.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-24T09:30:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5603c2aa-ad04-4e0f-80ad-963b950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:30:18.000Z",
|
||
|
|
"modified": "2015-09-24T09:30:18.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'syllyq1n.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-24T09:30:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5603c2aa-d9a4-40ab-80ea-963b950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:30:18.000Z",
|
||
|
|
"modified": "2015-09-24T09:30:18.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'wksnkys7.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-24T09:30:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5603c2c0-8d0c-4158-81a1-85a9950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2015-09-24T09:30:40.000Z",
|
||
|
|
"modified": "2015-09-24T09:30:40.000Z",
|
||
|
|
"pattern": "[url:value = 'http://down.agacdn.com/onlyapk/coolbroser_2.2_release_yeahmobi_self_1.apk']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-24T09:30:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|