4420 lines
183 KiB
JSON
4420 lines
183 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--563b1547-7c84-43ad-8e3a-8257950d210b",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:14.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:14.000Z",
|
||
|
|
"name": "CthulhuSPRL.be",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--563b1547-7c84-43ad-8e3a-8257950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:14.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:14.000Z",
|
||
|
|
"name": "OSINT Systematic cyber attacks against Israeli and Palestinian targets going on for a year by Norman",
|
||
|
|
"published": "2015-11-05T09:05:13Z",
|
||
|
|
"object_refs": [
|
||
|
|
"observed-data--563b15b4-c8b0-4bc6-b2d0-9fd2950d210b",
|
||
|
|
"url--563b15b4-c8b0-4bc6-b2d0-9fd2950d210b",
|
||
|
|
"indicator--563b15c0-2360-47b6-898f-9fd2950d210b",
|
||
|
|
"indicator--563b15c1-9ec0-4178-84db-9fd2950d210b",
|
||
|
|
"indicator--563b15c1-a4a4-4e81-9044-9fd2950d210b",
|
||
|
|
"indicator--563b15c2-4668-4b57-9cbf-9fd2950d210b",
|
||
|
|
"indicator--563b15c2-07c0-4c20-afd2-9fd2950d210b",
|
||
|
|
"indicator--563b15c3-7e10-41e9-8f19-9fd2950d210b",
|
||
|
|
"indicator--563b15c3-cea4-4130-9bdc-9fd2950d210b",
|
||
|
|
"indicator--563b15c3-3f94-4452-980e-9fd2950d210b",
|
||
|
|
"indicator--563b15c4-0484-4857-8a04-9fd2950d210b",
|
||
|
|
"indicator--563b15c4-7124-4d5f-9c73-9fd2950d210b",
|
||
|
|
"indicator--563b15c5-5f38-438c-892b-9fd2950d210b",
|
||
|
|
"indicator--563b15c5-0e8c-4a42-9c74-9fd2950d210b",
|
||
|
|
"indicator--563b15c5-977c-451d-a18b-9fd2950d210b",
|
||
|
|
"indicator--563b15c6-8ea4-4f74-ad00-9fd2950d210b",
|
||
|
|
"indicator--563b15c6-6cd4-49ba-834e-9fd2950d210b",
|
||
|
|
"indicator--563b15c7-dd7c-44c4-abba-9fd2950d210b",
|
||
|
|
"indicator--563b15c7-e820-4b51-aaf1-9fd2950d210b",
|
||
|
|
"indicator--563b15c7-4a1c-4e37-968e-9fd2950d210b",
|
||
|
|
"indicator--563b15c8-9b50-4bcc-a356-9fd2950d210b",
|
||
|
|
"indicator--563b15c8-8e1c-4d29-abf0-9fd2950d210b",
|
||
|
|
"indicator--563b15c9-1660-4751-a73b-9fd2950d210b",
|
||
|
|
"indicator--563b15c9-89a8-4dd3-8809-9fd2950d210b",
|
||
|
|
"indicator--563b15c9-f434-4885-b311-9fd2950d210b",
|
||
|
|
"indicator--563b15ca-37dc-40c9-8065-9fd2950d210b",
|
||
|
|
"indicator--563b15ca-e748-4930-9bbb-9fd2950d210b",
|
||
|
|
"indicator--563b15f2-f724-439b-980f-be64950d210b",
|
||
|
|
"indicator--563b15f2-3590-4023-a5c5-be64950d210b",
|
||
|
|
"indicator--563b15f3-3270-403c-ab2d-be64950d210b",
|
||
|
|
"indicator--563b15f4-2c14-4ef0-a3d3-be64950d210b",
|
||
|
|
"indicator--563b15f5-e114-4aa1-9919-be64950d210b",
|
||
|
|
"indicator--563b15f5-79b4-4327-8331-be64950d210b",
|
||
|
|
"indicator--563b15f6-f34c-43cd-abc4-be64950d210b",
|
||
|
|
"indicator--563b15f6-6f20-4192-9aca-be64950d210b",
|
||
|
|
"indicator--563b15f7-7000-4986-90df-be64950d210b",
|
||
|
|
"indicator--563b15f7-7764-4b85-a353-be64950d210b",
|
||
|
|
"indicator--563b15f7-aa38-427d-9334-be64950d210b",
|
||
|
|
"indicator--563b15f8-9c18-42b6-a372-be64950d210b",
|
||
|
|
"indicator--563b15f9-28e4-4c71-9b9d-be64950d210b",
|
||
|
|
"indicator--563b15f9-9ce0-4857-a5af-be64950d210b",
|
||
|
|
"indicator--563b15fa-aa00-479c-9dd9-be64950d210b",
|
||
|
|
"indicator--563b15fa-546c-42e4-9d85-be64950d210b",
|
||
|
|
"indicator--563b15fb-8d18-41e3-8f93-be64950d210b",
|
||
|
|
"indicator--563b15fb-d6cc-4bc6-b53b-be64950d210b",
|
||
|
|
"indicator--563b15fc-8ebc-4eb8-a6df-be64950d210b",
|
||
|
|
"indicator--563b15fc-ae10-43b7-afe0-be64950d210b",
|
||
|
|
"indicator--563b15fc-1434-4606-b141-be64950d210b",
|
||
|
|
"indicator--563b15fd-8ef0-45b4-a94a-be64950d210b",
|
||
|
|
"indicator--563b15fd-eaa0-498e-8095-be64950d210b",
|
||
|
|
"indicator--563b15fe-296c-4c03-919d-be64950d210b",
|
||
|
|
"indicator--563b15fe-d0bc-455c-aff2-be64950d210b",
|
||
|
|
"indicator--563b15ff-03e8-4c13-b753-be64950d210b",
|
||
|
|
"indicator--563b1600-3b4c-4103-afa6-be64950d210b",
|
||
|
|
"indicator--563b1600-5108-4d97-ba80-be64950d210b",
|
||
|
|
"indicator--563b1601-557c-44ae-9205-be64950d210b",
|
||
|
|
"indicator--563b1601-46b8-4b0b-948a-be64950d210b",
|
||
|
|
"indicator--563b1601-45b0-4d33-bd09-be64950d210b",
|
||
|
|
"indicator--563b1602-5458-4366-8185-be64950d210b",
|
||
|
|
"indicator--563b1603-8920-49a7-9fe3-be64950d210b",
|
||
|
|
"indicator--563b1603-b63c-4e40-b7c4-be64950d210b",
|
||
|
|
"indicator--563b1604-b330-4d51-b942-be64950d210b",
|
||
|
|
"indicator--563b1604-f5f0-4022-9594-be64950d210b",
|
||
|
|
"indicator--563b1604-f08c-4379-926b-be64950d210b",
|
||
|
|
"indicator--563b1605-3f30-4201-bcab-be64950d210b",
|
||
|
|
"indicator--563b1605-3128-4a51-9b87-be64950d210b",
|
||
|
|
"indicator--563b1ada-c798-4939-8778-b869950d210b",
|
||
|
|
"indicator--563b1ada-a254-4db7-9473-b869950d210b",
|
||
|
|
"observed-data--563b1adb-17ac-4d35-835a-b869950d210b",
|
||
|
|
"url--563b1adb-17ac-4d35-835a-b869950d210b",
|
||
|
|
"indicator--563b1adb-ae1c-46a7-aa16-b869950d210b",
|
||
|
|
"indicator--563b1adc-cd50-4843-b559-b869950d210b",
|
||
|
|
"observed-data--563b1adc-9ee4-4caa-87bc-b869950d210b",
|
||
|
|
"url--563b1adc-9ee4-4caa-87bc-b869950d210b",
|
||
|
|
"indicator--563b1adc-3de8-4365-bb47-b869950d210b",
|
||
|
|
"indicator--563b1add-2e18-4000-be06-b869950d210b",
|
||
|
|
"observed-data--563b1add-9f38-4354-95a9-b869950d210b",
|
||
|
|
"url--563b1add-9f38-4354-95a9-b869950d210b",
|
||
|
|
"indicator--563b1add-66d0-4b0b-9dfb-b869950d210b",
|
||
|
|
"indicator--563b1ade-d908-42f7-b797-b869950d210b",
|
||
|
|
"observed-data--563b1ade-6804-4d98-b2b5-b869950d210b",
|
||
|
|
"url--563b1ade-6804-4d98-b2b5-b869950d210b",
|
||
|
|
"indicator--563b1adf-5bb8-4d97-97e0-b869950d210b",
|
||
|
|
"indicator--563b1adf-831c-44f7-a359-b869950d210b",
|
||
|
|
"observed-data--563b1adf-a750-4d11-a3af-b869950d210b",
|
||
|
|
"url--563b1adf-a750-4d11-a3af-b869950d210b",
|
||
|
|
"indicator--563b1ae0-b984-4fba-8cb5-b869950d210b",
|
||
|
|
"indicator--563b1ae0-c1a0-4da2-a752-b869950d210b",
|
||
|
|
"observed-data--563b1ae1-89c0-44f3-929d-b869950d210b",
|
||
|
|
"url--563b1ae1-89c0-44f3-929d-b869950d210b",
|
||
|
|
"indicator--563b1ae1-f3d4-4db2-830d-b869950d210b",
|
||
|
|
"indicator--563b1ae1-8940-48b3-b2aa-b869950d210b",
|
||
|
|
"observed-data--563b1ae2-da7c-4c8f-82c8-b869950d210b",
|
||
|
|
"url--563b1ae2-da7c-4c8f-82c8-b869950d210b",
|
||
|
|
"indicator--563b1ae2-09e4-42b2-979f-b869950d210b",
|
||
|
|
"indicator--563b1ae3-8cfc-45a6-99ff-b869950d210b",
|
||
|
|
"observed-data--563b1ae3-9bbc-45c8-8fca-b869950d210b",
|
||
|
|
"url--563b1ae3-9bbc-45c8-8fca-b869950d210b",
|
||
|
|
"indicator--563b1ae3-7f24-4784-bfbe-b869950d210b",
|
||
|
|
"indicator--563b1ae4-5528-4a1f-825e-b869950d210b",
|
||
|
|
"observed-data--563b1ae4-f0f8-43d6-b95d-b869950d210b",
|
||
|
|
"url--563b1ae4-f0f8-43d6-b95d-b869950d210b",
|
||
|
|
"indicator--563b1ae4-f944-47c9-920d-b869950d210b",
|
||
|
|
"indicator--563b1ae5-46b8-425a-a0d8-b869950d210b",
|
||
|
|
"observed-data--563b1ae5-c888-4ab9-a819-b869950d210b",
|
||
|
|
"url--563b1ae5-c888-4ab9-a819-b869950d210b",
|
||
|
|
"indicator--563b1ae6-5958-4129-8124-b869950d210b",
|
||
|
|
"indicator--563b1ae6-5cf4-47e4-89bc-b869950d210b",
|
||
|
|
"observed-data--563b1ae6-30e0-4f28-9516-b869950d210b",
|
||
|
|
"url--563b1ae6-30e0-4f28-9516-b869950d210b",
|
||
|
|
"indicator--563b1ae7-fbec-4849-89f8-b869950d210b",
|
||
|
|
"indicator--563b1ae7-a28c-4942-b8fb-b869950d210b",
|
||
|
|
"observed-data--563b1ae8-afe4-4b09-99ee-b869950d210b",
|
||
|
|
"url--563b1ae8-afe4-4b09-99ee-b869950d210b",
|
||
|
|
"indicator--563b1ae8-f1f8-480d-9ce4-b869950d210b",
|
||
|
|
"indicator--563b1ae8-2000-4077-966b-b869950d210b",
|
||
|
|
"observed-data--563b1ae9-b460-490f-a919-b869950d210b",
|
||
|
|
"url--563b1ae9-b460-490f-a919-b869950d210b",
|
||
|
|
"indicator--563b1ae9-ffd4-48a3-84ad-b869950d210b",
|
||
|
|
"indicator--563b1aea-8a04-4255-897f-b869950d210b",
|
||
|
|
"observed-data--563b1aea-6870-49d9-92f5-b869950d210b",
|
||
|
|
"url--563b1aea-6870-49d9-92f5-b869950d210b",
|
||
|
|
"indicator--563b1aea-b6d4-40d4-a885-b869950d210b",
|
||
|
|
"indicator--563b1aeb-9124-4c7c-a53b-b869950d210b",
|
||
|
|
"observed-data--563b1aeb-87a4-420a-83bd-b869950d210b",
|
||
|
|
"url--563b1aeb-87a4-420a-83bd-b869950d210b",
|
||
|
|
"indicator--563b1aeb-b310-41b9-906a-b869950d210b",
|
||
|
|
"indicator--563b1aec-1960-42d8-8452-b869950d210b",
|
||
|
|
"observed-data--563b1aec-5b54-4910-b4d4-b869950d210b",
|
||
|
|
"url--563b1aec-5b54-4910-b4d4-b869950d210b",
|
||
|
|
"indicator--563b1aed-5fa8-4ae8-8968-b869950d210b",
|
||
|
|
"indicator--563b1aed-0dd4-4894-80a4-b869950d210b",
|
||
|
|
"observed-data--563b1aed-47b8-4a59-8228-b869950d210b",
|
||
|
|
"url--563b1aed-47b8-4a59-8228-b869950d210b",
|
||
|
|
"indicator--563b1aee-0060-4de1-8fb6-b869950d210b",
|
||
|
|
"indicator--563b1aee-e450-46ca-ae6f-b869950d210b",
|
||
|
|
"observed-data--563b1aef-ea54-4e60-885d-b869950d210b",
|
||
|
|
"url--563b1aef-ea54-4e60-885d-b869950d210b",
|
||
|
|
"indicator--563b1aef-8730-4a7f-a94b-b869950d210b",
|
||
|
|
"indicator--563b1aef-f8b0-4603-864c-b869950d210b",
|
||
|
|
"observed-data--563b1af0-bccc-43ec-86d7-b869950d210b",
|
||
|
|
"url--563b1af0-bccc-43ec-86d7-b869950d210b",
|
||
|
|
"indicator--563b1af0-ac08-47e6-aed9-b869950d210b",
|
||
|
|
"indicator--563b1af1-4a7c-44db-a75f-b869950d210b",
|
||
|
|
"observed-data--563b1af1-3e64-4697-bea4-b869950d210b",
|
||
|
|
"url--563b1af1-3e64-4697-bea4-b869950d210b",
|
||
|
|
"indicator--563b1af1-6b60-4154-b8c3-b869950d210b",
|
||
|
|
"indicator--563b1af2-5070-4f4f-9fc6-b869950d210b",
|
||
|
|
"observed-data--563b1af2-4630-4951-9374-b869950d210b",
|
||
|
|
"url--563b1af2-4630-4951-9374-b869950d210b",
|
||
|
|
"indicator--563b1af2-0040-4c64-b298-b869950d210b",
|
||
|
|
"indicator--563b1af3-be8c-4870-9f3c-b869950d210b",
|
||
|
|
"observed-data--563b1af3-04b0-4f57-bd0a-b869950d210b",
|
||
|
|
"url--563b1af3-04b0-4f57-bd0a-b869950d210b",
|
||
|
|
"indicator--563b1af4-9ca0-4fa2-a389-b869950d210b",
|
||
|
|
"indicator--563b1af4-9c70-433c-af14-b869950d210b",
|
||
|
|
"observed-data--563b1af4-ef0c-4643-adff-b869950d210b",
|
||
|
|
"url--563b1af4-ef0c-4643-adff-b869950d210b",
|
||
|
|
"indicator--563b1af5-c9f8-44af-969a-b869950d210b",
|
||
|
|
"indicator--563b1af5-58dc-43c6-b3a4-b869950d210b",
|
||
|
|
"observed-data--563b1af6-8568-4027-a901-b869950d210b",
|
||
|
|
"url--563b1af6-8568-4027-a901-b869950d210b",
|
||
|
|
"indicator--563b1af6-6608-4dbe-895a-b869950d210b",
|
||
|
|
"indicator--563b1af6-cce0-402a-bad8-b869950d210b",
|
||
|
|
"observed-data--563b1af7-787c-4077-ab69-b869950d210b",
|
||
|
|
"url--563b1af7-787c-4077-ab69-b869950d210b",
|
||
|
|
"indicator--563b1af7-d220-488e-9692-b869950d210b",
|
||
|
|
"indicator--563b1af7-5c2c-4ef3-a9cb-b869950d210b",
|
||
|
|
"observed-data--563b1af8-c800-4942-ae88-b869950d210b",
|
||
|
|
"url--563b1af8-c800-4942-ae88-b869950d210b",
|
||
|
|
"indicator--563b1af8-47a8-48fc-8bbe-b869950d210b",
|
||
|
|
"indicator--563b1af9-14cc-4756-95e9-b869950d210b",
|
||
|
|
"observed-data--563b1af9-972c-4778-9f4a-b869950d210b",
|
||
|
|
"url--563b1af9-972c-4778-9f4a-b869950d210b",
|
||
|
|
"indicator--563b1af9-6280-4c48-8802-b869950d210b",
|
||
|
|
"indicator--563b1afa-a198-4f1b-bc19-b869950d210b",
|
||
|
|
"observed-data--563b1afa-3a50-420f-be17-b869950d210b",
|
||
|
|
"url--563b1afa-3a50-420f-be17-b869950d210b",
|
||
|
|
"indicator--563b1afb-977c-404c-a193-b869950d210b",
|
||
|
|
"indicator--563b1afb-39e8-4d3c-9a2d-b869950d210b",
|
||
|
|
"observed-data--563b1afb-7c78-48c4-a39b-b869950d210b",
|
||
|
|
"url--563b1afb-7c78-48c4-a39b-b869950d210b",
|
||
|
|
"indicator--563b1afc-7dfc-44d8-b589-b869950d210b",
|
||
|
|
"indicator--563b1afc-a8f0-4ea0-96be-b869950d210b",
|
||
|
|
"observed-data--563b1afd-6604-4ffc-8540-b869950d210b",
|
||
|
|
"url--563b1afd-6604-4ffc-8540-b869950d210b",
|
||
|
|
"indicator--563b1afd-16d0-42eb-b3cc-b869950d210b",
|
||
|
|
"indicator--563b1afd-42f0-448a-b4d8-b869950d210b",
|
||
|
|
"observed-data--563b1afe-6a1c-40bc-b5d1-b869950d210b",
|
||
|
|
"url--563b1afe-6a1c-40bc-b5d1-b869950d210b",
|
||
|
|
"indicator--563b1afe-b198-44ed-946b-b869950d210b",
|
||
|
|
"indicator--563b1afe-aeac-496f-ad65-b869950d210b",
|
||
|
|
"observed-data--563b1aff-03d0-4cb6-9270-b869950d210b",
|
||
|
|
"url--563b1aff-03d0-4cb6-9270-b869950d210b",
|
||
|
|
"indicator--563b1aff-7304-4759-a502-b869950d210b",
|
||
|
|
"indicator--563b1b00-feec-44f8-8de2-b869950d210b",
|
||
|
|
"observed-data--563b1b00-ab28-4001-81ab-b869950d210b",
|
||
|
|
"url--563b1b00-ab28-4001-81ab-b869950d210b",
|
||
|
|
"indicator--563b1b00-3748-4fee-84ea-b869950d210b",
|
||
|
|
"indicator--563b1b01-1130-4cc7-8812-b869950d210b",
|
||
|
|
"observed-data--563b1b01-5f9c-47eb-a42a-b869950d210b",
|
||
|
|
"url--563b1b01-5f9c-47eb-a42a-b869950d210b",
|
||
|
|
"indicator--563b1b02-0320-48c9-9174-b869950d210b",
|
||
|
|
"indicator--563b1b02-7d54-4431-bbfe-b869950d210b",
|
||
|
|
"observed-data--563b1b02-8118-42de-b766-b869950d210b",
|
||
|
|
"url--563b1b02-8118-42de-b766-b869950d210b",
|
||
|
|
"indicator--563b1b03-34ec-4690-947f-b869950d210b",
|
||
|
|
"indicator--563b1b03-389c-4593-8a9d-b869950d210b",
|
||
|
|
"observed-data--563b1b04-68b4-4c1f-8c5d-b869950d210b",
|
||
|
|
"url--563b1b04-68b4-4c1f-8c5d-b869950d210b",
|
||
|
|
"indicator--563b1b04-4d5c-4101-b1e6-b869950d210b",
|
||
|
|
"indicator--563b1b04-45b4-491d-a84a-b869950d210b",
|
||
|
|
"observed-data--563b1b05-e7e4-476e-931f-b869950d210b",
|
||
|
|
"url--563b1b05-e7e4-476e-931f-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"type:OSINT"
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b15b4-c8b0-4bc6-b2d0-9fd2950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:39:16.000Z",
|
||
|
|
"modified": "2015-11-05T08:39:16.000Z",
|
||
|
|
"first_observed": "2015-11-05T08:39:16Z",
|
||
|
|
"last_observed": "2015-11-05T08:39:16Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b15b4-c8b0-4bc6-b2d0-9fd2950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b15b4-c8b0-4bc6-b2d0-9fd2950d210b",
|
||
|
|
"value": "http://download01.norman.no/whitepapers/Cyberattack_against_Israeli_and_Palestinian_targets.pdf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15c0-2360-47b6-898f-9fd2950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:39:28.000Z",
|
||
|
|
"modified": "2015-11-05T08:39:28.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'may2008.dyndns.info']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:39:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15c1-9ec0-4178-84db-9fd2950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:39:29.000Z",
|
||
|
|
"modified": "2015-11-05T08:39:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'menu.dyndns.biz']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:39:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15c1-a4a4-4e81-9044-9fd2950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:39:29.000Z",
|
||
|
|
"modified": "2015-11-05T08:39:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'flashsoft.no-ip.biz']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:39:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15c2-4668-4b57-9cbf-9fd2950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:39:30.000Z",
|
||
|
|
"modified": "2015-11-05T08:39:30.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'monagameel.chickenkiller.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:39:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15c2-07c0-4c20-afd2-9fd2950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:39:30.000Z",
|
||
|
|
"modified": "2015-11-05T08:39:30.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'hatamaya.chickenkiller.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:39:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15c3-7e10-41e9-8f19-9fd2950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:39:31.000Z",
|
||
|
|
"modified": "2015-11-05T08:39:31.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'powerhost.zapto.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:39:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15c3-cea4-4130-9bdc-9fd2950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:39:31.000Z",
|
||
|
|
"modified": "2015-11-05T08:39:31.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'helpme.no-ip.biz']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:39:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15c3-3f94-4452-980e-9fd2950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:39:31.000Z",
|
||
|
|
"modified": "2015-11-05T08:39:31.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'mjed10.no-ip.info']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:39:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15c4-0484-4857-8a04-9fd2950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:39:32.000Z",
|
||
|
|
"modified": "2015-11-05T08:39:32.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'good.zapto.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:39:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15c4-7124-4d5f-9c73-9fd2950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:39:32.000Z",
|
||
|
|
"modified": "2015-11-05T08:39:32.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'hint.zapto.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:39:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15c5-5f38-438c-892b-9fd2950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:39:33.000Z",
|
||
|
|
"modified": "2015-11-05T08:39:33.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'hint1.zapto.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:39:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15c5-0e8c-4a42-9c74-9fd2950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:39:33.000Z",
|
||
|
|
"modified": "2015-11-05T08:39:33.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'natco1.no-ip.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:39:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15c5-977c-451d-a18b-9fd2950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:39:33.000Z",
|
||
|
|
"modified": "2015-11-05T08:39:33.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'natco2.no-ip.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:39:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15c6-8ea4-4f74-ad00-9fd2950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:39:34.000Z",
|
||
|
|
"modified": "2015-11-05T08:39:34.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'natco3.no-ip.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:39:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15c6-6cd4-49ba-834e-9fd2950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:39:34.000Z",
|
||
|
|
"modified": "2015-11-05T08:39:34.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'natco4.no-ip.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:39:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15c7-dd7c-44c4-abba-9fd2950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:39:35.000Z",
|
||
|
|
"modified": "2015-11-05T08:39:35.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'loading.myftp.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:39:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15c7-e820-4b51-aaf1-9fd2950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:39:35.000Z",
|
||
|
|
"modified": "2015-11-05T08:39:35.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'skype.servemp3.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:39:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15c7-4a1c-4e37-968e-9fd2950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:39:35.000Z",
|
||
|
|
"modified": "2015-11-05T08:39:35.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'test.cable-modem.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:39:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15c8-9b50-4bcc-a356-9fd2950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:39:36.000Z",
|
||
|
|
"modified": "2015-11-05T08:39:36.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'idf.blogsite.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:39:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15c8-8e1c-4d29-abf0-9fd2950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:39:36.000Z",
|
||
|
|
"modified": "2015-11-05T08:39:36.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'javaupdate.no-ip.info']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:39:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15c9-1660-4751-a73b-9fd2950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:39:37.000Z",
|
||
|
|
"modified": "2015-11-05T08:39:37.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'lokia.mine.nu']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:39:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15c9-89a8-4dd3-8809-9fd2950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:39:37.000Z",
|
||
|
|
"modified": "2015-11-05T08:39:37.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'www.hint-sms.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:39:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15c9-f434-4885-b311-9fd2950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:39:37.000Z",
|
||
|
|
"modified": "2015-11-05T08:39:37.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'owner.no-ip.biz']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:39:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15ca-37dc-40c9-8065-9fd2950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:39:38.000Z",
|
||
|
|
"modified": "2015-11-05T08:39:38.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'remoteback.no-ip.biz']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:39:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15ca-e748-4930-9bbb-9fd2950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:39:38.000Z",
|
||
|
|
"modified": "2015-11-05T08:39:38.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'ramadi.no-ip.biz']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:39:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15f2-f724-439b-980f-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:18.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:18.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'a5de87646ee943cd1f448a67fdbe2817']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15f2-3590-4023-a5c5-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:18.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:18.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'f982401e46864f640bcaedc200319109']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15f3-3270-403c-ab2d-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:19.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:19.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ec5b360f5ff6251a08a14a2e95c4caa4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15f4-2c14-4ef0-a3d3-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:20.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:20.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '97576fa7a236679dbe3abe1a4e852026']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15f5-e114-4aa1-9919-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:20.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:20.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c1ec435e97a4a4c5585392d738b5879f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15f5-79b4-4327-8331-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:21.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:21.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '2559fe4eb88561138ce292df5d0e099f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15f6-f34c-43cd-abc4-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:22.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:22.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0abf3fa976372cbc8bf33162795e42a8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15f6-6f20-4192-9aca-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:22.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:22.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0b3b1e2e22c548d8f53c2aa338abd66e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15f7-7000-4986-90df-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:23.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:23.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0aa7b256d2dcc8bd3914f895b134b225']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15f7-7764-4b85-a353-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:23.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:23.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ff8e19ca8a224cc843bf0f2f74a3274e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15f7-aa38-427d-9334-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:23.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:23.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '7c5272f3f24acb225270dded72cfc1d4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15f8-9c18-42b6-a372-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:24.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:24.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '8aeaa0c81a36449ec9613ca846e196f2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15f9-28e4-4c71-9b9d-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:25.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:25.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '2aad951dbecb6d4715b306b337ca5c34']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15f9-9ce0-4857-a5af-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:25.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:25.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '926235fcf7b91442a405b5760a0729eb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15fa-aa00-479c-9dd9-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:26.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:26.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '963bfae19b3da5bece081dff1d1e3ef9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15fa-546c-42e4-9d85-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:26.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:26.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ebc9bdf9fdf0a9773899d96d24ac46f4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15fb-8d18-41e3-8f93-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:27.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:27.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '998f30457bc48a1a6567203e0ec3282e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15fb-d6cc-4bc6-b53b-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:27.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:27.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '31f96add841594d35e6e97376114e756']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15fc-8ebc-4eb8-a6df-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:28.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:28.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '6e416c45a833f959a63785892042595a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15fc-ae10-43b7-afe0-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:28.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:28.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0dc102cfb87c937eeffe01a06f94e229']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15fc-1434-4606-b141-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:28.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:28.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'b7df947b4a67a884c751840f83c4405e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15fd-8ef0-45b4-a94a-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:29.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:29.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '2eb1503751a7c74890096b1837c7bd81']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15fd-eaa0-498e-8095-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:29.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:29.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c21d7165b25caf65d7f92ff758c1b5b1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15fe-296c-4c03-919d-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:30.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:30.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0a67f9cc30083afb7e1f8295ae152bb6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15fe-d0bc-455c-aff2-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:30.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:30.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'e9823b61e6ce999387de821dfbf6e741']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b15ff-03e8-4c13-b753-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:31.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:31.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ed53831468ddf4220e1dc3c3398f7f39']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1600-3b4c-4103-afa6-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:32.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:32.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '66ddf27517985a75b2317231b46a6f62']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1600-5108-4d97-ba80-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:32.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:32.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '86be5f0d2303fb4a8a8e297a53ac0026']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1601-557c-44ae-9205-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:33.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:33.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd14e0a3d408065b1551f2827b50b83ca']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1601-46b8-4b0b-948a-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:33.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:33.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'b6c8a6d6c35428779c5c65c1b273eba0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1601-45b0-4d33-bd09-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:33.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:33.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c03b5985f2504939da9874246a439e25']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1602-5458-4366-8185-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:34.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:34.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '216689b2ca82f16a0cab3a2712c27da6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1603-8920-49a7-9fe3-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:35.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:35.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9c39d6f52e1e1be5ae61bab90971d054']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1603-b63c-4e40-b7c4-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:35.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:35.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'e7e05001a294ebfe8a012dd3bce78e96']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1604-b330-4d51-b942-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:36.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:36.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'may2008.dyndns.biz']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1604-f5f0-4022-9594-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:36.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:36.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'f68f85b0fbca450f0d5c8828063ad30d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1604-f08c-4379-926b-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:36.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:36.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '3da8c22f5340850ee5a2c25b1d17fc27']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1605-3f30-4201-bcab-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:37.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:37.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9d144a828f757a90b86976ef0c906b3f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1605-3128-4a51-9b87-be64950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T08:40:37.000Z",
|
||
|
|
"modified": "2015-11-05T08:40:37.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'dbe2ac744a3947b6306e13ebccb718bf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T08:40:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1ada-c798-4939-8778-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:14.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:14.000Z",
|
||
|
|
"description": "- Xchecked via VT: dbe2ac744a3947b6306e13ebccb718bf",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f5918a9630c33acf4d439e6e885c4a5179ad81ab64f2d2aff0914342246c107b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1ada-a254-4db7-9473-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:14.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:14.000Z",
|
||
|
|
"description": "- Xchecked via VT: dbe2ac744a3947b6306e13ebccb718bf",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '19bbb3e3a421d98914cb92c973bca9046c5eff25']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1adb-17ac-4d35-835a-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:15.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:15.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:15Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:15Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1adb-17ac-4d35-835a-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1adb-17ac-4d35-835a-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/f5918a9630c33acf4d439e6e885c4a5179ad81ab64f2d2aff0914342246c107b/analysis/1438015718/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1adb-ae1c-46a7-aa16-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:15.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:15.000Z",
|
||
|
|
"description": "- Xchecked via VT: 9d144a828f757a90b86976ef0c906b3f",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1ffa2c9f545a00a943b32c4fd0543bbdd425db063cf6d656f349337385a27ab6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1adc-cd50-4843-b559-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:16.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:16.000Z",
|
||
|
|
"description": "- Xchecked via VT: 9d144a828f757a90b86976ef0c906b3f",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '3d874e5c27525866294e3e21ba7182e7cb6e6973']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1adc-9ee4-4caa-87bc-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:16.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:16.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:16Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:16Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1adc-9ee4-4caa-87bc-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1adc-9ee4-4caa-87bc-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/1ffa2c9f545a00a943b32c4fd0543bbdd425db063cf6d656f349337385a27ab6/analysis/1438015286/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1adc-3de8-4365-bb47-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:16.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:16.000Z",
|
||
|
|
"description": "- Xchecked via VT: 3da8c22f5340850ee5a2c25b1d17fc27",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '67fb455c5dd6784c601fa9be8899fd0b4853980cf882452076092c38fc56a73f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1add-2e18-4000-be06-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:17.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:17.000Z",
|
||
|
|
"description": "- Xchecked via VT: 3da8c22f5340850ee5a2c25b1d17fc27",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '1bad17eb71ed06f1899300d73ece73f2509850eb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1add-9f38-4354-95a9-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:17.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:17.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:17Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:17Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1add-9f38-4354-95a9-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1add-9f38-4354-95a9-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/67fb455c5dd6784c601fa9be8899fd0b4853980cf882452076092c38fc56a73f/analysis/1349248621/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1add-66d0-4b0b-9dfb-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:17.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:17.000Z",
|
||
|
|
"description": "- Xchecked via VT: f68f85b0fbca450f0d5c8828063ad30d",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c48497a94e74a5ba1a32a66fcbd6e088bce3c06aa196e7858535908d0aacc28c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1ade-d908-42f7-b797-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:18.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:18.000Z",
|
||
|
|
"description": "- Xchecked via VT: f68f85b0fbca450f0d5c8828063ad30d",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '2cbd714a36dd418c3b15748a84872fb57c69b076']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1ade-6804-4d98-b2b5-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:18.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:18.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:18Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:18Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1ade-6804-4d98-b2b5-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1ade-6804-4d98-b2b5-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/c48497a94e74a5ba1a32a66fcbd6e088bce3c06aa196e7858535908d0aacc28c/analysis/1349574886/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1adf-5bb8-4d97-97e0-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:19.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:19.000Z",
|
||
|
|
"description": "- Xchecked via VT: e7e05001a294ebfe8a012dd3bce78e96",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '627830a7de627907b77f541160c9116a325cbeef916663ce318b44c0f79efba9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1adf-831c-44f7-a359-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:19.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:19.000Z",
|
||
|
|
"description": "- Xchecked via VT: e7e05001a294ebfe8a012dd3bce78e96",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '2369c434e37be58506063abd6aad9321fac8edda']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1adf-a750-4d11-a3af-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:19.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:19.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:19Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:19Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1adf-a750-4d11-a3af-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1adf-a750-4d11-a3af-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/627830a7de627907b77f541160c9116a325cbeef916663ce318b44c0f79efba9/analysis/1377603064/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1ae0-b984-4fba-8cb5-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:20.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:20.000Z",
|
||
|
|
"description": "- Xchecked via VT: 9c39d6f52e1e1be5ae61bab90971d054",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f6160f1a9d13f2d49e9edc0136f53e0a9a9c06fe990cdd47a07837711c86e7e3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1ae0-c1a0-4da2-a752-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:20.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:20.000Z",
|
||
|
|
"description": "- Xchecked via VT: 9c39d6f52e1e1be5ae61bab90971d054",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'dd75283b6a0507bab2ab1bcb7f21810350932a48']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1ae1-89c0-44f3-929d-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:21.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:21.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:21Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:21Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1ae1-89c0-44f3-929d-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1ae1-89c0-44f3-929d-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/f6160f1a9d13f2d49e9edc0136f53e0a9a9c06fe990cdd47a07837711c86e7e3/analysis/1352777644/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1ae1-f3d4-4db2-830d-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:21.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:21.000Z",
|
||
|
|
"description": "- Xchecked via VT: 216689b2ca82f16a0cab3a2712c27da6",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f3a5ab3eea8ee90b4e9ef2bdfe104f0e873844170d5357d56a7512bd1fcbd6da']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1ae1-8940-48b3-b2aa-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:21.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:21.000Z",
|
||
|
|
"description": "- Xchecked via VT: 216689b2ca82f16a0cab3a2712c27da6",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '2dab1d843cdd802deb8a1f504e45cb896b3d7c0f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1ae2-da7c-4c8f-82c8-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:22.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:22.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:22Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:22Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1ae2-da7c-4c8f-82c8-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1ae2-da7c-4c8f-82c8-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/f3a5ab3eea8ee90b4e9ef2bdfe104f0e873844170d5357d56a7512bd1fcbd6da/analysis/1352777561/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1ae2-09e4-42b2-979f-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:22.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:22.000Z",
|
||
|
|
"description": "- Xchecked via VT: c03b5985f2504939da9874246a439e25",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '97ed0ccd1d1446130df5b0ed9b4889d78ce0e1b38e08f50e4f6acade36a9affd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1ae3-8cfc-45a6-99ff-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:23.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:23.000Z",
|
||
|
|
"description": "- Xchecked via VT: c03b5985f2504939da9874246a439e25",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'ea31814ad3fc1066e90e9cefd47d433a0304e1cf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1ae3-9bbc-45c8-8fca-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:23.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:23.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:23Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:23Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1ae3-9bbc-45c8-8fca-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1ae3-9bbc-45c8-8fca-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/97ed0ccd1d1446130df5b0ed9b4889d78ce0e1b38e08f50e4f6acade36a9affd/analysis/1359054659/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1ae3-7f24-4784-bfbe-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:23.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:23.000Z",
|
||
|
|
"description": "- Xchecked via VT: b6c8a6d6c35428779c5c65c1b273eba0",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7ccfba8c9718cf363f197f2bc02bd8debb382330dd0486a3ec654c8559dbc4fe']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1ae4-5528-4a1f-825e-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:24.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:24.000Z",
|
||
|
|
"description": "- Xchecked via VT: b6c8a6d6c35428779c5c65c1b273eba0",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '6e900cee8876f9df6119786fd17e4ab2b288b6ca']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1ae4-f0f8-43d6-b95d-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:24.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:24.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:24Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:24Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1ae4-f0f8-43d6-b95d-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1ae4-f0f8-43d6-b95d-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/7ccfba8c9718cf363f197f2bc02bd8debb382330dd0486a3ec654c8559dbc4fe/analysis/1346756407/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1ae4-f944-47c9-920d-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:24.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:24.000Z",
|
||
|
|
"description": "- Xchecked via VT: d14e0a3d408065b1551f2827b50b83ca",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0d13ca67a6a47678064ac11ccec2c4f86233dc75fbe15d2286bf8b7ec3172a4b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1ae5-46b8-425a-a0d8-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:25.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:25.000Z",
|
||
|
|
"description": "- Xchecked via VT: d14e0a3d408065b1551f2827b50b83ca",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '9deee5f984b0f0c9c5e0dc83909acf77f50d671e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1ae5-c888-4ab9-a819-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:25.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:25.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:25Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:25Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1ae5-c888-4ab9-a819-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1ae5-c888-4ab9-a819-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/0d13ca67a6a47678064ac11ccec2c4f86233dc75fbe15d2286bf8b7ec3172a4b/analysis/1377105403/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1ae6-5958-4129-8124-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:26.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:26.000Z",
|
||
|
|
"description": "- Xchecked via VT: 86be5f0d2303fb4a8a8e297a53ac0026",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd6d9f3fcbd00b474e56b78443f713262cd077c0d5bccbce1cedcfd27168c3514']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1ae6-5cf4-47e4-89bc-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:26.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:26.000Z",
|
||
|
|
"description": "- Xchecked via VT: 86be5f0d2303fb4a8a8e297a53ac0026",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'd0e6b2d57b32cdcf688fdb33928022cfc938cf6c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1ae6-30e0-4f28-9516-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:26.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:26.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:26Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:26Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1ae6-30e0-4f28-9516-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1ae6-30e0-4f28-9516-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/d6d9f3fcbd00b474e56b78443f713262cd077c0d5bccbce1cedcfd27168c3514/analysis/1352777573/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1ae7-fbec-4849-89f8-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:27.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:27.000Z",
|
||
|
|
"description": "- Xchecked via VT: 66ddf27517985a75b2317231b46a6f62",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '74719d1c853c91c36fabff6259f09fc3dc0fac60fdd696c4c3a339593e6788d7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1ae7-a28c-4942-b8fb-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:27.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:27.000Z",
|
||
|
|
"description": "- Xchecked via VT: 66ddf27517985a75b2317231b46a6f62",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '6bf5659179c3120641b91d1cbb17c8f82cad989c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1ae8-afe4-4b09-99ee-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:28.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:28.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:28Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:28Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1ae8-afe4-4b09-99ee-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1ae8-afe4-4b09-99ee-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/74719d1c853c91c36fabff6259f09fc3dc0fac60fdd696c4c3a339593e6788d7/analysis/1358352686/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1ae8-f1f8-480d-9ce4-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:28.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:28.000Z",
|
||
|
|
"description": "- Xchecked via VT: ed53831468ddf4220e1dc3c3398f7f39",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '128ea8ed3c15df077756656c7331bbbacda9bc718aa9734d0995c461d915ef5e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1ae8-2000-4077-966b-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:28.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:28.000Z",
|
||
|
|
"description": "- Xchecked via VT: ed53831468ddf4220e1dc3c3398f7f39",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f98c9e57dd9a2fcf3795e15024fc2ae079c67a56']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1ae9-b460-490f-a919-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:29.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:29.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:29Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:29Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1ae9-b460-490f-a919-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1ae9-b460-490f-a919-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/128ea8ed3c15df077756656c7331bbbacda9bc718aa9734d0995c461d915ef5e/analysis/1366558045/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1ae9-ffd4-48a3-84ad-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:29.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:29.000Z",
|
||
|
|
"description": "- Xchecked via VT: 0a67f9cc30083afb7e1f8295ae152bb6",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd0d3fbd639551970b93b4fb2532593bc94097b72fd1fc730b3ab900afdfca9b2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1aea-8a04-4255-897f-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:30.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:30.000Z",
|
||
|
|
"description": "- Xchecked via VT: 0a67f9cc30083afb7e1f8295ae152bb6",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '1353b4e1a61cb22c5f4c6933ceb8c2a2de58608f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1aea-6870-49d9-92f5-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:30.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:30.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:30Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:30Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1aea-6870-49d9-92f5-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1aea-6870-49d9-92f5-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/d0d3fbd639551970b93b4fb2532593bc94097b72fd1fc730b3ab900afdfca9b2/analysis/1352777630/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1aea-b6d4-40d4-a885-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:30.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:30.000Z",
|
||
|
|
"description": "- Xchecked via VT: c21d7165b25caf65d7f92ff758c1b5b1",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1a5a7b9084815f86fd91e9f3a829c3c929ffa1d6d3b4a038064472aa6ff5baad']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1aeb-9124-4c7c-a53b-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:31.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:31.000Z",
|
||
|
|
"description": "- Xchecked via VT: c21d7165b25caf65d7f92ff758c1b5b1",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '966524e1c6efd9817b74d77fef8a9435bb5212ce']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1aeb-87a4-420a-83bd-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:31.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:31.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:31Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:31Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1aeb-87a4-420a-83bd-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1aeb-87a4-420a-83bd-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/1a5a7b9084815f86fd91e9f3a829c3c929ffa1d6d3b4a038064472aa6ff5baad/analysis/1352777696/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1aeb-b310-41b9-906a-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:31.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:31.000Z",
|
||
|
|
"description": "- Xchecked via VT: 2eb1503751a7c74890096b1837c7bd81",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5b7afb0d44a2b5d1a286a74ed95f9e43435f3f309d6461c6263494ade0c62a79']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1aec-1960-42d8-8452-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:32.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:32.000Z",
|
||
|
|
"description": "- Xchecked via VT: 2eb1503751a7c74890096b1837c7bd81",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '540e975884cbb673a8d45f73cd5f26ebd0837e0c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1aec-5b54-4910-b4d4-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:32.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:32.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:32Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:32Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1aec-5b54-4910-b4d4-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1aec-5b54-4910-b4d4-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/5b7afb0d44a2b5d1a286a74ed95f9e43435f3f309d6461c6263494ade0c62a79/analysis/1376140603/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1aed-5fa8-4ae8-8968-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:33.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:33.000Z",
|
||
|
|
"description": "- Xchecked via VT: b7df947b4a67a884c751840f83c4405e",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b916c6ef593dd9fd70a7ad6a039942bae89beb23fa0c45b7cc65ed996b09606e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1aed-0dd4-4894-80a4-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:33.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:33.000Z",
|
||
|
|
"description": "- Xchecked via VT: b7df947b4a67a884c751840f83c4405e",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '6a1bd6ced824ff5e4f11b47aca2381c3f3c4ec64']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1aed-47b8-4a59-8228-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:33.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:33.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:33Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:33Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1aed-47b8-4a59-8228-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1aed-47b8-4a59-8228-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/b916c6ef593dd9fd70a7ad6a039942bae89beb23fa0c45b7cc65ed996b09606e/analysis/1376102081/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1aee-0060-4de1-8fb6-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:34.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:34.000Z",
|
||
|
|
"description": "- Xchecked via VT: 0dc102cfb87c937eeffe01a06f94e229",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7cdfafa991034193bd8cfa9cbdede21b6929904bfc9133d2d96a63e549f90ba2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1aee-e450-46ca-ae6f-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:34.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:34.000Z",
|
||
|
|
"description": "- Xchecked via VT: 0dc102cfb87c937eeffe01a06f94e229",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '02862a4991a0b7959fe0c7e122ddb4641d22f5d4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1aef-ea54-4e60-885d-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:35.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:35.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:35Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:35Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1aef-ea54-4e60-885d-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1aef-ea54-4e60-885d-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/7cdfafa991034193bd8cfa9cbdede21b6929904bfc9133d2d96a63e549f90ba2/analysis/1364696385/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1aef-8730-4a7f-a94b-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:35.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:35.000Z",
|
||
|
|
"description": "- Xchecked via VT: 6e416c45a833f959a63785892042595a",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7ab8b6bb07d49cfa382582c27761521994c5bd47c21091c51629c0923b21c03b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1aef-f8b0-4603-864c-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:35.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:35.000Z",
|
||
|
|
"description": "- Xchecked via VT: 6e416c45a833f959a63785892042595a",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '1326f04e1f4be44e9cf3406c9cb77e80df09ba27']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1af0-bccc-43ec-86d7-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:36.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:36.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:36Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:36Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1af0-bccc-43ec-86d7-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1af0-bccc-43ec-86d7-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/7ab8b6bb07d49cfa382582c27761521994c5bd47c21091c51629c0923b21c03b/analysis/1338623388/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1af0-ac08-47e6-aed9-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:36.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:36.000Z",
|
||
|
|
"description": "- Xchecked via VT: 31f96add841594d35e6e97376114e756",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd5aa6d4413a7b941cc5163b8d54c9ce24e55dc3ac8c314b95dc66a5711af68b2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1af1-4a7c-44db-a75f-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:37.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:37.000Z",
|
||
|
|
"description": "- Xchecked via VT: 31f96add841594d35e6e97376114e756",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '82b485f10c49a186718aba5e691a2384154e847c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1af1-3e64-4697-bea4-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:37.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:37.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:37Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:37Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1af1-3e64-4697-bea4-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1af1-3e64-4697-bea4-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/d5aa6d4413a7b941cc5163b8d54c9ce24e55dc3ac8c314b95dc66a5711af68b2/analysis/1375920988/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1af1-6b60-4154-b8c3-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:37.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:37.000Z",
|
||
|
|
"description": "- Xchecked via VT: 998f30457bc48a1a6567203e0ec3282e",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3fbdb7517da43abd6eb17cd5716094d9f4de6bb27c908482c44949389b0fa057']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1af2-5070-4f4f-9fc6-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:38.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:38.000Z",
|
||
|
|
"description": "- Xchecked via VT: 998f30457bc48a1a6567203e0ec3282e",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '02ca5177400264a511bac1e52f0e2a4d2a5077da']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1af2-4630-4951-9374-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:38.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:38.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:38Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:38Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1af2-4630-4951-9374-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1af2-4630-4951-9374-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/3fbdb7517da43abd6eb17cd5716094d9f4de6bb27c908482c44949389b0fa057/analysis/1375912018/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1af2-0040-4c64-b298-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:38.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:38.000Z",
|
||
|
|
"description": "- Xchecked via VT: ebc9bdf9fdf0a9773899d96d24ac46f4",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '882b9fc7a0fc323257f070eeef2480f2684c39cdabd8a07b464e441f2141b8d6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1af3-be8c-4870-9f3c-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:39.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:39.000Z",
|
||
|
|
"description": "- Xchecked via VT: ebc9bdf9fdf0a9773899d96d24ac46f4",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '90b54620e519018bdd5b35804f9efc36bf598739']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1af3-04b0-4f57-bd0a-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:39.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:39.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:39Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:39Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1af3-04b0-4f57-bd0a-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1af3-04b0-4f57-bd0a-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/882b9fc7a0fc323257f070eeef2480f2684c39cdabd8a07b464e441f2141b8d6/analysis/1338914828/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1af4-9ca0-4fa2-a389-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:40.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:40.000Z",
|
||
|
|
"description": "- Xchecked via VT: 963bfae19b3da5bece081dff1d1e3ef9",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '02ae3920fd44b23de45db38a9f24cf312e0826c6249cd54b3043a534a15434da']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1af4-9c70-433c-af14-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:40.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:40.000Z",
|
||
|
|
"description": "- Xchecked via VT: 963bfae19b3da5bece081dff1d1e3ef9",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'd2bb8b199b239c4902d7bcd7ed6eedc39b5ffb19']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1af4-ef0c-4643-adff-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:40.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:40.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:40Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:40Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1af4-ef0c-4643-adff-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1af4-ef0c-4643-adff-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/02ae3920fd44b23de45db38a9f24cf312e0826c6249cd54b3043a534a15434da/analysis/1365473191/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1af5-c9f8-44af-969a-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:41.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:41.000Z",
|
||
|
|
"description": "- Xchecked via VT: 926235fcf7b91442a405b5760a0729eb",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '11579b7905eafbd4ae7709bfaf880a2442ad37257ebccedd1c6675b6ac45bb0a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1af5-58dc-43c6-b3a4-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:41.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:41.000Z",
|
||
|
|
"description": "- Xchecked via VT: 926235fcf7b91442a405b5760a0729eb",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'e36330f8eb7e99e70360b6ed0d658d72fa2a1b10']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1af6-8568-4027-a901-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:42.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:42.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:42Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:42Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1af6-8568-4027-a901-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1af6-8568-4027-a901-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/11579b7905eafbd4ae7709bfaf880a2442ad37257ebccedd1c6675b6ac45bb0a/analysis/1376346194/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1af6-6608-4dbe-895a-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:42.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:42.000Z",
|
||
|
|
"description": "- Xchecked via VT: 2aad951dbecb6d4715b306b337ca5c34",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3da0f277ad2396e717b2ddbd01264fb614af0a78b69973186f853f974b1c39ad']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1af6-cce0-402a-bad8-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:42.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:42.000Z",
|
||
|
|
"description": "- Xchecked via VT: 2aad951dbecb6d4715b306b337ca5c34",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '07677cd3ef658b4081b89235f166c8a9ca9ba6eb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1af7-787c-4077-ab69-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:43.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:43.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:43Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:43Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1af7-787c-4077-ab69-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1af7-787c-4077-ab69-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/3da0f277ad2396e717b2ddbd01264fb614af0a78b69973186f853f974b1c39ad/analysis/1425712719/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1af7-d220-488e-9692-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:43.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:43.000Z",
|
||
|
|
"description": "- Xchecked via VT: 8aeaa0c81a36449ec9613ca846e196f2",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0f7a632c34ddab36e8d69c90a2950680538c792dce288453ee27e41bdb08dae0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1af7-5c2c-4ef3-a9cb-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:43.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:43.000Z",
|
||
|
|
"description": "- Xchecked via VT: 8aeaa0c81a36449ec9613ca846e196f2",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '00e8fc27008d0c09a06a34307bb8bbe4cf5b8454']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1af8-c800-4942-ae88-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:44.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:44.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:44Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:44Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1af8-c800-4942-ae88-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1af8-c800-4942-ae88-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/0f7a632c34ddab36e8d69c90a2950680538c792dce288453ee27e41bdb08dae0/analysis/1325277707/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1af8-47a8-48fc-8bbe-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:44.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:44.000Z",
|
||
|
|
"description": "- Xchecked via VT: 7c5272f3f24acb225270dded72cfc1d4",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ecfda0248acb237388ba1a1ecc7edfa60739ba16a4a9c7ae6a9a7e7a5d0b5d10']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1af9-14cc-4756-95e9-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:45.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:45.000Z",
|
||
|
|
"description": "- Xchecked via VT: 7c5272f3f24acb225270dded72cfc1d4",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '3bffb787f217a6eacbc419f728ecfd988d329c11']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1af9-972c-4778-9f4a-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:45.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:45.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:45Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:45Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1af9-972c-4778-9f4a-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1af9-972c-4778-9f4a-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/ecfda0248acb237388ba1a1ecc7edfa60739ba16a4a9c7ae6a9a7e7a5d0b5d10/analysis/1376267511/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1af9-6280-4c48-8802-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:45.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:45.000Z",
|
||
|
|
"description": "- Xchecked via VT: ff8e19ca8a224cc843bf0f2f74a3274e",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '07083569a636694f9fbc7af26875c7c93cb705f136320c8c072e78f7d03bc6e7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1afa-a198-4f1b-bc19-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:46.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:46.000Z",
|
||
|
|
"description": "- Xchecked via VT: ff8e19ca8a224cc843bf0f2f74a3274e",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '59a7034e7417640bb1d4c740d26e1a54ef1400c1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1afa-3a50-420f-be17-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:46.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:46.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:46Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:46Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1afa-3a50-420f-be17-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1afa-3a50-420f-be17-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/07083569a636694f9fbc7af26875c7c93cb705f136320c8c072e78f7d03bc6e7/analysis/1325272129/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1afb-977c-404c-a193-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:47.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:47.000Z",
|
||
|
|
"description": "- Xchecked via VT: 0aa7b256d2dcc8bd3914f895b134b225",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5b1af5c49d34c59849bc5551d01eb99a84af629cb0635f5a16f00c10c65dbf98']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1afb-39e8-4d3c-9a2d-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:47.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:47.000Z",
|
||
|
|
"description": "- Xchecked via VT: 0aa7b256d2dcc8bd3914f895b134b225",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '826661ce6506c12d0532c50d9fe87524751d801d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1afb-7c78-48c4-a39b-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:47.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:47.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:47Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:47Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1afb-7c78-48c4-a39b-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1afb-7c78-48c4-a39b-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/5b1af5c49d34c59849bc5551d01eb99a84af629cb0635f5a16f00c10c65dbf98/analysis/1389777611/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1afc-7dfc-44d8-b589-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:48.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:48.000Z",
|
||
|
|
"description": "- Xchecked via VT: 0b3b1e2e22c548d8f53c2aa338abd66e",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'fef9b4a08de7680446349d5732a7cf4d568942ed36d3a7b2c950c8ad618ed286']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1afc-a8f0-4ea0-96be-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:48.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:48.000Z",
|
||
|
|
"description": "- Xchecked via VT: 0b3b1e2e22c548d8f53c2aa338abd66e",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a4d04bd40527c0a04b1dcf3ae2d4ebae342fab4c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1afd-6604-4ffc-8540-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:49.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:49.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:49Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:49Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1afd-6604-4ffc-8540-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1afd-6604-4ffc-8540-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/fef9b4a08de7680446349d5732a7cf4d568942ed36d3a7b2c950c8ad618ed286/analysis/1317853983/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1afd-16d0-42eb-b3cc-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:49.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:49.000Z",
|
||
|
|
"description": "- Xchecked via VT: 0abf3fa976372cbc8bf33162795e42a8",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '01858e0deeba46b3966117ab82509880a58e8637ed5da22931959c482acbee05']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1afd-42f0-448a-b4d8-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:49.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:49.000Z",
|
||
|
|
"description": "- Xchecked via VT: 0abf3fa976372cbc8bf33162795e42a8",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c7a4d5ae1f549d77df5d7c97ba68673d2d2a650b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1afe-6a1c-40bc-b5d1-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:50.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:50.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:50Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:50Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1afe-6a1c-40bc-b5d1-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1afe-6a1c-40bc-b5d1-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/01858e0deeba46b3966117ab82509880a58e8637ed5da22931959c482acbee05/analysis/1322690136/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1afe-b198-44ed-946b-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:50.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:50.000Z",
|
||
|
|
"description": "- Xchecked via VT: 2559fe4eb88561138ce292df5d0e099f",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'aa6667563a750fb58cf6e79a98da6b1e3e43c2d81af389a23ccfb0ea74d74a2f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1afe-aeac-496f-ad65-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:50.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:50.000Z",
|
||
|
|
"description": "- Xchecked via VT: 2559fe4eb88561138ce292df5d0e099f",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '945549dc5ae311285c358cf6be132e30a84bc64c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1aff-03d0-4cb6-9270-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:51.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:51.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:51Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:51Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1aff-03d0-4cb6-9270-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1aff-03d0-4cb6-9270-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/aa6667563a750fb58cf6e79a98da6b1e3e43c2d81af389a23ccfb0ea74d74a2f/analysis/1374447186/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1aff-7304-4759-a502-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:51.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:51.000Z",
|
||
|
|
"description": "- Xchecked via VT: c1ec435e97a4a4c5585392d738b5879f",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e5d4188e887f8ac9009f024d6c858a1754cd3264bc5a03e498821b8a8a71aaaa']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1b00-feec-44f8-8de2-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:52.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:52.000Z",
|
||
|
|
"description": "- Xchecked via VT: c1ec435e97a4a4c5585392d738b5879f",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '4343e2173eeb511e36f4b5b857cb2083855d7c23']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1b00-ab28-4001-81ab-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:52.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:52.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:52Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:52Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1b00-ab28-4001-81ab-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1b00-ab28-4001-81ab-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/e5d4188e887f8ac9009f024d6c858a1754cd3264bc5a03e498821b8a8a71aaaa/analysis/1352996790/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1b00-3748-4fee-84ea-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:52.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:52.000Z",
|
||
|
|
"description": "- Xchecked via VT: 97576fa7a236679dbe3abe1a4e852026",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'dc8ebbec5bd6c01c2665f66e4df7fbafc0572608869c768d9e8653bd99974cda']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1b01-1130-4cc7-8812-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:53.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:53.000Z",
|
||
|
|
"description": "- Xchecked via VT: 97576fa7a236679dbe3abe1a4e852026",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '410f01060635c3aed10cc2eda9b1bd17a2771b66']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1b01-5f9c-47eb-a42a-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:53.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:53.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:53Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:53Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1b01-5f9c-47eb-a42a-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1b01-5f9c-47eb-a42a-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/dc8ebbec5bd6c01c2665f66e4df7fbafc0572608869c768d9e8653bd99974cda/analysis/1319882670/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1b02-0320-48c9-9174-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:54.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:54.000Z",
|
||
|
|
"description": "- Xchecked via VT: ec5b360f5ff6251a08a14a2e95c4caa4",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1ca4266f213da0a4cc42a8a9cb935d2e708a18537985a7fdcd767dd808706af2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1b02-7d54-4431-bbfe-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:54.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:54.000Z",
|
||
|
|
"description": "- Xchecked via VT: ec5b360f5ff6251a08a14a2e95c4caa4",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '397bec2066db8ddcfb163c4f3f640808e9e25f33']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1b02-8118-42de-b766-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:54.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:54.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:54Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:54Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1b02-8118-42de-b766-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1b02-8118-42de-b766-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/1ca4266f213da0a4cc42a8a9cb935d2e708a18537985a7fdcd767dd808706af2/analysis/1356480983/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1b03-34ec-4690-947f-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:55.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:55.000Z",
|
||
|
|
"description": "- Xchecked via VT: f982401e46864f640bcaedc200319109",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c36279c28b699ca371241cc15b7ee69f6ad8c872370df6a34e499363164441c5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1b03-389c-4593-8a9d-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:55.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:55.000Z",
|
||
|
|
"description": "- Xchecked via VT: f982401e46864f640bcaedc200319109",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f2af4f09e91f759296e10ac42edbf363bafd1044']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1b04-68b4-4c1f-8c5d-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:56.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:56.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:56Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:56Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1b04-68b4-4c1f-8c5d-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1b04-68b4-4c1f-8c5d-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/c36279c28b699ca371241cc15b7ee69f6ad8c872370df6a34e499363164441c5/analysis/1339545320/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1b04-4d5c-4101-b1e6-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:56.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:56.000Z",
|
||
|
|
"description": "- Xchecked via VT: a5de87646ee943cd1f448a67fdbe2817",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '28c0ac866e02d98a06d13095a6f2bfdfc1bb2ecd66b0df19d007bcfb79f7d7cc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--563b1b04-45b4-491d-a84a-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:56.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:56.000Z",
|
||
|
|
"description": "- Xchecked via VT: a5de87646ee943cd1f448a67fdbe2817",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'b10725928e9be38c91f994cac7ad7d42f52cc935']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-11-05T09:01:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--563b1b05-e7e4-476e-931f-b869950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-11-05T09:01:57.000Z",
|
||
|
|
"modified": "2015-11-05T09:01:57.000Z",
|
||
|
|
"first_observed": "2015-11-05T09:01:57Z",
|
||
|
|
"last_observed": "2015-11-05T09:01:57Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--563b1b05-e7e4-476e-931f-b869950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--563b1b05-e7e4-476e-931f-b869950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/28c0ac866e02d98a06d13095a6f2bfdfc1bb2ecd66b0df19d007bcfb79f7d7cc/analysis/1332599783/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|