2712 lines
113 KiB
JSON
2712 lines
113 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--566f47dd-e7d4-4b1f-9f65-764f950d210b",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:26:37.000Z",
|
||
|
|
"modified": "2015-12-15T07:26:37.000Z",
|
||
|
|
"name": "CthulhuSPRL.be",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--566f47dd-e7d4-4b1f-9f65-764f950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:26:37.000Z",
|
||
|
|
"modified": "2015-12-15T07:26:37.000Z",
|
||
|
|
"name": "OSINT The Casino Malvertising Campaign by MalwareBytes",
|
||
|
|
"published": "2015-12-14T22:55:50Z",
|
||
|
|
"object_refs": [
|
||
|
|
"observed-data--566f47f1-29cc-4ec6-9312-4a38950d210b",
|
||
|
|
"url--566f47f1-29cc-4ec6-9312-4a38950d210b",
|
||
|
|
"indicator--566f488a-0a20-4d8a-a58f-45fb950d210b",
|
||
|
|
"indicator--566f488b-855c-4a0e-bc75-43fb950d210b",
|
||
|
|
"indicator--566f488b-1b38-451d-9de6-49f7950d210b",
|
||
|
|
"indicator--566f488c-fc5c-4368-8014-4808950d210b",
|
||
|
|
"indicator--566f488c-68a8-4686-acb9-4003950d210b",
|
||
|
|
"indicator--566f488d-dc50-43a5-98e0-4396950d210b",
|
||
|
|
"indicator--566f488d-bfdc-4b7f-b01d-44db950d210b",
|
||
|
|
"indicator--566f488e-dd34-4b17-9a15-4d39950d210b",
|
||
|
|
"indicator--566f488e-69ac-4275-b10c-4bee950d210b",
|
||
|
|
"indicator--566f488f-c29c-4fd3-9bd5-4e78950d210b",
|
||
|
|
"indicator--566f488f-b954-4e37-8f45-4871950d210b",
|
||
|
|
"indicator--566f4890-b464-4d57-a5bb-4381950d210b",
|
||
|
|
"indicator--566f4890-941c-453d-9b4d-4b19950d210b",
|
||
|
|
"indicator--566f4891-1f04-4958-923e-4052950d210b",
|
||
|
|
"indicator--566f4891-62d0-4f7f-88e2-4e60950d210b",
|
||
|
|
"indicator--566f4892-9424-4aec-9b51-492f950d210b",
|
||
|
|
"indicator--566f4893-9f1c-4c42-88d7-4d68950d210b",
|
||
|
|
"indicator--566f4893-c720-4ae0-a7a6-4dab950d210b",
|
||
|
|
"indicator--566f4894-c2f0-433d-aa68-4cba950d210b",
|
||
|
|
"indicator--566f4894-c754-4da0-9d82-495a950d210b",
|
||
|
|
"indicator--566f4895-1fe0-42a2-9564-4f79950d210b",
|
||
|
|
"indicator--566f4895-1170-4e8b-a146-45d6950d210b",
|
||
|
|
"indicator--566f4896-e3bc-4692-87e7-4eec950d210b",
|
||
|
|
"indicator--566f4896-de48-4997-948d-433d950d210b",
|
||
|
|
"indicator--566f4897-5630-4655-be24-406c950d210b",
|
||
|
|
"indicator--566f4897-f210-41d1-a4ec-4ff3950d210b",
|
||
|
|
"indicator--566f4898-f9d4-42a3-a1b3-4568950d210b",
|
||
|
|
"indicator--566f4898-9f14-4606-9f00-481f950d210b",
|
||
|
|
"indicator--566f4899-04a4-43c9-b099-4355950d210b",
|
||
|
|
"indicator--566f4899-3f28-4c25-a0d1-4e08950d210b",
|
||
|
|
"indicator--566f489a-0310-4617-a7be-4fcb950d210b",
|
||
|
|
"indicator--566f489a-2034-4e62-a4c4-4f93950d210b",
|
||
|
|
"indicator--566f489b-8948-4a9a-9f42-458f950d210b",
|
||
|
|
"indicator--566f489b-f818-476e-8104-40cd950d210b",
|
||
|
|
"observed-data--566fc0cc-7098-4209-a49d-1c70950d210b",
|
||
|
|
"url--566fc0cc-7098-4209-a49d-1c70950d210b",
|
||
|
|
"indicator--566fc0cc-e364-49d6-996d-1c70950d210b",
|
||
|
|
"indicator--566fc0cd-713c-4698-88b8-1c70950d210b",
|
||
|
|
"observed-data--566fc0cd-2eb4-4a1b-9385-1c70950d210b",
|
||
|
|
"url--566fc0cd-2eb4-4a1b-9385-1c70950d210b",
|
||
|
|
"indicator--566fc0ce-311c-488b-9fb6-1c70950d210b",
|
||
|
|
"indicator--566fc0ce-3544-4fe7-893d-1c70950d210b",
|
||
|
|
"observed-data--566fc0cf-1b1c-4060-8bad-1c70950d210b",
|
||
|
|
"url--566fc0cf-1b1c-4060-8bad-1c70950d210b",
|
||
|
|
"indicator--566fc0cf-4128-4f05-841d-1c70950d210b",
|
||
|
|
"indicator--566fc0cf-7c30-42fa-b536-1c70950d210b",
|
||
|
|
"observed-data--566fc0d0-0400-44d4-bc68-1c70950d210b",
|
||
|
|
"url--566fc0d0-0400-44d4-bc68-1c70950d210b",
|
||
|
|
"indicator--566fc0d0-9104-46c3-aa75-1c70950d210b",
|
||
|
|
"indicator--566fc0d1-46d8-4911-bdc8-1c70950d210b",
|
||
|
|
"observed-data--566fc0d1-55d0-41cf-a606-1c70950d210b",
|
||
|
|
"url--566fc0d1-55d0-41cf-a606-1c70950d210b",
|
||
|
|
"indicator--566fc0d2-79fc-4750-84f3-1c70950d210b",
|
||
|
|
"indicator--566fc0d2-0cd0-48ea-95a9-1c70950d210b",
|
||
|
|
"observed-data--566fc0d2-ac74-4e27-87de-1c70950d210b",
|
||
|
|
"url--566fc0d2-ac74-4e27-87de-1c70950d210b",
|
||
|
|
"indicator--566fc0d3-628c-4f36-bde9-1c70950d210b",
|
||
|
|
"indicator--566fc0d3-a430-4ed5-b0aa-1c70950d210b",
|
||
|
|
"observed-data--566fc0d4-7ee0-40b0-bc1c-1c70950d210b",
|
||
|
|
"url--566fc0d4-7ee0-40b0-bc1c-1c70950d210b",
|
||
|
|
"indicator--566fc0d4-4630-411d-8ba4-1c70950d210b",
|
||
|
|
"indicator--566fc0d4-4830-4b47-b9b0-1c70950d210b",
|
||
|
|
"observed-data--566fc0d5-1378-4f4e-842a-1c70950d210b",
|
||
|
|
"url--566fc0d5-1378-4f4e-842a-1c70950d210b",
|
||
|
|
"indicator--566fc0d5-b300-4078-9c03-1c70950d210b",
|
||
|
|
"indicator--566fc0d6-1288-4dc8-9818-1c70950d210b",
|
||
|
|
"observed-data--566fc0d6-ebe0-45d0-ad1f-1c70950d210b",
|
||
|
|
"url--566fc0d6-ebe0-45d0-ad1f-1c70950d210b",
|
||
|
|
"indicator--566fc0d7-749c-45d1-aa8d-1c70950d210b",
|
||
|
|
"indicator--566fc0d7-fb08-415a-928f-1c70950d210b",
|
||
|
|
"observed-data--566fc0d7-01f0-4649-aaab-1c70950d210b",
|
||
|
|
"url--566fc0d7-01f0-4649-aaab-1c70950d210b",
|
||
|
|
"indicator--566fc0d8-00d8-4869-9209-1c70950d210b",
|
||
|
|
"indicator--566fc0d8-e5b8-4fac-a0ea-1c70950d210b",
|
||
|
|
"observed-data--566fc0d9-5c9c-4f02-8e06-1c70950d210b",
|
||
|
|
"url--566fc0d9-5c9c-4f02-8e06-1c70950d210b",
|
||
|
|
"indicator--566fc0d9-950c-4e85-bc5c-1c70950d210b",
|
||
|
|
"indicator--566fc0d9-eeb0-4e79-9a13-1c70950d210b",
|
||
|
|
"observed-data--566fc0da-668c-4663-9080-1c70950d210b",
|
||
|
|
"url--566fc0da-668c-4663-9080-1c70950d210b",
|
||
|
|
"indicator--566fc0da-baa0-473d-bf16-1c70950d210b",
|
||
|
|
"indicator--566fc0db-78e8-4ffc-b4a2-1c70950d210b",
|
||
|
|
"observed-data--566fc0db-0c94-4e72-9f9b-1c70950d210b",
|
||
|
|
"url--566fc0db-0c94-4e72-9f9b-1c70950d210b",
|
||
|
|
"indicator--566fc0dc-2a08-427e-bf6a-1c70950d210b",
|
||
|
|
"indicator--566fc0dc-3b30-494f-b509-1c70950d210b",
|
||
|
|
"observed-data--566fc0dc-5a30-4eb5-941b-1c70950d210b",
|
||
|
|
"url--566fc0dc-5a30-4eb5-941b-1c70950d210b",
|
||
|
|
"indicator--566fc0dd-a860-41b1-b38a-1c70950d210b",
|
||
|
|
"indicator--566fc0dd-f584-4dd0-95d8-1c70950d210b",
|
||
|
|
"observed-data--566fc0de-408c-40cd-b6d3-1c70950d210b",
|
||
|
|
"url--566fc0de-408c-40cd-b6d3-1c70950d210b",
|
||
|
|
"indicator--566fc0de-4078-490d-9e80-1c70950d210b",
|
||
|
|
"indicator--566fc0de-2e8c-46fa-80c5-1c70950d210b",
|
||
|
|
"observed-data--566fc0df-48e0-40da-a50c-1c70950d210b",
|
||
|
|
"url--566fc0df-48e0-40da-a50c-1c70950d210b",
|
||
|
|
"indicator--566fc0df-e4a0-4cdc-80bf-1c70950d210b",
|
||
|
|
"indicator--566fc0e0-5e20-4521-ab3f-1c70950d210b",
|
||
|
|
"observed-data--566fc0e0-cef4-419a-aebf-1c70950d210b",
|
||
|
|
"url--566fc0e0-cef4-419a-aebf-1c70950d210b",
|
||
|
|
"indicator--566fc0e1-2f2c-42ac-bbe6-1c70950d210b",
|
||
|
|
"indicator--566fc0e1-9760-4521-8928-1c70950d210b",
|
||
|
|
"observed-data--566fc0e1-8044-492e-b90e-1c70950d210b",
|
||
|
|
"url--566fc0e1-8044-492e-b90e-1c70950d210b",
|
||
|
|
"indicator--566fc0e2-3904-4e61-91cf-1c70950d210b",
|
||
|
|
"indicator--566fc0e2-c654-4efd-9cf0-1c70950d210b",
|
||
|
|
"observed-data--566fc0e3-b398-460c-9797-1c70950d210b",
|
||
|
|
"url--566fc0e3-b398-460c-9797-1c70950d210b",
|
||
|
|
"indicator--566fc0e3-5bcc-47a5-ab75-1c70950d210b",
|
||
|
|
"indicator--566fc0e3-bee0-46f0-b9c8-1c70950d210b",
|
||
|
|
"observed-data--566fc0e4-5cd8-4b87-a067-1c70950d210b",
|
||
|
|
"url--566fc0e4-5cd8-4b87-a067-1c70950d210b",
|
||
|
|
"indicator--566fc0e4-47c4-4afe-ad40-1c70950d210b",
|
||
|
|
"indicator--566fc0e5-4024-41de-ab5c-1c70950d210b",
|
||
|
|
"observed-data--566fc0e5-fe64-4ce2-8ec7-1c70950d210b",
|
||
|
|
"url--566fc0e5-fe64-4ce2-8ec7-1c70950d210b",
|
||
|
|
"indicator--566fc0e6-6700-4978-ac09-1c70950d210b",
|
||
|
|
"indicator--566fc0e6-9a94-4a01-9b32-1c70950d210b",
|
||
|
|
"observed-data--566fc0e6-bc0c-4633-8f21-1c70950d210b",
|
||
|
|
"url--566fc0e6-bc0c-4633-8f21-1c70950d210b",
|
||
|
|
"indicator--566fc0e7-55dc-4666-aa98-1c70950d210b",
|
||
|
|
"indicator--566fc0e7-131c-4f6c-89ef-1c70950d210b",
|
||
|
|
"observed-data--566fc0e8-2ba8-4c57-88ad-1c70950d210b",
|
||
|
|
"url--566fc0e8-2ba8-4c57-88ad-1c70950d210b",
|
||
|
|
"indicator--566fc0e8-6e04-4f94-946d-1c70950d210b",
|
||
|
|
"indicator--566fc0e8-d2a0-4488-95bd-1c70950d210b",
|
||
|
|
"observed-data--566fc0e9-9618-4e9f-bfc6-1c70950d210b",
|
||
|
|
"url--566fc0e9-9618-4e9f-bfc6-1c70950d210b",
|
||
|
|
"indicator--566fc0e9-124c-4549-9f42-1c70950d210b",
|
||
|
|
"indicator--566fc0ea-96f0-48de-962d-1c70950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"type:OSINT"
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--566f47f1-29cc-4ec6-9312-4a38950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:51:29.000Z",
|
||
|
|
"modified": "2015-12-14T22:51:29.000Z",
|
||
|
|
"first_observed": "2015-12-14T22:51:29Z",
|
||
|
|
"last_observed": "2015-12-14T22:51:29Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--566f47f1-29cc-4ec6-9312-4a38950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--566f47f1-29cc-4ec6-9312-4a38950d210b",
|
||
|
|
"value": "https://blog.malwarebytes.org/malvertising-2/2015/11/the-casino-malvertising-campaign/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f488a-0a20-4d8a-a58f-45fb950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:02.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:02.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '09068c14b877e64ec552aef9e2a3c98d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f488b-855c-4a0e-bc75-43fb950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:03.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:03.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '119926c11c5fabeef804f453fc4431e2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f488b-1b38-451d-9de6-49f7950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:03.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:03.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '164ad98019c954c416f8d1e06411a855']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f488c-fc5c-4368-8014-4808950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:04.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:04.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '182c152766107a236245734082f0df7b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f488c-68a8-4686-acb9-4003950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:04.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:04.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '1c7b71d0f962d06bf579b9cc48a1a4a8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f488d-dc50-43a5-98e0-4396950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:05.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:05.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '21220340b150468bf3925578a8028bba']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f488d-bfdc-4b7f-b01d-44db950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:05.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:05.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '24860c06a06f660b3bcc27b7d27ccbcc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f488e-dd34-4b17-9a15-4d39950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:06.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:06.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '24f839c7fe5f01cfb6b8117562804a36']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f488e-69ac-4275-b10c-4bee950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:06.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:06.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '2559e4c3cf7949d794784955edd32d36']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f488f-c29c-4fd3-9bd5-4e78950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:07.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:07.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '270b3c164c3cb893f09530e10c3f7a3f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f488f-b954-4e37-8f45-4871950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:07.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:07.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '3d58f4b2008f6d87cab9166c09e513b5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f4890-b464-4d57-a5bb-4381950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:08.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:08.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '4210d8c8c0831aac94098ba7bbb9698e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f4890-941c-453d-9b4d-4b19950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:08.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:08.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '4b4c6ef6b3097f739202f2cf5f86ba4d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f4891-1f04-4958-923e-4052950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:09.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:09.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '5608bc6a52a8268fe279f73bb4f5ccf5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f4891-62d0-4f7f-88e2-4e60950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:09.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:09.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '5dc9c2e1f9d860ab946da37fbb12c297']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f4892-9424-4aec-9b51-492f950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:10.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:10.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '6004146646d1304b9177aa6c11e31c6b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f4893-9f1c-4c42-88d7-4d68950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:11.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:11.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '6780669322b396e6d8673eef0bc772cf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f4893-c720-4ae0-a7a6-4dab950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:11.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:11.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '774f453a56918203b9401d7043eba8dc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f4894-c2f0-433d-aa68-4cba950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:12.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:12.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '78ed64467ee1d397ad58035bd715e8c1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f4894-c754-4da0-9d82-495a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:12.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:12.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '7b1c9bd5b374a91737c74a02a71edf03']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f4895-1fe0-42a2-9564-4f79950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:13.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:13.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '891a905a194ee8600bae1fac150fddc9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f4895-1170-4e8b-a146-45d6950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:13.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:13.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9c6680e3e1d81cc47939947b9facbb6e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f4896-e3bc-4692-87e7-4eec950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:14.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:14.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9cab734b59d414409fe0ec79f77c455f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f4896-de48-4997-948d-433d950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:14.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:14.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9d58bde8411f1ca97eca899579b75673']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f4897-5630-4655-be24-406c950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:15.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:15.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'b74039eb6462e41cc2c4606f1aa54004']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f4897-f210-41d1-a4ec-4ff3950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:15.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:15.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'bdfbc8ba8adddaf3ed19a075d22c6b4b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f4898-f9d4-42a3-a1b3-4568950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:16.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:16.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd0f7096e3cec91b296ccb787dbb04e2e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f4898-9f14-4606-9f00-481f950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:16.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:16.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd4a616ad7439bd766d5a44cea4946f56']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f4899-04a4-43c9-b099-4355950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:17.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:17.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'debe6c7d02ef11fd88a817e1a0816fd1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f4899-3f28-4c25-a0d1-4e08950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:17.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:17.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'e38a282372a33a66794d12ff4c255fbd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f489a-0310-4617-a7be-4fcb950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:18.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:18.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'e67b5c8ae5317ab95f254a76dae7c636']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f489a-2034-4e62-a4c4-4f93950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:18.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:18.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ed6f43fed6ba216f19fbdfddd42c33fe']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f489b-8948-4a9a-9f42-458f950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:19.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:19.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ed72d81a564d421ebd8cc9280dcf618a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566f489b-f818-476e-8104-40cd950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-14T22:54:19.000Z",
|
||
|
|
"modified": "2015-12-14T22:54:19.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '58a2ef9f1801c840b14ad67cf3678a45']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-14T22:54:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--566fc0cc-7098-4209-a49d-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:08.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:08.000Z",
|
||
|
|
"first_observed": "2015-12-15T07:27:08Z",
|
||
|
|
"last_observed": "2015-12-15T07:27:08Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--566fc0cc-7098-4209-a49d-1c70950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--566fc0cc-7098-4209-a49d-1c70950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/7e29e9e8b2662a11a25bc84dd5ddfe3f9cad6cde3ccac12968bbccae5ad4c602/analysis/1449839399/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0cc-e364-49d6-996d-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:08.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:08.000Z",
|
||
|
|
"description": "- Xchecked via VT: 09068c14b877e64ec552aef9e2a3c98d",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd639b413038a33069b2d893c80cde2f3e0569fd3c442991062e7cb850780c5cc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0cd-713c-4698-88b8-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:09.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:09.000Z",
|
||
|
|
"description": "- Xchecked via VT: 09068c14b877e64ec552aef9e2a3c98d",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'bd664ab83b55a6723b3d0fcf6d1fc5c51e22f566']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--566fc0cd-2eb4-4a1b-9385-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:09.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:09.000Z",
|
||
|
|
"first_observed": "2015-12-15T07:27:09Z",
|
||
|
|
"last_observed": "2015-12-15T07:27:09Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--566fc0cd-2eb4-4a1b-9385-1c70950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--566fc0cd-2eb4-4a1b-9385-1c70950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/d639b413038a33069b2d893c80cde2f3e0569fd3c442991062e7cb850780c5cc/analysis/1447841129/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0ce-311c-488b-9fb6-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:10.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:10.000Z",
|
||
|
|
"description": "- Xchecked via VT: 119926c11c5fabeef804f453fc4431e2",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6ac09cc89d855bfeee86cb6d12950d0cad2f5f1f5ff534dee778296d9c18dc0d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0ce-3544-4fe7-893d-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:10.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:10.000Z",
|
||
|
|
"description": "- Xchecked via VT: 119926c11c5fabeef804f453fc4431e2",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '7461dd3bb4f4f54be252569fb094badc7b8770c7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--566fc0cf-1b1c-4060-8bad-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:11.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:11.000Z",
|
||
|
|
"first_observed": "2015-12-15T07:27:11Z",
|
||
|
|
"last_observed": "2015-12-15T07:27:11Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--566fc0cf-1b1c-4060-8bad-1c70950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--566fc0cf-1b1c-4060-8bad-1c70950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/6ac09cc89d855bfeee86cb6d12950d0cad2f5f1f5ff534dee778296d9c18dc0d/analysis/1447861930/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0cf-4128-4f05-841d-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:11.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:11.000Z",
|
||
|
|
"description": "- Xchecked via VT: 164ad98019c954c416f8d1e06411a855",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7a5c7cce34ba0500924151052d8ddb9d76b73aeecf7b86807ec22c835224485f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0cf-7c30-42fa-b536-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:11.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:11.000Z",
|
||
|
|
"description": "- Xchecked via VT: 164ad98019c954c416f8d1e06411a855",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a3ae2c1c67a17c6ba1a24500f2a26736951aeed4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--566fc0d0-0400-44d4-bc68-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:12.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:12.000Z",
|
||
|
|
"first_observed": "2015-12-15T07:27:12Z",
|
||
|
|
"last_observed": "2015-12-15T07:27:12Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--566fc0d0-0400-44d4-bc68-1c70950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--566fc0d0-0400-44d4-bc68-1c70950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/7a5c7cce34ba0500924151052d8ddb9d76b73aeecf7b86807ec22c835224485f/analysis/1449016919/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0d0-9104-46c3-aa75-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:12.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:12.000Z",
|
||
|
|
"description": "- Xchecked via VT: 182c152766107a236245734082f0df7b",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0de74674685bfde079e3075d2730c6a1aea8a6b732ba258ce6d748b404f9aa1c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0d1-46d8-4911-bdc8-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:13.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:13.000Z",
|
||
|
|
"description": "- Xchecked via VT: 182c152766107a236245734082f0df7b",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '6d78a1855d1ec44254facc226ff29536f16c8a71']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--566fc0d1-55d0-41cf-a606-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:13.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:13.000Z",
|
||
|
|
"first_observed": "2015-12-15T07:27:13Z",
|
||
|
|
"last_observed": "2015-12-15T07:27:13Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--566fc0d1-55d0-41cf-a606-1c70950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--566fc0d1-55d0-41cf-a606-1c70950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/0de74674685bfde079e3075d2730c6a1aea8a6b732ba258ce6d748b404f9aa1c/analysis/1449060104/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0d2-79fc-4750-84f3-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:14.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:14.000Z",
|
||
|
|
"description": "- Xchecked via VT: 1c7b71d0f962d06bf579b9cc48a1a4a8",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c0f201c2ea270bc3428de1441ba0b45ddc68dd8ba42fdc69bd17eae0ed0bc8ab']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0d2-0cd0-48ea-95a9-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:14.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:14.000Z",
|
||
|
|
"description": "- Xchecked via VT: 1c7b71d0f962d06bf579b9cc48a1a4a8",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '1836b2c0f7bfc9697b0d006bd8e5048aaa8de669']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--566fc0d2-ac74-4e27-87de-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:14.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:14.000Z",
|
||
|
|
"first_observed": "2015-12-15T07:27:14Z",
|
||
|
|
"last_observed": "2015-12-15T07:27:14Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--566fc0d2-ac74-4e27-87de-1c70950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--566fc0d2-ac74-4e27-87de-1c70950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/c0f201c2ea270bc3428de1441ba0b45ddc68dd8ba42fdc69bd17eae0ed0bc8ab/analysis/1447861929/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0d3-628c-4f36-bde9-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:15.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:15.000Z",
|
||
|
|
"description": "- Xchecked via VT: 21220340b150468bf3925578a8028bba",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9d9e60baddf6cc5338244d05d049851c3989ca28493bb9441fbcfe510feb4588']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0d3-a430-4ed5-b0aa-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:15.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:15.000Z",
|
||
|
|
"description": "- Xchecked via VT: 21220340b150468bf3925578a8028bba",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f75102e06f4cb8a05fe558f661a7f74697ff0c96']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--566fc0d4-7ee0-40b0-bc1c-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:16.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:16.000Z",
|
||
|
|
"first_observed": "2015-12-15T07:27:16Z",
|
||
|
|
"last_observed": "2015-12-15T07:27:16Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--566fc0d4-7ee0-40b0-bc1c-1c70950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--566fc0d4-7ee0-40b0-bc1c-1c70950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/9d9e60baddf6cc5338244d05d049851c3989ca28493bb9441fbcfe510feb4588/analysis/1447861930/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0d4-4630-411d-8ba4-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:16.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:16.000Z",
|
||
|
|
"description": "- Xchecked via VT: 24860c06a06f660b3bcc27b7d27ccbcc",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ef54021ff3cac91632da3c8fba712bcb2d00863a8307321d5c7c00053f46fbbc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0d4-4830-4b47-b9b0-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:16.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:16.000Z",
|
||
|
|
"description": "- Xchecked via VT: 24860c06a06f660b3bcc27b7d27ccbcc",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '96487c24233c59cd2234c8d5b1f04142bbc6d73e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--566fc0d5-1378-4f4e-842a-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:17.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:17.000Z",
|
||
|
|
"first_observed": "2015-12-15T07:27:17Z",
|
||
|
|
"last_observed": "2015-12-15T07:27:17Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--566fc0d5-1378-4f4e-842a-1c70950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--566fc0d5-1378-4f4e-842a-1c70950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/ef54021ff3cac91632da3c8fba712bcb2d00863a8307321d5c7c00053f46fbbc/analysis/1446572425/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0d5-b300-4078-9c03-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:17.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:17.000Z",
|
||
|
|
"description": "- Xchecked via VT: 24f839c7fe5f01cfb6b8117562804a36",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd58e6af52738911ddd7b734c2eb87146d99eb5efd413b7dc2521b7f342854f36']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0d6-1288-4dc8-9818-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:18.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:18.000Z",
|
||
|
|
"description": "- Xchecked via VT: 24f839c7fe5f01cfb6b8117562804a36",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '97e5f79b2636cf817ec9c588e3303f4c2e6f7bd2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--566fc0d6-ebe0-45d0-ad1f-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:18.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:18.000Z",
|
||
|
|
"first_observed": "2015-12-15T07:27:18Z",
|
||
|
|
"last_observed": "2015-12-15T07:27:18Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--566fc0d6-ebe0-45d0-ad1f-1c70950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--566fc0d6-ebe0-45d0-ad1f-1c70950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/d58e6af52738911ddd7b734c2eb87146d99eb5efd413b7dc2521b7f342854f36/analysis/1447840209/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0d7-749c-45d1-aa8d-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:19.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:19.000Z",
|
||
|
|
"description": "- Xchecked via VT: 3d58f4b2008f6d87cab9166c09e513b5",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e251d761bc383b97e3df39b7565457ac0e5d497a1e0073563ce1787e60911def']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0d7-fb08-415a-928f-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:19.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:19.000Z",
|
||
|
|
"description": "- Xchecked via VT: 3d58f4b2008f6d87cab9166c09e513b5",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'b1004e02d99b517604e6d34a5f522624ffa92a12']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--566fc0d7-01f0-4649-aaab-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:19.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:19.000Z",
|
||
|
|
"first_observed": "2015-12-15T07:27:19Z",
|
||
|
|
"last_observed": "2015-12-15T07:27:19Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--566fc0d7-01f0-4649-aaab-1c70950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--566fc0d7-01f0-4649-aaab-1c70950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/e251d761bc383b97e3df39b7565457ac0e5d497a1e0073563ce1787e60911def/analysis/1447861932/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0d8-00d8-4869-9209-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:20.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:20.000Z",
|
||
|
|
"description": "- Xchecked via VT: 4210d8c8c0831aac94098ba7bbb9698e",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8b60d99593de1a07167ba11ef98f17f4a19c41494775d3af3fba71b49aee1fa6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0d8-e5b8-4fac-a0ea-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:20.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:20.000Z",
|
||
|
|
"description": "- Xchecked via VT: 4210d8c8c0831aac94098ba7bbb9698e",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '5f3e503cd630789967c1d5ddb83612e2c3e81e83']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--566fc0d9-5c9c-4f02-8e06-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:21.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:21.000Z",
|
||
|
|
"first_observed": "2015-12-15T07:27:21Z",
|
||
|
|
"last_observed": "2015-12-15T07:27:21Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--566fc0d9-5c9c-4f02-8e06-1c70950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--566fc0d9-5c9c-4f02-8e06-1c70950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/8b60d99593de1a07167ba11ef98f17f4a19c41494775d3af3fba71b49aee1fa6/analysis/1447841030/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0d9-950c-4e85-bc5c-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:21.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:21.000Z",
|
||
|
|
"description": "- Xchecked via VT: 5608bc6a52a8268fe279f73bb4f5ccf5",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c2f7b6b9baf9e25e3973fc060d2370aa1312be756f9e7c7a006f39ca32ffd593']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0d9-eeb0-4e79-9a13-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:21.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:21.000Z",
|
||
|
|
"description": "- Xchecked via VT: 5608bc6a52a8268fe279f73bb4f5ccf5",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '981b386edd67cbc1b72d31317162ddb6f85ed4b2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--566fc0da-668c-4663-9080-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:22.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:22.000Z",
|
||
|
|
"first_observed": "2015-12-15T07:27:22Z",
|
||
|
|
"last_observed": "2015-12-15T07:27:22Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--566fc0da-668c-4663-9080-1c70950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--566fc0da-668c-4663-9080-1c70950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/c2f7b6b9baf9e25e3973fc060d2370aa1312be756f9e7c7a006f39ca32ffd593/analysis/1447861932/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0da-baa0-473d-bf16-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:22.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:22.000Z",
|
||
|
|
"description": "- Xchecked via VT: 5dc9c2e1f9d860ab946da37fbb12c297",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a7787bf7a445f85915719bea5194bfcd4d55b258fd4767936e43f210ac097d4a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0db-78e8-4ffc-b4a2-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:23.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:23.000Z",
|
||
|
|
"description": "- Xchecked via VT: 5dc9c2e1f9d860ab946da37fbb12c297",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '8db284bf415f3a5cbbb1e804f70eebd469339055']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--566fc0db-0c94-4e72-9f9b-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:23.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:23.000Z",
|
||
|
|
"first_observed": "2015-12-15T07:27:23Z",
|
||
|
|
"last_observed": "2015-12-15T07:27:23Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--566fc0db-0c94-4e72-9f9b-1c70950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--566fc0db-0c94-4e72-9f9b-1c70950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/a7787bf7a445f85915719bea5194bfcd4d55b258fd4767936e43f210ac097d4a/analysis/1449838075/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0dc-2a08-427e-bf6a-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:24.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:24.000Z",
|
||
|
|
"description": "- Xchecked via VT: 774f453a56918203b9401d7043eba8dc",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6df1730c3eefa9ff0259978aab555083461fc3374e809ac0580f88e9d99b74e1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0dc-3b30-494f-b509-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:24.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:24.000Z",
|
||
|
|
"description": "- Xchecked via VT: 774f453a56918203b9401d7043eba8dc",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f7520b40de8638f912d38bc3a8207d1df4520fdd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--566fc0dc-5a30-4eb5-941b-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:24.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:24.000Z",
|
||
|
|
"first_observed": "2015-12-15T07:27:24Z",
|
||
|
|
"last_observed": "2015-12-15T07:27:24Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--566fc0dc-5a30-4eb5-941b-1c70950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--566fc0dc-5a30-4eb5-941b-1c70950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/6df1730c3eefa9ff0259978aab555083461fc3374e809ac0580f88e9d99b74e1/analysis/1447841361/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0dd-a860-41b1-b38a-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:25.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:25.000Z",
|
||
|
|
"description": "- Xchecked via VT: 78ed64467ee1d397ad58035bd715e8c1",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '317f0257cb213bcc7e746fa814bf40c0ecb321171ab636b58884754ce0edeb72']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0dd-f584-4dd0-95d8-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:25.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:25.000Z",
|
||
|
|
"description": "- Xchecked via VT: 78ed64467ee1d397ad58035bd715e8c1",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '7fc2f946c59e1f2003bb3025c000df043c516967']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--566fc0de-408c-40cd-b6d3-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:26.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:26.000Z",
|
||
|
|
"first_observed": "2015-12-15T07:27:26Z",
|
||
|
|
"last_observed": "2015-12-15T07:27:26Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--566fc0de-408c-40cd-b6d3-1c70950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--566fc0de-408c-40cd-b6d3-1c70950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/317f0257cb213bcc7e746fa814bf40c0ecb321171ab636b58884754ce0edeb72/analysis/1447861933/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0de-4078-490d-9e80-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:26.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:26.000Z",
|
||
|
|
"description": "- Xchecked via VT: 7b1c9bd5b374a91737c74a02a71edf03",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '73f5226d7d99ab1687e9ec1a198cf1403a70909bc9219cd8ce862b8ef725bb79']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0de-2e8c-46fa-80c5-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:26.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:26.000Z",
|
||
|
|
"description": "- Xchecked via VT: 7b1c9bd5b374a91737c74a02a71edf03",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c94c23b17c80333e85e8ce5a313fe78043e7a225']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--566fc0df-48e0-40da-a50c-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:27.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:27.000Z",
|
||
|
|
"first_observed": "2015-12-15T07:27:27Z",
|
||
|
|
"last_observed": "2015-12-15T07:27:27Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--566fc0df-48e0-40da-a50c-1c70950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--566fc0df-48e0-40da-a50c-1c70950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/73f5226d7d99ab1687e9ec1a198cf1403a70909bc9219cd8ce862b8ef725bb79/analysis/1447405541/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0df-e4a0-4cdc-80bf-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:27.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:27.000Z",
|
||
|
|
"description": "- Xchecked via VT: 891a905a194ee8600bae1fac150fddc9",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7a3896fbb3c9f39af2c10b66b143daa04c27b91f0a82f71d8e06f4c120155176']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0e0-5e20-4521-ab3f-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:28.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:28.000Z",
|
||
|
|
"description": "- Xchecked via VT: 891a905a194ee8600bae1fac150fddc9",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '58ad28070f827fc74419867badaf8ac13e4a7968']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--566fc0e0-cef4-419a-aebf-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:28.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:28.000Z",
|
||
|
|
"first_observed": "2015-12-15T07:27:28Z",
|
||
|
|
"last_observed": "2015-12-15T07:27:28Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--566fc0e0-cef4-419a-aebf-1c70950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--566fc0e0-cef4-419a-aebf-1c70950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/7a3896fbb3c9f39af2c10b66b143daa04c27b91f0a82f71d8e06f4c120155176/analysis/1446524936/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0e1-2f2c-42ac-bbe6-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:29.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:29.000Z",
|
||
|
|
"description": "- Xchecked via VT: bdfbc8ba8adddaf3ed19a075d22c6b4b",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7014e6fec7c02129b1d5eee26f1fbe0244cf4d264114114cf606d0f260844b39']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0e1-9760-4521-8928-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:29.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:29.000Z",
|
||
|
|
"description": "- Xchecked via VT: bdfbc8ba8adddaf3ed19a075d22c6b4b",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '188a9ba4c6f84fd86ca821fcbd068e0f64242e48']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--566fc0e1-8044-492e-b90e-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:29.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:29.000Z",
|
||
|
|
"first_observed": "2015-12-15T07:27:29Z",
|
||
|
|
"last_observed": "2015-12-15T07:27:29Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--566fc0e1-8044-492e-b90e-1c70950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--566fc0e1-8044-492e-b90e-1c70950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/7014e6fec7c02129b1d5eee26f1fbe0244cf4d264114114cf606d0f260844b39/analysis/1448972551/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0e2-3904-4e61-91cf-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:30.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:30.000Z",
|
||
|
|
"description": "- Xchecked via VT: d0f7096e3cec91b296ccb787dbb04e2e",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0fe2671548c555b0df7d1e1d651c2ffc9f3476db86466fefddab6de266cbf97a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0e2-c654-4efd-9cf0-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:30.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:30.000Z",
|
||
|
|
"description": "- Xchecked via VT: d0f7096e3cec91b296ccb787dbb04e2e",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '7a86cffda74f11921a1a261e7b3a5ecda5467bb2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--566fc0e3-b398-460c-9797-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:31.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:31.000Z",
|
||
|
|
"first_observed": "2015-12-15T07:27:31Z",
|
||
|
|
"last_observed": "2015-12-15T07:27:31Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--566fc0e3-b398-460c-9797-1c70950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--566fc0e3-b398-460c-9797-1c70950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/0fe2671548c555b0df7d1e1d651c2ffc9f3476db86466fefddab6de266cbf97a/analysis/1449060098/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0e3-5bcc-47a5-ab75-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:31.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:31.000Z",
|
||
|
|
"description": "- Xchecked via VT: d4a616ad7439bd766d5a44cea4946f56",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9307e7140ba1adaa19bed2d1751416c2491119bfdc4d5520f5b4d1fcacd10e4f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0e3-bee0-46f0-b9c8-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:31.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:31.000Z",
|
||
|
|
"description": "- Xchecked via VT: d4a616ad7439bd766d5a44cea4946f56",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '2788fba04a568897a3fe68752acc1d9e7b5ea272']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--566fc0e4-5cd8-4b87-a067-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:32.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:32.000Z",
|
||
|
|
"first_observed": "2015-12-15T07:27:32Z",
|
||
|
|
"last_observed": "2015-12-15T07:27:32Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--566fc0e4-5cd8-4b87-a067-1c70950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--566fc0e4-5cd8-4b87-a067-1c70950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/9307e7140ba1adaa19bed2d1751416c2491119bfdc4d5520f5b4d1fcacd10e4f/analysis/1445877049/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0e4-47c4-4afe-ad40-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:32.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:32.000Z",
|
||
|
|
"description": "- Xchecked via VT: e38a282372a33a66794d12ff4c255fbd",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd4541b3d89c6f8c8214d4ff1afd5b70be0c00825fd9e169d4e55c59dc50de732']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0e5-4024-41de-ab5c-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:33.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:33.000Z",
|
||
|
|
"description": "- Xchecked via VT: e38a282372a33a66794d12ff4c255fbd",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '0d09bf517337dc7d5b25798c74851167d3486121']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--566fc0e5-fe64-4ce2-8ec7-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:33.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:33.000Z",
|
||
|
|
"first_observed": "2015-12-15T07:27:33Z",
|
||
|
|
"last_observed": "2015-12-15T07:27:33Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--566fc0e5-fe64-4ce2-8ec7-1c70950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--566fc0e5-fe64-4ce2-8ec7-1c70950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/d4541b3d89c6f8c8214d4ff1afd5b70be0c00825fd9e169d4e55c59dc50de732/analysis/1447861936/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0e6-6700-4978-ac09-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:34.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:34.000Z",
|
||
|
|
"description": "- Xchecked via VT: e67b5c8ae5317ab95f254a76dae7c636",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3dfc7ea0f71a5930a149131c38094be3bad373c85e2a0985dcb0f4d0a2daac51']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0e6-9a94-4a01-9b32-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:34.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:34.000Z",
|
||
|
|
"description": "- Xchecked via VT: e67b5c8ae5317ab95f254a76dae7c636",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '4a52e095eff412f6f5ec172d3a330c124cbc4966']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--566fc0e6-bc0c-4633-8f21-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:34.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:34.000Z",
|
||
|
|
"first_observed": "2015-12-15T07:27:34Z",
|
||
|
|
"last_observed": "2015-12-15T07:27:34Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--566fc0e6-bc0c-4633-8f21-1c70950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--566fc0e6-bc0c-4633-8f21-1c70950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/3dfc7ea0f71a5930a149131c38094be3bad373c85e2a0985dcb0f4d0a2daac51/analysis/1447861937/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0e7-55dc-4666-aa98-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:35.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:35.000Z",
|
||
|
|
"description": "- Xchecked via VT: ed6f43fed6ba216f19fbdfddd42c33fe",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ed8ea2fc684ed6b0fed17b8614c4367ca7ac037ea3c09b90ebd2557522a7cf51']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0e7-131c-4f6c-89ef-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:35.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:35.000Z",
|
||
|
|
"description": "- Xchecked via VT: ed6f43fed6ba216f19fbdfddd42c33fe",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '02c46a6d76da2fb0c7ab464dc3b89c63fb14b315']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--566fc0e8-2ba8-4c57-88ad-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:36.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:36.000Z",
|
||
|
|
"first_observed": "2015-12-15T07:27:36Z",
|
||
|
|
"last_observed": "2015-12-15T07:27:36Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--566fc0e8-2ba8-4c57-88ad-1c70950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--566fc0e8-2ba8-4c57-88ad-1c70950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/ed8ea2fc684ed6b0fed17b8614c4367ca7ac037ea3c09b90ebd2557522a7cf51/analysis/1447861938/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0e8-6e04-4f94-946d-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:36.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:36.000Z",
|
||
|
|
"description": "- Xchecked via VT: ed72d81a564d421ebd8cc9280dcf618a",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '781031457cea1e46df1200a47eaa7e90ce585f3c983ee5912af2a2ef8442b8ce']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0e8-d2a0-4488-95bd-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:36.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:36.000Z",
|
||
|
|
"description": "- Xchecked via VT: ed72d81a564d421ebd8cc9280dcf618a",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '75201c083b3ded3812f63930535b46d2af7366a4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--566fc0e9-9618-4e9f-bfc6-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:37.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:37.000Z",
|
||
|
|
"first_observed": "2015-12-15T07:27:37Z",
|
||
|
|
"last_observed": "2015-12-15T07:27:37Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--566fc0e9-9618-4e9f-bfc6-1c70950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--566fc0e9-9618-4e9f-bfc6-1c70950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/781031457cea1e46df1200a47eaa7e90ce585f3c983ee5912af2a2ef8442b8ce/analysis/1447502253/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0e9-124c-4549-9f42-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:37.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:37.000Z",
|
||
|
|
"description": "- Xchecked via VT: 58a2ef9f1801c840b14ad67cf3678a45",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7e29e9e8b2662a11a25bc84dd5ddfe3f9cad6cde3ccac12968bbccae5ad4c602']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--566fc0ea-96f0-48de-962d-1c70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-12-15T07:27:38.000Z",
|
||
|
|
"modified": "2015-12-15T07:27:38.000Z",
|
||
|
|
"description": "- Xchecked via VT: 58a2ef9f1801c840b14ad67cf3678a45",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '69053135d9a43ef6f7eea301f110a99799b3f85b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-12-15T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|