adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/stix-2.1/56d4b32d-664c-4647-a748-1362950d210f.json

300 lines
12 KiB
JSON
Raw Permalink Normal View History

chg: [misp-stix] STIX 2.1 export added
2023-04-21 14:44:17 +00:00
{
"type": "bundle",
"id": "bundle--56d4b32d-664c-4647-a748-1362950d210f",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-02-29T21:25:02.000Z",
"modified": "2016-02-29T21:25:02.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--56d4b32d-664c-4647-a748-1362950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-02-29T21:25:02.000Z",
"modified": "2016-02-29T21:25:02.000Z",
"name": "OSINT - New Hacking team samples (OSX)",
"published": "2016-02-29T21:25:12Z",
"object_refs": [
"indicator--56d4b488-ae78-464f-a218-1363950d210f",
"indicator--56d4b489-a684-4f7a-a0fb-1363950d210f",
"indicator--56d4b489-9400-4c37-8e64-1363950d210f",
"observed-data--56d4b489-bab0-4bc1-bc3f-1363950d210f",
"url--56d4b489-bab0-4bc1-bc3f-1363950d210f",
"indicator--56d4b55f-1790-4a76-b14f-136602de0b81",
"indicator--56d4b55f-0494-4e05-bbd1-136602de0b81",
"observed-data--56d4b560-1cec-475e-a298-136602de0b81",
"url--56d4b560-1cec-475e-a298-136602de0b81",
"indicator--56d4b560-f868-4c50-a9dd-136602de0b81",
"indicator--56d4b560-d8b8-4625-8d5b-136602de0b81",
"observed-data--56d4b561-8b38-4590-9a9e-136602de0b81",
"url--56d4b561-8b38-4590-9a9e-136602de0b81"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"type:OSINT",
"circl:incident-classification=\"malware\""
],
"object_marking_refs": [
"marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56d4b488-ae78-464f-a218-1363950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-02-29T21:13:44.000Z",
"modified": "2016-02-29T21:13:44.000Z",
"description": "ZIP with dropper",
"pattern": "[file:hashes.SHA256 = '2ee9e9d9a0cd3cee6519e7b950821d5c90af03da665879615e52fd093dd8e947']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-02-29T21:13:44Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56d4b489-a684-4f7a-a0fb-1363950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-02-29T21:13:45.000Z",
"modified": "2016-02-29T21:13:45.000Z",
"description": "Dropper binary",
"pattern": "[file:hashes.SHA256 = '58e4e4853c6cfbb43afd49e5238046596ee5b78eca439c7d76bd95a34115a273']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-02-29T21:13:45Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56d4b489-9400-4c37-8e64-1363950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-02-29T21:13:45.000Z",
"modified": "2016-02-29T21:13:45.000Z",
"description": "C&C",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '212.71.254.212']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-02-29T21:13:45Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--56d4b489-bab0-4bc1-bc3f-1363950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-02-29T21:25:02.000Z",
"modified": "2016-02-29T21:25:02.000Z",
"first_observed": "2016-02-29T21:25:02Z",
"last_observed": "2016-02-29T21:25:02Z",
"number_observed": 1,
"object_refs": [
"url--56d4b489-bab0-4bc1-bc3f-1363950d210f"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--56d4b489-bab0-4bc1-bc3f-1363950d210f",
"value": "https://reverse.put.as/2016/02/29/the-italian-morons-are-back-what-are-they-up-to-this-time/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56d4b55f-1790-4a76-b14f-136602de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-02-29T21:17:19.000Z",
"modified": "2016-02-29T21:17:19.000Z",
"description": "Dropper binary - Xchecked via VT: 58e4e4853c6cfbb43afd49e5238046596ee5b78eca439c7d76bd95a34115a273",
"pattern": "[file:hashes.SHA1 = 'df0c428657f8d317a9617a209ed1998860f22c42']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-02-29T21:17:19Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56d4b55f-0494-4e05-bbd1-136602de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-02-29T21:17:19.000Z",
"modified": "2016-02-29T21:17:19.000Z",
"description": "Dropper binary - Xchecked via VT: 58e4e4853c6cfbb43afd49e5238046596ee5b78eca439c7d76bd95a34115a273",
"pattern": "[file:hashes.MD5 = 'e2b81bed4472087dca00bee18acbce04']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-02-29T21:17:19Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--56d4b560-1cec-475e-a298-136602de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-02-29T21:17:20.000Z",
"modified": "2016-02-29T21:17:20.000Z",
"first_observed": "2016-02-29T21:17:20Z",
"last_observed": "2016-02-29T21:17:20Z",
"number_observed": 1,
"object_refs": [
"url--56d4b560-1cec-475e-a298-136602de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--56d4b560-1cec-475e-a298-136602de0b81",
"value": "https://www.virustotal.com/file/58e4e4853c6cfbb43afd49e5238046596ee5b78eca439c7d76bd95a34115a273/analysis/1456779730/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56d4b560-f868-4c50-a9dd-136602de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-02-29T21:17:20.000Z",
"modified": "2016-02-29T21:17:20.000Z",
"description": "ZIP with dropper - Xchecked via VT: 2ee9e9d9a0cd3cee6519e7b950821d5c90af03da665879615e52fd093dd8e947",
"pattern": "[file:hashes.SHA1 = '64341827760eb2d4ac4107b6d18c6942d3d69cba']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-02-29T21:17:20Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56d4b560-d8b8-4625-8d5b-136602de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-02-29T21:17:20.000Z",
"modified": "2016-02-29T21:17:20.000Z",
"description": "ZIP with dropper - Xchecked via VT: 2ee9e9d9a0cd3cee6519e7b950821d5c90af03da665879615e52fd093dd8e947",
"pattern": "[file:hashes.MD5 = '92d4556d3d594b987044106388d484b3']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-02-29T21:17:20Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--56d4b561-8b38-4590-9a9e-136602de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-02-29T21:17:21.000Z",
"modified": "2016-02-29T21:17:21.000Z",
"first_observed": "2016-02-29T21:17:21Z",
"last_observed": "2016-02-29T21:17:21Z",
"number_observed": 1,
"object_refs": [
"url--56d4b561-8b38-4590-9a9e-136602de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--56d4b561-8b38-4590-9a9e-136602de0b81",
"value": "https://www.virustotal.com/file/2ee9e9d9a0cd3cee6519e7b950821d5c90af03da665879615e52fd093dd8e947/analysis/1456767669/"
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:GREEN",
"definition": {
"tlp": "green"
}
}
]
}
Reference in a new issue Copy permalink