1146 lines
48 KiB
JSON
1146 lines
48 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--5718d275-88d4-492e-9f07-43ee950d210f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T15:07:29.000Z",
|
||
|
|
"modified": "2016-04-21T15:07:29.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--5718d275-88d4-492e-9f07-43ee950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T15:07:29.000Z",
|
||
|
|
"modified": "2016-04-21T15:07:29.000Z",
|
||
|
|
"name": "OSINT - \u00e2\u20ac\u0153Operation C-Major\u00e2\u20ac\u009d Actors Also Used Android, BlackBerry Mobile Spyware Against Targets",
|
||
|
|
"published": "2016-04-21T15:15:02Z",
|
||
|
|
"object_refs": [
|
||
|
|
"observed-data--5718d28f-6890-4731-95e4-4b42950d210f",
|
||
|
|
"url--5718d28f-6890-4731-95e4-4b42950d210f",
|
||
|
|
"x-misp-attribute--5718d2a3-a008-4c0d-ba56-4ec7950d210f",
|
||
|
|
"indicator--5718d4f3-98c0-40be-a296-40f8950d210f",
|
||
|
|
"indicator--5718d4f3-43a4-4bbd-bf88-40c4950d210f",
|
||
|
|
"indicator--5718d4f3-ba78-4f00-a3d3-4232950d210f",
|
||
|
|
"indicator--5718d4f4-ef9c-46a2-8d75-4f77950d210f",
|
||
|
|
"indicator--5718d4f4-d518-44d4-aef8-442a950d210f",
|
||
|
|
"indicator--5718d4f5-e228-4ed6-b03a-4bff950d210f",
|
||
|
|
"indicator--5718d4f5-cdac-47c9-ae00-43d2950d210f",
|
||
|
|
"indicator--5718d4f5-84c8-4878-b3a9-4d19950d210f",
|
||
|
|
"indicator--5718d54c-be50-4f58-83e2-408c950d210f",
|
||
|
|
"indicator--5718d54d-2990-4cb5-9bfd-4883950d210f",
|
||
|
|
"indicator--5718d54d-4be0-4e06-9405-4d66950d210f",
|
||
|
|
"indicator--5718d54e-8b80-4d4b-9b3f-48a3950d210f",
|
||
|
|
"indicator--5718d54e-7dc8-49eb-9432-449a950d210f",
|
||
|
|
"indicator--5718d54e-6f18-48bd-aa39-43f1950d210f",
|
||
|
|
"indicator--5718d54f-23a8-44b0-86b4-46a7950d210f",
|
||
|
|
"indicator--5718d54f-8be4-4981-8136-4bb4950d210f",
|
||
|
|
"indicator--5718d54f-e3d0-4a0a-9f5c-45a8950d210f",
|
||
|
|
"indicator--5718e3a8-eef0-4849-81fd-470c950d210f",
|
||
|
|
"indicator--5718ecb1-fb28-4bb5-85e0-40b702de0b81",
|
||
|
|
"indicator--5718ecb2-9428-4848-83fb-405b02de0b81",
|
||
|
|
"observed-data--5718ecb2-efec-4668-8f3e-493002de0b81",
|
||
|
|
"url--5718ecb2-efec-4668-8f3e-493002de0b81",
|
||
|
|
"indicator--5718ecb3-1d2c-47aa-b21c-474302de0b81",
|
||
|
|
"indicator--5718ecb3-71bc-491c-8314-48ad02de0b81",
|
||
|
|
"observed-data--5718ecb3-9f58-4d1a-8e7f-408f02de0b81",
|
||
|
|
"url--5718ecb3-9f58-4d1a-8e7f-408f02de0b81",
|
||
|
|
"indicator--5718ecb4-03c4-4676-ac2e-4c5002de0b81",
|
||
|
|
"indicator--5718ecb4-dd44-44ee-9cd3-4b0702de0b81",
|
||
|
|
"observed-data--5718ecb4-8b60-44dd-bc05-483e02de0b81",
|
||
|
|
"url--5718ecb4-8b60-44dd-bc05-483e02de0b81",
|
||
|
|
"indicator--5718ecb5-a7d0-4a52-bd6c-4bcd02de0b81",
|
||
|
|
"indicator--5718ecb5-fa50-4255-823a-4b5702de0b81",
|
||
|
|
"observed-data--5718ecb5-1ad4-4fb3-9889-4b1802de0b81",
|
||
|
|
"url--5718ecb5-1ad4-4fb3-9889-4b1802de0b81",
|
||
|
|
"indicator--5718ecb6-a3fc-4ab9-ad1a-48ce02de0b81",
|
||
|
|
"indicator--5718ecb6-117c-45d3-951e-4c0402de0b81",
|
||
|
|
"observed-data--5718ecb7-3c5c-4b28-8cf0-46f402de0b81",
|
||
|
|
"url--5718ecb7-3c5c-4b28-8cf0-46f402de0b81",
|
||
|
|
"indicator--5718ecb7-a578-4bc5-b9c2-48b602de0b81",
|
||
|
|
"indicator--5718ecb7-3210-4790-b39c-4cba02de0b81",
|
||
|
|
"observed-data--5718ecb8-7d80-4ee0-9656-43f602de0b81",
|
||
|
|
"url--5718ecb8-7d80-4ee0-9656-43f602de0b81",
|
||
|
|
"indicator--5718ecb8-1018-4832-8633-448602de0b81",
|
||
|
|
"indicator--5718ecb9-5f4c-48f3-80c9-413202de0b81",
|
||
|
|
"observed-data--5718ecb9-acdc-4965-83d0-4a9c02de0b81",
|
||
|
|
"url--5718ecb9-acdc-4965-83d0-4a9c02de0b81",
|
||
|
|
"indicator--5718ecb9-67b8-422e-b4d1-4f8202de0b81",
|
||
|
|
"indicator--5718ecba-bc08-4277-9a9f-473002de0b81",
|
||
|
|
"observed-data--5718ecba-61b8-46ad-aef6-4bc502de0b81",
|
||
|
|
"url--5718ecba-61b8-46ad-aef6-4bc502de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"type:OSINT"
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5718d28f-6890-4731-95e4-4b42950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T13:15:59.000Z",
|
||
|
|
"modified": "2016-04-21T13:15:59.000Z",
|
||
|
|
"first_observed": "2016-04-21T13:15:59Z",
|
||
|
|
"last_observed": "2016-04-21T13:15:59Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5718d28f-6890-4731-95e4-4b42950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5718d28f-6890-4731-95e4-4b42950d210f",
|
||
|
|
"value": "http://blog.trendmicro.com/trendlabs-security-intelligence/operation-c-major-actors-also-used-android-blackberry-mobile-spyware-targets/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--5718d2a3-a008-4c0d-ba56-4ec7950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T13:16:19.000Z",
|
||
|
|
"modified": "2016-04-21T13:16:19.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"comment\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "External analysis",
|
||
|
|
"x_misp_type": "comment",
|
||
|
|
"x_misp_value": "Last March, we reported on Operation C-Major, an active information theft campaign that was able to steal sensitive information from high profile targets in India. The campaign was able to steal large amounts of data despite using relatively simple malware because it used clever social engineering tactics against its targets. In this post, we will focus on the mobile part of their operation and discuss in detail several Android and BlackBerry apps they are using. Based on our investigation, the actors behind Operation C-Major were able to keep their Android malware on Google Play for months and they advertised their apps on Facebook pages which have thousands of likes from high profile targets."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718d4f3-98c0-40be-a296-40f8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T13:26:26.000Z",
|
||
|
|
"modified": "2016-04-21T13:26:26.000Z",
|
||
|
|
"description": "Smesh app",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '24f52c5f909d79a70e6e2a4e89aa7816b5f24aec']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T13:26:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718d4f3-43a4-4bbd-bf88-40c4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T13:26:31.000Z",
|
||
|
|
"modified": "2016-04-21T13:26:31.000Z",
|
||
|
|
"description": "Smesh app",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '202f11c5cf2b9df8bf8ab766a33cd0e6d7a5161a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T13:26:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718d4f3-ba78-4f00-a3d3-4232950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T13:26:38.000Z",
|
||
|
|
"modified": "2016-04-21T13:26:38.000Z",
|
||
|
|
"description": "Smesh app",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '31ac19091fd5347568b130d7150ed867ffe38c28']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T13:26:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718d4f4-ef9c-46a2-8d75-4f77950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T13:26:56.000Z",
|
||
|
|
"modified": "2016-04-21T13:26:56.000Z",
|
||
|
|
"description": "Smesh app",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '6919aa3a9d5e193a1d48e05e7bf320d795923ea7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T13:26:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718d4f4-d518-44d4-aef8-442a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T13:26:42.000Z",
|
||
|
|
"modified": "2016-04-21T13:26:42.000Z",
|
||
|
|
"description": "Smesh app",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c48a5d639430e08980f1aeb5af49310692f2701b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T13:26:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718d4f5-e228-4ed6-b03a-4bff950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T13:26:52.000Z",
|
||
|
|
"modified": "2016-04-21T13:26:52.000Z",
|
||
|
|
"description": "Smesh app",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '1ce6b3f02fe2e4ee201bdab2c1e4f6bb5a8da1b1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T13:26:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718d4f5-cdac-47c9-ae00-43d2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T13:26:48.000Z",
|
||
|
|
"modified": "2016-04-21T13:26:48.000Z",
|
||
|
|
"description": "Smesh app",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '59aec5002684de8cc8c27f7512ed70c094e4bd20']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T13:26:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718d4f5-84c8-4878-b3a9-4d19950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T13:26:45.000Z",
|
||
|
|
"modified": "2016-04-21T13:26:45.000Z",
|
||
|
|
"description": "Smesh app",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '552e3a16dd36ae4a3d4480182124a3f6701911f2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T13:26:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718d54c-be50-4f58-83e2-408c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T13:27:40.000Z",
|
||
|
|
"modified": "2016-04-21T13:27:40.000Z",
|
||
|
|
"description": "Ringster",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c544e5d8c6f38bb199283f11f799da8f3bb3807f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T13:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718d54d-2990-4cb5-9bfd-4883950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T13:27:41.000Z",
|
||
|
|
"modified": "2016-04-21T13:27:41.000Z",
|
||
|
|
"description": "Ringster",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a13568164c0a8f50d76d9ffa6e34e31674a3afc8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T13:27:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718d54d-4be0-4e06-9405-4d66950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T13:27:41.000Z",
|
||
|
|
"modified": "2016-04-21T13:27:41.000Z",
|
||
|
|
"description": "Androrat",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '9288811c9747d151eab4ec708b368fc6cc4e2cb5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T13:27:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718d54e-8b80-4d4b-9b3f-48a3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T13:27:42.000Z",
|
||
|
|
"modified": "2016-04-21T13:27:42.000Z",
|
||
|
|
"description": "Androrat",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '94c74a9e5d1aab18f51487e4e47e5995b7252c4b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T13:27:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718d54e-7dc8-49eb-9432-449a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T13:27:42.000Z",
|
||
|
|
"modified": "2016-04-21T13:27:42.000Z",
|
||
|
|
"description": "Androrat",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'decf429be7d469292827c3b873f7e61076ffbba1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T13:27:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718d54e-6f18-48bd-aa39-43f1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T13:27:42.000Z",
|
||
|
|
"modified": "2016-04-21T13:27:42.000Z",
|
||
|
|
"description": "Androrat",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f86302da2d38bf60f1ea9549b2e21a34fe655b33']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T13:27:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718d54f-23a8-44b0-86b4-46a7950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T13:27:43.000Z",
|
||
|
|
"modified": "2016-04-21T13:27:43.000Z",
|
||
|
|
"description": "India Sena News",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'b142e4b75a4562cdaad5cc2610d31594d2ed17c3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T13:27:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718d54f-8be4-4981-8136-4bb4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T13:27:43.000Z",
|
||
|
|
"modified": "2016-04-21T13:27:43.000Z",
|
||
|
|
"description": "BlackBerry spyware",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'abcb176578df44c2be7173b318abe704963052b2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T13:27:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718d54f-e3d0-4a0a-9f5c-45a8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T13:27:43.000Z",
|
||
|
|
"modified": "2016-04-21T13:27:43.000Z",
|
||
|
|
"description": "BlackBerry spyware",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '16318c4e4f94a5c4018b05955975771637b306b4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T13:27:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718e3a8-eef0-4849-81fd-470c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T14:28:56.000Z",
|
||
|
|
"modified": "2016-04-21T14:28:56.000Z",
|
||
|
|
"description": "Imported via the freetext import.",
|
||
|
|
"pattern": "[domain-name:value = 'mpjunkie.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T14:28:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718ecb1-fb28-4bb5-85e0-40b702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T15:07:29.000Z",
|
||
|
|
"modified": "2016-04-21T15:07:29.000Z",
|
||
|
|
"description": "BlackBerry spyware - Xchecked via VT: 16318c4e4f94a5c4018b05955975771637b306b4",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a2d9ef1e249a08737d183177116cba1ed03c411d257d4b8ab66064c9affda057']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T15:07:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718ecb2-9428-4848-83fb-405b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T15:07:30.000Z",
|
||
|
|
"modified": "2016-04-21T15:07:30.000Z",
|
||
|
|
"description": "BlackBerry spyware - Xchecked via VT: 16318c4e4f94a5c4018b05955975771637b306b4",
|
||
|
|
"pattern": "[file:hashes.MD5 = '5e5a6fd42417c98fdc0a2c9391876d7a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T15:07:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5718ecb2-efec-4668-8f3e-493002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T15:07:30.000Z",
|
||
|
|
"modified": "2016-04-21T15:07:30.000Z",
|
||
|
|
"first_observed": "2016-04-21T15:07:30Z",
|
||
|
|
"last_observed": "2016-04-21T15:07:30Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5718ecb2-efec-4668-8f3e-493002de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5718ecb2-efec-4668-8f3e-493002de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/a2d9ef1e249a08737d183177116cba1ed03c411d257d4b8ab66064c9affda057/analysis/1461189256/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718ecb3-1d2c-47aa-b21c-474302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T15:07:31.000Z",
|
||
|
|
"modified": "2016-04-21T15:07:31.000Z",
|
||
|
|
"description": "BlackBerry spyware - Xchecked via VT: abcb176578df44c2be7173b318abe704963052b2",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7ef9af07a8a5f76a9b80349b1aeac59b25fcda1fb731e03797c682ad85f6e396']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T15:07:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718ecb3-71bc-491c-8314-48ad02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T15:07:31.000Z",
|
||
|
|
"modified": "2016-04-21T15:07:31.000Z",
|
||
|
|
"description": "BlackBerry spyware - Xchecked via VT: abcb176578df44c2be7173b318abe704963052b2",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9201801719ebf4c6d8b4adf0425a35dc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T15:07:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5718ecb3-9f58-4d1a-8e7f-408f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T15:07:31.000Z",
|
||
|
|
"modified": "2016-04-21T15:07:31.000Z",
|
||
|
|
"first_observed": "2016-04-21T15:07:31Z",
|
||
|
|
"last_observed": "2016-04-21T15:07:31Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5718ecb3-9f58-4d1a-8e7f-408f02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5718ecb3-9f58-4d1a-8e7f-408f02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/7ef9af07a8a5f76a9b80349b1aeac59b25fcda1fb731e03797c682ad85f6e396/analysis/1461189249/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718ecb4-03c4-4676-ac2e-4c5002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T15:07:32.000Z",
|
||
|
|
"modified": "2016-04-21T15:07:32.000Z",
|
||
|
|
"description": "India Sena News - Xchecked via VT: b142e4b75a4562cdaad5cc2610d31594d2ed17c3",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5bbcd8a7856e037418c0ac1c0c987476e3210f577beffcdfe2eceebc19c5644d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T15:07:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718ecb4-dd44-44ee-9cd3-4b0702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T15:07:32.000Z",
|
||
|
|
"modified": "2016-04-21T15:07:32.000Z",
|
||
|
|
"description": "India Sena News - Xchecked via VT: b142e4b75a4562cdaad5cc2610d31594d2ed17c3",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'e6a0066676cab0144eb6055f67d917e0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T15:07:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5718ecb4-8b60-44dd-bc05-483e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T15:07:32.000Z",
|
||
|
|
"modified": "2016-04-21T15:07:32.000Z",
|
||
|
|
"first_observed": "2016-04-21T15:07:32Z",
|
||
|
|
"last_observed": "2016-04-21T15:07:32Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5718ecb4-8b60-44dd-bc05-483e02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5718ecb4-8b60-44dd-bc05-483e02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/5bbcd8a7856e037418c0ac1c0c987476e3210f577beffcdfe2eceebc19c5644d/analysis/1461073518/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718ecb5-a7d0-4a52-bd6c-4bcd02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T15:07:33.000Z",
|
||
|
|
"modified": "2016-04-21T15:07:33.000Z",
|
||
|
|
"description": "Androrat - Xchecked via VT: f86302da2d38bf60f1ea9549b2e21a34fe655b33",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f529ccdee54c53e4c02366713ec2d2e8ff629fe56b2f5778f9f7d31f809e4446']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T15:07:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718ecb5-fa50-4255-823a-4b5702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T15:07:33.000Z",
|
||
|
|
"modified": "2016-04-21T15:07:33.000Z",
|
||
|
|
"description": "Androrat - Xchecked via VT: f86302da2d38bf60f1ea9549b2e21a34fe655b33",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'dfd2eca84919418da2fa617fc51e9de5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T15:07:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5718ecb5-1ad4-4fb3-9889-4b1802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T15:07:33.000Z",
|
||
|
|
"modified": "2016-04-21T15:07:33.000Z",
|
||
|
|
"first_observed": "2016-04-21T15:07:33Z",
|
||
|
|
"last_observed": "2016-04-21T15:07:33Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5718ecb5-1ad4-4fb3-9889-4b1802de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5718ecb5-1ad4-4fb3-9889-4b1802de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/f529ccdee54c53e4c02366713ec2d2e8ff629fe56b2f5778f9f7d31f809e4446/analysis/1461051345/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718ecb6-a3fc-4ab9-ad1a-48ce02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T15:07:34.000Z",
|
||
|
|
"modified": "2016-04-21T15:07:34.000Z",
|
||
|
|
"description": "Androrat - Xchecked via VT: decf429be7d469292827c3b873f7e61076ffbba1",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8b64a32e386d7cc51bb761bee8959bb5cac20e79ae1e549b04b7354e67bdee66']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T15:07:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718ecb6-117c-45d3-951e-4c0402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T15:07:34.000Z",
|
||
|
|
"modified": "2016-04-21T15:07:34.000Z",
|
||
|
|
"description": "Androrat - Xchecked via VT: decf429be7d469292827c3b873f7e61076ffbba1",
|
||
|
|
"pattern": "[file:hashes.MD5 = '11ba93d968bd96e9e9c9418ea1fdcbbc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T15:07:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5718ecb7-3c5c-4b28-8cf0-46f402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T15:07:35.000Z",
|
||
|
|
"modified": "2016-04-21T15:07:35.000Z",
|
||
|
|
"first_observed": "2016-04-21T15:07:35Z",
|
||
|
|
"last_observed": "2016-04-21T15:07:35Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5718ecb7-3c5c-4b28-8cf0-46f402de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5718ecb7-3c5c-4b28-8cf0-46f402de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/8b64a32e386d7cc51bb761bee8959bb5cac20e79ae1e549b04b7354e67bdee66/analysis/1461051347/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718ecb7-a578-4bc5-b9c2-48b602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T15:07:35.000Z",
|
||
|
|
"modified": "2016-04-21T15:07:35.000Z",
|
||
|
|
"description": "Androrat - Xchecked via VT: 94c74a9e5d1aab18f51487e4e47e5995b7252c4b",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '563ebffbcd81d41e3ddb7b6ed580a2b17a6a6e14ec6bf208c9c22d7a296de7ae']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T15:07:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718ecb7-3210-4790-b39c-4cba02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T15:07:35.000Z",
|
||
|
|
"modified": "2016-04-21T15:07:35.000Z",
|
||
|
|
"description": "Androrat - Xchecked via VT: 94c74a9e5d1aab18f51487e4e47e5995b7252c4b",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'af046d94f254a3f85a0ba731562a05c5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T15:07:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5718ecb8-7d80-4ee0-9656-43f602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T15:07:36.000Z",
|
||
|
|
"modified": "2016-04-21T15:07:36.000Z",
|
||
|
|
"first_observed": "2016-04-21T15:07:36Z",
|
||
|
|
"last_observed": "2016-04-21T15:07:36Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5718ecb8-7d80-4ee0-9656-43f602de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5718ecb8-7d80-4ee0-9656-43f602de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/563ebffbcd81d41e3ddb7b6ed580a2b17a6a6e14ec6bf208c9c22d7a296de7ae/analysis/1461073437/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718ecb8-1018-4832-8633-448602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T15:07:36.000Z",
|
||
|
|
"modified": "2016-04-21T15:07:36.000Z",
|
||
|
|
"description": "Androrat - Xchecked via VT: 9288811c9747d151eab4ec708b368fc6cc4e2cb5",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e6753bba53d7cca4a534c3089f24cd0546462667d110c0d48974f9e76714fe1c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T15:07:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718ecb9-5f4c-48f3-80c9-413202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T15:07:37.000Z",
|
||
|
|
"modified": "2016-04-21T15:07:37.000Z",
|
||
|
|
"description": "Androrat - Xchecked via VT: 9288811c9747d151eab4ec708b368fc6cc4e2cb5",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ce59958c01e437f4bdc68b4896222b8e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T15:07:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5718ecb9-acdc-4965-83d0-4a9c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T15:07:37.000Z",
|
||
|
|
"modified": "2016-04-21T15:07:37.000Z",
|
||
|
|
"first_observed": "2016-04-21T15:07:37Z",
|
||
|
|
"last_observed": "2016-04-21T15:07:37Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5718ecb9-acdc-4965-83d0-4a9c02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5718ecb9-acdc-4965-83d0-4a9c02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/e6753bba53d7cca4a534c3089f24cd0546462667d110c0d48974f9e76714fe1c/analysis/1461217726/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718ecb9-67b8-422e-b4d1-4f8202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T15:07:37.000Z",
|
||
|
|
"modified": "2016-04-21T15:07:37.000Z",
|
||
|
|
"description": "Ringster - Xchecked via VT: a13568164c0a8f50d76d9ffa6e34e31674a3afc8",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8babf68a96861c8495580b5ecf54d8e9e1c76fc89fb72a322c94e74796db4e19']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T15:07:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5718ecba-bc08-4277-9a9f-473002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T15:07:38.000Z",
|
||
|
|
"modified": "2016-04-21T15:07:38.000Z",
|
||
|
|
"description": "Ringster - Xchecked via VT: a13568164c0a8f50d76d9ffa6e34e31674a3afc8",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c4cd2f9ba10c0f773a8ec56045d3b398']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-21T15:07:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5718ecba-61b8-46ad-aef6-4bc502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-21T15:07:38.000Z",
|
||
|
|
"modified": "2016-04-21T15:07:38.000Z",
|
||
|
|
"first_observed": "2016-04-21T15:07:38Z",
|
||
|
|
"last_observed": "2016-04-21T15:07:38Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5718ecba-61b8-46ad-aef6-4bc502de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5718ecba-61b8-46ad-aef6-4bc502de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/8babf68a96861c8495580b5ecf54d8e9e1c76fc89fb72a322c94e74796db4e19/analysis/1461226275/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|