919 lines
39 KiB
JSON
919 lines
39 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--5720669e-55ac-42ef-bc40-4b78950d210f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:25:21.000Z",
|
||
|
|
"modified": "2016-04-27T07:25:21.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--5720669e-55ac-42ef-bc40-4b78950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:25:21.000Z",
|
||
|
|
"modified": "2016-04-27T07:25:21.000Z",
|
||
|
|
"name": "OSINT - New Poison Ivy Activity Targeting Myanmar, Asian Countries",
|
||
|
|
"published": "2016-04-27T07:26:12Z",
|
||
|
|
"object_refs": [
|
||
|
|
"indicator--5720672e-e3ec-4191-bec0-475a950d210f",
|
||
|
|
"indicator--5720672e-28d4-4158-b7ff-4cde950d210f",
|
||
|
|
"indicator--5720672e-d8ac-43c2-b401-47c9950d210f",
|
||
|
|
"indicator--5720672f-5cc0-45f3-8335-45ba950d210f",
|
||
|
|
"indicator--5720672f-64ac-42fa-8431-4f09950d210f",
|
||
|
|
"indicator--57206839-7adc-45ad-b90c-4393950d210f",
|
||
|
|
"indicator--57206839-2274-4fa4-91a2-4aee950d210f",
|
||
|
|
"indicator--5720683a-a1dc-4777-9b22-40e3950d210f",
|
||
|
|
"indicator--5720683a-de00-499a-9963-4a6b950d210f",
|
||
|
|
"indicator--5720683a-70c4-4d63-a8f0-460f950d210f",
|
||
|
|
"indicator--5720683b-c4a4-4f2f-91d6-42d5950d210f",
|
||
|
|
"indicator--5720683b-f100-4756-a65f-489c950d210f",
|
||
|
|
"indicator--5720683c-6890-438f-b766-4576950d210f",
|
||
|
|
"indicator--57206879-b23c-4749-95c9-433902de0b81",
|
||
|
|
"indicator--5720687a-4cfc-4c96-913d-4feb02de0b81",
|
||
|
|
"observed-data--5720687a-9bd0-46be-bf8f-42b402de0b81",
|
||
|
|
"url--5720687a-9bd0-46be-bf8f-42b402de0b81",
|
||
|
|
"indicator--5720687b-2e58-467a-b6c5-4a1a02de0b81",
|
||
|
|
"indicator--5720687b-b328-4db6-8d52-473a02de0b81",
|
||
|
|
"observed-data--5720687b-3670-4619-9690-4b7502de0b81",
|
||
|
|
"url--5720687b-3670-4619-9690-4b7502de0b81",
|
||
|
|
"indicator--5720687c-a6d0-4a40-81da-462102de0b81",
|
||
|
|
"indicator--5720687c-d4b0-4045-9f80-473602de0b81",
|
||
|
|
"observed-data--5720687d-c874-4e64-b207-48ba02de0b81",
|
||
|
|
"url--5720687d-c874-4e64-b207-48ba02de0b81",
|
||
|
|
"indicator--5720687d-9bd4-45c1-ae92-4a7402de0b81",
|
||
|
|
"indicator--5720687d-a41c-47f7-999b-48b002de0b81",
|
||
|
|
"observed-data--5720687e-b544-490f-9475-47b402de0b81",
|
||
|
|
"url--5720687e-b544-490f-9475-47b402de0b81",
|
||
|
|
"indicator--5720687e-58ac-4dda-b11d-4d5f02de0b81",
|
||
|
|
"indicator--5720687e-69f0-4e06-bfb6-497602de0b81",
|
||
|
|
"observed-data--5720687f-da04-4f1c-b759-499b02de0b81",
|
||
|
|
"url--5720687f-da04-4f1c-b759-499b02de0b81",
|
||
|
|
"indicator--5720687f-8180-47c8-8cda-46fb02de0b81",
|
||
|
|
"indicator--5720687f-16bc-45d0-be6a-467f02de0b81",
|
||
|
|
"observed-data--57206880-44e4-47a5-97c7-4b4802de0b81",
|
||
|
|
"url--57206880-44e4-47a5-97c7-4b4802de0b81",
|
||
|
|
"indicator--57206880-7a7c-425b-9987-4f9302de0b81",
|
||
|
|
"indicator--57206881-a5c4-44cd-a3a5-49e302de0b81",
|
||
|
|
"observed-data--57206881-88f4-44b5-942d-4dc102de0b81",
|
||
|
|
"url--57206881-88f4-44b5-942d-4dc102de0b81",
|
||
|
|
"x-misp-attribute--57206961-530c-481e-a074-4466950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"type:OSINT"
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5720672e-e3ec-4191-bec0-475a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:15:58.000Z",
|
||
|
|
"modified": "2016-04-27T07:15:58.000Z",
|
||
|
|
"description": "Unique C2 Hostnames",
|
||
|
|
"pattern": "[domain-name:value = 'news.tibetgroupworks.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-27T07:15:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5720672e-28d4-4158-b7ff-4cde950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:15:58.000Z",
|
||
|
|
"modified": "2016-04-27T07:15:58.000Z",
|
||
|
|
"description": "Unique C2 Hostnames",
|
||
|
|
"pattern": "[domain-name:value = 'web.microsoftdefence.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-27T07:15:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5720672e-d8ac-43c2-b401-47c9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:15:58.000Z",
|
||
|
|
"modified": "2016-04-27T07:15:58.000Z",
|
||
|
|
"description": "Unique C2 Hostnames",
|
||
|
|
"pattern": "[domain-name:value = 'admin.nslookupdns.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-27T07:15:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5720672f-5cc0-45f3-8335-45ba950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:15:59.000Z",
|
||
|
|
"modified": "2016-04-27T07:15:59.000Z",
|
||
|
|
"description": "Unique C2 Hostnames",
|
||
|
|
"pattern": "[domain-name:value = 'jackhex.md5c.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-27T07:15:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5720672f-64ac-42fa-8431-4f09950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:15:59.000Z",
|
||
|
|
"modified": "2016-04-27T07:15:59.000Z",
|
||
|
|
"description": "Unique C2 Hostnames",
|
||
|
|
"pattern": "[domain-name:value = 'webserver.servehttp.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-27T07:15:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57206839-7adc-45ad-b90c-4393950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:20:25.000Z",
|
||
|
|
"modified": "2016-04-27T07:20:25.000Z",
|
||
|
|
"description": "Malware sample",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '63e00dbf45961ad11bd1eb55dff9c2771c2916a6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-27T07:20:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57206839-2274-4fa4-91a2-4aee950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:20:25.000Z",
|
||
|
|
"modified": "2016-04-27T07:20:25.000Z",
|
||
|
|
"description": "Malware sample",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '675a3247f4c0e1105a41c685f4c2fb606e5b1eac']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-27T07:20:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5720683a-a1dc-4777-9b22-40e3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:20:26.000Z",
|
||
|
|
"modified": "2016-04-27T07:20:26.000Z",
|
||
|
|
"description": "Malware sample",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '49e36de6d757ca44c43d5670d497bd8738c1d2a4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-27T07:20:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5720683a-de00-499a-9963-4a6b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:20:26.000Z",
|
||
|
|
"modified": "2016-04-27T07:20:26.000Z",
|
||
|
|
"description": "Malware sample",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'cbbfc3b5ff08de14fdb2316f3b14886dfe5504ef']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-27T07:20:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5720683a-70c4-4d63-a8f0-460f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:20:26.000Z",
|
||
|
|
"modified": "2016-04-27T07:20:26.000Z",
|
||
|
|
"description": "Malware sample",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a7d206791b1cdec616e9b18ae6fa1548ca96a321']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-27T07:20:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5720683b-c4a4-4f2f-91d6-42d5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:20:27.000Z",
|
||
|
|
"modified": "2016-04-27T07:20:27.000Z",
|
||
|
|
"description": "Malware sample",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'ec646c57f9ac5e56230a17aeca6523a4532ff472']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-27T07:20:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5720683b-f100-4756-a65f-489c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:20:27.000Z",
|
||
|
|
"modified": "2016-04-27T07:20:27.000Z",
|
||
|
|
"description": "Malware sample",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'ef2618d58bd50fa232a19f9bcf3983d1e2dff266']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-27T07:20:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5720683c-6890-438f-b766-4576950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:20:28.000Z",
|
||
|
|
"modified": "2016-04-27T07:20:28.000Z",
|
||
|
|
"description": "Malware sample",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f389e1c970b2ca28112a30a8cfef1f3973fa82ea']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-27T07:20:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57206879-b23c-4749-95c9-433902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:21:29.000Z",
|
||
|
|
"modified": "2016-04-27T07:21:29.000Z",
|
||
|
|
"description": "Malware sample - Xchecked via VT: ef2618d58bd50fa232a19f9bcf3983d1e2dff266",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '02362ac6b456d3538b4a7ddd48690cabfaa466d346c72401a1286d28ddc6b04c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-27T07:21:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5720687a-4cfc-4c96-913d-4feb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:21:30.000Z",
|
||
|
|
"modified": "2016-04-27T07:21:30.000Z",
|
||
|
|
"description": "Malware sample - Xchecked via VT: ef2618d58bd50fa232a19f9bcf3983d1e2dff266",
|
||
|
|
"pattern": "[file:hashes.MD5 = '277f3ada5fc43284b84b3b0e0e10a413']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-27T07:21:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5720687a-9bd0-46be-bf8f-42b402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:21:30.000Z",
|
||
|
|
"modified": "2016-04-27T07:21:30.000Z",
|
||
|
|
"first_observed": "2016-04-27T07:21:30Z",
|
||
|
|
"last_observed": "2016-04-27T07:21:30Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5720687a-9bd0-46be-bf8f-42b402de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5720687a-9bd0-46be-bf8f-42b402de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/02362ac6b456d3538b4a7ddd48690cabfaa466d346c72401a1286d28ddc6b04c/analysis/1457540291/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5720687b-2e58-467a-b6c5-4a1a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:21:31.000Z",
|
||
|
|
"modified": "2016-04-27T07:21:31.000Z",
|
||
|
|
"description": "Malware sample - Xchecked via VT: ec646c57f9ac5e56230a17aeca6523a4532ff472",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3a9ab623c8a0a9f6c65e108e83c90da7620d2d6b22192c857556117587d0d038']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-27T07:21:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5720687b-b328-4db6-8d52-473a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:21:31.000Z",
|
||
|
|
"modified": "2016-04-27T07:21:31.000Z",
|
||
|
|
"description": "Malware sample - Xchecked via VT: ec646c57f9ac5e56230a17aeca6523a4532ff472",
|
||
|
|
"pattern": "[file:hashes.MD5 = '11eccf2c247dd4f9df730354b3e0947d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-27T07:21:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5720687b-3670-4619-9690-4b7502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:21:31.000Z",
|
||
|
|
"modified": "2016-04-27T07:21:31.000Z",
|
||
|
|
"first_observed": "2016-04-27T07:21:31Z",
|
||
|
|
"last_observed": "2016-04-27T07:21:31Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5720687b-3670-4619-9690-4b7502de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5720687b-3670-4619-9690-4b7502de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/3a9ab623c8a0a9f6c65e108e83c90da7620d2d6b22192c857556117587d0d038/analysis/1459493835/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5720687c-a6d0-4a40-81da-462102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:21:32.000Z",
|
||
|
|
"modified": "2016-04-27T07:21:32.000Z",
|
||
|
|
"description": "Malware sample - Xchecked via VT: a7d206791b1cdec616e9b18ae6fa1548ca96a321",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '81c07c15dd725f02f48859b6d493cd4b08f0a0939a57a7b2a869a8d71a3a1950']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-27T07:21:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5720687c-d4b0-4045-9f80-473602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:21:32.000Z",
|
||
|
|
"modified": "2016-04-27T07:21:32.000Z",
|
||
|
|
"description": "Malware sample - Xchecked via VT: a7d206791b1cdec616e9b18ae6fa1548ca96a321",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd2a4c1f91b2535cfe20c486fcdad907b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-27T07:21:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5720687d-c874-4e64-b207-48ba02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:21:33.000Z",
|
||
|
|
"modified": "2016-04-27T07:21:33.000Z",
|
||
|
|
"first_observed": "2016-04-27T07:21:33Z",
|
||
|
|
"last_observed": "2016-04-27T07:21:33Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5720687d-c874-4e64-b207-48ba02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5720687d-c874-4e64-b207-48ba02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/81c07c15dd725f02f48859b6d493cd4b08f0a0939a57a7b2a869a8d71a3a1950/analysis/1451297533/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5720687d-9bd4-45c1-ae92-4a7402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:21:33.000Z",
|
||
|
|
"modified": "2016-04-27T07:21:33.000Z",
|
||
|
|
"description": "Malware sample - Xchecked via VT: cbbfc3b5ff08de14fdb2316f3b14886dfe5504ef",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f7e667bc5d7d7e961f6afd880f979f4dfe52585e3379c5746a384d2a23b9fdf5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-27T07:21:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5720687d-a41c-47f7-999b-48b002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:21:33.000Z",
|
||
|
|
"modified": "2016-04-27T07:21:33.000Z",
|
||
|
|
"description": "Malware sample - Xchecked via VT: cbbfc3b5ff08de14fdb2316f3b14886dfe5504ef",
|
||
|
|
"pattern": "[file:hashes.MD5 = '241e30dd81588222c7f1ff92a53cc312']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-27T07:21:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5720687e-b544-490f-9475-47b402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:21:34.000Z",
|
||
|
|
"modified": "2016-04-27T07:21:34.000Z",
|
||
|
|
"first_observed": "2016-04-27T07:21:34Z",
|
||
|
|
"last_observed": "2016-04-27T07:21:34Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5720687e-b544-490f-9475-47b402de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5720687e-b544-490f-9475-47b402de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/f7e667bc5d7d7e961f6afd880f979f4dfe52585e3379c5746a384d2a23b9fdf5/analysis/1460040916/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5720687e-58ac-4dda-b11d-4d5f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:21:34.000Z",
|
||
|
|
"modified": "2016-04-27T07:21:34.000Z",
|
||
|
|
"description": "Malware sample - Xchecked via VT: 49e36de6d757ca44c43d5670d497bd8738c1d2a4",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8a013fad26ea7c6a710c1646716c8e09d044598d25683470775b0da6048542a8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-27T07:21:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5720687e-69f0-4e06-bfb6-497602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:21:34.000Z",
|
||
|
|
"modified": "2016-04-27T07:21:34.000Z",
|
||
|
|
"description": "Malware sample - Xchecked via VT: 49e36de6d757ca44c43d5670d497bd8738c1d2a4",
|
||
|
|
"pattern": "[file:hashes.MD5 = '96bff6ef607bbe07c49357d0c58714a5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-27T07:21:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5720687f-da04-4f1c-b759-499b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:21:35.000Z",
|
||
|
|
"modified": "2016-04-27T07:21:35.000Z",
|
||
|
|
"first_observed": "2016-04-27T07:21:35Z",
|
||
|
|
"last_observed": "2016-04-27T07:21:35Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5720687f-da04-4f1c-b759-499b02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5720687f-da04-4f1c-b759-499b02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/8a013fad26ea7c6a710c1646716c8e09d044598d25683470775b0da6048542a8/analysis/1459494481/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5720687f-8180-47c8-8cda-46fb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:21:35.000Z",
|
||
|
|
"modified": "2016-04-27T07:21:35.000Z",
|
||
|
|
"description": "Malware sample - Xchecked via VT: 675a3247f4c0e1105a41c685f4c2fb606e5b1eac",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1e2543e364217d9f48bf963709299fa54c381c6d583a419171d12e30d6e078e9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-27T07:21:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5720687f-16bc-45d0-be6a-467f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:21:35.000Z",
|
||
|
|
"modified": "2016-04-27T07:21:35.000Z",
|
||
|
|
"description": "Malware sample - Xchecked via VT: 675a3247f4c0e1105a41c685f4c2fb606e5b1eac",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'be06e2f28143abdbaf61819e1746dfbe']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-27T07:21:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--57206880-44e4-47a5-97c7-4b4802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:21:36.000Z",
|
||
|
|
"modified": "2016-04-27T07:21:36.000Z",
|
||
|
|
"first_observed": "2016-04-27T07:21:36Z",
|
||
|
|
"last_observed": "2016-04-27T07:21:36Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--57206880-44e4-47a5-97c7-4b4802de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--57206880-44e4-47a5-97c7-4b4802de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/1e2543e364217d9f48bf963709299fa54c381c6d583a419171d12e30d6e078e9/analysis/1460373004/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57206880-7a7c-425b-9987-4f9302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:21:36.000Z",
|
||
|
|
"modified": "2016-04-27T07:21:36.000Z",
|
||
|
|
"description": "Malware sample - Xchecked via VT: 63e00dbf45961ad11bd1eb55dff9c2771c2916a6",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ac8fc264c7ec3cf70836e1bb21f9a20174b04ad49731b8797d7d8bb95cb353e2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-27T07:21:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57206881-a5c4-44cd-a3a5-49e302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:21:37.000Z",
|
||
|
|
"modified": "2016-04-27T07:21:37.000Z",
|
||
|
|
"description": "Malware sample - Xchecked via VT: 63e00dbf45961ad11bd1eb55dff9c2771c2916a6",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9dd6fb40a7ace992bedc283dee79f50b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-04-27T07:21:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--57206881-88f4-44b5-942d-4dc102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:21:37.000Z",
|
||
|
|
"modified": "2016-04-27T07:21:37.000Z",
|
||
|
|
"first_observed": "2016-04-27T07:21:37Z",
|
||
|
|
"last_observed": "2016-04-27T07:21:37Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--57206881-88f4-44b5-942d-4dc102de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--57206881-88f4-44b5-942d-4dc102de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/ac8fc264c7ec3cf70836e1bb21f9a20174b04ad49731b8797d7d8bb95cb353e2/analysis/1461585828/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--57206961-530c-481e-a074-4466950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-04-27T07:25:21.000Z",
|
||
|
|
"modified": "2016-04-27T07:25:21.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"comment\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "External analysis",
|
||
|
|
"x_misp_type": "comment",
|
||
|
|
"x_misp_value": "The infamous Remote Access Trojan (RAT) Poison Ivy (hereafter referred to as PIVY) has resurfaced recently, and exhibits some new behaviors. PIVY has been observed targeting a number of Asian countries for various purposes over the past year. Palo Alto Networks\u00e2\u20ac\u2122 Unit 42 recently blogged about a new Poison Ivy variant targeting Hong Kong activists dubbed SPIVY that uses DLL sideloading and operates quite differently from a variant recently observed by ASERT that has been active for at least the past 12 months."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|