1095 lines
46 KiB
JSON
1095 lines
46 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--5739b34f-01ac-4e80-a403-4a1502de0b81",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:58:25.000Z",
|
||
|
|
"modified": "2016-05-16T11:58:25.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--5739b34f-01ac-4e80-a403-4a1502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:58:25.000Z",
|
||
|
|
"modified": "2016-05-16T11:58:25.000Z",
|
||
|
|
"name": "OSINT - Hancitor and Ruckguv Reappear, Updated and With Vawtrak On Deck",
|
||
|
|
"published": "2016-05-16T11:58:58Z",
|
||
|
|
"object_refs": [
|
||
|
|
"observed-data--5739b382-e464-4c58-bf66-44c302de0b81",
|
||
|
|
"url--5739b382-e464-4c58-bf66-44c302de0b81",
|
||
|
|
"x-misp-attribute--5739b397-f144-48c0-a8a7-472d02de0b81",
|
||
|
|
"indicator--5739b3d6-068c-42fb-83f4-4b0c02de0b81",
|
||
|
|
"indicator--5739b3d6-0940-4787-9571-44b502de0b81",
|
||
|
|
"indicator--5739b3d6-cd9c-4e5f-b332-473502de0b81",
|
||
|
|
"indicator--5739b3d7-b578-440d-9e5c-4db202de0b81",
|
||
|
|
"indicator--5739b3d7-6b0c-47db-a983-4bb302de0b81",
|
||
|
|
"indicator--5739b405-8604-4bb7-b7bc-4e6b02de0b81",
|
||
|
|
"indicator--5739b406-b970-4bb2-afc1-416902de0b81",
|
||
|
|
"indicator--5739b406-cbe4-490c-b81a-451502de0b81",
|
||
|
|
"indicator--5739b406-498c-44f0-94cd-481202de0b81",
|
||
|
|
"indicator--5739b48a-5510-41e1-952a-4fc402de0b81",
|
||
|
|
"indicator--5739b48a-1098-4ba4-a3f6-4c0d02de0b81",
|
||
|
|
"indicator--5739b535-745c-4fa5-b5d3-445202de0b81",
|
||
|
|
"indicator--5739b535-3bb0-45bc-b8fc-4ebb02de0b81",
|
||
|
|
"indicator--5739b535-28d8-47c7-be75-4af502de0b81",
|
||
|
|
"indicator--5739b535-968c-4cd1-b88f-406402de0b81",
|
||
|
|
"indicator--5739b59e-fbc4-4aca-9af5-4ee902de0b81",
|
||
|
|
"indicator--5739b59e-0b48-44e9-a8aa-406d02de0b81",
|
||
|
|
"indicator--5739b59f-3eec-4b2c-b62f-499702de0b81",
|
||
|
|
"indicator--5739b59f-9be8-43b9-8654-4dd902de0b81",
|
||
|
|
"indicator--5739b5e1-872c-459b-9c96-454e02de0b81",
|
||
|
|
"indicator--5739b5e1-99c4-4e19-8650-4d0b02de0b81",
|
||
|
|
"observed-data--5739b5e1-9d14-482a-bb1f-455f02de0b81",
|
||
|
|
"url--5739b5e1-9d14-482a-bb1f-455f02de0b81",
|
||
|
|
"indicator--5739b5e1-6710-4847-ba02-4d3a02de0b81",
|
||
|
|
"indicator--5739b5e1-06e0-4766-930e-4f2802de0b81",
|
||
|
|
"observed-data--5739b5e2-97e8-4de1-af00-42ab02de0b81",
|
||
|
|
"url--5739b5e2-97e8-4de1-af00-42ab02de0b81",
|
||
|
|
"indicator--5739b5e2-b92c-4d17-adaa-456502de0b81",
|
||
|
|
"indicator--5739b5e2-53d4-4158-99c8-491002de0b81",
|
||
|
|
"observed-data--5739b5e2-d658-4689-9c2b-4bae02de0b81",
|
||
|
|
"url--5739b5e2-d658-4689-9c2b-4bae02de0b81",
|
||
|
|
"indicator--5739b5e2-37c0-467d-bf51-49f102de0b81",
|
||
|
|
"indicator--5739b5e3-8d3c-433c-9a2d-46bd02de0b81",
|
||
|
|
"observed-data--5739b5e3-c674-487a-acf4-4f1e02de0b81",
|
||
|
|
"url--5739b5e3-c674-487a-acf4-4f1e02de0b81",
|
||
|
|
"indicator--5739b5e3-e9ac-441e-9069-4b2502de0b81",
|
||
|
|
"indicator--5739b5e3-b1c8-40b6-8794-485802de0b81",
|
||
|
|
"observed-data--5739b5e3-a94c-4d1b-8d86-4f5002de0b81",
|
||
|
|
"url--5739b5e3-a94c-4d1b-8d86-4f5002de0b81",
|
||
|
|
"indicator--5739b5e4-3590-4015-a1de-4a0e02de0b81",
|
||
|
|
"indicator--5739b5e4-b2c0-4339-a778-48bb02de0b81",
|
||
|
|
"observed-data--5739b5e4-5af8-4ccc-bd61-496202de0b81",
|
||
|
|
"url--5739b5e4-5af8-4ccc-bd61-496202de0b81",
|
||
|
|
"indicator--5739b5e4-3c40-40e7-84f7-474b02de0b81",
|
||
|
|
"indicator--5739b5e4-f720-4f41-8d10-46cb02de0b81",
|
||
|
|
"observed-data--5739b5e4-3f5c-4b59-aa26-4f1e02de0b81",
|
||
|
|
"url--5739b5e4-3f5c-4b59-aa26-4f1e02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"type:OSINT"
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5739b382-e464-4c58-bf66-44c302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:48:18.000Z",
|
||
|
|
"modified": "2016-05-16T11:48:18.000Z",
|
||
|
|
"first_observed": "2016-05-16T11:48:18Z",
|
||
|
|
"last_observed": "2016-05-16T11:48:18Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5739b382-e464-4c58-bf66-44c302de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5739b382-e464-4c58-bf66-44c302de0b81",
|
||
|
|
"value": "https://www.proofpoint.com/us/threat-insight/post/hancitor-ruckguv-reappear"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--5739b397-f144-48c0-a8a7-472d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:48:39.000Z",
|
||
|
|
"modified": "2016-05-16T11:48:39.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"comment\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "External analysis",
|
||
|
|
"x_misp_type": "comment",
|
||
|
|
"x_misp_value": "Proofpoint researchers have recently observed the re-emergence of two malware downloaders that had largely disappeared for several months. Hancitor (also known as Tordal and Chanitor) and Ruckguv have reappeared in campaigns distributing Pony and Vawtrak with significant updates and increased functionality. We have also been tracking an actor experimenting with various loaders, providing insights into these evolving components of malware ecosystems."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5739b3d6-068c-42fb-83f4-4b0c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:49:42.000Z",
|
||
|
|
"modified": "2016-05-16T11:49:42.000Z",
|
||
|
|
"description": "Ruckguv downloading Pony",
|
||
|
|
"pattern": "[url:value = 'http://logimax.net.in/ii.exe']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-16T11:49:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5739b3d6-0940-4787-9571-44b502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:49:42.000Z",
|
||
|
|
"modified": "2016-05-16T11:49:42.000Z",
|
||
|
|
"description": "Ruckguv downloading Pony",
|
||
|
|
"pattern": "[url:value = 'http://tourjacket.me/ii.exe']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-16T11:49:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5739b3d6-cd9c-4e5f-b332-473502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:49:42.000Z",
|
||
|
|
"modified": "2016-05-16T11:49:42.000Z",
|
||
|
|
"description": "Ruckguv downloading Pony",
|
||
|
|
"pattern": "[url:value = 'http://urbanrecreation.eu/ii.exe']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-16T11:49:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5739b3d7-b578-440d-9e5c-4db202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:49:43.000Z",
|
||
|
|
"modified": "2016-05-16T11:49:43.000Z",
|
||
|
|
"description": "Ruckguv downloading Pony",
|
||
|
|
"pattern": "[url:value = 'http://tantrix.com.tr/pm.dll']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-16T11:49:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5739b3d7-6b0c-47db-a983-4bb302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:49:43.000Z",
|
||
|
|
"modified": "2016-05-16T11:49:43.000Z",
|
||
|
|
"description": "Ruckguv downloading Pony",
|
||
|
|
"pattern": "[url:value = 'http://therapeutica.com.br/pm.dll']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-16T11:49:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5739b405-8604-4bb7-b7bc-4e6b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:50:29.000Z",
|
||
|
|
"modified": "2016-05-16T11:50:29.000Z",
|
||
|
|
"description": "Hancitor C2",
|
||
|
|
"pattern": "[url:value = 'http://hadfanawass.com/sl/gate.php']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-16T11:50:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5739b406-b970-4bb2-afc1-416902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:50:30.000Z",
|
||
|
|
"modified": "2016-05-16T11:50:30.000Z",
|
||
|
|
"description": "Hancitor C2",
|
||
|
|
"pattern": "[url:value = 'http://rophenreswi.ru/sl/gate.php']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-16T11:50:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5739b406-cbe4-490c-b81a-451502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:50:30.000Z",
|
||
|
|
"modified": "2016-05-16T11:50:30.000Z",
|
||
|
|
"description": "Hancitor C2",
|
||
|
|
"pattern": "[url:value = 'http://mihesfitons.ru/sl/gate.php']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-16T11:50:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5739b406-498c-44f0-94cd-481202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:50:30.000Z",
|
||
|
|
"modified": "2016-05-16T11:50:30.000Z",
|
||
|
|
"description": "Hancitor C2",
|
||
|
|
"pattern": "[url:value = 'https://krrewiaog3u4npcg.onion.to/sl/gate.php']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-16T11:50:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5739b48a-5510-41e1-952a-4fc402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:52:42.000Z",
|
||
|
|
"modified": "2016-05-16T11:52:42.000Z",
|
||
|
|
"description": "Hancitor downloading Pony",
|
||
|
|
"pattern": "[url:value = 'http://quoapps.es/pm.dll']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-16T11:52:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5739b48a-1098-4ba4-a3f6-4c0d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:52:42.000Z",
|
||
|
|
"modified": "2016-05-16T11:52:42.000Z",
|
||
|
|
"description": "Hancitor downloading Pony",
|
||
|
|
"pattern": "[url:value = 'http://posturepals.es/inst1.exe']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-16T11:52:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5739b535-745c-4fa5-b5d3-445202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:55:33.000Z",
|
||
|
|
"modified": "2016-05-16T11:55:33.000Z",
|
||
|
|
"description": "Document that dropped Ruckguv on May 4",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b1ba251cf4f494a00ff0d64a50004d839928dac816afb81c33af51622baf2c12']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-16T11:55:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5739b535-3bb0-45bc-b8fc-4ebb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:55:33.000Z",
|
||
|
|
"modified": "2016-05-16T11:55:33.000Z",
|
||
|
|
"description": "Ruckguv",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0b6e868c196c7ad80fac72a7d02159cfa4f72ad657604cd3e5eb03c796df01ba']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-16T11:55:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5739b535-28d8-47c7-be75-4af502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:55:33.000Z",
|
||
|
|
"modified": "2016-05-16T11:55:33.000Z",
|
||
|
|
"description": "Pony (Ruckguv module)",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2ccebf5fee30073e849895c6e43f6519017f226281c80177d72febcfbaf1f0d3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-16T11:55:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5739b535-968c-4cd1-b88f-406402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:55:33.000Z",
|
||
|
|
"modified": "2016-05-16T11:55:33.000Z",
|
||
|
|
"description": "Vawtrak (Ruckguv payload)",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9b11304e4362a8fbe2ee91d8e31d7ae5774019aaeef9240c6878da78bdf0bfa9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-16T11:55:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5739b59e-fbc4-4aca-9af5-4ee902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:57:18.000Z",
|
||
|
|
"modified": "2016-05-16T11:57:18.000Z",
|
||
|
|
"description": "Document that dropped Hancitor on April 28",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9b3fa5dc3b340e0df08d26dd53cd3aa83212950b2d41cf1b1e5a6dd1acd0e4df']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-16T11:57:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5739b59e-0b48-44e9-a8aa-406d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:57:18.000Z",
|
||
|
|
"modified": "2016-05-16T11:57:18.000Z",
|
||
|
|
"description": "Hancitor",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5ec4ba1a97500e664af6896f4c02846ca6777e671bb600103dc8d49224e38f48']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-16T11:57:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5739b59f-3eec-4b2c-b62f-499702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:57:19.000Z",
|
||
|
|
"modified": "2016-05-16T11:57:19.000Z",
|
||
|
|
"description": "Pony (Hancitor module)",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b19ec186f59b1f72c768ed2fcd8344d75821e527870b71e8123db96f683f1b68']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-16T11:57:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5739b59f-9be8-43b9-8654-4dd902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:57:19.000Z",
|
||
|
|
"modified": "2016-05-16T11:57:19.000Z",
|
||
|
|
"description": "Vawtrak (Hancitor payload)",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ec9a14f442bbb549388c7a36f8f221fab4f8d3578540ad528f9cb12d35e73fa5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-16T11:57:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5739b5e1-872c-459b-9c96-454e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:58:25.000Z",
|
||
|
|
"modified": "2016-05-16T11:58:25.000Z",
|
||
|
|
"description": "Vawtrak (Hancitor payload) - Xchecked via VT: ec9a14f442bbb549388c7a36f8f221fab4f8d3578540ad528f9cb12d35e73fa5",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a35698fe9ef3c6215f50c06d3ef398e5bdeb8c6f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-16T11:58:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5739b5e1-99c4-4e19-8650-4d0b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:58:25.000Z",
|
||
|
|
"modified": "2016-05-16T11:58:25.000Z",
|
||
|
|
"description": "Vawtrak (Hancitor payload) - Xchecked via VT: ec9a14f442bbb549388c7a36f8f221fab4f8d3578540ad528f9cb12d35e73fa5",
|
||
|
|
"pattern": "[file:hashes.MD5 = '68793f7cc760048ba97eb1cc97252461']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-16T11:58:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5739b5e1-9d14-482a-bb1f-455f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:58:25.000Z",
|
||
|
|
"modified": "2016-05-16T11:58:25.000Z",
|
||
|
|
"first_observed": "2016-05-16T11:58:25Z",
|
||
|
|
"last_observed": "2016-05-16T11:58:25Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5739b5e1-9d14-482a-bb1f-455f02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5739b5e1-9d14-482a-bb1f-455f02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/ec9a14f442bbb549388c7a36f8f221fab4f8d3578540ad528f9cb12d35e73fa5/analysis/1462606723/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5739b5e1-6710-4847-ba02-4d3a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:58:25.000Z",
|
||
|
|
"modified": "2016-05-16T11:58:25.000Z",
|
||
|
|
"description": "Pony (Hancitor module) - Xchecked via VT: b19ec186f59b1f72c768ed2fcd8344d75821e527870b71e8123db96f683f1b68",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '3a7ad22bb6f4953c7bbcaec85680c6a9be03af46']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-16T11:58:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5739b5e1-06e0-4766-930e-4f2802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:58:25.000Z",
|
||
|
|
"modified": "2016-05-16T11:58:25.000Z",
|
||
|
|
"description": "Pony (Hancitor module) - Xchecked via VT: b19ec186f59b1f72c768ed2fcd8344d75821e527870b71e8123db96f683f1b68",
|
||
|
|
"pattern": "[file:hashes.MD5 = '21eb66fd849c57ce2c69e3e1ad1b064c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-16T11:58:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5739b5e2-97e8-4de1-af00-42ab02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:58:26.000Z",
|
||
|
|
"modified": "2016-05-16T11:58:26.000Z",
|
||
|
|
"first_observed": "2016-05-16T11:58:26Z",
|
||
|
|
"last_observed": "2016-05-16T11:58:26Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5739b5e2-97e8-4de1-af00-42ab02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5739b5e2-97e8-4de1-af00-42ab02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/b19ec186f59b1f72c768ed2fcd8344d75821e527870b71e8123db96f683f1b68/analysis/1463121357/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5739b5e2-b92c-4d17-adaa-456502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:58:26.000Z",
|
||
|
|
"modified": "2016-05-16T11:58:26.000Z",
|
||
|
|
"description": "Hancitor - Xchecked via VT: 5ec4ba1a97500e664af6896f4c02846ca6777e671bb600103dc8d49224e38f48",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'dbb61c1e21440dd671eeb76576aa293ae1ef117c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-16T11:58:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5739b5e2-53d4-4158-99c8-491002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:58:26.000Z",
|
||
|
|
"modified": "2016-05-16T11:58:26.000Z",
|
||
|
|
"description": "Hancitor - Xchecked via VT: 5ec4ba1a97500e664af6896f4c02846ca6777e671bb600103dc8d49224e38f48",
|
||
|
|
"pattern": "[file:hashes.MD5 = '2c1e65962b41bcd1ffef977870f083fa']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-16T11:58:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5739b5e2-d658-4689-9c2b-4bae02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:58:26.000Z",
|
||
|
|
"modified": "2016-05-16T11:58:26.000Z",
|
||
|
|
"first_observed": "2016-05-16T11:58:26Z",
|
||
|
|
"last_observed": "2016-05-16T11:58:26Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5739b5e2-d658-4689-9c2b-4bae02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5739b5e2-d658-4689-9c2b-4bae02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/5ec4ba1a97500e664af6896f4c02846ca6777e671bb600103dc8d49224e38f48/analysis/1463383176/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5739b5e2-37c0-467d-bf51-49f102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:58:26.000Z",
|
||
|
|
"modified": "2016-05-16T11:58:26.000Z",
|
||
|
|
"description": "Document that dropped Hancitor on April 28 - Xchecked via VT: 9b3fa5dc3b340e0df08d26dd53cd3aa83212950b2d41cf1b1e5a6dd1acd0e4df",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '64d8f9d5c127a53c124ba4aef48662cbf3919ea6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-16T11:58:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5739b5e3-8d3c-433c-9a2d-46bd02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:58:27.000Z",
|
||
|
|
"modified": "2016-05-16T11:58:27.000Z",
|
||
|
|
"description": "Document that dropped Hancitor on April 28 - Xchecked via VT: 9b3fa5dc3b340e0df08d26dd53cd3aa83212950b2d41cf1b1e5a6dd1acd0e4df",
|
||
|
|
"pattern": "[file:hashes.MD5 = '50be8add4e5a01175808893af56468bd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-16T11:58:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5739b5e3-c674-487a-acf4-4f1e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:58:27.000Z",
|
||
|
|
"modified": "2016-05-16T11:58:27.000Z",
|
||
|
|
"first_observed": "2016-05-16T11:58:27Z",
|
||
|
|
"last_observed": "2016-05-16T11:58:27Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5739b5e3-c674-487a-acf4-4f1e02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5739b5e3-c674-487a-acf4-4f1e02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/9b3fa5dc3b340e0df08d26dd53cd3aa83212950b2d41cf1b1e5a6dd1acd0e4df/analysis/1462606671/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5739b5e3-e9ac-441e-9069-4b2502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:58:27.000Z",
|
||
|
|
"modified": "2016-05-16T11:58:27.000Z",
|
||
|
|
"description": "Vawtrak (Ruckguv payload) - Xchecked via VT: 9b11304e4362a8fbe2ee91d8e31d7ae5774019aaeef9240c6878da78bdf0bfa9",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '375133988496954a4e59083f4e8510a26ab394e3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-16T11:58:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5739b5e3-b1c8-40b6-8794-485802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:58:27.000Z",
|
||
|
|
"modified": "2016-05-16T11:58:27.000Z",
|
||
|
|
"description": "Vawtrak (Ruckguv payload) - Xchecked via VT: 9b11304e4362a8fbe2ee91d8e31d7ae5774019aaeef9240c6878da78bdf0bfa9",
|
||
|
|
"pattern": "[file:hashes.MD5 = '8dc5fd222426538698ab5b7975ada717']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-16T11:58:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5739b5e3-a94c-4d1b-8d86-4f5002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:58:27.000Z",
|
||
|
|
"modified": "2016-05-16T11:58:27.000Z",
|
||
|
|
"first_observed": "2016-05-16T11:58:27Z",
|
||
|
|
"last_observed": "2016-05-16T11:58:27Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5739b5e3-a94c-4d1b-8d86-4f5002de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5739b5e3-a94c-4d1b-8d86-4f5002de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/9b11304e4362a8fbe2ee91d8e31d7ae5774019aaeef9240c6878da78bdf0bfa9/analysis/1463212109/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5739b5e4-3590-4015-a1de-4a0e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:58:28.000Z",
|
||
|
|
"modified": "2016-05-16T11:58:28.000Z",
|
||
|
|
"description": "Pony (Ruckguv module) - Xchecked via VT: 2ccebf5fee30073e849895c6e43f6519017f226281c80177d72febcfbaf1f0d3",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'e5884dbd7b4504a95f7fe0c6db1b2f62b3cb96d2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-16T11:58:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5739b5e4-b2c0-4339-a778-48bb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:58:28.000Z",
|
||
|
|
"modified": "2016-05-16T11:58:28.000Z",
|
||
|
|
"description": "Pony (Ruckguv module) - Xchecked via VT: 2ccebf5fee30073e849895c6e43f6519017f226281c80177d72febcfbaf1f0d3",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'e7f103eacd306f9fa7484f3783ca40f0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-16T11:58:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5739b5e4-5af8-4ccc-bd61-496202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:58:28.000Z",
|
||
|
|
"modified": "2016-05-16T11:58:28.000Z",
|
||
|
|
"first_observed": "2016-05-16T11:58:28Z",
|
||
|
|
"last_observed": "2016-05-16T11:58:28Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5739b5e4-5af8-4ccc-bd61-496202de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5739b5e4-5af8-4ccc-bd61-496202de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/2ccebf5fee30073e849895c6e43f6519017f226281c80177d72febcfbaf1f0d3/analysis/1463383601/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5739b5e4-3c40-40e7-84f7-474b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:58:28.000Z",
|
||
|
|
"modified": "2016-05-16T11:58:28.000Z",
|
||
|
|
"description": "Ruckguv - Xchecked via VT: 0b6e868c196c7ad80fac72a7d02159cfa4f72ad657604cd3e5eb03c796df01ba",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'd7895d3b24fb1e4e4d62361fcd365ca3062acf62']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-16T11:58:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5739b5e4-f720-4f41-8d10-46cb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:58:28.000Z",
|
||
|
|
"modified": "2016-05-16T11:58:28.000Z",
|
||
|
|
"description": "Ruckguv - Xchecked via VT: 0b6e868c196c7ad80fac72a7d02159cfa4f72ad657604cd3e5eb03c796df01ba",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'aebefd65569920aa7ae61171ebc65af6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-16T11:58:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5739b5e4-3f5c-4b59-aa26-4f1e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-16T11:58:28.000Z",
|
||
|
|
"modified": "2016-05-16T11:58:28.000Z",
|
||
|
|
"first_observed": "2016-05-16T11:58:28Z",
|
||
|
|
"last_observed": "2016-05-16T11:58:28Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5739b5e4-3f5c-4b59-aa26-4f1e02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5739b5e4-3f5c-4b59-aa26-4f1e02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/0b6e868c196c7ad80fac72a7d02159cfa4f72ad657604cd3e5eb03c796df01ba/analysis/1463383560/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|