1027 lines
43 KiB
JSON
1027 lines
43 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--57454ee0-3294-407a-8468-493c950d210f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:34:51.000Z",
|
||
|
|
"modified": "2016-05-25T07:34:51.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--57454ee0-3294-407a-8468-493c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:34:51.000Z",
|
||
|
|
"modified": "2016-05-25T07:34:51.000Z",
|
||
|
|
"name": "OSINT - New Wekby Attacks Use DNS Requests As Command and Control Mechanism",
|
||
|
|
"published": "2016-05-25T07:48:54Z",
|
||
|
|
"object_refs": [
|
||
|
|
"indicator--57455077-0144-41d3-b61f-4420950d210f",
|
||
|
|
"indicator--57455077-e4e8-46e7-8528-4fe1950d210f",
|
||
|
|
"indicator--57455078-6e98-4713-ae9a-4370950d210f",
|
||
|
|
"indicator--57455078-5aa8-4a30-9f3e-48ee950d210f",
|
||
|
|
"indicator--57455078-7a08-49da-a316-463f950d210f",
|
||
|
|
"indicator--57455079-8b60-418f-8579-4b4c950d210f",
|
||
|
|
"indicator--57455079-d494-4a47-9489-48a9950d210f",
|
||
|
|
"indicator--57455119-805c-49dd-b728-4394950d210f",
|
||
|
|
"indicator--57455119-2dcc-40d1-aa46-44a9950d210f",
|
||
|
|
"indicator--57455119-880c-48af-a815-4de3950d210f",
|
||
|
|
"indicator--5745511a-9328-4035-85c8-456f950d210f",
|
||
|
|
"indicator--5745511a-e1e4-4728-8b1a-441b950d210f",
|
||
|
|
"indicator--5745511a-1828-434d-bfbe-40fa950d210f",
|
||
|
|
"indicator--5745511b-5548-434d-a276-4bb1950d210f",
|
||
|
|
"observed-data--5745513e-e4c4-429d-98fb-40f5950d210f",
|
||
|
|
"url--5745513e-e4c4-429d-98fb-40f5950d210f",
|
||
|
|
"observed-data--5745513f-68ac-4629-9b82-480d950d210f",
|
||
|
|
"url--5745513f-68ac-4629-9b82-480d950d210f",
|
||
|
|
"observed-data--5745513f-79fc-4aa8-a5e4-48bf950d210f",
|
||
|
|
"url--5745513f-79fc-4aa8-a5e4-48bf950d210f",
|
||
|
|
"observed-data--5745513f-98a4-4b12-a221-4f50950d210f",
|
||
|
|
"url--5745513f-98a4-4b12-a221-4f50950d210f",
|
||
|
|
"observed-data--57455140-3e14-4530-a551-4326950d210f",
|
||
|
|
"url--57455140-3e14-4530-a551-4326950d210f",
|
||
|
|
"observed-data--57455140-79a4-4aaf-a4e3-4882950d210f",
|
||
|
|
"url--57455140-79a4-4aaf-a4e3-4882950d210f",
|
||
|
|
"observed-data--57455182-0280-4cee-8e2e-4bbb950d210f",
|
||
|
|
"mutex--57455182-0280-4cee-8e2e-4bbb950d210f",
|
||
|
|
"indicator--5745559b-6988-419d-aa75-4c9302de0b81",
|
||
|
|
"indicator--5745559b-b154-4998-98af-425f02de0b81",
|
||
|
|
"observed-data--5745559b-948c-4fe7-9404-4ef902de0b81",
|
||
|
|
"url--5745559b-948c-4fe7-9404-4ef902de0b81",
|
||
|
|
"indicator--5745559b-e91c-488c-82cb-479a02de0b81",
|
||
|
|
"indicator--5745559c-6bac-4960-9e47-445402de0b81",
|
||
|
|
"observed-data--5745559c-cffc-4030-b815-486102de0b81",
|
||
|
|
"url--5745559c-cffc-4030-b815-486102de0b81",
|
||
|
|
"indicator--5745559c-c63c-45ac-9f98-43a702de0b81",
|
||
|
|
"indicator--5745559c-4324-4a68-ae68-422f02de0b81",
|
||
|
|
"observed-data--5745559c-2db8-4f32-af0f-498c02de0b81",
|
||
|
|
"url--5745559c-2db8-4f32-af0f-498c02de0b81",
|
||
|
|
"indicator--5745559d-dba8-4c1b-9fdc-49db02de0b81",
|
||
|
|
"indicator--5745559d-9b54-46fc-b82c-44c202de0b81",
|
||
|
|
"observed-data--5745559d-5274-4cd4-992a-4d6402de0b81",
|
||
|
|
"url--5745559d-5274-4cd4-992a-4d6402de0b81",
|
||
|
|
"indicator--5745559d-0054-4721-a70e-4d3502de0b81",
|
||
|
|
"indicator--5745559d-5e58-4eaa-bc9b-4d3a02de0b81",
|
||
|
|
"observed-data--5745559e-fcb4-4847-a533-419402de0b81",
|
||
|
|
"url--5745559e-fcb4-4847-a533-419402de0b81",
|
||
|
|
"indicator--5745559e-c110-4754-af54-43a302de0b81",
|
||
|
|
"indicator--5745559e-f960-43d3-974a-410702de0b81",
|
||
|
|
"observed-data--5745559e-b6b0-419c-b1fc-469f02de0b81",
|
||
|
|
"url--5745559e-b6b0-419c-b1fc-469f02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"type:OSINT"
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57455077-0144-41d3-b61f-4420950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:12:55.000Z",
|
||
|
|
"modified": "2016-05-25T07:12:55.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'da3261c332e72e4c1641ca0de439af280e064b224d950817a11922a8078b11f1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-25T07:12:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57455077-e4e8-46e7-8528-4fe1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:12:55.000Z",
|
||
|
|
"modified": "2016-05-25T07:12:55.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '930772d6af8f43f62ea78092914fa8d6b03e8e3360dd4678eec1a3dda17206ed']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-25T07:12:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57455078-6e98-4713-ae9a-4370950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:12:56.000Z",
|
||
|
|
"modified": "2016-05-25T07:12:56.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6852ba95720af64809995e04f4818517ca1bd650bc42ea86d9adfdb018d6b274']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-25T07:12:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57455078-5aa8-4a30-9f3e-48ee950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:12:56.000Z",
|
||
|
|
"modified": "2016-05-25T07:12:56.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9200f80c08b21ebae065141f0367f9c88f8fed896b0b4af9ec30fc98c606129b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-25T07:12:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57455078-7a08-49da-a316-463f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:12:56.000Z",
|
||
|
|
"modified": "2016-05-25T07:12:56.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4d62caef1ca8f4f9aead7823c95228a52852a1145ca6aaa58ad8493e042aed16']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-25T07:12:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57455079-8b60-418f-8579-4b4c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:12:57.000Z",
|
||
|
|
"modified": "2016-05-25T07:12:57.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1b341dab023de64598d80456349db146aafe9b9e2ec24490c7d0ac881cecc094']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-25T07:12:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57455079-d494-4a47-9489-48a9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:12:57.000Z",
|
||
|
|
"modified": "2016-05-25T07:12:57.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '456fffc256422ad667ca023d694494881baed1496a3067485d56ecc8fefbfaeb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-25T07:12:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57455119-805c-49dd-b728-4394950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:15:37.000Z",
|
||
|
|
"modified": "2016-05-25T07:15:37.000Z",
|
||
|
|
"description": "DNS exfiltration",
|
||
|
|
"pattern": "[domain-name:value = 'ns1.logitech-usa.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-25T07:15:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57455119-2dcc-40d1-aa46-44a9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:15:37.000Z",
|
||
|
|
"modified": "2016-05-25T07:15:37.000Z",
|
||
|
|
"description": "Delivery of the initial file",
|
||
|
|
"pattern": "[domain-name:value = 'globalprint-us.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-25T07:15:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57455119-880c-48af-a815-4de3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:15:37.000Z",
|
||
|
|
"modified": "2016-05-25T07:15:37.000Z",
|
||
|
|
"description": "Imported via the Freetext Import Tool",
|
||
|
|
"pattern": "[domain-name:value = 'intranetwabcam.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-25T07:15:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5745511a-9328-4035-85c8-456f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:15:38.000Z",
|
||
|
|
"modified": "2016-05-25T07:15:38.000Z",
|
||
|
|
"description": "Imported via the Freetext Import Tool",
|
||
|
|
"pattern": "[domain-name:value = 'login.access-mail.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-25T07:15:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5745511a-e1e4-4728-8b1a-441b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:15:38.000Z",
|
||
|
|
"modified": "2016-05-25T07:15:38.000Z",
|
||
|
|
"description": "Imported via the Freetext Import Tool",
|
||
|
|
"pattern": "[domain-name:value = 'glb.it-desktop.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-25T07:15:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5745511a-1828-434d-bfbe-40fa950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:15:38.000Z",
|
||
|
|
"modified": "2016-05-25T07:15:38.000Z",
|
||
|
|
"description": "Imported via the Freetext Import Tool",
|
||
|
|
"pattern": "[domain-name:value = 'local.it-desktop.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-25T07:15:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5745511b-5548-434d-a276-4bb1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:15:39.000Z",
|
||
|
|
"modified": "2016-05-25T07:15:39.000Z",
|
||
|
|
"description": "Imported via the Freetext Import Tool",
|
||
|
|
"pattern": "[domain-name:value = 'hi.getgo2.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-25T07:15:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5745513e-e4c4-429d-98fb-40f5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:16:14.000Z",
|
||
|
|
"modified": "2016-05-25T07:16:14.000Z",
|
||
|
|
"first_observed": "2016-05-25T07:16:14Z",
|
||
|
|
"last_observed": "2016-05-25T07:16:14Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5745513e-e4c4-429d-98fb-40f5950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5745513e-e4c4-429d-98fb-40f5950d210f",
|
||
|
|
"value": "https://blog.anomali.com/evasive-maneuvers-the-wekby-group-attempts-to-evade-analysis-via-custom-rop"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5745513f-68ac-4629-9b82-480d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:16:15.000Z",
|
||
|
|
"modified": "2016-05-25T07:16:15.000Z",
|
||
|
|
"first_observed": "2016-05-25T07:16:15Z",
|
||
|
|
"last_observed": "2016-05-25T07:16:15Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5745513f-68ac-4629-9b82-480d950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5745513f-68ac-4629-9b82-480d950d210f",
|
||
|
|
"value": "http://www.volexity.com/blog/?p=158"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5745513f-79fc-4aa8-a5e4-48bf950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:16:15.000Z",
|
||
|
|
"modified": "2016-05-25T07:16:15.000Z",
|
||
|
|
"first_observed": "2016-05-25T07:16:15Z",
|
||
|
|
"last_observed": "2016-05-25T07:16:15Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5745513f-79fc-4aa8-a5e4-48bf950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5745513f-79fc-4aa8-a5e4-48bf950d210f",
|
||
|
|
"value": "https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5745513f-98a4-4b12-a221-4f50950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:16:15.000Z",
|
||
|
|
"modified": "2016-05-25T07:16:15.000Z",
|
||
|
|
"first_observed": "2016-05-25T07:16:15Z",
|
||
|
|
"last_observed": "2016-05-25T07:16:15Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5745513f-98a4-4b12-a221-4f50950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5745513f-98a4-4b12-a221-4f50950d210f",
|
||
|
|
"value": "https://www.zscaler.com/blogs/research/chinese-cyber-espionage-apt-group-leveraging-recently-leaked-hacking-team-exploits-target-financial-services-firm"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--57455140-3e14-4530-a551-4326950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:16:16.000Z",
|
||
|
|
"modified": "2016-05-25T07:16:16.000Z",
|
||
|
|
"first_observed": "2016-05-25T07:16:16Z",
|
||
|
|
"last_observed": "2016-05-25T07:16:16Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--57455140-3e14-4530-a551-4326950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--57455140-3e14-4530-a551-4326950d210f",
|
||
|
|
"value": "https://www.fireeye.com/blog/threat-research/2015/07/demonstrating_hustle.html"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--57455140-79a4-4aaf-a4e3-4882950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:16:16.000Z",
|
||
|
|
"modified": "2016-05-25T07:16:16.000Z",
|
||
|
|
"first_observed": "2016-05-25T07:16:16Z",
|
||
|
|
"last_observed": "2016-05-25T07:16:16Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--57455140-79a4-4aaf-a4e3-4882950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--57455140-79a4-4aaf-a4e3-4882950d210f",
|
||
|
|
"value": "http://researchcenter.paloaltonetworks.com/2016/05/unit42-new-wekby-attacks-use-dns-requests-as-command-and-control-mechanism/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--57455182-0280-4cee-8e2e-4bbb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:17:22.000Z",
|
||
|
|
"modified": "2016-05-25T07:17:22.000Z",
|
||
|
|
"first_observed": "2016-05-25T07:17:22Z",
|
||
|
|
"last_observed": "2016-05-25T07:17:22Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"mutex--57455182-0280-4cee-8e2e-4bbb950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"mutex\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "mutex",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "mutex--57455182-0280-4cee-8e2e-4bbb950d210f",
|
||
|
|
"name": ")!VoqA.I5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5745559b-6988-419d-aa75-4c9302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:34:51.000Z",
|
||
|
|
"modified": "2016-05-25T07:34:51.000Z",
|
||
|
|
"description": "- Xchecked via VT: 456fffc256422ad667ca023d694494881baed1496a3067485d56ecc8fefbfaeb",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '0d620c1c7e64a20a2918c0ec92260afc2716fd17']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-25T07:34:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5745559b-b154-4998-98af-425f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:34:51.000Z",
|
||
|
|
"modified": "2016-05-25T07:34:51.000Z",
|
||
|
|
"description": "- Xchecked via VT: 456fffc256422ad667ca023d694494881baed1496a3067485d56ecc8fefbfaeb",
|
||
|
|
"pattern": "[file:hashes.MD5 = '07b9b62fb3b1c068837c188fefbd5de9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-25T07:34:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5745559b-948c-4fe7-9404-4ef902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:34:51.000Z",
|
||
|
|
"modified": "2016-05-25T07:34:51.000Z",
|
||
|
|
"first_observed": "2016-05-25T07:34:51Z",
|
||
|
|
"last_observed": "2016-05-25T07:34:51Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5745559b-948c-4fe7-9404-4ef902de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5745559b-948c-4fe7-9404-4ef902de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/456fffc256422ad667ca023d694494881baed1496a3067485d56ecc8fefbfaeb/analysis/1463822200/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5745559b-e91c-488c-82cb-479a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:34:51.000Z",
|
||
|
|
"modified": "2016-05-25T07:34:51.000Z",
|
||
|
|
"description": "- Xchecked via VT: 1b341dab023de64598d80456349db146aafe9b9e2ec24490c7d0ac881cecc094",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '459d35058d4a5c8ca84638a5ea8fcbc2d4e0c772']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-25T07:34:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5745559c-6bac-4960-9e47-445402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:34:52.000Z",
|
||
|
|
"modified": "2016-05-25T07:34:52.000Z",
|
||
|
|
"description": "- Xchecked via VT: 1b341dab023de64598d80456349db146aafe9b9e2ec24490c7d0ac881cecc094",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'e5414c5215c9305feeebbe0dbee43567']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-25T07:34:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5745559c-cffc-4030-b815-486102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:34:52.000Z",
|
||
|
|
"modified": "2016-05-25T07:34:52.000Z",
|
||
|
|
"first_observed": "2016-05-25T07:34:52Z",
|
||
|
|
"last_observed": "2016-05-25T07:34:52Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5745559c-cffc-4030-b815-486102de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5745559c-cffc-4030-b815-486102de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/1b341dab023de64598d80456349db146aafe9b9e2ec24490c7d0ac881cecc094/analysis/1445829715/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5745559c-c63c-45ac-9f98-43a702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:34:52.000Z",
|
||
|
|
"modified": "2016-05-25T07:34:52.000Z",
|
||
|
|
"description": "- Xchecked via VT: 4d62caef1ca8f4f9aead7823c95228a52852a1145ca6aaa58ad8493e042aed16",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '326b5dfa775f7479862c8896e1906ba95e530f9b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-25T07:34:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5745559c-4324-4a68-ae68-422f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:34:52.000Z",
|
||
|
|
"modified": "2016-05-25T07:34:52.000Z",
|
||
|
|
"description": "- Xchecked via VT: 4d62caef1ca8f4f9aead7823c95228a52852a1145ca6aaa58ad8493e042aed16",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd0f79de7bd194c1843e7411c473e4288']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-25T07:34:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5745559c-2db8-4f32-af0f-498c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:34:52.000Z",
|
||
|
|
"modified": "2016-05-25T07:34:52.000Z",
|
||
|
|
"first_observed": "2016-05-25T07:34:52Z",
|
||
|
|
"last_observed": "2016-05-25T07:34:52Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5745559c-2db8-4f32-af0f-498c02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5745559c-2db8-4f32-af0f-498c02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/4d62caef1ca8f4f9aead7823c95228a52852a1145ca6aaa58ad8493e042aed16/analysis/1445828993/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5745559d-dba8-4c1b-9fdc-49db02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:34:53.000Z",
|
||
|
|
"modified": "2016-05-25T07:34:53.000Z",
|
||
|
|
"description": "- Xchecked via VT: 9200f80c08b21ebae065141f0367f9c88f8fed896b0b4af9ec30fc98c606129b",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '0e989a0867d6385ed0eda780a86a9229ac5b809e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-25T07:34:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5745559d-9b54-46fc-b82c-44c202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:34:53.000Z",
|
||
|
|
"modified": "2016-05-25T07:34:53.000Z",
|
||
|
|
"description": "- Xchecked via VT: 9200f80c08b21ebae065141f0367f9c88f8fed896b0b4af9ec30fc98c606129b",
|
||
|
|
"pattern": "[file:hashes.MD5 = '985eba97e12c3e5bce9221631fb66d68']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-25T07:34:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5745559d-5274-4cd4-992a-4d6402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:34:53.000Z",
|
||
|
|
"modified": "2016-05-25T07:34:53.000Z",
|
||
|
|
"first_observed": "2016-05-25T07:34:53Z",
|
||
|
|
"last_observed": "2016-05-25T07:34:53Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5745559d-5274-4cd4-992a-4d6402de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5745559d-5274-4cd4-992a-4d6402de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/9200f80c08b21ebae065141f0367f9c88f8fed896b0b4af9ec30fc98c606129b/analysis/1437393001/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5745559d-0054-4721-a70e-4d3502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:34:53.000Z",
|
||
|
|
"modified": "2016-05-25T07:34:53.000Z",
|
||
|
|
"description": "- Xchecked via VT: 6852ba95720af64809995e04f4818517ca1bd650bc42ea86d9adfdb018d6b274",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '1c581a09963109fc526a71adc5cde8e6c89ce615']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-25T07:34:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5745559d-5e58-4eaa-bc9b-4d3a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:34:53.000Z",
|
||
|
|
"modified": "2016-05-25T07:34:53.000Z",
|
||
|
|
"description": "- Xchecked via VT: 6852ba95720af64809995e04f4818517ca1bd650bc42ea86d9adfdb018d6b274",
|
||
|
|
"pattern": "[file:hashes.MD5 = '7b24d17e5f29e27b1c17127839be591a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-25T07:34:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5745559e-fcb4-4847-a533-419402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:34:54.000Z",
|
||
|
|
"modified": "2016-05-25T07:34:54.000Z",
|
||
|
|
"first_observed": "2016-05-25T07:34:54Z",
|
||
|
|
"last_observed": "2016-05-25T07:34:54Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5745559e-fcb4-4847-a533-419402de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5745559e-fcb4-4847-a533-419402de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/6852ba95720af64809995e04f4818517ca1bd650bc42ea86d9adfdb018d6b274/analysis/1447119998/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5745559e-c110-4754-af54-43a302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:34:54.000Z",
|
||
|
|
"modified": "2016-05-25T07:34:54.000Z",
|
||
|
|
"description": "- Xchecked via VT: da3261c332e72e4c1641ca0de439af280e064b224d950817a11922a8078b11f1",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c6db4ddc514869a41272abba5e10de70b888476a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-25T07:34:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5745559e-f960-43d3-974a-410702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:34:54.000Z",
|
||
|
|
"modified": "2016-05-25T07:34:54.000Z",
|
||
|
|
"description": "- Xchecked via VT: da3261c332e72e4c1641ca0de439af280e064b224d950817a11922a8078b11f1",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'e8d58aa76dd97536ac225949a2767e05']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-05-25T07:34:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5745559e-b6b0-419c-b1fc-469f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-05-25T07:34:54.000Z",
|
||
|
|
"modified": "2016-05-25T07:34:54.000Z",
|
||
|
|
"first_observed": "2016-05-25T07:34:54Z",
|
||
|
|
"last_observed": "2016-05-25T07:34:54Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5745559e-b6b0-419c-b1fc-469f02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5745559e-b6b0-419c-b1fc-469f02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/da3261c332e72e4c1641ca0de439af280e064b224d950817a11922a8078b11f1/analysis/1462960470/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|