524 lines
21 KiB
JSON
524 lines
21 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--57b5a864-be78-4eba-af85-4608950d210f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:32:42.000Z",
|
||
|
|
"modified": "2016-08-18T12:32:42.000Z",
|
||
|
|
"name": "CthulhuSPRL.be",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--57b5a864-be78-4eba-af85-4608950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:32:42.000Z",
|
||
|
|
"modified": "2016-08-18T12:32:42.000Z",
|
||
|
|
"name": "OSINT Shakti Trojan: Document Thief by Malwarebytes",
|
||
|
|
"published": "2016-08-18T12:37:57Z",
|
||
|
|
"object_refs": [
|
||
|
|
"observed-data--57b5a877-9d20-49f7-aa38-4c16950d210f",
|
||
|
|
"url--57b5a877-9d20-49f7-aa38-4c16950d210f",
|
||
|
|
"observed-data--57b5a877-9be4-4767-b8e5-436a950d210f",
|
||
|
|
"url--57b5a877-9be4-4767-b8e5-436a950d210f",
|
||
|
|
"observed-data--57b5a877-a95c-48cf-be90-4981950d210f",
|
||
|
|
"url--57b5a877-a95c-48cf-be90-4981950d210f",
|
||
|
|
"observed-data--57b5a8aa-4290-4175-9509-478d950d210f",
|
||
|
|
"url--57b5a8aa-4290-4175-9509-478d950d210f",
|
||
|
|
"indicator--57b5a8c8-1a70-4ec3-9746-44dc950d210f",
|
||
|
|
"indicator--57b5a8c8-a87c-44bf-9aec-46e8950d210f",
|
||
|
|
"indicator--57b5a8c9-3110-4536-8e93-4baa950d210f",
|
||
|
|
"indicator--57b5a8c9-31ec-442a-9e77-4819950d210f",
|
||
|
|
"indicator--57b5a8c9-6830-4de5-a4b0-4b00950d210f",
|
||
|
|
"indicator--57b5a8ff-4aa4-4baf-a764-49ad950d210f",
|
||
|
|
"indicator--57b5a8ff-c074-4601-92b7-4dbc950d210f",
|
||
|
|
"indicator--57b5a8ff-8974-40f4-b6bd-44b6950d210f",
|
||
|
|
"indicator--57b5a8ff-1dd0-413f-8ede-46ab950d210f",
|
||
|
|
"indicator--57b5a900-db74-4f77-8cff-4754950d210f",
|
||
|
|
"indicator--57b5a919-cad0-42ff-9825-4d5a950d210f",
|
||
|
|
"x-misp-attribute--57b5a93e-f604-442f-8443-49d2950d210f",
|
||
|
|
"x-misp-attribute--57b5a93f-9fb4-4436-a220-4a41950d210f",
|
||
|
|
"observed-data--57b5a9d1-46d0-4515-8152-429a950d210f",
|
||
|
|
"url--57b5a9d1-46d0-4515-8152-429a950d210f",
|
||
|
|
"indicator--57b5aa1a-cd14-4bd9-b994-4e4f950d210f",
|
||
|
|
"x-misp-attribute--57b5aaea-41e8-41ee-9a00-499c950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"OSINT"
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--57b5a877-9d20-49f7-aa38-4c16950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:22:15.000Z",
|
||
|
|
"modified": "2016-08-18T12:22:15.000Z",
|
||
|
|
"first_observed": "2016-08-18T12:22:15Z",
|
||
|
|
"last_observed": "2016-08-18T12:22:15Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--57b5a877-9d20-49f7-aa38-4c16950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--57b5a877-9d20-49f7-aa38-4c16950d210f",
|
||
|
|
"value": "https://blog.malwarebytes.com/threat-analysis/2016/08/shakti-trojan-stealing-documents/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--57b5a877-9be4-4767-b8e5-436a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:22:15.000Z",
|
||
|
|
"modified": "2016-08-18T12:22:15.000Z",
|
||
|
|
"first_observed": "2016-08-18T12:22:15Z",
|
||
|
|
"last_observed": "2016-08-18T12:22:15Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--57b5a877-9be4-4767-b8e5-436a950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--57b5a877-9be4-4767-b8e5-436a950d210f",
|
||
|
|
"value": "https://malwr.com/analysis/NjA0OGVmMDdlMzg5NDJjOGI1OTA3YTJkMDllZTk5Y2U/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--57b5a877-a95c-48cf-be90-4981950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:22:15.000Z",
|
||
|
|
"modified": "2016-08-18T12:22:15.000Z",
|
||
|
|
"first_observed": "2016-08-18T12:22:15Z",
|
||
|
|
"last_observed": "2016-08-18T12:22:15Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--57b5a877-a95c-48cf-be90-4981950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--57b5a877-a95c-48cf-be90-4981950d210f",
|
||
|
|
"value": "http://www.bleepingcomputer.com/news/security/new-information-stealing-trojan-steals-and-uploads-corporate-files/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--57b5a8aa-4290-4175-9509-478d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:23:05.000Z",
|
||
|
|
"modified": "2016-08-18T12:23:05.000Z",
|
||
|
|
"first_observed": "2016-08-18T12:23:05Z",
|
||
|
|
"last_observed": "2016-08-18T12:23:05Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--57b5a8aa-4290-4175-9509-478d950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--57b5a8aa-4290-4175-9509-478d950d210f",
|
||
|
|
"value": "https://blog.malwarebytes.com/threat-analysis/2016/08/shakti-trojan-technical-analysis/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57b5a8c8-1a70-4ec3-9746-44dc950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:23:36.000Z",
|
||
|
|
"modified": "2016-08-18T12:23:36.000Z",
|
||
|
|
"description": "Imported via the Freetext Import Tool",
|
||
|
|
"pattern": "[file:name = 'Carrier.dll']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-18T12:23:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57b5a8c8-a87c-44bf-9aec-46e8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:23:36.000Z",
|
||
|
|
"modified": "2016-08-18T12:23:36.000Z",
|
||
|
|
"description": "Imported via the Freetext Import Tool",
|
||
|
|
"pattern": "[file:name = 'Payload.dll']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-18T12:23:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57b5a8c9-3110-4536-8e93-4baa950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:23:37.000Z",
|
||
|
|
"modified": "2016-08-18T12:23:37.000Z",
|
||
|
|
"description": "Imported via the Freetext Import Tool",
|
||
|
|
"pattern": "[domain-name:value = 'web4solution.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-18T12:23:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57b5a8c9-31ec-442a-9e77-4819950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:23:37.000Z",
|
||
|
|
"modified": "2016-08-18T12:23:37.000Z",
|
||
|
|
"description": "Imported via the Freetext Import Tool",
|
||
|
|
"pattern": "[domain-name:value = 'securedesignus.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-18T12:23:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57b5a8c9-6830-4de5-a4b0-4b00950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:23:37.000Z",
|
||
|
|
"modified": "2016-08-18T12:23:37.000Z",
|
||
|
|
"description": "Imported via the Freetext Import Tool",
|
||
|
|
"pattern": "[domain-name:value = 'securedesignuk.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-18T12:23:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57b5a8ff-4aa4-4baf-a764-49ad950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:24:31.000Z",
|
||
|
|
"modified": "2016-08-18T12:24:31.000Z",
|
||
|
|
"description": "Imported via the Freetext Import Tool",
|
||
|
|
"pattern": "[file:name = 'Carrier.dll']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-18T12:24:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57b5a8ff-c074-4601-92b7-4dbc950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:24:31.000Z",
|
||
|
|
"modified": "2016-08-18T12:24:31.000Z",
|
||
|
|
"description": "Imported via the Freetext Import Tool",
|
||
|
|
"pattern": "[file:name = 'Payload.dll']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-18T12:24:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57b5a8ff-8974-40f4-b6bd-44b6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:24:31.000Z",
|
||
|
|
"modified": "2016-08-18T12:24:31.000Z",
|
||
|
|
"description": "Imported via the Freetext Import Tool",
|
||
|
|
"pattern": "[file:hashes.MD5 = '8ea35293cbb0712a520c7b89059d5a2a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-18T12:24:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57b5a8ff-1dd0-413f-8ede-46ab950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:24:31.000Z",
|
||
|
|
"modified": "2016-08-18T12:24:31.000Z",
|
||
|
|
"description": "Imported via the Freetext Import Tool",
|
||
|
|
"pattern": "[file:hashes.MD5 = '6992370821f8fbeea4a96f7be8015967']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-18T12:24:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57b5a900-db74-4f77-8cff-4754950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:24:32.000Z",
|
||
|
|
"modified": "2016-08-18T12:24:32.000Z",
|
||
|
|
"description": "Imported via the Freetext Import Tool",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd9181d69c40fc95d7d27448f5ece1878']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-18T12:24:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57b5a919-cad0-42ff-9825-4d5a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:24:57.000Z",
|
||
|
|
"modified": "2016-08-18T12:24:57.000Z",
|
||
|
|
"pattern": "[url:value = '/external/update']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-18T12:24:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"uri\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--57b5a93e-f604-442f-8443-49d2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:25:34.000Z",
|
||
|
|
"modified": "2016-08-18T12:25:34.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"pdb\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Artifacts dropped",
|
||
|
|
"x_misp_type": "pdb",
|
||
|
|
"x_misp_value": "E:\\Projects\\ComplexStatement\\Shakti\\Code\\Carrier\\Release\\Carrier.pdb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--57b5a93f-9fb4-4436-a220-4a41950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:25:35.000Z",
|
||
|
|
"modified": "2016-08-18T12:25:35.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"pdb\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Artifacts dropped",
|
||
|
|
"x_misp_type": "pdb",
|
||
|
|
"x_misp_value": "E:\\Projects\\ComplexStatement\\Shakti\\Code\\Payload\\Release\\Payload.pdb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--57b5a9d1-46d0-4515-8152-429a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:28:01.000Z",
|
||
|
|
"modified": "2016-08-18T12:28:01.000Z",
|
||
|
|
"first_observed": "2016-08-18T12:28:01Z",
|
||
|
|
"last_observed": "2016-08-18T12:28:01Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--57b5a9d1-46d0-4515-8152-429a950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--57b5a9d1-46d0-4515-8152-429a950d210f",
|
||
|
|
"value": "http://vms.drweb.ru/virus/?i=3793941&virus_name=Trojan.DownLoader11.5634"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57b5aa1a-cd14-4bd9-b994-4e4f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:29:14.000Z",
|
||
|
|
"modified": "2016-08-18T12:29:14.000Z",
|
||
|
|
"pattern": "[file:name = '\\\\%UserProfile\\\\%\\\\uninst.dll']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-08-18T12:29:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--57b5aaea-41e8-41ee-9a00-499c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-08-18T12:32:42.000Z",
|
||
|
|
"modified": "2016-08-18T12:32:42.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"whois-registrant-email\"",
|
||
|
|
"misp:category=\"Attribution\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Attribution",
|
||
|
|
"x_misp_type": "whois-registrant-email",
|
||
|
|
"x_misp_value": "ashrafahmed2882@yahoo.com"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|