adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/stix-2.1/58e73aab-3530-44d8-94b7-4cbf950d210f.json

1601 lines
67 KiB
JSON
Raw Permalink Normal View History

chg: [misp-stix] STIX 2.1 export added
2023-04-21 14:44:17 +00:00
{
"type": "bundle",
"id": "bundle--58e73aab-3530-44d8-94b7-4cbf950d210f",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:13:39.000Z",
"modified": "2017-04-07T10:13:39.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--58e73aab-3530-44d8-94b7-4cbf950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:13:39.000Z",
"modified": "2017-04-07T10:13:39.000Z",
"name": "OSINT - High-Volume Dridex Campaigns Return, First to Hit Millions Since June 2016",
"published": "2017-04-07T10:15:39Z",
"object_refs": [
"indicator--58e73b5f-bd3c-4749-b338-4683950d210f",
"indicator--58e73b60-9508-41a5-b5d4-4076950d210f",
"indicator--58e73b61-5820-4259-bf31-47ad950d210f",
"observed-data--58e73b73-775c-4c97-a655-4120950d210f",
"url--58e73b73-775c-4c97-a655-4120950d210f",
"indicator--58e73cbd-d934-4c4f-9673-4aed950d210f",
"indicator--58e73cbe-0a68-4d90-9596-450a950d210f",
"indicator--58e73cbf-c770-4e6d-97b8-4004950d210f",
"indicator--58e73cc0-08cc-4ade-84b3-44fa950d210f",
"indicator--58e73cc1-ce74-4efe-b509-483d950d210f",
"indicator--58e73cc2-0044-43f2-8a9f-4cd3950d210f",
"indicator--58e73cc3-5ad8-48e1-ae5e-4e5f950d210f",
"indicator--58e73d58-13c4-4a30-8f9b-4072950d210f",
"indicator--58e73d59-2f14-4f5d-8b44-4275950d210f",
"indicator--58e73d5a-3b5c-4902-a0c9-4608950d210f",
"indicator--58e73d5b-aab0-4ab1-85b4-4007950d210f",
"indicator--58e73da3-cf44-49cc-9c82-4fd1950d210f",
"indicator--58e73da4-a844-4319-851a-491c950d210f",
"indicator--58e73de0-26d0-4e32-b380-47e4950d210f",
"indicator--58e73de1-26f8-4352-862a-4204950d210f",
"indicator--58e73de2-9c50-4fe6-99d3-431e950d210f",
"indicator--58e73de3-cee8-4425-9217-43c2950d210f",
"indicator--58e73de5-d9c8-48b4-91ce-40cf950d210f",
"indicator--58e73de6-1c44-421f-b169-465c950d210f",
"x-misp-attribute--58e73e57-0c84-41fe-a209-491d950d210f",
"indicator--58e73fc0-6d00-4fcd-9200-4af8950d210f",
"indicator--58e73fc2-fbf8-4eb2-b55e-47f9950d210f",
"indicator--58e73fc4-5f60-4ad3-b30c-42bf950d210f",
"indicator--58e73fc6-f0a0-4574-89c8-4dee950d210f",
"indicator--58e73fc8-4d50-453a-af40-4238950d210f",
"indicator--58e73fca-7608-49de-8ecf-4130950d210f",
"indicator--58e73fcc-4910-4c8e-817e-4be1950d210f",
"indicator--58e73fce-f480-4d25-be75-4505950d210f",
"indicator--58e73ff3-8c9c-4cd0-b98b-4e5d950d210f",
"indicator--58e73ff4-ecfc-48fd-9970-4075950d210f",
"indicator--58e73ff5-1f6c-4567-bb07-4a94950d210f",
"indicator--58e76654-0f90-4af3-9d77-499302de0b81",
"indicator--58e76655-1eb0-46f4-b791-413602de0b81",
"observed-data--58e76656-b394-4f3d-8498-40ac02de0b81",
"url--58e76656-b394-4f3d-8498-40ac02de0b81",
"indicator--58e76657-0cf8-48f2-9e77-45eb02de0b81",
"indicator--58e76658-8684-4696-9e23-4c7402de0b81",
"observed-data--58e76659-b41c-4a12-afdf-41af02de0b81",
"url--58e76659-b41c-4a12-afdf-41af02de0b81",
"indicator--58e7665a-89dc-48f5-a69e-4d3b02de0b81",
"indicator--58e7665b-d364-4005-b2c2-406902de0b81",
"observed-data--58e7665c-5394-4250-9d8c-49f302de0b81",
"url--58e7665c-5394-4250-9d8c-49f302de0b81",
"indicator--58e7665d-3844-4f1f-9fa8-40e202de0b81",
"indicator--58e7665e-9778-483d-9712-4e2202de0b81",
"observed-data--58e7665f-c77c-4b35-acd9-4f0302de0b81",
"url--58e7665f-c77c-4b35-acd9-4f0302de0b81",
"indicator--58e76660-f4ec-4ac7-96c6-4e9202de0b81",
"indicator--58e76660-28a0-4837-b925-405202de0b81",
"observed-data--58e76661-edf0-4e21-945d-4df102de0b81",
"url--58e76661-edf0-4e21-945d-4df102de0b81",
"indicator--58e76662-6f30-4eeb-987b-441602de0b81",
"indicator--58e76663-b798-454f-887a-460502de0b81",
"observed-data--58e76664-e204-4ed7-8ab0-439c02de0b81",
"url--58e76664-e204-4ed7-8ab0-439c02de0b81",
"indicator--58e76665-f120-4ccd-a42c-4e7502de0b81",
"indicator--58e76666-87b4-420b-92f6-433c02de0b81",
"observed-data--58e76667-b1b0-43d3-bacd-413102de0b81",
"url--58e76667-b1b0-43d3-bacd-413102de0b81",
"indicator--58e76668-dbac-41b1-84c0-41fc02de0b81",
"indicator--58e76669-a3c0-454b-8635-43ea02de0b81",
"observed-data--58e7666a-9bb8-40ac-a37a-4e9402de0b81",
"url--58e7666a-9bb8-40ac-a37a-4e9402de0b81",
"indicator--58e7666b-5a48-4cf6-a3f5-4cb502de0b81",
"indicator--58e7666c-7810-4fa4-9361-4e4d02de0b81",
"observed-data--58e7666d-4628-4053-a1a9-4bb602de0b81",
"url--58e7666d-4628-4053-a1a9-4bb602de0b81"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"misp-galaxy:tool=\"Dridex\"",
"osint:source-type=\"blog-post\"",
"type:OSINT"
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e73b5f-bd3c-4749-b338-4683950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"description": "VBS Downloader Example",
"pattern": "[file:hashes.SHA256 = '84c9028a1d25e5f171c170179f2f1ea3e1eab9514812ab9e4b617de822b46e69']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:12:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e73b60-9508-41a5-b5d4-4076950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"description": "Macro Document",
"pattern": "[file:hashes.SHA256 = '1ac8931791374c156c8e619b4ca66fdcbd31a56203fa3a429d981e20955099c8']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:12:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e73b61-5820-4259-bf31-47ad950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"description": "Macro Document",
"pattern": "[file:hashes.SHA256 = '743f6538c1dc1b224e443356f9bf3ae3954f2dea2c3b6e7986a5bc410b8dda20']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:12:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--58e73b73-775c-4c97-a655-4120950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:13:15.000Z",
"modified": "2017-04-07T10:13:15.000Z",
"first_observed": "2017-04-07T10:13:15Z",
"last_observed": "2017-04-07T10:13:15Z",
"number_observed": 1,
"object_refs": [
"url--58e73b73-775c-4c97-a655-4120950d210f"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\"",
"osint:source-type=\"blog-post\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--58e73b73-775c-4c97-a655-4120950d210f",
"value": "https://www.proofpoint.com/us/threat-insight/post/high-volume-dridex-campaigns-return"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e73cbd-d934-4c4f-9673-4aed950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"description": "Document Payload",
"pattern": "[url:value = 'http://meyermuehltal.de/0h656jk']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:12:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e73cbe-0a68-4d90-9596-450a950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"description": "Document Payload",
"pattern": "[url:value = 'http://technologyservice.eu/0h656jk']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:12:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e73cbf-c770-4e6d-97b8-4004950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"description": "Document Payload",
"pattern": "[url:value = 'http://tspars.com/0h656jk']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:12:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e73cc0-08cc-4ade-84b3-44fa950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"description": "Document Payload",
"pattern": "[url:value = 'http://thaipowertools.com/0h656jk']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:12:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e73cc1-ce74-4efe-b509-483d950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"description": "Document Payload",
"pattern": "[url:value = 'http://www.movimentodiesel.gr/0h656jk']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:12:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e73cc2-0044-43f2-8a9f-4cd3950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"description": "Document Payload",
"pattern": "[url:value = 'http://lhgarden.org/0h656jk']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:12:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e73cc3-5ad8-48e1-ae5e-4e5f950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"description": "Document Payload",
"pattern": "[url:value = 'http://www.soulcube.com/0h656jk']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:12:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e73d58-13c4-4a30-8f9b-4072950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"description": "VBS Payload",
"pattern": "[url:value = 'http://roylgrafix.com/76gbce?']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:12:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e73d59-2f14-4f5d-8b44-4275950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"description": "VBS Payload",
"pattern": "[url:value = 'http://signwaves.net/76gbce?']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:12:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e73d5a-3b5c-4902-a0c9-4608950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"description": "VBS Payload",
"pattern": "[url:value = 'http://testsite.prosun.com/76gbce?']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:12:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e73d5b-aab0-4ab1-85b4-4007950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"description": "VBS Payload",
"pattern": "[url:value = 'http://omurongen.com/76gbce?']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:12:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e73da3-cf44-49cc-9c82-4fd1950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"description": "Smoke Loader Payload",
"pattern": "[url:value = 'http://pastasmolinero.es/76gf33']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:12:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e73da4-a844-4319-851a-491c950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"description": "Quant Loader Payload",
"pattern": "[url:value = 'http://nzhat.net/9jgtyft6']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:12:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e73de0-26d0-4e32-b380-47e4950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"description": "Dridex Botnet 7500 Loader",
"pattern": "[file:hashes.SHA256 = 'dfd99e050505ec41bc41fbaf51fee908fcda8c17a1bc92623748d34915c5bc0a']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:12:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e73de1-26f8-4352-862a-4204950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"description": "Dridex Botnet 7500 Loader",
"pattern": "[file:hashes.SHA256 = '20b61b6ce821f8011f2cb1a409e6221b7bc1ae3a0cde56d66b025d12d640ee81']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:12:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e73de2-9c50-4fe6-99d3-431e950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"description": "Smoke Loader",
"pattern": "[file:hashes.SHA256 = '4d76f25637f4193457b124290f878a47b5b9361ff486b79dc48a2d5c3648de02']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:12:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e73de3-cee8-4425-9217-43c2950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"description": "Dridex Botnet 7200 Loader",
"pattern": "[file:hashes.SHA256 = '379466fd81787399f7da3bfaab288c4b67ba3518c0225d1deabf9bc833dcaa22']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:12:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e73de5-d9c8-48b4-91ce-40cf950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"description": "Dridex Botnet 7200 Loader",
"pattern": "[file:hashes.SHA256 = '6adda664e3ab2936a8dbe8e95e10d33e34d13fbe375123c69abf3ac5fbf52fcd']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:12:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e73de6-1c44-421f-b169-465c950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"description": "Quant Loader",
"pattern": "[file:hashes.SHA256 = 'ac4d02637e1e01b16062f368658275cb8400b21f6592819d3a09dbee31cb5cc1']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:12:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "x-misp-attribute",
"spec_version": "2.1",
"id": "x-misp-attribute--58e73e57-0c84-41fe-a209-491d950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"labels": [
"misp:type=\"other\"",
"misp:category=\"Payload delivery\""
],
"x_misp_category": "Payload delivery",
"x_misp_comment": "Dridex Botnet 7200 Loader",
"x_misp_type": "other",
"x_misp_value": "5054518c52e70f86a6e42641b094e9b64df96bd65C&C9ab0d21e810dcf14c87b5|SHA256|Dridex Botnet 7200 Loader"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e73fc0-6d00-4fcd-9200-4af8950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"description": "Dridex Loader C&C",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '8.8.247.36' AND network-traffic:dst_port = '443']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:12:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e73fc2-fbf8-4eb2-b55e-47f9950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"description": "Dridex Loader C&C",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '81.12.229.190' AND network-traffic:dst_port = '8043']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:12:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e73fc4-5f60-4ad3-b30c-42bf950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"description": "Dridex Loader C&C",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '107.170.0.14' AND network-traffic:dst_port = '8043']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:12:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e73fc6-f0a0-4574-89c8-4dee950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"description": "Dridex Loader C&C",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '37.120.172.171' AND network-traffic:dst_port = '4143']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:12:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e73fc8-4d50-453a-af40-4238950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"description": "Dridex Loader C&C",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '91.219.28.55' AND network-traffic:dst_port = '443']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:12:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e73fca-7608-49de-8ecf-4130950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"description": "Dridex Loader C&C",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '178.32.255.130' AND network-traffic:dst_port = '44343']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:12:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e73fcc-4910-4c8e-817e-4be1950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"description": "Dridex Loader C&C",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '217.197.39.1' AND network-traffic:dst_port = '8443']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:12:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e73fce-f480-4d25-be75-4505950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"description": "Dridex Loader C&C",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '195.88.209.221' AND network-traffic:dst_port = '4413']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:12:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e73ff3-8c9c-4cd0-b98b-4e5d950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"description": "Smoke Loader C&C",
"pattern": "[url:value = 'http://justjohnwilhertthet.ws/m/']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:12:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e73ff4-ecfc-48fd-9970-4075950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"description": "Quant Loader C&C",
"pattern": "[url:value = 'http://jusevengwassresbet.ws/q/index.php']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:12:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e73ff5-1f6c-4567-bb07-4a94950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:12:57.000Z",
"modified": "2017-04-07T10:12:57.000Z",
"description": "Quant Loader C&C",
"pattern": "[url:value = 'http://sinmanarattot.ws/q/index.php']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:12:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e76654-0f90-4af3-9d77-499302de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:13:40.000Z",
"modified": "2017-04-07T10:13:40.000Z",
"description": "Quant Loader - Xchecked via VT: ac4d02637e1e01b16062f368658275cb8400b21f6592819d3a09dbee31cb5cc1",
"pattern": "[file:hashes.SHA1 = '155863bcd4ea677986beb13b1e519f3f71cf2183']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:13:40Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e76655-1eb0-46f4-b791-413602de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:13:41.000Z",
"modified": "2017-04-07T10:13:41.000Z",
"description": "Quant Loader - Xchecked via VT: ac4d02637e1e01b16062f368658275cb8400b21f6592819d3a09dbee31cb5cc1",
"pattern": "[file:hashes.MD5 = '3ede7214e1fe848aefd67e8d11beec00']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:13:41Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--58e76656-b394-4f3d-8498-40ac02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:13:42.000Z",
"modified": "2017-04-07T10:13:42.000Z",
"first_observed": "2017-04-07T10:13:42Z",
"last_observed": "2017-04-07T10:13:42Z",
"number_observed": 1,
"object_refs": [
"url--58e76656-b394-4f3d-8498-40ac02de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--58e76656-b394-4f3d-8498-40ac02de0b81",
"value": "https://www.virustotal.com/file/ac4d02637e1e01b16062f368658275cb8400b21f6592819d3a09dbee31cb5cc1/analysis/1491538426/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e76657-0cf8-48f2-9e77-45eb02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:13:43.000Z",
"modified": "2017-04-07T10:13:43.000Z",
"description": "Dridex Botnet 7200 Loader - Xchecked via VT: 6adda664e3ab2936a8dbe8e95e10d33e34d13fbe375123c69abf3ac5fbf52fcd",
"pattern": "[file:hashes.SHA1 = '694266450ffedf4008f0cf0e5573c63c56f2e5d0']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:13:43Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e76658-8684-4696-9e23-4c7402de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:13:44.000Z",
"modified": "2017-04-07T10:13:44.000Z",
"description": "Dridex Botnet 7200 Loader - Xchecked via VT: 6adda664e3ab2936a8dbe8e95e10d33e34d13fbe375123c69abf3ac5fbf52fcd",
"pattern": "[file:hashes.MD5 = 'f4e11acef79702561dea6070d4dbba45']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:13:44Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--58e76659-b41c-4a12-afdf-41af02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:13:45.000Z",
"modified": "2017-04-07T10:13:45.000Z",
"first_observed": "2017-04-07T10:13:45Z",
"last_observed": "2017-04-07T10:13:45Z",
"number_observed": 1,
"object_refs": [
"url--58e76659-b41c-4a12-afdf-41af02de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--58e76659-b41c-4a12-afdf-41af02de0b81",
"value": "https://www.virustotal.com/file/6adda664e3ab2936a8dbe8e95e10d33e34d13fbe375123c69abf3ac5fbf52fcd/analysis/1491294800/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e7665a-89dc-48f5-a69e-4d3b02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:13:46.000Z",
"modified": "2017-04-07T10:13:46.000Z",
"description": "Dridex Botnet 7200 Loader - Xchecked via VT: 379466fd81787399f7da3bfaab288c4b67ba3518c0225d1deabf9bc833dcaa22",
"pattern": "[file:hashes.SHA1 = '44bbd62533c8b1257a02f11756b39ebca77eda78']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:13:46Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e7665b-d364-4005-b2c2-406902de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:13:47.000Z",
"modified": "2017-04-07T10:13:47.000Z",
"description": "Dridex Botnet 7200 Loader - Xchecked via VT: 379466fd81787399f7da3bfaab288c4b67ba3518c0225d1deabf9bc833dcaa22",
"pattern": "[file:hashes.MD5 = '0243c9bb903d6f89d7eeadae882cf591']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:13:47Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--58e7665c-5394-4250-9d8c-49f302de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:13:48.000Z",
"modified": "2017-04-07T10:13:48.000Z",
"first_observed": "2017-04-07T10:13:48Z",
"last_observed": "2017-04-07T10:13:48Z",
"number_observed": 1,
"object_refs": [
"url--58e7665c-5394-4250-9d8c-49f302de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--58e7665c-5394-4250-9d8c-49f302de0b81",
"value": "https://www.virustotal.com/file/379466fd81787399f7da3bfaab288c4b67ba3518c0225d1deabf9bc833dcaa22/analysis/1491192423/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e7665d-3844-4f1f-9fa8-40e202de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:13:49.000Z",
"modified": "2017-04-07T10:13:49.000Z",
"description": "Smoke Loader - Xchecked via VT: 4d76f25637f4193457b124290f878a47b5b9361ff486b79dc48a2d5c3648de02",
"pattern": "[file:hashes.SHA1 = 'a6cc5c3aedf9eba6ff3f18b76430e3f8efb90f57']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:13:49Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e7665e-9778-483d-9712-4e2202de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:13:50.000Z",
"modified": "2017-04-07T10:13:50.000Z",
"description": "Smoke Loader - Xchecked via VT: 4d76f25637f4193457b124290f878a47b5b9361ff486b79dc48a2d5c3648de02",
"pattern": "[file:hashes.MD5 = 'c738746c751e3f4465cdf20959ed7115']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:13:50Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--58e7665f-c77c-4b35-acd9-4f0302de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:13:51.000Z",
"modified": "2017-04-07T10:13:51.000Z",
"first_observed": "2017-04-07T10:13:51Z",
"last_observed": "2017-04-07T10:13:51Z",
"number_observed": 1,
"object_refs": [
"url--58e7665f-c77c-4b35-acd9-4f0302de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--58e7665f-c77c-4b35-acd9-4f0302de0b81",
"value": "https://www.virustotal.com/file/4d76f25637f4193457b124290f878a47b5b9361ff486b79dc48a2d5c3648de02/analysis/1491540064/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e76660-f4ec-4ac7-96c6-4e9202de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:13:52.000Z",
"modified": "2017-04-07T10:13:52.000Z",
"description": "Dridex Botnet 7500 Loader - Xchecked via VT: 20b61b6ce821f8011f2cb1a409e6221b7bc1ae3a0cde56d66b025d12d640ee81",
"pattern": "[file:hashes.SHA1 = '6812c5b94ea2452b794e8e735428eddd415e1bb6']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:13:52Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e76660-28a0-4837-b925-405202de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:13:52.000Z",
"modified": "2017-04-07T10:13:52.000Z",
"description": "Dridex Botnet 7500 Loader - Xchecked via VT: 20b61b6ce821f8011f2cb1a409e6221b7bc1ae3a0cde56d66b025d12d640ee81",
"pattern": "[file:hashes.MD5 = 'e50522bf1817a8f5698b740e5225c34f']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:13:52Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--58e76661-edf0-4e21-945d-4df102de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:13:53.000Z",
"modified": "2017-04-07T10:13:53.000Z",
"first_observed": "2017-04-07T10:13:53Z",
"last_observed": "2017-04-07T10:13:53Z",
"number_observed": 1,
"object_refs": [
"url--58e76661-edf0-4e21-945d-4df102de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--58e76661-edf0-4e21-945d-4df102de0b81",
"value": "https://www.virustotal.com/file/20b61b6ce821f8011f2cb1a409e6221b7bc1ae3a0cde56d66b025d12d640ee81/analysis/1491282981/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e76662-6f30-4eeb-987b-441602de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:13:54.000Z",
"modified": "2017-04-07T10:13:54.000Z",
"description": "Dridex Botnet 7500 Loader - Xchecked via VT: dfd99e050505ec41bc41fbaf51fee908fcda8c17a1bc92623748d34915c5bc0a",
"pattern": "[file:hashes.SHA1 = '7eb1ab6a19b3ab9fc8dd96f73e5a696571a72400']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:13:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e76663-b798-454f-887a-460502de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:13:55.000Z",
"modified": "2017-04-07T10:13:55.000Z",
"description": "Dridex Botnet 7500 Loader - Xchecked via VT: dfd99e050505ec41bc41fbaf51fee908fcda8c17a1bc92623748d34915c5bc0a",
"pattern": "[file:hashes.MD5 = '41a5b1d50947452adb663abcb6ecb829']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:13:55Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--58e76664-e204-4ed7-8ab0-439c02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:13:56.000Z",
"modified": "2017-04-07T10:13:56.000Z",
"first_observed": "2017-04-07T10:13:56Z",
"last_observed": "2017-04-07T10:13:56Z",
"number_observed": 1,
"object_refs": [
"url--58e76664-e204-4ed7-8ab0-439c02de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--58e76664-e204-4ed7-8ab0-439c02de0b81",
"value": "https://www.virustotal.com/file/dfd99e050505ec41bc41fbaf51fee908fcda8c17a1bc92623748d34915c5bc0a/analysis/1491188391/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e76665-f120-4ccd-a42c-4e7502de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:13:57.000Z",
"modified": "2017-04-07T10:13:57.000Z",
"description": "Macro Document - Xchecked via VT: 743f6538c1dc1b224e443356f9bf3ae3954f2dea2c3b6e7986a5bc410b8dda20",
"pattern": "[file:hashes.SHA1 = 'f40791fd456f4e9429cbcc231e5550bfe8fcb906']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:13:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e76666-87b4-420b-92f6-433c02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:13:58.000Z",
"modified": "2017-04-07T10:13:58.000Z",
"description": "Macro Document - Xchecked via VT: 743f6538c1dc1b224e443356f9bf3ae3954f2dea2c3b6e7986a5bc410b8dda20",
"pattern": "[file:hashes.MD5 = '130b76fcf04f44433fa075c3cc596d03']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:13:58Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--58e76667-b1b0-43d3-bacd-413102de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:13:59.000Z",
"modified": "2017-04-07T10:13:59.000Z",
"first_observed": "2017-04-07T10:13:59Z",
"last_observed": "2017-04-07T10:13:59Z",
"number_observed": 1,
"object_refs": [
"url--58e76667-b1b0-43d3-bacd-413102de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--58e76667-b1b0-43d3-bacd-413102de0b81",
"value": "https://www.virustotal.com/file/743f6538c1dc1b224e443356f9bf3ae3954f2dea2c3b6e7986a5bc410b8dda20/analysis/1491287540/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e76668-dbac-41b1-84c0-41fc02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:14:00.000Z",
"modified": "2017-04-07T10:14:00.000Z",
"description": "Macro Document - Xchecked via VT: 1ac8931791374c156c8e619b4ca66fdcbd31a56203fa3a429d981e20955099c8",
"pattern": "[file:hashes.SHA1 = '49858617e73d5a56894140d90f0d75fe59496b1e']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:14:00Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e76669-a3c0-454b-8635-43ea02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:14:01.000Z",
"modified": "2017-04-07T10:14:01.000Z",
"description": "Macro Document - Xchecked via VT: 1ac8931791374c156c8e619b4ca66fdcbd31a56203fa3a429d981e20955099c8",
"pattern": "[file:hashes.MD5 = '6c8104146ba1bb6e1a4c3b8b6f6a1fa9']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:14:01Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--58e7666a-9bb8-40ac-a37a-4e9402de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:14:02.000Z",
"modified": "2017-04-07T10:14:02.000Z",
"first_observed": "2017-04-07T10:14:02Z",
"last_observed": "2017-04-07T10:14:02Z",
"number_observed": 1,
"object_refs": [
"url--58e7666a-9bb8-40ac-a37a-4e9402de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--58e7666a-9bb8-40ac-a37a-4e9402de0b81",
"value": "https://www.virustotal.com/file/1ac8931791374c156c8e619b4ca66fdcbd31a56203fa3a429d981e20955099c8/analysis/1491436931/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e7666b-5a48-4cf6-a3f5-4cb502de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:14:03.000Z",
"modified": "2017-04-07T10:14:03.000Z",
"description": "VBS Downloader Example - Xchecked via VT: 84c9028a1d25e5f171c170179f2f1ea3e1eab9514812ab9e4b617de822b46e69",
"pattern": "[file:hashes.SHA1 = '71792564c59392c6f875c18bb62b7f501ba48a5d']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:14:03Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58e7666c-7810-4fa4-9361-4e4d02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:14:04.000Z",
"modified": "2017-04-07T10:14:04.000Z",
"description": "VBS Downloader Example - Xchecked via VT: 84c9028a1d25e5f171c170179f2f1ea3e1eab9514812ab9e4b617de822b46e69",
"pattern": "[file:hashes.MD5 = '1cdecc032262cc06375296dd7d907968']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-04-07T10:14:04Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--58e7666d-4628-4053-a1a9-4bb602de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-04-07T10:14:05.000Z",
"modified": "2017-04-07T10:14:05.000Z",
"first_observed": "2017-04-07T10:14:05Z",
"last_observed": "2017-04-07T10:14:05Z",
"number_observed": 1,
"object_refs": [
"url--58e7666d-4628-4053-a1a9-4bb602de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--58e7666d-4628-4053-a1a9-4bb602de0b81",
"value": "https://www.virustotal.com/file/84c9028a1d25e5f171c170179f2f1ea3e1eab9514812ab9e4b617de822b46e69/analysis/1491200234/"
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
]
}
Reference in a new issue Copy permalink