886 lines
39 KiB
JSON
886 lines
39 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--59a25cc4-e870-4bef-a7d1-48a802de0b81",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--59a25cc4-e870-4bef-a7d1-48a802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"name": "OSINT - Ukrainian Financial Institutions Targeted by Wave of Malicious EPS File Attacks",
|
||
|
|
"published": "2017-08-27T05:56:47Z",
|
||
|
|
"object_refs": [
|
||
|
|
"vulnerability--59a25cf6-d7a0-4d00-8b4e-45f902de0b81",
|
||
|
|
"vulnerability--59a25cf6-9670-4c50-a443-409202de0b81",
|
||
|
|
"vulnerability--59a25cf6-affc-42cf-948f-4f5b02de0b81",
|
||
|
|
"indicator--59a25d41-4b6c-4cbc-8e15-44a602de0b81",
|
||
|
|
"indicator--59a25d41-974c-4dad-b1d5-40fc02de0b81",
|
||
|
|
"indicator--59a25d41-d920-44d6-a046-4bf002de0b81",
|
||
|
|
"indicator--59a25d41-8a74-4e53-a3bb-43ab02de0b81",
|
||
|
|
"indicator--59a25d41-ac30-47e6-832d-411102de0b81",
|
||
|
|
"indicator--59a25d7d-17d8-48c9-9f7a-45aa02de0b81",
|
||
|
|
"x-misp-attribute--59a25da6-2424-4517-af23-4b6702de0b81",
|
||
|
|
"x-misp-attribute--59a25da6-eea4-46cf-a439-400c02de0b81",
|
||
|
|
"observed-data--59a25dc1-ee70-4f02-9db8-b60e02de0b81",
|
||
|
|
"email-message--59a25dc1-ee70-4f02-9db8-b60e02de0b81",
|
||
|
|
"file--59a25dc1-ee70-4f02-9db8-b60e02de0b81",
|
||
|
|
"observed-data--59a25dc1-7764-4a0b-89c0-b60e02de0b81",
|
||
|
|
"email-message--59a25dc1-7764-4a0b-89c0-b60e02de0b81",
|
||
|
|
"file--59a25dc1-7764-4a0b-89c0-b60e02de0b81",
|
||
|
|
"observed-data--59a25dc1-db3c-46fb-bd1c-b60e02de0b81",
|
||
|
|
"email-message--59a25dc1-db3c-46fb-bd1c-b60e02de0b81",
|
||
|
|
"file--59a25dc1-db3c-46fb-bd1c-b60e02de0b81",
|
||
|
|
"observed-data--59a25dc1-36c4-412d-8b6d-b60e02de0b81",
|
||
|
|
"email-message--59a25dc1-36c4-412d-8b6d-b60e02de0b81",
|
||
|
|
"file--59a25dc1-36c4-412d-8b6d-b60e02de0b81",
|
||
|
|
"observed-data--59a25dc1-9058-4d49-b0e9-b60e02de0b81",
|
||
|
|
"email-message--59a25dc1-9058-4d49-b0e9-b60e02de0b81",
|
||
|
|
"file--59a25dc1-9058-4d49-b0e9-b60e02de0b81",
|
||
|
|
"x-misp-attribute--59a25dd9-bf68-45c0-9374-494302de0b81",
|
||
|
|
"indicator--59a25dec-e044-4ab0-a56f-b60e02de0b81",
|
||
|
|
"indicator--59a25dec-a75c-45e3-89eb-b60e02de0b81",
|
||
|
|
"observed-data--59a25dec-f1ac-4268-8c34-b60e02de0b81",
|
||
|
|
"url--59a25dec-f1ac-4268-8c34-b60e02de0b81",
|
||
|
|
"indicator--59a25dec-cd54-489e-ada2-b60e02de0b81",
|
||
|
|
"indicator--59a25dec-eb38-4439-88b3-b60e02de0b81",
|
||
|
|
"observed-data--59a25dec-7f9c-4fd1-8047-b60e02de0b81",
|
||
|
|
"url--59a25dec-7f9c-4fd1-8047-b60e02de0b81",
|
||
|
|
"indicator--59a25dec-5794-402f-a588-b60e02de0b81",
|
||
|
|
"indicator--59a25dec-2500-44c2-b562-b60e02de0b81",
|
||
|
|
"observed-data--59a25dec-0d44-442b-b613-b60e02de0b81",
|
||
|
|
"url--59a25dec-0d44-442b-b613-b60e02de0b81",
|
||
|
|
"indicator--59a25dec-a084-4101-8ba1-b60e02de0b81",
|
||
|
|
"indicator--59a25dec-2e20-4de3-90c2-b60e02de0b81",
|
||
|
|
"observed-data--59a25dec-6aa8-4213-a915-b60e02de0b81",
|
||
|
|
"url--59a25dec-6aa8-4213-a915-b60e02de0b81",
|
||
|
|
"indicator--59a25dec-bc48-4a8a-8977-b60e02de0b81",
|
||
|
|
"indicator--59a25dec-355c-4c9b-8590-b60e02de0b81",
|
||
|
|
"observed-data--59a25dec-c0d8-4432-a038-b60e02de0b81",
|
||
|
|
"url--59a25dec-c0d8-4432-a038-b60e02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"circl:topic=\"finance\""
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "vulnerability",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "vulnerability--59a25cf6-d7a0-4d00-8b4e-45f902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"name": "CVE-2015-2545",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"vulnerability\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"circl:incident-classification=\"vulnerability\""
|
||
|
|
],
|
||
|
|
"external_references": [
|
||
|
|
{
|
||
|
|
"source_name": "cve",
|
||
|
|
"external_id": "CVE-2015-2545"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "vulnerability",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "vulnerability--59a25cf6-9670-4c50-a443-409202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"name": "CVE-2017-0261",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"vulnerability\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"circl:incident-classification=\"vulnerability\""
|
||
|
|
],
|
||
|
|
"external_references": [
|
||
|
|
{
|
||
|
|
"source_name": "cve",
|
||
|
|
"external_id": "CVE-2017-0261"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "vulnerability",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "vulnerability--59a25cf6-affc-42cf-948f-4f5b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"name": "CVE-2017-0262",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"vulnerability\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"circl:incident-classification=\"vulnerability\""
|
||
|
|
],
|
||
|
|
"external_references": [
|
||
|
|
{
|
||
|
|
"source_name": "cve",
|
||
|
|
"external_id": "CVE-2017-0262"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59a25d41-4b6c-4cbc-8e15-44a602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ecc055974d7d190871dc4eb1bf1f8b998d6e8abf04dba2ff560ae395aeec4d5d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-08-27T05:51:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59a25d41-974c-4dad-b1d5-40fc02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '430c1bfa22e0f7b0e8742c0d70b8911089ba58645818e4281d7066d1324a3952']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-08-27T05:51:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59a25d41-d920-44d6-a046-4bf002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1892154cc47e8a1bc81186d131e001a22e4edbc4fd88688eb1782b934e1941b6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-08-27T05:51:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59a25d41-8a74-4e53-a3bb-43ab02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e9d843761df7f6ef193d9f8e88d93a90816f2067fdd51a1c0765dfbfd4cb398f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-08-27T05:51:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59a25d41-ac30-47e6-832d-411102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '647572d133677882f52843f799375ac77178616bcd3d9ed13b95d49eecfd0a51']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-08-27T05:51:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59a25d7d-17d8-48c9-9f7a-45aa02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"description": "Once the malware has managed to infect a system, it tries to connect to a server based in France over TCP port 80",
|
||
|
|
"pattern": "[url:value = 'http://137.74.224.142/z/get.php?name=3c6*****']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-08-27T05:51:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--59a25da6-2424-4517-af23-4b6702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"pattern-in-file\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Artifacts dropped",
|
||
|
|
"x_misp_comment": "When we dug deeper into the details of the \u00e2\u20ac\u02dcimage1.eps\u00e2\u20ac\u2122 file, we noticed two awkward strings that you normally wouldn\u00e2\u20ac\u2122t see in malware",
|
||
|
|
"x_misp_type": "pattern-in-file",
|
||
|
|
"x_misp_value": "%%Icantdestroywhatisntthere"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--59a25da6-eea4-46cf-a439-400c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"pattern-in-file\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Artifacts dropped",
|
||
|
|
"x_misp_comment": "When we dug deeper into the details of the \u00e2\u20ac\u02dcimage1.eps\u00e2\u20ac\u2122 file, we noticed two awkward strings that you normally wouldn\u00e2\u20ac\u2122t see in malware",
|
||
|
|
"x_misp_type": "pattern-in-file",
|
||
|
|
"x_misp_value": "%%Myheartisjusttoodarktocare"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59a25dc1-ee70-4f02-9db8-b60e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"first_observed": "2017-08-27T05:51:40Z",
|
||
|
|
"last_observed": "2017-08-27T05:51:40Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"email-message--59a25dc1-ee70-4f02-9db8-b60e02de0b81",
|
||
|
|
"file--59a25dc1-ee70-4f02-9db8-b60e02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"email-attachment\"",
|
||
|
|
"misp:category=\"Payload delivery\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "email-message",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "email-message--59a25dc1-ee70-4f02-9db8-b60e02de0b81",
|
||
|
|
"is_multipart": true,
|
||
|
|
"body_multipart": [
|
||
|
|
{
|
||
|
|
"body_raw_ref": "file--59a25dc1-ee70-4f02-9db8-b60e02de0b81",
|
||
|
|
"content_disposition": "attachment; filename='\u00d0\u2019\u00d1\u2039\u00d0\u00bf\u00d0\u00b8\u00d1\u0081\u00d0\u00ba\u00d0\u00b0.docx'"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--59a25dc1-ee70-4f02-9db8-b60e02de0b81",
|
||
|
|
"name": "\u00d0\u2019\u00d1\u2039\u00d0\u00bf\u00d0\u00b8\u00d1\u0081\u00d0\u00ba\u00d0\u00b0.docx"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59a25dc1-7764-4a0b-89c0-b60e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"first_observed": "2017-08-27T05:51:40Z",
|
||
|
|
"last_observed": "2017-08-27T05:51:40Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"email-message--59a25dc1-7764-4a0b-89c0-b60e02de0b81",
|
||
|
|
"file--59a25dc1-7764-4a0b-89c0-b60e02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"email-attachment\"",
|
||
|
|
"misp:category=\"Payload delivery\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "email-message",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "email-message--59a25dc1-7764-4a0b-89c0-b60e02de0b81",
|
||
|
|
"is_multipart": true,
|
||
|
|
"body_multipart": [
|
||
|
|
{
|
||
|
|
"body_raw_ref": "file--59a25dc1-7764-4a0b-89c0-b60e02de0b81",
|
||
|
|
"content_disposition": "attachment; filename='\u00d0\u2019\u00d1\u2039\u00d0\u00bf\u00d0\u00b8\u00d1\u0081\u00d0\u00ba\u00d0\u00b0 \u00d0\u00bf\u00d0\u00be \u00d1\u0081\u00d1\u2021\u00d0\u00b5\u00d1\u201a\u00d1\u0192.docx'"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--59a25dc1-7764-4a0b-89c0-b60e02de0b81",
|
||
|
|
"name": "\u00d0\u2019\u00d1\u2039\u00d0\u00bf\u00d0\u00b8\u00d1\u0081\u00d0\u00ba\u00d0\u00b0 \u00d0\u00bf\u00d0\u00be \u00d1\u0081\u00d1\u2021\u00d0\u00b5\u00d1\u201a\u00d1\u0192.docx"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59a25dc1-db3c-46fb-bd1c-b60e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"first_observed": "2017-08-27T05:51:40Z",
|
||
|
|
"last_observed": "2017-08-27T05:51:40Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"email-message--59a25dc1-db3c-46fb-bd1c-b60e02de0b81",
|
||
|
|
"file--59a25dc1-db3c-46fb-bd1c-b60e02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"email-attachment\"",
|
||
|
|
"misp:category=\"Payload delivery\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "email-message",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "email-message--59a25dc1-db3c-46fb-bd1c-b60e02de0b81",
|
||
|
|
"is_multipart": true,
|
||
|
|
"body_multipart": [
|
||
|
|
{
|
||
|
|
"body_raw_ref": "file--59a25dc1-db3c-46fb-bd1c-b60e02de0b81",
|
||
|
|
"content_disposition": "attachment; filename='\u00d0\u2019\u00d1\u2039\u00d0\u00bf\u00d0\u00b8\u00d1\u0081\u00d0\u00ba\u00d0\u00b0 \u00d0\u00bf\u00d0\u00be \u00d0\u00ba\u00d0\u00b0\u00d1\u20ac\u00d1\u201a\u00d0\u00b5.docx'"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--59a25dc1-db3c-46fb-bd1c-b60e02de0b81",
|
||
|
|
"name": "\u00d0\u2019\u00d1\u2039\u00d0\u00bf\u00d0\u00b8\u00d1\u0081\u00d0\u00ba\u00d0\u00b0 \u00d0\u00bf\u00d0\u00be \u00d0\u00ba\u00d0\u00b0\u00d1\u20ac\u00d1\u201a\u00d0\u00b5.docx"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59a25dc1-36c4-412d-8b6d-b60e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"first_observed": "2017-08-27T05:51:40Z",
|
||
|
|
"last_observed": "2017-08-27T05:51:40Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"email-message--59a25dc1-36c4-412d-8b6d-b60e02de0b81",
|
||
|
|
"file--59a25dc1-36c4-412d-8b6d-b60e02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"email-attachment\"",
|
||
|
|
"misp:category=\"Payload delivery\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "email-message",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "email-message--59a25dc1-36c4-412d-8b6d-b60e02de0b81",
|
||
|
|
"is_multipart": true,
|
||
|
|
"body_multipart": [
|
||
|
|
{
|
||
|
|
"body_raw_ref": "file--59a25dc1-36c4-412d-8b6d-b60e02de0b81",
|
||
|
|
"content_disposition": "attachment; filename='\u00d0\u2019\u00d1\u2039\u00d0\u00bf\u00d0\u00b8\u00d1\u0081\u00d0\u00ba\u00d0\u00b0 \u00d0\u00bf\u00d0\u00be \u00d0\u00ba\u00d0\u00b0\u00d1\u20ac\u00d1\u201a\u00d0\u00b5 \u00d0\u00ba\u00d0\u00bb\u00d0\u00b8\u00d0\u00b5\u00d0\u00bd\u00d1\u201a\u00d0\u00b0.docx'"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--59a25dc1-36c4-412d-8b6d-b60e02de0b81",
|
||
|
|
"name": "\u00d0\u2019\u00d1\u2039\u00d0\u00bf\u00d0\u00b8\u00d1\u0081\u00d0\u00ba\u00d0\u00b0 \u00d0\u00bf\u00d0\u00be \u00d0\u00ba\u00d0\u00b0\u00d1\u20ac\u00d1\u201a\u00d0\u00b5 \u00d0\u00ba\u00d0\u00bb\u00d0\u00b8\u00d0\u00b5\u00d0\u00bd\u00d1\u201a\u00d0\u00b0.docx"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59a25dc1-9058-4d49-b0e9-b60e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"first_observed": "2017-08-27T05:51:40Z",
|
||
|
|
"last_observed": "2017-08-27T05:51:40Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"email-message--59a25dc1-9058-4d49-b0e9-b60e02de0b81",
|
||
|
|
"file--59a25dc1-9058-4d49-b0e9-b60e02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"email-attachment\"",
|
||
|
|
"misp:category=\"Payload delivery\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "email-message",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "email-message--59a25dc1-9058-4d49-b0e9-b60e02de0b81",
|
||
|
|
"is_multipart": true,
|
||
|
|
"body_multipart": [
|
||
|
|
{
|
||
|
|
"body_raw_ref": "file--59a25dc1-9058-4d49-b0e9-b60e02de0b81",
|
||
|
|
"content_disposition": "attachment; filename='12.docx'"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--59a25dc1-9058-4d49-b0e9-b60e02de0b81",
|
||
|
|
"name": "12.docx"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--59a25dd9-bf68-45c0-9374-494302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "External analysis",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Last week, the Ukrainian Central Bank issued a warning around an attack being launched against Ukrainian banks. Thanks to one of our contacts in the region, we received the malware at an early stage and were able to provide coverage for our customers\u00e2\u20ac\u201dalways our first priority. Now that local authorities have publicly disclosed the matter, we would like to share some insights into the campaign.\r\n\r\nThe attacks appear to have targeted banks in Russia as well as Ukraine, and we are aware of reports of similar attack vectors and payloads in other countries.\r\n\r\nThe initial threat started with emails sent to the banks around August 10, 2017, and a second wave on August 18 that carried attachments containing a payload. The subject of the emails were triggered to get the attention of the users and lure them into opening the attachments."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59a25dec-e044-4ab0-a56f-b60e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"description": "- Xchecked via VT: 647572d133677882f52843f799375ac77178616bcd3d9ed13b95d49eecfd0a51",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '583570d92cc49ec7661c055c4900c439446307f9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-08-27T05:51:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59a25dec-a75c-45e3-89eb-b60e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"description": "- Xchecked via VT: 647572d133677882f52843f799375ac77178616bcd3d9ed13b95d49eecfd0a51",
|
||
|
|
"pattern": "[file:hashes.MD5 = '4eee1c5db5c4678cfa7ad6262a18253d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-08-27T05:51:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59a25dec-f1ac-4268-8c34-b60e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"first_observed": "2017-08-27T05:51:40Z",
|
||
|
|
"last_observed": "2017-08-27T05:51:40Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--59a25dec-f1ac-4268-8c34-b60e02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--59a25dec-f1ac-4268-8c34-b60e02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/647572d133677882f52843f799375ac77178616bcd3d9ed13b95d49eecfd0a51/analysis/1503366922/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59a25dec-cd54-489e-ada2-b60e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"description": "- Xchecked via VT: e9d843761df7f6ef193d9f8e88d93a90816f2067fdd51a1c0765dfbfd4cb398f",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'dfaa3825b6bf2fc21978bf3234f38ffbd2966b96']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-08-27T05:51:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59a25dec-eb38-4439-88b3-b60e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"description": "- Xchecked via VT: e9d843761df7f6ef193d9f8e88d93a90816f2067fdd51a1c0765dfbfd4cb398f",
|
||
|
|
"pattern": "[file:hashes.MD5 = '98c5c33f5c0bd07ac3e24935edab202a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-08-27T05:51:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59a25dec-7f9c-4fd1-8047-b60e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"first_observed": "2017-08-27T05:51:40Z",
|
||
|
|
"last_observed": "2017-08-27T05:51:40Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--59a25dec-7f9c-4fd1-8047-b60e02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--59a25dec-7f9c-4fd1-8047-b60e02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/e9d843761df7f6ef193d9f8e88d93a90816f2067fdd51a1c0765dfbfd4cb398f/analysis/1503021378/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59a25dec-5794-402f-a588-b60e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"description": "- Xchecked via VT: 1892154cc47e8a1bc81186d131e001a22e4edbc4fd88688eb1782b934e1941b6",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a85e66a654ca056a14f64516af62e82c07036e06']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-08-27T05:51:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59a25dec-2500-44c2-b562-b60e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"description": "- Xchecked via VT: 1892154cc47e8a1bc81186d131e001a22e4edbc4fd88688eb1782b934e1941b6",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'cfc0b41a7cde01333f10d48e9997d293']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-08-27T05:51:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59a25dec-0d44-442b-b613-b60e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"first_observed": "2017-08-27T05:51:40Z",
|
||
|
|
"last_observed": "2017-08-27T05:51:40Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--59a25dec-0d44-442b-b613-b60e02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--59a25dec-0d44-442b-b613-b60e02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/1892154cc47e8a1bc81186d131e001a22e4edbc4fd88688eb1782b934e1941b6/analysis/1503475768/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59a25dec-a084-4101-8ba1-b60e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"description": "- Xchecked via VT: 430c1bfa22e0f7b0e8742c0d70b8911089ba58645818e4281d7066d1324a3952",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a8bcbaedfbd3eff1e3d5005c35bd8f4c4f6f325c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-08-27T05:51:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59a25dec-2e20-4de3-90c2-b60e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"description": "- Xchecked via VT: 430c1bfa22e0f7b0e8742c0d70b8911089ba58645818e4281d7066d1324a3952",
|
||
|
|
"pattern": "[file:hashes.MD5 = '5df8067a6fcb6c45c3b5c14adb944806']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-08-27T05:51:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59a25dec-6aa8-4213-a915-b60e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"first_observed": "2017-08-27T05:51:40Z",
|
||
|
|
"last_observed": "2017-08-27T05:51:40Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--59a25dec-6aa8-4213-a915-b60e02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--59a25dec-6aa8-4213-a915-b60e02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/430c1bfa22e0f7b0e8742c0d70b8911089ba58645818e4281d7066d1324a3952/analysis/1503474922/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59a25dec-bc48-4a8a-8977-b60e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"description": "- Xchecked via VT: ecc055974d7d190871dc4eb1bf1f8b998d6e8abf04dba2ff560ae395aeec4d5d",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '5983b31b80b7f3d84d9d0436574a7351d8522e9c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-08-27T05:51:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59a25dec-355c-4c9b-8590-b60e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"description": "- Xchecked via VT: ecc055974d7d190871dc4eb1bf1f8b998d6e8abf04dba2ff560ae395aeec4d5d",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c43f1716d6dbb243f0b8cd92944a04bd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-08-27T05:51:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59a25dec-c0d8-4432-a038-b60e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-08-27T05:51:40.000Z",
|
||
|
|
"modified": "2017-08-27T05:51:40.000Z",
|
||
|
|
"first_observed": "2017-08-27T05:51:40Z",
|
||
|
|
"last_observed": "2017-08-27T05:51:40Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--59a25dec-c0d8-4432-a038-b60e02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--59a25dec-c0d8-4432-a038-b60e02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/ecc055974d7d190871dc4eb1bf1f8b998d6e8abf04dba2ff560ae395aeec4d5d/analysis/1503475773/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|