adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/stix-2.1/59a3bc82-f214-4bef-ab11-461b950d210f.json

566 lines
24 KiB
JSON
Raw Permalink Normal View History

chg: [misp-stix] STIX 2.1 export added
2023-04-21 14:44:17 +00:00
{
"type": "bundle",
"id": "bundle--59a3bc82-f214-4bef-ab11-461b950d210f",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-08-28T14:23:55.000Z",
"modified": "2017-08-28T14:23:55.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--59a3bc82-f214-4bef-ab11-461b950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-08-28T14:23:55.000Z",
"modified": "2017-08-28T14:23:55.000Z",
"name": "OSINT - Ursnif variant found using mouse movement for decryption and evasion",
"published": "2017-08-28T14:24:00Z",
"object_refs": [
"observed-data--59a3bc9a-a1c4-440f-bc9e-4e22950d210f",
"url--59a3bc9a-a1c4-440f-bc9e-4e22950d210f",
"x-misp-attribute--59a3bcdb-123c-4401-b037-4e83950d210f",
"indicator--59a3bd70-2700-48b3-8033-4ec3950d210f",
"indicator--59a3bd70-3474-4b05-9452-4952950d210f",
"indicator--59a3bd70-7950-4d02-a65b-4e5e950d210f",
"indicator--59a3bd70-cd70-4925-b57e-41d5950d210f",
"indicator--59a3bd70-00ec-42c0-86ac-4011950d210f",
"indicator--59a3bd81-7c78-4ca1-bbb7-4915950d210f",
"indicator--59a3bd82-c9b4-45f4-b13d-4b36950d210f",
"indicator--59a3bda9-6a18-4c11-9c24-4ac7950d210f",
"indicator--59a3bda9-6a60-4cc4-968e-4e8c950d210f",
"indicator--59a3bda9-535c-4b5d-8f27-4fe9950d210f",
"indicator--59a3bda9-4174-4074-91a6-4543950d210f",
"indicator--59a3bda9-96b4-4b8e-be4a-4c12950d210f",
"observed-data--59a3bdc5-47e4-4f75-abdc-4c80950d210f",
"windows-registry-key--59a3bdc5-47e4-4f75-abdc-4c80950d210f",
"indicator--59a42777-65c8-4b43-ab3c-4a9502de0b81",
"indicator--59a42777-feec-472d-a9d2-456d02de0b81",
"observed-data--59a42777-ef2c-4b28-9362-408602de0b81",
"url--59a42777-ef2c-4b28-9362-408602de0b81",
"indicator--59a42777-7bc8-4563-bde9-439202de0b81",
"indicator--59a42777-6ad4-4edb-849c-45a002de0b81",
"observed-data--59a42777-bef0-4674-82fd-4ffc02de0b81",
"url--59a42777-bef0-4674-82fd-4ffc02de0b81"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"type:OSINT",
"malware_classification:malware-category=\"Trojan\"",
"osint:source-type=\"blog-post\"",
"misp-galaxy:tool=\"Snifula\""
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--59a3bc9a-a1c4-440f-bc9e-4e22950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-08-28T14:23:50.000Z",
"modified": "2017-08-28T14:23:50.000Z",
"first_observed": "2017-08-28T14:23:50Z",
"last_observed": "2017-08-28T14:23:50Z",
"number_observed": 1,
"object_refs": [
"url--59a3bc9a-a1c4-440f-bc9e-4e22950d210f"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\"",
"osint:source-type=\"blog-post\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--59a3bc9a-a1c4-440f-bc9e-4e22950d210f",
"value": "https://blogs.forcepoint.com/security-labs/ursnif-variant-found-using-mouse-movement-decryption-and-evasion"
},
{
"type": "x-misp-attribute",
"spec_version": "2.1",
"id": "x-misp-attribute--59a3bcdb-123c-4401-b037-4e83950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-08-28T14:23:50.000Z",
"modified": "2017-08-28T14:23:50.000Z",
"labels": [
"misp:type=\"comment\"",
"misp:category=\"External analysis\"",
"osint:source-type=\"blog-post\""
],
"x_misp_category": "External analysis",
"x_misp_type": "comment",
"x_misp_value": "In January 2016 Forcepoint Security Labs reported an email campaign delivering the Ursnif banking Trojan which used the \u00e2\u20ac\u02dcRange\u00e2\u20ac\u2122 feature within its initial HTTP requests to avoid detection.\r\n\r\nIn July 2017 we discovered a malicious email sample delivering a new variant of Ursnif, attached within an encrypted Word document with the plaintext password within the email body. As recorded in several other Ursnif campaigns reported since April 2017, this Word document contains several obfuscated VBS files which load malicious DLLs through WMI.\r\n\r\nHowever, these samples appear to exhibit new features including anti-sandboxing features that use a combination of mouse position and file timestamps to decode their internal data and the ability to steal data from the Thunderbird application."
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--59a3bd70-2700-48b3-8033-4ec3950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-08-28T14:23:50.000Z",
"modified": "2017-08-28T14:23:50.000Z",
"description": "Download locations",
"pattern": "[url:value = 'http://46.17.40.22/hyey.pnj']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-08-28T14:23:50Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--59a3bd70-3474-4b05-9452-4952950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-08-28T14:23:50.000Z",
"modified": "2017-08-28T14:23:50.000Z",
"description": "Download locations",
"pattern": "[url:value = '46.17.40.142/45.txt']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-08-28T14:23:50Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--59a3bd70-7950-4d02-a65b-4e5e950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-08-28T14:23:50.000Z",
"modified": "2017-08-28T14:23:50.000Z",
"description": "Download locations",
"pattern": "[url:value = 'http://inshaengineeringindustries.com/head.pkl']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-08-28T14:23:50Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--59a3bd70-cd70-4925-b57e-41d5950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-08-28T14:23:50.000Z",
"modified": "2017-08-28T14:23:50.000Z",
"description": "Download locations",
"pattern": "[url:value = 'http://ardshinbank.at/key/x32.bin']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-08-28T14:23:50Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--59a3bd70-00ec-42c0-86ac-4011950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-08-28T14:23:50.000Z",
"modified": "2017-08-28T14:23:50.000Z",
"description": "Download locations",
"pattern": "[url:value = 'http://ardshinbank.at/key/x64.bin']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-08-28T14:23:50Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--59a3bd81-7c78-4ca1-bbb7-4915950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-08-28T14:23:50.000Z",
"modified": "2017-08-28T14:23:50.000Z",
"description": "C2",
"pattern": "[file:name = 'aaxvkah7dudzoloq.onion']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-08-28T14:23:50Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"filename\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--59a3bd82-c9b4-45f4-b13d-4b36950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-08-28T14:23:50.000Z",
"modified": "2017-08-28T14:23:50.000Z",
"description": "C2",
"pattern": "[domain-name:value = '0x7293c971.ru']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-08-28T14:23:50Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--59a3bda9-6a18-4c11-9c24-4ac7950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-08-28T14:23:50.000Z",
"modified": "2017-08-28T14:23:50.000Z",
"pattern": "[file:hashes.SHA1 = '82615b4bb03ba00f141bb4d4b57bf8a73e76ebe9']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-08-28T14:23:50Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--59a3bda9-6a60-4cc4-968e-4e8c950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-08-28T14:23:50.000Z",
"modified": "2017-08-28T14:23:50.000Z",
"pattern": "[file:hashes.SHA1 = 'bdcb4b96a281da3e09e29071dc9661ce39d442f1']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-08-28T14:23:50Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--59a3bda9-535c-4b5d-8f27-4fe9950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-08-28T14:23:50.000Z",
"modified": "2017-08-28T14:23:50.000Z",
"pattern": "[file:hashes.SHA1 = '73fdde182759e644a3d7296537a048a6980e8526']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-08-28T14:23:50Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--59a3bda9-4174-4074-91a6-4543950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-08-28T14:23:50.000Z",
"modified": "2017-08-28T14:23:50.000Z",
"pattern": "[file:hashes.SHA1 = '60e221bd9e234ab6786def88a1f0e11460678fb4']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-08-28T14:23:50Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--59a3bda9-96b4-4b8e-be4a-4c12950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-08-28T14:23:50.000Z",
"modified": "2017-08-28T14:23:50.000Z",
"pattern": "[file:hashes.SHA1 = 'ce7e48d8ee6e113429dba75a8528568fda4b0067']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-08-28T14:23:50Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--59a3bdc5-47e4-4f75-abdc-4c80950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-08-28T14:23:50.000Z",
"modified": "2017-08-28T14:23:50.000Z",
"first_observed": "2017-08-28T14:23:50Z",
"last_observed": "2017-08-28T14:23:50Z",
"number_observed": 1,
"object_refs": [
"windows-registry-key--59a3bdc5-47e4-4f75-abdc-4c80950d210f"
],
"labels": [
"misp:type=\"regkey\"",
"misp:category=\"Persistence mechanism\""
]
},
{
"type": "windows-registry-key",
"spec_version": "2.1",
"id": "windows-registry-key--59a3bdc5-47e4-4f75-abdc-4c80950d210f",
"key": "HKEY_USERS\\S-1-5-21-746137067-1417001333-1606980848-500\\Software\\Microsoft\\Windows\\CurrentVersion\\Run"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--59a42777-65c8-4b43-ab3c-4a9502de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-08-28T14:23:51.000Z",
"modified": "2017-08-28T14:23:51.000Z",
"description": "- Xchecked via VT: 73fdde182759e644a3d7296537a048a6980e8526",
"pattern": "[file:hashes.SHA256 = '48dbf539d756d61a1eae7f6c87d4ccb6beae1b14e0273c87e53402e040b02f91']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-08-28T14:23:51Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--59a42777-feec-472d-a9d2-456d02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-08-28T14:23:51.000Z",
"modified": "2017-08-28T14:23:51.000Z",
"description": "- Xchecked via VT: 73fdde182759e644a3d7296537a048a6980e8526",
"pattern": "[file:hashes.MD5 = 'db53017980dcb70ee9f6bdee3603da42']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-08-28T14:23:51Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--59a42777-ef2c-4b28-9362-408602de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-08-28T14:23:51.000Z",
"modified": "2017-08-28T14:23:51.000Z",
"first_observed": "2017-08-28T14:23:51Z",
"last_observed": "2017-08-28T14:23:51Z",
"number_observed": 1,
"object_refs": [
"url--59a42777-ef2c-4b28-9362-408602de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--59a42777-ef2c-4b28-9362-408602de0b81",
"value": "https://www.virustotal.com/file/48dbf539d756d61a1eae7f6c87d4ccb6beae1b14e0273c87e53402e040b02f91/analysis/1503556363/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--59a42777-7bc8-4563-bde9-439202de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-08-28T14:23:51.000Z",
"modified": "2017-08-28T14:23:51.000Z",
"description": "- Xchecked via VT: bdcb4b96a281da3e09e29071dc9661ce39d442f1",
"pattern": "[file:hashes.SHA256 = '1e2efef5ae950993d8393f17ffd7752a0b3aefec77e97bebb2940fdb323e22ce']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-08-28T14:23:51Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--59a42777-6ad4-4edb-849c-45a002de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-08-28T14:23:51.000Z",
"modified": "2017-08-28T14:23:51.000Z",
"description": "- Xchecked via VT: bdcb4b96a281da3e09e29071dc9661ce39d442f1",
"pattern": "[file:hashes.MD5 = 'e6db3165321e8cbbc19f04b8493135da']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-08-28T14:23:51Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--59a42777-bef0-4674-82fd-4ffc02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-08-28T14:23:51.000Z",
"modified": "2017-08-28T14:23:51.000Z",
"first_observed": "2017-08-28T14:23:51Z",
"last_observed": "2017-08-28T14:23:51Z",
"number_observed": 1,
"object_refs": [
"url--59a42777-bef0-4674-82fd-4ffc02de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--59a42777-bef0-4674-82fd-4ffc02de0b81",
"value": "https://www.virustotal.com/file/1e2efef5ae950993d8393f17ffd7752a0b3aefec77e97bebb2940fdb323e22ce/analysis/1502176481/"
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
]
}
Reference in a new issue Copy permalink