1457 lines
59 KiB
JSON
1457 lines
59 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--59c561be-c660-49d3-8193-e0c7950d210f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T13:03:16.000Z",
|
||
|
|
"modified": "2017-09-25T13:03:16.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--59c561be-c660-49d3-8193-e0c7950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T13:03:16.000Z",
|
||
|
|
"modified": "2017-09-25T13:03:16.000Z",
|
||
|
|
"name": "M2M - Locky: \"Invoice RE-2017-09-21-00xxx\"\tfrom \"Amazon Marketplace\"",
|
||
|
|
"published": "2017-09-25T13:03:22Z",
|
||
|
|
"object_refs": [
|
||
|
|
"indicator--59c561be-fa38-421b-83fc-48f8950d210f",
|
||
|
|
"indicator--59c561bf-9720-416e-9b86-46f0950d210f",
|
||
|
|
"indicator--59c561bf-ecd0-4323-96e1-43b0950d210f",
|
||
|
|
"indicator--59c561bf-b0f8-4391-8ae4-4309950d210f",
|
||
|
|
"indicator--59c561c0-b2a0-4e35-bd50-4bd6950d210f",
|
||
|
|
"indicator--59c561c0-b5e0-4142-8649-4ec8950d210f",
|
||
|
|
"observed-data--59c561c1-9178-4058-9cb3-d2d7950d210f",
|
||
|
|
"network-traffic--59c561c1-9178-4058-9cb3-d2d7950d210f",
|
||
|
|
"ipv4-addr--59c561c1-9178-4058-9cb3-d2d7950d210f",
|
||
|
|
"indicator--59c561c2-3f34-494b-b73a-4875950d210f",
|
||
|
|
"indicator--59c561c2-4e58-4fa3-bca7-4b66950d210f",
|
||
|
|
"observed-data--59c561c2-aed4-4bb2-8c22-4aae950d210f",
|
||
|
|
"network-traffic--59c561c2-aed4-4bb2-8c22-4aae950d210f",
|
||
|
|
"ipv4-addr--59c561c2-aed4-4bb2-8c22-4aae950d210f",
|
||
|
|
"indicator--59c561c3-9fa0-43bf-93b3-df79950d210f",
|
||
|
|
"indicator--59c561c3-fc10-43e6-855d-47cd950d210f",
|
||
|
|
"observed-data--59c561c3-97c8-4a82-a68c-e0d9950d210f",
|
||
|
|
"network-traffic--59c561c3-97c8-4a82-a68c-e0d9950d210f",
|
||
|
|
"ipv4-addr--59c561c3-97c8-4a82-a68c-e0d9950d210f",
|
||
|
|
"indicator--59c561c4-7880-4a4b-b932-47ba950d210f",
|
||
|
|
"indicator--59c561c4-af4c-4f57-a1f0-d2d7950d210f",
|
||
|
|
"observed-data--59c561c4-9288-4676-bd19-7461950d210f",
|
||
|
|
"network-traffic--59c561c4-9288-4676-bd19-7461950d210f",
|
||
|
|
"ipv4-addr--59c561c4-9288-4676-bd19-7461950d210f",
|
||
|
|
"indicator--59c561c5-e5a0-4e89-8240-48e2950d210f",
|
||
|
|
"indicator--59c561c5-5350-430b-ab83-49ba950d210f",
|
||
|
|
"observed-data--59c561c5-bdd4-4047-bb19-4656950d210f",
|
||
|
|
"network-traffic--59c561c5-bdd4-4047-bb19-4656950d210f",
|
||
|
|
"ipv4-addr--59c561c5-bdd4-4047-bb19-4656950d210f",
|
||
|
|
"indicator--59c561c6-32bc-40b5-8b26-e0d9950d210f",
|
||
|
|
"indicator--59c561c6-2a60-4934-afb3-4b36950d210f",
|
||
|
|
"observed-data--59c561c6-a6c4-4293-b7ac-4260950d210f",
|
||
|
|
"network-traffic--59c561c6-a6c4-4293-b7ac-4260950d210f",
|
||
|
|
"ipv4-addr--59c561c6-a6c4-4293-b7ac-4260950d210f",
|
||
|
|
"indicator--59c561c7-2b18-4256-b68a-41cf950d210f",
|
||
|
|
"indicator--59c561c7-3358-4ad1-8ada-1330950d210f",
|
||
|
|
"observed-data--59c561c7-7fb8-4db0-9207-e0c7950d210f",
|
||
|
|
"network-traffic--59c561c7-7fb8-4db0-9207-e0c7950d210f",
|
||
|
|
"ipv4-addr--59c561c7-7fb8-4db0-9207-e0c7950d210f",
|
||
|
|
"indicator--59c561c8-df5c-4a42-9887-42d2950d210f",
|
||
|
|
"indicator--59c561c8-cda8-4c40-a088-4fde950d210f",
|
||
|
|
"observed-data--59c561c8-15ec-4b9d-bed3-4e91950d210f",
|
||
|
|
"network-traffic--59c561c8-15ec-4b9d-bed3-4e91950d210f",
|
||
|
|
"ipv4-addr--59c561c8-15ec-4b9d-bed3-4e91950d210f",
|
||
|
|
"indicator--59c561c9-1a30-4595-972b-475f950d210f",
|
||
|
|
"indicator--59c561c9-e21c-48e3-9b19-d2d7950d210f",
|
||
|
|
"observed-data--59c561ca-5134-4bee-a8f5-7461950d210f",
|
||
|
|
"network-traffic--59c561ca-5134-4bee-a8f5-7461950d210f",
|
||
|
|
"ipv4-addr--59c561ca-5134-4bee-a8f5-7461950d210f",
|
||
|
|
"indicator--59c561ca-d87c-4f1a-b49c-e0c7950d210f",
|
||
|
|
"indicator--59c561ca-fe2c-4e66-8408-44e2950d210f",
|
||
|
|
"observed-data--59c561ca-4290-4553-baa4-449d950d210f",
|
||
|
|
"network-traffic--59c561ca-4290-4553-baa4-449d950d210f",
|
||
|
|
"ipv4-addr--59c561ca-4290-4553-baa4-449d950d210f",
|
||
|
|
"indicator--59c561cb-7710-463b-843c-411b950d210f",
|
||
|
|
"indicator--59c561cb-22c0-4e86-9c65-4e82950d210f",
|
||
|
|
"indicator--59c561cc-4128-45ea-ac19-df79950d210f",
|
||
|
|
"indicator--59c561cc-44e0-43a8-a6c9-40aa950d210f",
|
||
|
|
"observed-data--59c561cd-3be8-4825-a2e0-d2d7950d210f",
|
||
|
|
"network-traffic--59c561cd-3be8-4825-a2e0-d2d7950d210f",
|
||
|
|
"ipv4-addr--59c561cd-3be8-4825-a2e0-d2d7950d210f",
|
||
|
|
"indicator--59c561cd-b0e8-4e76-9e05-4670950d210f",
|
||
|
|
"observed-data--59c561d0-4d28-48f3-997d-1330950d210f",
|
||
|
|
"url--59c561d0-4d28-48f3-997d-1330950d210f",
|
||
|
|
"observed-data--59c561d6-b3d4-4c42-a4a9-48c0950d210f",
|
||
|
|
"url--59c561d6-b3d4-4c42-a4a9-48c0950d210f",
|
||
|
|
"observed-data--59c561d6-0cac-48c8-9a4d-42f9950d210f",
|
||
|
|
"url--59c561d6-0cac-48c8-9a4d-42f9950d210f",
|
||
|
|
"observed-data--59c561d6-1f8c-42d4-8dca-4d6a950d210f",
|
||
|
|
"url--59c561d6-1f8c-42d4-8dca-4d6a950d210f",
|
||
|
|
"indicator--59c56293-68e4-4593-a751-484802de0b81",
|
||
|
|
"indicator--59c56293-cd4c-41e1-b0fa-463b02de0b81",
|
||
|
|
"observed-data--59c56293-67c0-4948-a658-4c1402de0b81",
|
||
|
|
"url--59c56293-67c0-4948-a658-4c1402de0b81",
|
||
|
|
"indicator--59c56293-80c4-4db9-a9eb-44f702de0b81",
|
||
|
|
"indicator--59c56293-6ca8-4988-b890-490c02de0b81",
|
||
|
|
"observed-data--59c56293-5f64-49d4-8ff6-44e902de0b81",
|
||
|
|
"url--59c56293-5f64-49d4-8ff6-44e902de0b81",
|
||
|
|
"indicator--59c56293-4794-477d-8834-441a02de0b81",
|
||
|
|
"observed-data--59c56293-9ffc-40dc-b442-4f9902de0b81",
|
||
|
|
"url--59c56293-9ffc-40dc-b442-4f9902de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"ecsirt:malicious-code=\"ransomware\"",
|
||
|
|
"misp-galaxy:ransomware=\"Locky\""
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c561be-fa38-421b-83fc-48f8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '149d63efd95781f3d3a07b838d14f04e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c561bf-9720-416e-9b86-46f0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '35d9c92cc67596b694396eab38b8ab8b016a96ae3b40e2cd9e6aa686970186ca']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c561bf-ecd0-4323-96e1-43b0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ac6da4890150e2037a5913623557ab759b62d0ee9206ec0bacac318523afbc53']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c561bf-b0f8-4391-8ae4-4309950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7bf8de16c1fc84eabcf087894b534c8af8fa4f6aa632c77c8b52471274d78a6c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c561c0-b2a0-4e35-bd50-4bd6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"pattern": "[url:value = 'http://81552.com/IUGiwe8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c561c0-b5e0-4142-8649-4ec8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"pattern": "[domain-name:value = '81552.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c561c1-9178-4058-9cb3-d2d7950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"first_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"last_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c561c1-9178-4058-9cb3-d2d7950d210f",
|
||
|
|
"ipv4-addr--59c561c1-9178-4058-9cb3-d2d7950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c561c1-9178-4058-9cb3-d2d7950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c561c1-9178-4058-9cb3-d2d7950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c561c1-9178-4058-9cb3-d2d7950d210f",
|
||
|
|
"value": "203.83.241.105"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c561c2-3f34-494b-b73a-4875950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"pattern": "[url:value = 'http://accuflowfloors.com/IUGiwe8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c561c2-4e58-4fa3-bca7-4b66950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'accuflowfloors.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c561c2-aed4-4bb2-8c22-4aae950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"first_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"last_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c561c2-aed4-4bb2-8c22-4aae950d210f",
|
||
|
|
"ipv4-addr--59c561c2-aed4-4bb2-8c22-4aae950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c561c2-aed4-4bb2-8c22-4aae950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c561c2-aed4-4bb2-8c22-4aae950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c561c2-aed4-4bb2-8c22-4aae950d210f",
|
||
|
|
"value": "65.182.174.12"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c561c3-9fa0-43bf-93b3-df79950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"pattern": "[url:value = 'http://adr-werbetechnik.de/IUGiwe8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c561c3-fc10-43e6-855d-47cd950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'adr-werbetechnik.de']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c561c3-97c8-4a82-a68c-e0d9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"first_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"last_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c561c3-97c8-4a82-a68c-e0d9950d210f",
|
||
|
|
"ipv4-addr--59c561c3-97c8-4a82-a68c-e0d9950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c561c3-97c8-4a82-a68c-e0d9950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c561c3-97c8-4a82-a68c-e0d9950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c561c3-97c8-4a82-a68c-e0d9950d210f",
|
||
|
|
"value": "85.236.207.83"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c561c4-7880-4a4b-b932-47ba950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"pattern": "[url:value = 'http://aetozi.gr/IUGiwe8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c561c4-af4c-4f57-a1f0-d2d7950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'aetozi.gr']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c561c4-9288-4676-bd19-7461950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"first_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"last_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c561c4-9288-4676-bd19-7461950d210f",
|
||
|
|
"ipv4-addr--59c561c4-9288-4676-bd19-7461950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c561c4-9288-4676-bd19-7461950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c561c4-9288-4676-bd19-7461950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c561c4-9288-4676-bd19-7461950d210f",
|
||
|
|
"value": "185.4.135.15"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c561c5-e5a0-4e89-8240-48e2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"pattern": "[url:value = 'http://afmance.it/IUGiwe8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c561c5-5350-430b-ab83-49ba950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'afmance.it']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c561c5-bdd4-4047-bb19-4656950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"first_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"last_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c561c5-bdd4-4047-bb19-4656950d210f",
|
||
|
|
"ipv4-addr--59c561c5-bdd4-4047-bb19-4656950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c561c5-bdd4-4047-bb19-4656950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c561c5-bdd4-4047-bb19-4656950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c561c5-bdd4-4047-bb19-4656950d210f",
|
||
|
|
"value": "151.1.140.206"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c561c6-32bc-40b5-8b26-e0d9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"pattern": "[url:value = 'http://afradem.com/IUGiwe8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c561c6-2a60-4934-afb3-4b36950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'afradem.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c561c6-a6c4-4293-b7ac-4260950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"first_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"last_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c561c6-a6c4-4293-b7ac-4260950d210f",
|
||
|
|
"ipv4-addr--59c561c6-a6c4-4293-b7ac-4260950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c561c6-a6c4-4293-b7ac-4260950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c561c6-a6c4-4293-b7ac-4260950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c561c6-a6c4-4293-b7ac-4260950d210f",
|
||
|
|
"value": "178.255.99.134"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c561c7-2b18-4256-b68a-41cf950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"pattern": "[url:value = 'http://agricom.it/IUGiwe8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c561c7-3358-4ad1-8ada-1330950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'agricom.it']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c561c7-7fb8-4db0-9207-e0c7950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"first_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"last_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c561c7-7fb8-4db0-9207-e0c7950d210f",
|
||
|
|
"ipv4-addr--59c561c7-7fb8-4db0-9207-e0c7950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c561c7-7fb8-4db0-9207-e0c7950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c561c7-7fb8-4db0-9207-e0c7950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c561c7-7fb8-4db0-9207-e0c7950d210f",
|
||
|
|
"value": "195.225.168.230"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c561c8-df5c-4a42-9887-42d2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"pattern": "[url:value = 'http://agriturismobellaria.net/IUGiwe8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c561c8-cda8-4c40-a088-4fde950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'agriturismobellaria.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c561c8-15ec-4b9d-bed3-4e91950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"first_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"last_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c561c8-15ec-4b9d-bed3-4e91950d210f",
|
||
|
|
"ipv4-addr--59c561c8-15ec-4b9d-bed3-4e91950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c561c8-15ec-4b9d-bed3-4e91950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c561c8-15ec-4b9d-bed3-4e91950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c561c8-15ec-4b9d-bed3-4e91950d210f",
|
||
|
|
"value": "80.88.87.95"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c561c9-1a30-4595-972b-475f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"pattern": "[url:value = 'http://agro-kerler.de/IUGiwe8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c561c9-e21c-48e3-9b19-d2d7950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'agro-kerler.de']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c561ca-5134-4bee-a8f5-7461950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"first_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"last_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c561ca-5134-4bee-a8f5-7461950d210f",
|
||
|
|
"ipv4-addr--59c561ca-5134-4bee-a8f5-7461950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c561ca-5134-4bee-a8f5-7461950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c561ca-5134-4bee-a8f5-7461950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c561ca-5134-4bee-a8f5-7461950d210f",
|
||
|
|
"value": "213.165.96.3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c561ca-d87c-4f1a-b49c-e0c7950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"pattern": "[url:value = 'http://ahlbrandt.eu/IUGiwe8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c561ca-fe2c-4e66-8408-44e2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'ahlbrandt.eu']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c561ca-4290-4553-baa4-449d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"first_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"last_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c561ca-4290-4553-baa4-449d950d210f",
|
||
|
|
"ipv4-addr--59c561ca-4290-4553-baa4-449d950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c561ca-4290-4553-baa4-449d950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c561ca-4290-4553-baa4-449d950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c561ca-4290-4553-baa4-449d950d210f",
|
||
|
|
"value": "87.230.26.149"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c561cb-7710-463b-843c-411b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"pattern": "[url:value = 'http://fulcar.info/p66/IUGiwe8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c561cb-22c0-4e86-9c65-4e82950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'fulcar.info']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c561cc-4128-45ea-ac19-df79950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"pattern": "[url:value = 'http://moonmusic.com.au/IUGiwe8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c561cc-44e0-43a8-a6c9-40aa950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'moonmusic.com.au']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c561cd-3be8-4825-a2e0-d2d7950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"first_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"last_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c561cd-3be8-4825-a2e0-d2d7950d210f",
|
||
|
|
"ipv4-addr--59c561cd-3be8-4825-a2e0-d2d7950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c561cd-3be8-4825-a2e0-d2d7950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c561cd-3be8-4825-a2e0-d2d7950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c561cd-3be8-4825-a2e0-d2d7950d210f",
|
||
|
|
"value": "117.55.235.14"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c561cd-b0e8-4e76-9e05-4670950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:13.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:13.000Z",
|
||
|
|
"pattern": "[url:value = 'http://blog.dynamoo.com/2017/09/malware-spam-invoice-re-2017-09-21.html']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-25T12:56:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "External analysis"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c561d0-4d28-48f3-997d-1330950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"first_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"last_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--59c561d0-4d28-48f3-997d-1330950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--59c561d0-4d28-48f3-997d-1330950d210f",
|
||
|
|
"value": "https://www.virustotal.com/#/file/35d9c92cc67596b694396eab38b8ab8b016a96ae3b40e2cd9e6aa686970186ca/detection"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c561d6-b3d4-4c42-a4a9-48c0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"first_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"last_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--59c561d6-b3d4-4c42-a4a9-48c0950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--59c561d6-b3d4-4c42-a4a9-48c0950d210f",
|
||
|
|
"value": "https://www.virustotal.com/#/file/ac6da4890150e2037a5913623557ab759b62d0ee9206ec0bacac318523afbc53/detection"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c561d6-0cac-48c8-9a4d-42f9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"first_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"last_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--59c561d6-0cac-48c8-9a4d-42f9950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--59c561d6-0cac-48c8-9a4d-42f9950d210f",
|
||
|
|
"value": "https://www.hybrid-analysis.com/sample/35d9c92cc67596b694396eab38b8ab8b016a96ae3b40e2cd9e6aa686970186ca?environmentId=100"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c561d6-1f8c-42d4-8dca-4d6a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:50.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:50.000Z",
|
||
|
|
"first_observed": "2017-09-22T19:20:50Z",
|
||
|
|
"last_observed": "2017-09-22T19:20:50Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--59c561d6-1f8c-42d4-8dca-4d6a950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--59c561d6-1f8c-42d4-8dca-4d6a950d210f",
|
||
|
|
"value": "https://www.hybrid-analysis.com/sample/7bf8de16c1fc84eabcf087894b534c8af8fa4f6aa632c77c8b52471274d78a6c?environmentId=100"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c56293-68e4-4593-a751-484802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"description": "- Xchecked via VT: 35d9c92cc67596b694396eab38b8ab8b016a96ae3b40e2cd9e6aa686970186ca",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '7eb945458b1f489b351b86e3ff4403edc3503653']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c56293-cd4c-41e1-b0fa-463b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"description": "- Xchecked via VT: 35d9c92cc67596b694396eab38b8ab8b016a96ae3b40e2cd9e6aa686970186ca",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'f3fcbc16b37e56f7a89ddf7d0f718291']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c56293-67c0-4948-a658-4c1402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"first_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"last_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--59c56293-67c0-4948-a658-4c1402de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--59c56293-67c0-4948-a658-4c1402de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/35d9c92cc67596b694396eab38b8ab8b016a96ae3b40e2cd9e6aa686970186ca/analysis/1506079172/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c56293-80c4-4db9-a9eb-44f702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"description": "- Xchecked via VT: 7bf8de16c1fc84eabcf087894b534c8af8fa4f6aa632c77c8b52471274d78a6c",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'cb540085bef26e1b627476636701006abdff5de9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c56293-6ca8-4988-b890-490c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"description": "- Xchecked via VT: 7bf8de16c1fc84eabcf087894b534c8af8fa4f6aa632c77c8b52471274d78a6c",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c47bc13595d44521b3f5567ded0a0a13']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c56293-5f64-49d4-8ff6-44e902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"first_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"last_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--59c56293-5f64-49d4-8ff6-44e902de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--59c56293-5f64-49d4-8ff6-44e902de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/7bf8de16c1fc84eabcf087894b534c8af8fa4f6aa632c77c8b52471274d78a6c/analysis/1505989331/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c56293-4794-477d-8834-441a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"description": "- Xchecked via VT: ac6da4890150e2037a5913623557ab759b62d0ee9206ec0bacac318523afbc53",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '0f4ca32e004dbbf7c3e485b3ccd6ed1adac7fb65']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c56293-9ffc-40dc-b442-4f9902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:20:51.000Z",
|
||
|
|
"modified": "2017-09-22T19:20:51.000Z",
|
||
|
|
"first_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"last_observed": "2017-09-22T19:20:51Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--59c56293-9ffc-40dc-b442-4f9902de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--59c56293-9ffc-40dc-b442-4f9902de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/ac6da4890150e2037a5913623557ab759b62d0ee9206ec0bacac318523afbc53/analysis/1506053433/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|