adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/stix-2.1/5a0d5bf4-99c8-4f15-9879-22b1950d210f.json

2950 lines
245 KiB
JSON
Raw Permalink Normal View History

chg: [misp-stix] STIX 2.1 export added
2023-04-21 14:44:17 +00:00
{
"type": "bundle",
"id": "bundle--5a0d5bf4-99c8-4f15-9879-22b1950d210f",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-20T13:15:33.000Z",
"modified": "2017-11-20T13:15:33.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "grouping",
"spec_version": "2.1",
"id": "grouping--5a0d5bf4-99c8-4f15-9879-22b1950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-20T13:15:33.000Z",
"modified": "2017-11-20T13:15:33.000Z",
"name": "OSINT - HIDDEN COBRA \u2013 North Korean Remote Administration Tool: FALLCHILL",
"context": "suspicious-activity",
"object_refs": [
"indicator--5a0d5cac-2ef4-4bae-baa4-4a91950d210f",
"indicator--5a0d5cac-ba20-4bc4-8262-4bba950d210f",
"indicator--5a0d5cac-9b70-447e-a488-478d950d210f",
"indicator--5a0d5cab-007c-4517-99e0-433d950d210f",
"x-misp-attribute--5a0d5c2a-f1e4-4b25-b521-223f950d210f",
"observed-data--5a0d5c0d-b18c-4f6f-aa4f-21c1950d210f",
"url--5a0d5c0d-b18c-4f6f-aa4f-21c1950d210f",
"indicator--5a0d5cac-e5a0-4eb8-aeae-450e950d210f",
"indicator--5a0d5cac-d258-4609-8361-4d7a950d210f",
"indicator--5a0d5cac-86f4-4569-9bd2-44e6950d210f",
"indicator--5a0d5cac-43bc-4e34-bb67-4071950d210f",
"indicator--5a0d5cac-03a4-4235-9147-4ba4950d210f",
"indicator--5a0d5cac-052c-44da-bf20-406a950d210f",
"indicator--5a0d5cac-94a4-4948-b022-4729950d210f",
"indicator--5a0d5cac-98e8-483a-87c0-4806950d210f",
"indicator--5a0d5cac-b8e8-442b-b8db-4c15950d210f",
"indicator--5a0d5cac-4968-4900-b36b-4f77950d210f",
"indicator--5a0d5cac-ab6c-41d9-8db5-4538950d210f",
"indicator--5a0d5cac-7510-42a3-974f-4101950d210f",
"indicator--5a0d5cac-e318-4ceb-9e1d-464b950d210f",
"indicator--5a0d5cac-f0ac-4308-8aa8-4546950d210f",
"indicator--5a0d5cac-7364-4cec-a34d-49d3950d210f",
"indicator--5a0d5cac-3548-4317-ba86-47aa950d210f",
"indicator--5a0d5cac-19a8-4022-a693-4626950d210f",
"indicator--5a0d5cac-f848-4a73-9157-46db950d210f",
"indicator--5a0d5cac-18ec-4bc8-a595-460c950d210f",
"indicator--5a0d5cac-df54-41a3-9862-48cb950d210f",
"indicator--5a0d5cac-406c-4dac-a6fc-411c950d210f",
"indicator--5a0d5cac-efec-4716-a5d3-42a7950d210f",
"indicator--5a0d5cac-6a8c-4e1a-bad4-467e950d210f",
"indicator--5a0d5cac-8bf8-4464-bda7-41b9950d210f",
"indicator--5a0d5cac-dd70-41ea-9e72-4316950d210f",
"indicator--5a0d5cac-6fe4-48ff-a4da-48d4950d210f",
"indicator--5a0d5cac-f0c4-443e-a482-42d6950d210f",
"indicator--5a0d5cac-4774-448e-a959-4be3950d210f",
"indicator--5a0d5cac-060c-4f32-9ef5-44e7950d210f",
"indicator--5a0d5cac-db4c-49cd-8e8e-4d6d950d210f",
"indicator--5a0d5cac-52b8-4327-9ba8-48af950d210f",
"indicator--5a0d5cac-b904-4e2e-9886-4d18950d210f",
"indicator--5a0d5cac-c498-48c9-862e-4e3e950d210f",
"indicator--5a0d5cac-71ac-493a-be1e-45a9950d210f",
"indicator--5a0d5cac-690c-4409-9a7f-4f46950d210f",
"indicator--5a0d5cac-0f08-46a5-9976-4e9d950d210f",
"indicator--5a0d5cac-c828-475e-aa90-445b950d210f",
"indicator--5a0d5cac-52cc-4c04-b3e0-4bdf950d210f",
"indicator--5a0d5cac-5454-4bfa-ac35-4729950d210f",
"indicator--5a0d5cac-88e4-4815-bae9-490d950d210f",
"indicator--5a0d5cac-64e4-4694-be69-49e4950d210f",
"indicator--5a0d5cac-00d4-450d-90a0-4a22950d210f",
"indicator--5a0d5cac-44c4-4f44-822c-4a3f950d210f",
"indicator--5a0d5cac-2fa4-485a-a67a-42bc950d210f",
"indicator--5a0d5cac-811c-4636-8a32-422c950d210f",
"indicator--5a0d5cac-8d0c-48d7-a471-4723950d210f",
"indicator--5a0d5cac-92fc-4454-bc1f-499e950d210f",
"indicator--5a0d5cad-8fe8-49f2-826a-4b9d950d210f",
"indicator--5a0d5cad-fe48-4022-907e-455a950d210f",
"indicator--5a0d5cad-284c-44d1-8bc0-4c23950d210f",
"indicator--5a0d5cad-a3bc-47dd-b8bb-43bf950d210f",
"indicator--5a0d5cad-b52c-4840-9e6c-411a950d210f",
"indicator--5a0d5cad-f1cc-4186-8ddf-4701950d210f",
"indicator--5a0d5cad-8ee8-418c-bf8f-41eb950d210f",
"indicator--5a0d5cad-c090-4253-8707-4c41950d210f",
"indicator--5a0d5cad-d178-46f3-bef8-4ee7950d210f",
"indicator--5a0d5cad-ab04-40df-a071-4f0b950d210f",
"indicator--5a0d5cad-81f8-44bc-bd21-4882950d210f",
"indicator--5a0d5cad-4144-45a1-8e13-40c1950d210f",
"indicator--5a0d5cad-0160-47d4-bbe3-4700950d210f",
"indicator--5a0d5cad-9de0-4760-82fc-4864950d210f",
"indicator--5a0d5cad-f54c-42af-ac30-4f89950d210f",
"indicator--5a0d5cad-b57c-4a18-8f1c-4770950d210f",
"indicator--5a0d5cad-b018-4f1d-93af-482a950d210f",
"indicator--5a0d5cad-88b8-4899-83c5-412a950d210f",
"indicator--5a0d5cad-63d4-4033-9899-4982950d210f",
"indicator--5a0d5cad-eaac-431f-a176-430b950d210f",
"indicator--5a0d5cad-897c-4f7a-ba71-429e950d210f",
"indicator--5a0d5cad-1848-4566-84b6-43d8950d210f",
"indicator--5a0d5cad-12d0-47f9-9c4c-4191950d210f",
"indicator--5a0d5cad-71bc-4cc8-83ca-4866950d210f",
"indicator--5a0d5cad-8434-4f4b-8eaa-4809950d210f",
"indicator--5a0d5cad-da38-4053-a188-45a3950d210f",
"indicator--5a0d5cad-4a28-476e-9df6-4fc5950d210f",
"indicator--5a0d5cad-bd9c-4057-b472-4bb0950d210f",
"indicator--5a0d5cad-27f0-468c-9143-43f8950d210f",
"indicator--5a0d5cad-18a4-447f-ac34-4265950d210f",
"indicator--5a0d5cad-cf6c-4ed0-a3b9-480f950d210f",
"indicator--5a0d5cad-de7c-441f-be8d-422d950d210f",
"indicator--5a0d5cad-1e3c-4d69-b544-4548950d210f",
"indicator--5a0d5cad-3470-4089-8adc-40f3950d210f",
"indicator--5a0d5cad-ec70-4532-9ff5-4167950d210f",
"indicator--5a0d5cad-9028-4a7e-b958-4683950d210f",
"indicator--5a0d5cad-ea9c-4249-9228-40c9950d210f",
"indicator--5a0d65c3-59c0-430d-a6f9-4e6a950d210f",
"indicator--5a0d6a08-d304-4922-924f-7860950d210f",
"indicator--5a0d6a08-c718-42ec-a84a-7860950d210f",
"indicator--5a0d6a08-ba98-4007-8907-7860950d210f",
"indicator--5a0d6a08-99b4-4f94-9278-7860950d210f",
"indicator--5a0d6a08-defc-41fe-b70a-7860950d210f",
"indicator--5a0d6a76-7878-4cec-ad85-76fa950d210f",
"indicator--5a0d6a76-e90c-4ece-aa45-76fa950d210f",
"indicator--5a0d6a76-e5f0-4f3d-b7c0-76fa950d210f",
"observed-data--5a0d6b47-01d4-4bef-b59c-4fcb950d210f",
"file--5a0d6b47-01d4-4bef-b59c-4fcb950d210f",
"artifact--5a0d6b47-01d4-4bef-b59c-4fcb950d210f",
"indicator--5a0d6e08-0298-459d-859f-7779950d210f",
"indicator--5a0d6e08-3238-4c4b-a0d1-7779950d210f",
"indicator--5a0d6e08-a908-4ee6-b576-7779950d210f",
"indicator--5a0d6e08-b020-4b90-bccf-7779950d210f",
"indicator--5a0d6e08-45f0-4e70-9ce1-7779950d210f",
"indicator--5a0d6e09-7780-4d52-967d-7779950d210f",
"indicator--5a0d6e09-1a98-49dc-a594-7779950d210f",
"indicator--5a0ed76f-4cec-4790-ac37-48a502de0b81",
"observed-data--5a0ed76f-74c8-4636-b565-4ca302de0b81",
"url--5a0ed76f-74c8-4636-b565-4ca302de0b81",
"indicator--5a0ed76f-d3ac-4e29-b8f3-43bf02de0b81",
"observed-data--5a0ed76f-45e4-4d7d-8556-4dca02de0b81",
"url--5a0ed76f-45e4-4d7d-8556-4dca02de0b81",
"indicator--5a0d68b2-c4d0-4721-936b-77bb950d210f",
"indicator--5a0d6aa6-a230-4f7b-8ab3-469a950d210f",
"indicator--5a0d6abb-4910-4c4c-9004-7753950d210f",
"indicator--5a0d6ada-a910-4186-90fc-21c1950d210f",
"indicator--5a0d6d2a-464c-4b9c-8406-421c950d210f"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"type:OSINT",
"osint:source-type=\"technical-report\"",
"misp-galaxy:threat-actor=\"Lazarus Group\"",
"misp-galaxy:rat=\"FALLCHILL\""
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-2ef4-4bae-baa4-4a91950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:52.000Z",
"modified": "2017-11-17T12:34:52.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '98.101.211.162']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:52Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-ba20-4bc4-8262-4bba950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:52.000Z",
"modified": "2017-11-17T12:34:52.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '81.0.213.173']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:52Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-9b70-447e-a488-478d950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-16T09:38:52.000Z",
"modified": "2017-11-16T09:38:52.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '175.100.189.174']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-16T09:38:52Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cab-007c-4517-99e0-433d950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-16T09:38:51.000Z",
"modified": "2017-11-16T09:38:51.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '125.212.132.222']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-16T09:38:51Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "x-misp-attribute",
"spec_version": "2.1",
"id": "x-misp-attribute--5a0d5c2a-f1e4-4b25-b521-223f950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:52.000Z",
"modified": "2017-11-17T12:34:52.000Z",
"labels": [
"misp:type=\"comment\"",
"misp:category=\"External analysis\""
],
"x_misp_category": "External analysis",
"x_misp_type": "comment",
"x_misp_value": "This joint Technical Alert (TA) is the result of analytic efforts between the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). Working with U.S. government partners, DHS and FBI identified Internet Protocol (IP) addresses and other indicators of compromise (IOCs) associated with a remote administration tool (RAT) used by the North Korean government\u2014commonly known as FALLCHILL. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA. For more information on HIDDEN COBRA activity, visit https://www.us-cert.gov/hiddencobra.\r\n\r\nFBI has high confidence that HIDDEN COBRA actors are using the IP addresses\u2014listed in this report\u2019s IOC files\u2014to maintain a presence on victims\u2019 networks and to further network exploitation. DHS and FBI are distributing these IP addresses to enable network defense and reduce exposure to any North Korean government malicious cyber activity.\r\n\r\nThis alert includes IOCs related to HIDDEN COBRA, IP addresses linked to systems infected with FALLCHILL malware, malware descriptions, and associated signatures. This alert also includes suggested response actions to the IOCs provided, recommended mitigation techniques, and information on reporting incidents. If users or administrators detect activity associated with the FALLCHILL malware, they should immediately flag it, report it to the DHS National Cybersecurity and Communications Integration Center (NCCIC) or the FBI Cyber Watch (CyWatch), and give it the highest priority for enhanced mitigation."
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5a0d5c0d-b18c-4f6f-aa4f-21c1950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:52.000Z",
"modified": "2017-11-17T12:34:52.000Z",
"first_observed": "2017-11-17T12:34:52Z",
"last_observed": "2017-11-17T12:34:52Z",
"number_observed": 1,
"object_refs": [
"url--5a0d5c0d-b18c-4f6f-aa4f-21c1950d210f"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--5a0d5c0d-b18c-4f6f-aa4f-21c1950d210f",
"value": "https://www.us-cert.gov/ncas/alerts/TA17-318A"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-e5a0-4eb8-aeae-450e950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:52.000Z",
"modified": "2017-11-17T12:34:52.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '181.119.19.118']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:52Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-d258-4609-8361-4d7a950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:52.000Z",
"modified": "2017-11-17T12:34:52.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '181.119.19.141']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:52Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-86f4-4569-9bd2-44e6950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:52.000Z",
"modified": "2017-11-17T12:34:52.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '181.119.19.196']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:52Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-43bc-4e34-bb67-4071950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:52.000Z",
"modified": "2017-11-17T12:34:52.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '181.119.19.5']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:52Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-03a4-4235-9147-4ba4950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:52.000Z",
"modified": "2017-11-17T12:34:52.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '181.119.19.50']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:52Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-052c-44da-bf20-406a950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:52.000Z",
"modified": "2017-11-17T12:34:52.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '181.119.19.54']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:52Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-94a4-4948-b022-4729950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:52.000Z",
"modified": "2017-11-17T12:34:52.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '181.119.19.56']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:52Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-98e8-483a-87c0-4806950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:52.000Z",
"modified": "2017-11-17T12:34:52.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '181.119.19.58']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:52Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-b8e8-442b-b8db-4c15950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:52.000Z",
"modified": "2017-11-17T12:34:52.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '181.119.19.74']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:52Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-4968-4900-b36b-4f77950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:52.000Z",
"modified": "2017-11-17T12:34:52.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '190.105.225.232']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:52Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-ab6c-41d9-8db5-4538950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:52.000Z",
"modified": "2017-11-17T12:34:52.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '41.92.208.194']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:52Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-7510-42a3-974f-4101950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:52.000Z",
"modified": "2017-11-17T12:34:52.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '41.92.208.196']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:52Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-e318-4ceb-9e1d-464b950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:52.000Z",
"modified": "2017-11-17T12:34:52.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '41.92.208.197']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:52Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-f0ac-4308-8aa8-4546950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:52.000Z",
"modified": "2017-11-17T12:34:52.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '209.183.21.222']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:52Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-7364-4cec-a34d-49d3950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '190.82.74.66']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-3548-4317-ba86-47aa950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '190.82.86.164']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-19a8-4022-a693-4626950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '111.207.78.204']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-f848-4a73-9157-46db950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '119.10.74.66']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-18ec-4bc8-a595-460c950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '122.114.89.131']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-df54-41a3-9862-48cb950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '122.114.94.26']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-406c-4dac-a6fc-411c950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '139.217.27.203']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-efec-4716-a5d3-42a7950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '221.208.194.72']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-6a8c-4e1a-bad4-467e950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '221.235.53.229']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-8bf8-4464-bda7-41b9950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '77.78.100.101']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-dd70-41ea-9e72-4316950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '62.243.45.227']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-6fe4-48ff-a4da-48d4950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '117.232.100.154']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-f0c4-443e-a482-42d6950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '59.90.93.138']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-4774-448e-a959-4be3950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '125.160.213.239']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-060c-4f32-9ef5-44e7950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '27.123.221.66']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-db4c-49cd-8e8e-4d6d950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '36.71.90.4']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-52b8-4327-9ba8-48af950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '191.233.33.177']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-b904-4e2e-9886-4d18950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '200.57.90.108']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-c498-48c9-862e-4e3e950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.79.99.169']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-71ac-493a-be1e-45a9950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '203.160.191.116']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-690c-4409-9a7f-4f46950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '196.25.89.30']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-0f08-46a5-9976-4e9d950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '82.223.213.115']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-c828-475e-aa90-445b950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '82.223.73.81']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-52cc-4c04-b3e0-4bdf950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '91.116.139.195']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-5454-4bfa-ac35-4729950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '195.74.38.115']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-88e4-4815-bae9-490d950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '210.202.40.35']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-64e4-4694-be69-49e4950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '104.192.193.149']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-00d4-450d-90a0-4a22950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '173.0.129.65']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-44c4-4f44-822c-4a3f950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '173.0.129.83']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-2fa4-485a-a67a-42bc950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '191.234.40.112']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-811c-4636-8a32-422c950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '199.167.100.46']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-8d0c-48d7-a471-4723950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '208.180.64.10']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cac-92fc-4454-bc1f-499e950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '208.78.33.70']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-8fe8-49f2-826a-4b9d950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '208.78.33.82']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-fe48-4022-907e-455a950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '216.163.20.178']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-284c-44d1-8bc0-4c23950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '50.62.168.157']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-a3bc-47dd-b8bb-43bf950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '64.29.144.201']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-b52c-4840-9e6c-411a950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '66.175.41.191']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-f1cc-4186-8ddf-4701950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:53.000Z",
"modified": "2017-11-17T12:34:53.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '66.232.121.65']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-8ee8-418c-bf8f-41eb950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '66.242.128.11']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-c090-4253-8707-4c41950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '66.242.128.12']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-d178-46f3-bef8-4ee7950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '66.242.128.13']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-ab04-40df-a071-4f0b950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '66.242.128.134']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-81f8-44bc-bd21-4882950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '66.242.128.140']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-4144-45a1-8e13-40c1950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '66.242.128.158']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-0160-47d4-bbe3-4700950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '66.242.128.162']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-9de0-4760-82fc-4864950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '66.242.128.163']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-f54c-42af-ac30-4f89950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '66.242.128.164']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-b57c-4a18-8f1c-4770950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '66.242.128.170']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-b018-4f1d-93af-482a950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '66.242.128.173']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-88b8-4899-83c5-412a950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '66.242.128.179']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-63d4-4033-9899-4982950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '66.242.128.181']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-eaac-431f-a176-430b950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '66.242.128.185']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-897c-4f7a-ba71-429e950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '66.242.128.186']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-1848-4566-84b6-43d8950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '66.242.128.223']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-12d0-47f9-9c4c-4191950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '71.125.1.130']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-71bc-4cc8-83ca-4866950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '71.125.1.132']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-8434-4f4b-8eaa-4809950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '71.125.1.133']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-da38-4053-a188-45a3950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '71.125.1.138']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-4a28-476e-9df6-4fc5950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '72.167.53.183']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-bd9c-4057-b472-4bb0950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '75.103.110.134']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-27f0-468c-9143-43f8950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '96.65.90.58']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-18a4-447f-ac34-4265950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '98.101.211.140']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-cf6c-4ed0-a3b9-480f950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '98.101.211.170']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-de7c-441f-be8d-422d950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '98.101.211.251']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-1e3c-4d69-b544-4548950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '98.113.84.130']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-3470-4089-8adc-40f3950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '98.159.16.132']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-ec70-4532-9ff5-4167950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "C2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '197.211.212.14']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-9028-4a7e-b958-4683950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-16T09:38:53.000Z",
"modified": "2017-11-16T09:38:53.000Z",
"description": "INSTALLATION",
"pattern": "[file:hashes.MD5 = '1216da2b3d6e64075e8434be1058de06']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-16T09:38:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d5cad-ea9c-4249-9228-40c9950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-16T09:38:53.000Z",
"modified": "2017-11-16T09:38:53.000Z",
"description": "INSTALLATION",
"pattern": "[file:hashes.MD5 = 'e48fe20eb1f5a5887f2ac631fed9ed63']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-16T09:38:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d65c3-59c0-430d-a6f9-4e6a950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-16T10:17:39.000Z",
"modified": "2017-11-16T10:17:39.000Z",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '10.10.30.110']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-16T10:17:39Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d6a08-d304-4922-924f-7860950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "(header)",
"pattern": "[file:hashes.MD5 = '9c58c3fe5f463b33e9d2bc488bf4ae82']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d6a08-c718-42ec-a84a-7860950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": ".text",
"pattern": "[file:hashes.MD5 = '5e856b2016485f5d844d07ebc461690c']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d6a08-ba98-4007-8907-7860950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": ".rdata",
"pattern": "[file:hashes.MD5 = '063ef94aa302b3de760bbf4ce2f3ef9d']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d6a08-99b4-4f94-9278-7860950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": ".data",
"pattern": "[file:hashes.MD5 = '59ad2089dfe1a9456b4b456e62933a32']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d6a08-defc-41fe-b70a-7860950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": ".rsrc",
"pattern": "[file:hashes.MD5 = '3e47af504a67377daffd633c5ee43c50']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d6a76-7878-4cec-ad85-76fa950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "On port 443",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '125.212.132.222' AND network-traffic:dst_port = '443']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d6a76-e90c-4ece-aa45-76fa950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "On port 443",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '175.100.189.174' AND network-traffic:dst_port = '443']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d6a76-e5f0-4f3d-b7c0-76fa950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "On port 1992",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '10.10.30.110' AND network-traffic:dst_port = '1992']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5a0d6b47-01d4-4bef-b59c-4fcb950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"first_observed": "2017-11-17T12:34:54Z",
"last_observed": "2017-11-17T12:34:54Z",
"number_observed": 1,
"object_refs": [
"file--5a0d6b47-01d4-4bef-b59c-4fcb950d210f",
"artifact--5a0d6b47-01d4-4bef-b59c-4fcb950d210f"
],
"labels": [
"misp:type=\"attachment\"",
"misp:category=\"External analysis\""
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "file",
"spec_version": "2.1",
"id": "file--5a0d6b47-01d4-4bef-b59c-4fcb950d210f",
"name": "MAR-10135536-A_WHITE_S508C.pdf",
"content_ref": "artifact--5a0d6b47-01d4-4bef-b59c-4fcb950d210f"
},
{
"type": "artifact",
"spec_version": "2.1",
"id": "artifact--5a0d6b47-01d4-4bef-b59c-4fcb950d210f",
"payload_bin": "JVBERi0xLjYNJeLjz9MNCjE1OTQgMCBvYmoNPDwvTGluZWFyaXplZCAxL0wgOTM2NjIvTyAxNTk3L0UgMjkxMzEvTiA4L1QgOTMxNjEvSCBbIDQ4MyAyOTddPj4NZW5kb2JqDSAgICAgICAgICAgICAgDQoxNjA2IDAgb2JqDTw8L0RlY29kZVBhcm1zPDwvQ29sdW1ucyA0L1ByZWRpY3RvciAxMj4+L0ZpbHRlci9GbGF0ZURlY29kZS9JRFs8RTBEOEZEOUIxMzY3NEY1QzFEMkZENjBBRUJGODQ3Q0E+PEUwNzBFODExRUVDNTMyNDE5MDhDNDcyNjYwMzgwMzdEPl0vSW5kZXhbMTU5NCAyOV0vSW5mbyAxNTkzIDAgUi9MZW5ndGggNzEvUHJldiA5MzE2Mi9Sb290IDE1OTUgMCBSL1NpemUgMTYyMy9UeXBlL1hSZWYvV1sxIDIgMV0+PnN0cmVhbQ0KaN5iYmQQYGBiYP4DJBjFgQSDDYgVAiRYWUAsRSDBLQokmDRBXHUQqw4k1gYkbhkzMDGynQJpY2CknPj/e+kngAADADd7CSANCmVuZHN0cmVhbQ1lbmRvYmoNc3RhcnR4cmVmDQowDQolJUVPRg0KICAgICAgIA0KMTYyMiAwIG9iag08PC9DIDIwNy9GaWx0ZXIvRmxhdGVEZWNvZGUvSSAyMzAvTCAxOTEvTGVuZ3RoIDE5NS9TIDEyNC9WIDE2OT4+c3RyZWFtDQpo3mJgYGBiYGA2Y2BmYODPYOBnQAB+oBgLEHI8EPLcw8HAICTgyWB0YH/D5Daj27X7gQqEXNOF3MKFXKcVarpCUPpEVbcCBsEIBkYPBkYJBgaWBgbBBgYlIJnBwMDagGYK0AgRBoYPSUCaE4i5QJYyKgLtTePvYWCY78DIwNiwrjN1yiVuHbCDRBkYvviB1ADdfBvuTDUGxsg2iChDHxCLMTB81wTSAgwMSbEMIO+xTARSmgyMWcshyhidAQIMANU6JwQNCmVuZHN0cmVhbQ1lbmRvYmoNMTU5NSAwIG9iag08PC9BY3JvRm9ybSAxNjA3IDAgUi9MYW5nKGVuKS9NYXJrSW5mbzw8L01hcmtlZCB0cnVlPj4vTWV0YWRhdGEgMzkgMCBSL09wZW5BY3Rpb24gMTU5NiAwIFIvUGFnZUxhYmVscyAxNTkwIDAgUi9QYWdlTGF5b3V0L1NpbmdsZVBhZ2UvUGFnZXMgMTU5MiAwIFIvU3RydWN0VHJlZVJvb3QgODMgMCBSL1R5cGUvQ2F0YWxvZy9WaWV3ZXJQcmVmZXJlbmNlczw8L0NlbnRlcldpbmRvdyB0cnVlL0Rpc3BsYXlEb2NUaXRsZSB0cnVlL0ZpdFdpbmRvdyB0cnVlPj4+Pg1lbmRvYmoNMTU5NiAwIG9iag08PC9EWzE1OTcgMCBSL1hZWiBudWxsIG51bGwgMS4wXS9TL0dvVG8+Pg1lbmRvYmoNMTU5NyAwIG9iag08PC9Bbm5vdHMgMTYwOCAwIFIvQ29udGVudHMgMTYwMCAwIFIvQ3JvcEJveFswIDAgNjEyIDc5Ml0vTWVkaWFCb3hbMCAwIDYxMiA3OTJdL1BhcmVudCAxNTkyIDAgUi9SZXNvdXJjZXM8PC9Db2xvclNwYWNlPDwvQ1MwIDE2MTAgMCBSPj4vRXh0R1N0YXRlPDwvR1MwIDE2MTEgMCBSPj4vRm9udDw8L1QxXzAgMTYxNCAwIFIvVFQwIDE2MTYgMCBSL1RUMSAxNjE4IDAgUi9UVDIgMTYyMCAwIFI+Pi9Qcm9jU2V0Wy9QREYvVGV4dC9JbWFnZUNdL1hPYmplY3Q8PC9JbTAgMTYwNSAwIFI+Pj4+L1JvdGF0ZSAwL1N0cnVjdFBhcmVudHMgMC9UYWJzL1MvVHlwZS9QYWdlPj4NZW5kb2JqDTE1OTggMCBvYmoNPDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0ZpcnN0IDE0MC9MZW5ndGggMTE4NC9OIDE1L1R5cGUvT2JqU3RtPj5zdHJlYW0NCmjexFfbbts4EP0VPiYPNi8SKWlRGLDjZhugaYM43SzW8INqM7awjmRIStP8/c4MRUn2xs0FCyyEsYaX4cxwDg9laUTEBJNGxEyiGJEwKVGRgqlIoyKZSkhRLNCkBCyIJSohC8MEFejWMWmGySgxqEVMNYYxU1op1BKm4jgETQkWiCRCTcKyRrEPH/h0fMI/2e0PCOnmDn7W7JRPr2HgY74sVlm+BvVqej4tlr6DxQrmXY9G/LzIaxgm81hgJ/8rnX5nEChNwCmZ3a6q+WI0mlOi0L8Ak7ELAi0mM2jP4Ll52lk+KcqVLfktE2DsGnNcWSz42VwMYd9A4L3gV5B+EtES13ZZz8M4GAYh00E8BD/a6KGCYR1G0FzwWV0+LOurtLR5zYKIzx6+1+jvc5b/7TyP87yoIUx+cXY2SSu7wsqEPuCvV+wu3VYWlEsm+WzcNGeXGI1yS3z8Wf8+q9Pa8mLnxjFtvnnabWzOFK926dKywL1xVfTjt5XfZvk4r7K2Pc3u7izEu7SVQwKm6vw0U0ajZg0sBL/J7m01uC7u07yd4ZCDhudZWdVnm7Rkgn9OG1Vp3e4Eriz5TfEtz8DWYvZB55I83GarelPNlQYgBQHD9/8l6D+E06OFIImhHUVwiGI3hkJjJmR78UadzUuCc2k+rOElDEOWAHIjOFvGRCSkw5HV2pCOQjHA6fRjcaOj+HloizqO+7EE1vc69lPcEAPlaxKKi3SYh3r/3ebcj73Ro2fy9jH294Tia3RcM4T9VKjDW4dIG3gag2ZH/SwpDpZ1HZAbNjB3tKB8dGft86DYtTMmQxxIsJBoiIXFDdXOFepiL9U25Z7/yGDapoWAoB4HGtcT4EzRS0MHLVCoXzYbojsJe8U5FEySAAFJ9sUn6uWYPW28Ob4+bmZblGcEfT/X74HQB8RRMeFLh2JBnDOulsijidD8LN19stl6U1Pp+NS6oYGSkp9v03XFAkXsMZkUP+cDYzQbBEpjtajaZkGj5+l9tn06GZdZuj2lni/pPZAyti9vqAMo3NbLDf9SlPfplrpunWeoKb+o0222HOfrrQWGm9X2/g+oSUdeGFiZ7eqi5H/2At6nUO/uKCd3LNpk1S3rrmQkzJZepVIdvZYPloLpMaxOkiMM2xQL734svCB4wX4lHaCgHHHYckNbXoTJK8TPd6vgmZYCwu9TWktxSE9IIdD2CPLUFXtEQz/ZNfNau0ZPGoT6/j4iRZNiG54Qe2G2Ovpv6Anf6PswLX+aW7sDSjtEcJzIXyDYeASHPQRrEwOC4RvOIzjaQzDdwuyLfWR0E/ewTCMwQP1Xs/ejWr0R1f92/F58Rwf4hjP+K3wbIY9/QRx7HLZfd0MfPu5yQJC522Z/1J0h9xzeveKFx0fVf/4LOlQIJrioGjDJ+GU6HEyK7epF9ERH0CODd5Gid/pe5CRvY0Yj1HFmPKxFx4i+1dHKa6S/nkPN4eX7HA2K7tvuDSQonkGmx2H/jTH5T4guG9ToQ6P3geE+k/o29H3Z7YBH6Yx/u75o/uugerKp691v9MP54+Pj8KEaLG1ZD9fFj9PR6B8BBgDkGpTcDQplbmRzdHJlYW0NZW5kb2JqDTE1OTkgMCBvYmoNPDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAyMTc+PnN0cmVhbQ0KSIlckLFuwyAQhvsCvMONqTqAs3RBlqp08ZC2ipPuBM4WUnygMx7y9gGSeMgAgvv4Tx8nd913Rz6B/ONge0wweHKMc1jYIpxx9CSaLThv0+NWdzuZKGQO99c54dTREEBrIQ8ZzomvsPliby7744d6B4eDkL/skD2NsDk2p/9HsV9ivOCElEDVStvewW5v4o+ZEOTapwKA5q5hg8M5GotsaESht6oF/WlageRe2Jo5Dy+PQSuVzyXzZCVe/rYK2IU5+9UBVK3i4QnXGcUQSwryEuLtJsAAkx5tpw0KZW5kc3RyZWFtDWVuZG9iag0xNjAwIDAgb2JqDTw8L0ZpbHR
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d6e08-0298-459d-859f-7779950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": "(header)",
"pattern": "[file:hashes.MD5 = '08697ebe4017d27c904c7117bb109ca8']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d6e08-3238-4c4b-a0d1-7779950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:54.000Z",
"modified": "2017-11-17T12:34:54.000Z",
"description": ".test",
"pattern": "[file:hashes.MD5 = 'cacb1aba3ba5bddfc2f023bb4ff3c54d']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d6e08-a908-4ee6-b576-7779950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:55.000Z",
"modified": "2017-11-17T12:34:55.000Z",
"description": ".rdata",
"pattern": "[file:hashes.MD5 = '0a36c62d9bd091d84219f7d34cf59284']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:55Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d6e08-b020-4b90-bccf-7779950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:55.000Z",
"modified": "2017-11-17T12:34:55.000Z",
"description": ".data",
"pattern": "[file:hashes.MD5 = '5c31589e75fc435a827c73e1b5bb4bca']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:55Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d6e08-45f0-4e70-9ce1-7779950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:55.000Z",
"modified": "2017-11-17T12:34:55.000Z",
"description": ".pdata",
"pattern": "[file:hashes.MD5 = 'afc6eebc27a713b8010efe7f16ee8fab']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:55Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d6e09-7780-4d52-967d-7779950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:55.000Z",
"modified": "2017-11-17T12:34:55.000Z",
"description": ".rsrc",
"pattern": "[file:hashes.MD5 = '9a33838895830247744985365b8b2948']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:55Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d6e09-1a98-49dc-a594-7779950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:55.000Z",
"modified": "2017-11-17T12:34:55.000Z",
"description": ".reloc",
"pattern": "[file:hashes.MD5 = 'd5815368ff7a4f0c4b82c70660aa7028']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:55Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0ed76f-4cec-4790-ac37-48a502de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:55.000Z",
"modified": "2017-11-17T12:34:55.000Z",
"description": "INSTALLATION - Xchecked via VT: e48fe20eb1f5a5887f2ac631fed9ed63",
"pattern": "[file:hashes.SHA256 = 'a606716355035d4a1ea0b15f3bee30aad41a2c32df28c2d468eafd18361d60d6']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:55Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5a0ed76f-74c8-4636-b565-4ca302de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:55.000Z",
"modified": "2017-11-17T12:34:55.000Z",
"first_observed": "2017-11-17T12:34:55Z",
"last_observed": "2017-11-17T12:34:55Z",
"number_observed": 1,
"object_refs": [
"url--5a0ed76f-74c8-4636-b565-4ca302de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--5a0ed76f-74c8-4636-b565-4ca302de0b81",
"value": "https://www.virustotal.com/file/a606716355035d4a1ea0b15f3bee30aad41a2c32df28c2d468eafd18361d60d6/analysis/1510823064/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0ed76f-d3ac-4e29-b8f3-43bf02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:55.000Z",
"modified": "2017-11-17T12:34:55.000Z",
"description": "INSTALLATION - Xchecked via VT: 1216da2b3d6e64075e8434be1058de06",
"pattern": "[file:hashes.SHA256 = '0a118eb23399000d148186b9079fa59caf4c3faa7e7a8f91533e467ac9b6ff41']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-17T12:34:55Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5a0ed76f-45e4-4d7d-8556-4dca02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-17T12:34:55.000Z",
"modified": "2017-11-17T12:34:55.000Z",
"first_observed": "2017-11-17T12:34:55Z",
"last_observed": "2017-11-17T12:34:55Z",
"number_observed": 1,
"object_refs": [
"url--5a0ed76f-45e4-4d7d-8556-4dca02de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--5a0ed76f-45e4-4d7d-8556-4dca02de0b81",
"value": "https://www.virustotal.com/file/0a118eb23399000d148186b9079fa59caf4c3faa7e7a8f91533e467ac9b6ff41/analysis/1510822839/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d68b2-c4d0-4721-936b-77bb950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-16T10:30:10.000Z",
"modified": "2017-11-16T10:30:10.000Z",
"pattern": "[file:hashes.MD5 = 'e48fe20eb1f5a5887f2ac631fed9ed63' AND file:hashes.SHA1 = 'f83f30bd284074d1daaf2e262a280ca780791f2c' AND file:hashes.SSDEEP = '1536:qJhDLw1yDhhzoN/e/C/O/C/a/D/I26251K06Zk/XrqqitM4NvL:qvfw1ahEVOS+Sq7IN251ikzq5tM4NvL' AND file:name = 'E48FE20EB1F5A5887F2AC631FED9ED63' AND file:size = '94208' AND file:x_misp_entropy = '5.49321665686']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-16T10:30:10Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d6aa6-a230-4f7b-8ab3-469a950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-16T10:38:30.000Z",
"modified": "2017-11-16T10:38:30.000Z",
"pattern": "[(network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '125.212.132.222') AND network-traffic:dst_port = '443']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-16T10:38:30Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "network"
}
],
"labels": [
"misp:name=\"ip-port\"",
"misp:meta-category=\"network\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d6abb-4910-4c4c-9004-7753950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-16T10:38:51.000Z",
"modified": "2017-11-16T10:38:51.000Z",
"pattern": "[(network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '175.100.189.174') AND network-traffic:dst_port = '443']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-16T10:38:51Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "network"
}
],
"labels": [
"misp:name=\"ip-port\"",
"misp:meta-category=\"network\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d6ada-a910-4186-90fc-21c1950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-16T10:39:22.000Z",
"modified": "2017-11-16T10:39:22.000Z",
"pattern": "[(network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '10.10.30.110') AND network-traffic:dst_port = '1992']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-16T10:39:22Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "network"
}
],
"labels": [
"misp:name=\"ip-port\"",
"misp:meta-category=\"network\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a0d6d2a-464c-4b9c-8406-421c950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-16T10:49:14.000Z",
"modified": "2017-11-16T10:49:14.000Z",
"pattern": "[file:hashes.MD5 = '1216da2b3d6e64075e8434be1058de06' AND file:hashes.SHA1 = '5ee752a1b2bcdb84243e615cd67397d965b16490' AND file:name = '1216DA2B3D6E64075E8434BE1058DE06' AND file:x_misp_entropy = '6.27082111511' AND file:x_misp_ssdeep = '3072:GxXIbbVcpID+5/MiPDH8QnO3oMc+i+TN85mQLP\r\ngpnejnceJEOED:Gx4bbVZD+5\r\n/MiPDchdi+TN85muP0SlO']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-16T10:49:14Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
]
}
Reference in a new issue Copy permalink