247 lines
75 KiB
JSON
247 lines
75 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--5a3cc2cd-2d2c-4423-ad4d-4c59950d210f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-10-31T14:56:41.000Z",
|
||
|
|
"modified": "2018-10-31T14:56:41.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "grouping",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "grouping--5a3cc2cd-2d2c-4423-ad4d-4c59950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-10-31T14:56:41.000Z",
|
||
|
|
"modified": "2018-10-31T14:56:41.000Z",
|
||
|
|
"name": "OSINT - File-Locker Ransomware Targets Korean Victims and asks for 50K Won",
|
||
|
|
"context": "suspicious-activity",
|
||
|
|
"object_refs": [
|
||
|
|
"observed-data--5a3cc2da-5ae4-466c-bedf-4c62950d210f",
|
||
|
|
"url--5a3cc2da-5ae4-466c-bedf-4c62950d210f",
|
||
|
|
"indicator--5bd87745-0468-408f-a0eb-49a7950d210f",
|
||
|
|
"observed-data--5bd9875a-ec2c-4f92-b23a-465f950d210f",
|
||
|
|
"file--5bd9875a-ec2c-4f92-b23a-465f950d210f",
|
||
|
|
"artifact--5bd9875a-ec2c-4f92-b23a-465f950d210f",
|
||
|
|
"indicator--5bd87702-40d0-4020-bbb0-45db950d210f",
|
||
|
|
"indicator--5bd87712-d774-4c8c-87c0-4505950d210f",
|
||
|
|
"x-misp-object--5bd87865-61fc-4432-81d1-45bc950d210f",
|
||
|
|
"x-misp-object--5bd8787b-1760-49c0-a467-4042950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"workflow:todo=\"create-missing-misp-galaxy-cluster-values\"",
|
||
|
|
"workflow:todo=\"create-missing-misp-galaxy-cluster\"",
|
||
|
|
"workflow:state=\"incomplete\"",
|
||
|
|
"workflow:todo=\"expansion\"",
|
||
|
|
"workflow:todo=\"add-mitre-attack-cluster\""
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5a3cc2da-5ae4-466c-bedf-4c62950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-12-22T08:31:22.000Z",
|
||
|
|
"modified": "2017-12-22T08:31:22.000Z",
|
||
|
|
"first_observed": "2017-12-22T08:31:22Z",
|
||
|
|
"last_observed": "2017-12-22T08:31:22Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5a3cc2da-5ae4-466c-bedf-4c62950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5a3cc2da-5ae4-466c-bedf-4c62950d210f",
|
||
|
|
"value": "https://www.bleepingcomputer.com/news/security/file-locker-ransomware-targets-korean-victims-and-asks-for-50k-won/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5bd87745-0468-408f-a0eb-49a7950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-10-30T15:22:45.000Z",
|
||
|
|
"modified": "2018-10-30T15:22:45.000Z",
|
||
|
|
"pattern": "[email-message:from_ref.value = 'fasfry2323@naver.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-10-30T15:22:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"email-src\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5bd9875a-ec2c-4f92-b23a-465f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-10-31T10:43:38.000Z",
|
||
|
|
"modified": "2018-10-31T10:43:38.000Z",
|
||
|
|
"first_observed": "2018-10-31T10:43:38Z",
|
||
|
|
"last_observed": "2018-10-31T10:43:38Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--5bd9875a-ec2c-4f92-b23a-465f950d210f",
|
||
|
|
"artifact--5bd9875a-ec2c-4f92-b23a-465f950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"attachment\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--5bd9875a-ec2c-4f92-b23a-465f950d210f",
|
||
|
|
"name": "ransom-note - Copy.jpg",
|
||
|
|
"content_ref": "artifact--5bd9875a-ec2c-4f92-b23a-465f950d210f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "artifact",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "artifact--5bd9875a-ec2c-4f92-b23a-465f950d210f",
|
||
|
|
"payload_bin": "/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDABALCwsMCxAMDBAXDw0PFxsUEBAUGx8XFxcXFx8eFxoaGhoXHh4jJSclIx4vLzMzLy9AQEBAQEBAQEBAQEBAQED/2wBDAREPDxETERUSEhUUERQRFBoUFhYUGiYaGhwaGiYwIx4eHh4jMCsuJycnLis1NTAwNTVAQD9AQEBAQEBAQEBAQED/wgARCAFRA8UDASIAAhEBAxEB/8QAGgABAAMBAQEAAAAAAAAAAAAAAAIDBAEFBv/EABcBAQEBAQAAAAAAAAAAAAAAAAABAgP/2gAMAwEAAhADEAAAAbbZd3zg72ouylgs5UFkDjqOJqgsrgmqCwVuo4sVWsFawVrBWsFawVrBWsFawVrBWsFawVrBWsFawVrBWsFawVrBWsFawVrBWsFawVrBWsFawVrBWsFawVrBWsFawVrBWsFawVrBWsFawVrBWsFawVrEVrhSurIrOEF1C9c5nUnO2Bc2dWJh03dry5+il82PqDzY+l1cfNxPKu3ijF6g82v1h5Nno9PK1axUtFS0VLRUtFS0VLRUtFS0VLRUtFS0VLRUtFS0VLRUtFS0VLRUtFS0VLRUtFS0VLRUtFS0VLRUtFS0VLRUtFS0VLRUtFS0VLRUtFS0VLRUtFS0VLRVG/hQvS116OWVVa0tWXfBfO03MdMGm6RS66cJbMeqax21JdvYDN2m4utpsqiVCNU8mirM1+CNCuZNVUeh2qdVX5rySIkiJIiSIkiJIiSIkiJIiSIkiJIiSIkiJIiSIkiJIiSIkiJIiSIkiJIiSIkiJIiSIkiJIiSIkiJIiSIkiJIiSIkiJIiSIkiJIiSIkiJIiSIkiJRcTGLie7Drm5o5pdaqObex3WXKK5damO5o552svVwi9V0sUSLO0TLFPS1VEvZ5lrz7cXV2ie5Y8qyz0VPn5363KuXKELpYX5lmxVQbGeZazdL+0SLWWFbO586b2K/Or2fLHpMGvcsVosVixWLFYsVixWLFYsVixWLFYsVixWLFYsVixWLFYsVixWLFYsVixWLFYsVixWLFYsVixWLFYsViyHOVjdXE9ObVNUx0dlqo2sXHfa0y1bxVg9RqeXuuEOTRDsulXbFUzmiiVqq6dSMGq1WGPoM2ntqzLHYqvNtRh0XDI0wXzNt1tkKdKMemaM9ewUysVm5qVTh9Rm4r7hTl9AUzmsgmIJiCYgmIJiCYgnwil0gmIJiCYgmIJiCYgmIJiCYgmIJiCYgmIJiCYgmIJiCYgmIJiCYhyyNYhcWbMezO6Z8szvzNFuq58az0aydtVpR5/qVkErIqWqq012Hm909Mfp03HmXWzMHqVRL8+iJkhrrO6KbCjJ6NJmbBg7rmebdq6Jxkc871vPPQqtgYo76iMrR5Ou/hm5qkXeb6WczVb6CvVKY8n2cZFpieXp0WFGffEjm08J1zmVSs6Vaa7AAAAAAAAAAAAAAAAAAAAABVbWmB1vE9eXVndfF2d4dFGm55n05D0s9+chm1ZD0+Bko25TsrOHLozGbXiNdNkRqzagAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABXZWmJ1rEtWHdNwR5nco5NVzOHcR6CqZpx7MYlTMnzPQeuo0xg01562ZZXHZ11F8IWkVczkIxNUsiN0c8a0yx+gKeRJRzcNM8utL8O3y19GuNBfd5foFlPKT0a55CzP2JshHOaLsmolnuznLvM2FzJcau12Es2nFE+w5U+8iaOYumjvIl1dEidmK+JTp7ZZzpV/n6iqWfQQnV0unkgbu00RonnhZfOEFsln6aqq+mmGTpds8/0BTd5xZHmc9iuyklTWJSptNYFdlSZFbeJbsO7O0ZU5t7z+WejPy6pfZYrqkjnN7xZHsPE9Yr04649B42it+amMehXhvs1z8vq+nHz+R6MvMjZ6rDpW15dJ7XPIuNtvOgAAAAAAAAAAAAAAAAAAAAAAAAACMgAAAAAjIAAAAAAAKrakwDeJbsO7O3ck871sNNx6mXNeujuaRZd5ug1KpRN4t9emxcNjEN7zbjUoF8s2kVYr4u7CqzYrzLteZ09KGXWShRjPWebcbGHKew8uR6TzbjYqtEa8htn5Fp6XfOtNkfP1Jd2PFS8ztnp88/ku+zzSei86S72Hqbed8xfS75tprnjmaY5M0epLz67PUYdqwnkrPQeZ09JjibnnRPTeaPSQoNTzbTaw8N7zEenVlmapUWWQljtW27HnPUYNx1jznqPPsNjzvRAAFVtSYBvEt2Hdnce95mx7m7UdufpfGFJonkkX24azVwLezFS0U0bRWsFdgQ5YI8mI0aRn5pEJhVDQKeXjP28Z52iqN4rjcKqtUSlbIqheSrtvFqu7FM/NXCuN3VzyviUTs4lXboks2gtPbSR7MtUNArr0CEwhG0Y7rhTOYphpFPbRCnSKVwrheM87RRK0R70QTEKtAz39FcLxTZIUXgAAqtqTAN4luw7s7cjLOq4WLI2LjClcQjbIqhdaVqLDQUF6kXIdJPO0mhm0HWXppV2AAAAAAAAACMonXOnO8I5IRSHHS8S4nYur2MuCMuI53pxLi9AAAAAAAAAAAAAAAAAAAAAAAqtqTAN4luw7s7o0c7nVGbZfZ5fqIFOXfEyS1jNtzXGan0hzDsqMvPTgUagzZfTGbTTaZ2kVSmBAmAz3EiBNReDMaWcaFMDSqtAAAABEkomWITBEkjIAAAESSMgAptOgAAAAAAAAAAAAAAAAAAVW1JgG8S3Yd2d5bbe53iyezK58Wz1kUUbllOfcl8+v1OV5np1XHmvSR4/PZhXmW+jA8h7Q8P2+jy6/VmeLt1cJ+ZusPH9qoZIemjxtHoqwd3RMDZaed30BkxewPHn6o8i/0B4mr0RVj9Gsw5/Z6eZr0RPMv2STy++mXzeemjzLtSyrF6XV8XR6lJ5kPWuPJl6gx6JVGXN7EU8ez2C4tqJJGQAAAQmAAAAAAAAAAAAAKrakwDeJbsO7OxGXPh9Thl7qRmtu5WHRb08+e6Rio9IYZbRiq2CuOqJjejWY7ruxhq9KdZo6rDz5aOlPNHCqjX0o5rlGCUrqohouJeT68DHzVSU1+jwxzvsMXo03GCdlpk7qrISnOMPNsbMjXRLZYVCjVI82ezhi9OiZR3RAxaLBVRt7GSy2yzDZfxaq9UoyNXKhorGarZwyW6OFkwAAAAAAAAAAAAAVW1JgG8S3Yd2d112151rFgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACq2pMA3iW7Duzt3nZZgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVW1JgG8S3Yd2du87LMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACq2pMA3iW7Duzt3nZZgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVW1JgG8S15NGdzU8l0OUGh3MaFNRrKS5k6alN5x0cdHHRx0cdHHRx0cdHHRx0cdHHRxjkalNJsZuGpyRx0cdpi1gsrWx6iTo46OOjjtRYy8Nais1u+eb2PQWO4jYy1m5VQbGYaWTYcdHHRx0cdHHRx0cdHHRx0cdHHRx0cdHHRx0cdHHRx0cjOKYhvEtGa6WU6i3cqJopiOuFu5UROAtnnGhnGhnGhnGhnGhnGhnGhnGhnGhnGhnGhnGhnHeBOqRYz4SyzONDONFMS2dqJOdJdDOTQzjQzjRCovZ1ifayaKOF7ZUTRnFlDod4S2ES805yaGcaGcaGcaGcaGcaGcaGcaGcaGcaGcaGcaGcaGcaGcaGcaGcaGcaGcXxq4UotZ+VHPqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB//xAAuEAACAwACAQMDAwQDAQEBAAABAgADEhETIQQQMxQiMSAjYDBAQlAyNENBJET/2gAIAQEAAQUCrrULlZlZlZlZlZlZlZl
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5bd87702-40d0-4020-bbb0-45db950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-10-30T15:21:38.000Z",
|
||
|
|
"modified": "2018-10-30T15:21:38.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b6b5e455c4ebe875907aa185988c2eb654ed373dc0e6b712a391069d63dc5c3f' AND file:x_misp_state = 'Malicious']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-10-30T15:21:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5bd87712-d774-4c8c-87c0-4505950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-10-30T15:21:54.000Z",
|
||
|
|
"modified": "2018-10-30T15:21:54.000Z",
|
||
|
|
"pattern": "[file:name = 'Warning!!!!!!.txt' AND file:x_misp_state = 'Malicious']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-10-30T15:21:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--5bd87865-61fc-4432-81d1-45bc950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-10-30T15:27:33.000Z",
|
||
|
|
"modified": "2018-10-30T15:27:33.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"coin-address\"",
|
||
|
|
"misp:meta-category=\"financial\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "btc",
|
||
|
|
"object_relation": "address",
|
||
|
|
"value": "1F1tAaz5x1HUXrCNLbtMDqcw6o5GNn4xqX",
|
||
|
|
"category": "Financial fraud",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5bd87865-e77c-449f-8f16-4173950d210f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "symbol",
|
||
|
|
"value": "BTC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5bd87868-2f48-42c4-aec4-4995950d210f"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "financial",
|
||
|
|
"x_misp_name": "coin-address"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--5bd8787b-1760-49c0-a467-4042950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-10-30T15:27:55.000Z",
|
||
|
|
"modified": "2018-10-30T15:27:55.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"coin-address\"",
|
||
|
|
"misp:meta-category=\"financial\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "btc",
|
||
|
|
"object_relation": "address",
|
||
|
|
"value": "1BoatSLRHtKNngkdXEeobR76b53LETtpyT",
|
||
|
|
"category": "Financial fraud",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5bd8787b-3e7c-4c25-b168-4e9f950d210f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "symbol",
|
||
|
|
"value": "BTC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5bd87885-b180-422d-8c75-408d950d210f"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "financial",
|
||
|
|
"x_misp_name": "coin-address"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|