adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/stix-2.1/5a6869a1-1bbc-4a25-ad96-a8fd950d210f.json

238 lines
201 KiB
JSON
Raw Permalink Normal View History

chg: [misp-stix] STIX 2.1 export added
2023-04-21 14:44:17 +00:00
{
"type": "bundle",
"id": "bundle--5a6869a1-1bbc-4a25-ad96-a8fd950d210f",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-01-26T14:23:00.000Z",
"modified": "2018-01-26T14:23:00.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--5a6869a1-1bbc-4a25-ad96-a8fd950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-01-26T14:23:00.000Z",
"modified": "2018-01-26T14:23:00.000Z",
"name": "Fake Job Application incl. Macro",
"published": "2018-01-26T14:23:03Z",
"object_refs": [
"observed-data--5a686a38-1e18-4fd1-8dcc-4c3c950d210f",
"email-message--5a686a38-1e18-4fd1-8dcc-4c3c950d210f",
"indicator--5a686a90-7ed4-4766-93f1-ff60950d210f",
"indicator--5a686bba-6270-4d9d-b3f0-abee950d210f",
"indicator--5a686c19-3960-4f6e-b20d-aba6950d210f",
"observed-data--5a686ca8-650c-46b3-b28f-ff92950d210f",
"network-traffic--5a686ca8-650c-46b3-b28f-ff92950d210f",
"ipv4-addr--5a686ca8-650c-46b3-b28f-ff92950d210f",
"x-misp-attribute--5a68765a-0b08-4fac-a1d7-4cfd950d210f",
"indicator--5a68766f-23fc-4446-b1c6-48c1950d210f",
"indicator--5a686c4f-bc24-4956-8c70-4492950d210f"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"circl:incident-classification=\"malware\"",
"ecsirt:malicious-code=\"malware\"",
"misp-galaxy:tool=\"Smoke Loader\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5a686a38-1e18-4fd1-8dcc-4c3c950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-01-24T11:12:56.000Z",
"modified": "2018-01-24T11:12:56.000Z",
"first_observed": "2018-01-24T11:12:56Z",
"last_observed": "2018-01-24T11:12:56Z",
"number_observed": 1,
"object_refs": [
"email-message--5a686a38-1e18-4fd1-8dcc-4c3c950d210f"
],
"labels": [
"misp:type=\"email-subject\"",
"misp:category=\"Payload delivery\""
]
},
{
"type": "email-message",
"spec_version": "2.1",
"id": "email-message--5a686a38-1e18-4fd1-8dcc-4c3c950d210f",
"is_multipart": false,
"subject": "Website Job Application"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a686a90-7ed4-4766-93f1-ff60950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-01-24T11:14:24.000Z",
"modified": "2018-01-24T11:14:24.000Z",
"description": "Office file with VBA",
"pattern": "[file:name = 'resume.doc' AND file:hashes.MD5 = '13cc8d0857ee50cbd9fdc38484dc32f2']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-01-24T11:14:24Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Artifacts dropped"
}
],
"labels": [
"misp:type=\"filename|md5\"",
"misp:category=\"Artifacts dropped\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a686bba-6270-4d9d-b3f0-abee950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-01-24T11:19:22.000Z",
"modified": "2018-01-24T11:19:22.000Z",
"description": "Office file with VBA",
"pattern": "[file:name = 'resume.doc' AND file:hashes.SHA1 = 'f5a0e53dda360c372067d8aa9091f80451ee9eb5']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-01-24T11:19:22Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"filename|sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a686c19-3960-4f6e-b20d-aba6950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-01-24T12:13:40.000Z",
"modified": "2018-01-24T12:13:40.000Z",
"description": "Stage 2 executable",
"pattern": "[url:value = 'http://80.82.67.217/poop.jpg']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-01-24T12:13:40Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5a686ca8-650c-46b3-b28f-ff92950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-01-24T11:23:20.000Z",
"modified": "2018-01-24T11:23:20.000Z",
"first_observed": "2018-01-24T11:23:20Z",
"last_observed": "2018-01-24T11:23:20Z",
"number_observed": 1,
"object_refs": [
"network-traffic--5a686ca8-650c-46b3-b28f-ff92950d210f",
"ipv4-addr--5a686ca8-650c-46b3-b28f-ff92950d210f"
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\""
]
},
{
"type": "network-traffic",
"spec_version": "2.1",
"id": "network-traffic--5a686ca8-650c-46b3-b28f-ff92950d210f",
"dst_ref": "ipv4-addr--5a686ca8-650c-46b3-b28f-ff92950d210f",
"protocols": [
"tcp"
]
},
{
"type": "ipv4-addr",
"spec_version": "2.1",
"id": "ipv4-addr--5a686ca8-650c-46b3-b28f-ff92950d210f",
"value": "80.82.67.217"
},
{
"type": "x-misp-attribute",
"spec_version": "2.1",
"id": "x-misp-attribute--5a68765a-0b08-4fac-a1d7-4cfd950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-01-24T12:04:42.000Z",
"modified": "2018-01-24T12:04:42.000Z",
"labels": [
"misp:type=\"comment\"",
"misp:category=\"Internal reference\"",
"misp:to_ids=\"True\""
],
"x_misp_category": "Internal reference",
"x_misp_type": "comment",
"x_misp_value": "Smokeloader"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a68766f-23fc-4446-b1c6-48c1950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-01-24T12:05:03.000Z",
"modified": "2018-01-24T12:05:03.000Z",
"pattern": "[file:hashes.SHA256 = '954e8e88740fd3e659fd4ad0502982dd173db2d90cfca0718bfc739bf886d51c']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-01-24T12:05:03Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a686c4f-bc24-4956-8c70-4492950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-01-24T11:21:51.000Z",
"modified": "2018-01-24T11:21:51.000Z",
"pattern": "[file:hashes.MD5 = '82abe64c84e906789ea4fde853ebb9fc' AND file:hashes.SHA1 = '3ef1633d5c068dfeda66d2906daa9ac07715933a' AND file:hashes.SHA256 = 'c53dd04cb0ddfd82076cecdcc38dca16163f2b3d843708e448bd3d8b822ed27d' AND file:name = 'poop.jpg' AND file:size = '290816' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIALpaOEy9BDhUajsCAABwBAAgABwAODJhYmU2NGM4NGU5MDY3ODllYTRmZGU4NTNlYmI5ZmNVVAkAA09saFpPbGhadXgLAAEEIQAAAAQhAAAAygYXQyEssccBN9dtM8WsWgUGi8OgXhHtXkm09Sa/b9+SLwdaQCqZv03C1H+VfwvGSYjjZjeFhHqrnkCUPgwYmcy8rm4N37D1GO12aQ1x/Ep6whWpgNYtoW6gO7Tkj7e7PNi8zCeV9ZIfYzyN8svAZ27rwpjiadXsieuu7RMOzXPlTlV3BRp7mYqZcHdQSsjmVyjLbgvEi0E7eKL4Zck3DSroPjLaklzFv2t9nAQq2Wkwvs/svFN/hB52oQD1H+EmeXvQaHj/3jk/1z4PCwQOedq+s56o2AMO4H6XeuGXG22Jdyet5IsiR02sQVKcUUISEcQciJCFOVv1ILyY57MM964jbSuVJxWkwmV8YLcNB3xTK4s5SgoCKozaD2hVagvh9NDIX1mT3R9rbdgLN/al39PyGbR7Ga0WuMvna1rPvi8AygSwZMOnj2SRPfALknnuHKyxdEZheiEWQvJpM9sFSbKU5JmQ4uQiaDhR7yTwCaD5Ug7WZQoLmLaWjvMGQAytdMSdX1C5yAjvPkRql64M3E3mcaaIhkS+5ZeR19rhh5lC6YxiM8KEB162CxWmn214miJcX+9rRoEFcwV6l1Bo1cCR3VUtXs89UyXJsJErOgWlOa0Kg1rjRBado9NrZ/aAl32P/UzE8n83SXnC/9ZVbz9Eo97ovnm2O0VWxuncjTpDz5pT/pbW3v8mgd/XhbYc3MdO7Wop260MsVJYFwNHF9+sGPOPKwCYcvrj1WJagNs7TuFM+1744SDRVr1wxQoShuZujk0tcB8utHlskVorIraelWHLVNcRKHa029MrjFDuSChtDzClOLlDuavaO2kNY7IpZjO9mBPYvdoSLe2ilnXOcMdf++5lcz3BUpAsXV+tPifWNDezW6YiBfCFU/Rnjn52FrbvnbhWqQ+gLHmntl4MyRmMXSG3h/TkPlpbM2cDOFeu6Iwep1xI298sToyQzrK5XVGJOizxo7l8Iaq0XtqPjLBMKmjOFsbvMRGAEYOHc3lOVNH9PKF3yAkt+0wTJ/Ik3IB4pty+Q3h2jlYEwmOsHAUvjma4wLpAqOk9zTOvjN8CcOdjLLwZARaHM3Ji3iPUk0PofONtok3Q37CoWoRQKy88Nx+4bTTKnjtCQ4lqxH2uTQpL6Ua4mIpVBQ2KvHWyoQhlkF7bHHEdXp8swDLEdAhk03Gu8h0/mJel505sAMLluEp7ZF4tOutwaoMsxn8sG+ZbwylKRBdKEvKF66ZGyEgfU9sWpJf6L/PyyGGRXPwlAUdMlpYnmnXaQR0aIO2JFPanWGN63JeHPVM/eBmbz1k7kLAtxd8xpI5e9jm0eTkd8tro0d08dg/FwTT7PgMA6YymUiIcDznItmvDGVXXu8FvR4+YfYav4nGsVotr7jnZaOByRIRMbsoBqtSwlCsAU/il0NioFqujFYWe583/BFMc+GONiccSsRkO8yHlBtHFgNu27MozPRnsyZZd4eiVlPldpBZhFrmCOaeVXVOhmrOlIHP03Pw2Q1uCyZfVR0pkLxHaRmmqB5HRuJlbPEgmvvpcmNh3wDoI6J2VVzuVpMAwmNQkCo5ULKil/8wg/mpt8Pd8WypjqSV+Yhl+fCijodvIqlsXQpMt8CA2b5VU1GkYH+yUWXEmv0ulHCs5yL1VrcX4bdUT8tAhBkc7b7zVa52+eKuiYCy0Dcmj0cQ2Loh1dWYMXwZvBHkORNvPxBPSSLiuu1HA5e4UGOKnkbpZvauzwqUzO2slfxUNzf5aZsBzjiWzmMbBqDReM5dE1IaO7BLiDcLjhto1PlTlZ9Cp99TBuE2v2xWMZrSc0iXfztU5z3kf3mPDntx7x4Dk/KAicUmrVFVbsC3XLS0c8ERMRIVS1OzLuFfFI01RwTUcvixhP0hTIrE7u4WaG7745mwcIc+bm65AB/RgVW2SzAsHt/ecykVHoDiNwRQYY+0uQfmyAQd9UTlHSwhtqenlm6d77ujTTMlTvYIhZbTCX10rrpHWmAgHUZS0CgP+MBRiRYgehSl4mb7Me61H9IysvOLkDzSLQd96h+xzMyRLxnswksAjdWpzksc0+XrWCxwy2ehkXtXEAsAoGMuQc+uzD9Q281hUXq2ounsBtLFhASaBEOeJsgCgYdIN1Fl7PBZhRHx/p8iYxI36C/e2PbHyEgGabkhez81K1J5/nu1ly2zDoxZ5wFaN2wyIP9pqbI2+QfbuqniptXoHcO+aP17phUYgAo6SweqF6rNNutXrPxVrICmr4U42NIWEBvNa4sBgjGVg1by213MvXyLftnkOLSaOAs5GUwZtAN4Gos52OiL4W0O18x2OxSDKOISp4R5MDvki+JxmlhLzfehEImYuAm4xJeinv3FGkCnlCtuOPtyr3O45aSZf5xN8S2QDwqCu4mTpAldYOoZVz3cCzjJ2CBNAsMoEXhH8LJJnld1PJBKCoSW0o00oSy43HLdVhAyl0qbOpNwqsizD8Xukl4P0sWZ6SfzY4AwPx6AvnRF8CXTmYMCYBY8rMBBqKugTRJueCBEUR8CUZkW5M0FBfdT9+0D5rQ48W9g+m8RP8khdb9DnM5TQwTe5NUZdlPNFtn3a73ZOJ3ZXXarSTKvYcgPOhlnKYsZulsj3pJ71ybkyaXUix8MhDpo9OzbUEkUKJpEdK9qVN5BkQjvBXqcIKZBdZPXXeGkfBWW8+exfVFxFt765JUoBUpbhPdq1Qq2ZdN3Ux62DdLW7F+fiu7CbmE1g0WCzjnarQScf7jHmnxlNEoz6X+/Y9wWmhcQxJZSrdN2lH74n0rJRBKbtMYdSeA+oBuMDYUxIfVsvLsEvDSexUl717a/e/A+4LKKQGQhkClq34fSGfBKoZaBQSGPZ7gdXxx4VovSRZtlGMKhPZXnlCUjZeA/SjXPNrPNG039Ot5p2jLSXSftSmS4b7UN6JEBWMOFPjmw4SYvK5GOOfs3mvD3cvR3TdRSeoMmuJhTPEbAaUUp3fIQ7KC9CNvqnk7/zB/23dLTOb242kJ+03M60HV7KdPoRvvJ7I/J2FrmTLTauWaPOw1gkBahQsoKTqT/5CcMriSX777dX8MD1q0OTCYwOsLLINQKbfL74cdkndhUNdN13DWF6hVncC/cWvj1x+vDerIt5VxVN3RNs8zqluGmpxnkeYVTKyAgJkh9lDdN5VKk9t3POYpNDFLqJlnpaYyT8zXeZBcZIW2T/nn+fVM6EaMIhBfjiosx9zX2AfqTSHM1tkGt+J28pFW5L6zXzC7TQTgo3wrVjI1BhVohBXkhqfON5u83e8xKIZZCHrwPYRa6h6HRdnrCw6LEsLlmzq4sYkVfg/lG4zmdZnrVWzd9nb9fqimVbBY7+sd1KWCpnmbzqumOMUzLP5QHBetPLuUwdiNAB6ZAWqDfemUZqk8ut2n3bfRUWweZfVEC8FR4cAJDSDrQ3ja5bK/d0eg08fpFiGxc3/DVcOrNnnLGt4tX53nHTCusrqeIk1HGCFJT7PxOOM3Y2IdEFHGSKWLnV3I4kghGav665bEnF6M9Bv1D7b2fAQMFrxMMsqP96iR5QDSb4saFXVURI7kK61Sqxkij8M0oX6/OlJjtdZFfqi9Bx/5rEnXVH/FV14/XsZxZKCdcluLj2QqOUR+/k+Tb/xVTp/gZ4nbQsuOt2kPJbmj
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-01-24T11:21:51Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
}
]
}
Reference in a new issue Copy permalink