2023-04-21 14:44:17 +00:00
{
"type" : "bundle" ,
"id" : "bundle--5abc9cfc-4f24-40a6-b7e1-4870950d210f" ,
"objects" : [
{
"type" : "identity" ,
"spec_version" : "2.1" ,
"id" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-03-29T14:52:37.000Z" ,
"modified" : "2018-03-29T14:52:37.000Z" ,
"name" : "CIRCL" ,
"identity_class" : "organization"
} ,
{
"type" : "report" ,
"spec_version" : "2.1" ,
"id" : "report--5abc9cfc-4f24-40a6-b7e1-4870950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-03-29T14:52:37.000Z" ,
"modified" : "2018-03-29T14:52:37.000Z" ,
"name" : "OSINT - March 28, 2018: Malware Analysis Report (MAR-10135536.11) \u00e2\u20ac\u201c North Korean Trojan: SHARPKNOT" ,
"published" : "2018-03-29T14:53:49Z" ,
"object_refs" : [
"observed-data--5abc9cfc-3014-460b-bc7a-4f1d950d210f" ,
"file--5abc9cfc-3014-460b-bc7a-4f1d950d210f" ,
"artifact--5abc9cfc-3014-460b-bc7a-4f1d950d210f" ,
"observed-data--5abc9cfc-0ab0-4e02-a662-40d9950d210f" ,
"file--5abc9cfc-0ab0-4e02-a662-40d9950d210f" ,
"artifact--5abc9cfc-0ab0-4e02-a662-40d9950d210f" ,
"observed-data--5abc9cfd-c088-465d-b61c-452d950d210f" ,
"file--5abc9cfd-c088-465d-b61c-452d950d210f" ,
"artifact--5abc9cfd-c088-465d-b61c-452d950d210f" ,
"indicator--5abcf6c9-60b0-4aa8-b52b-4f7d950d210f" ,
"indicator--5abcf6f8-e8c4-4164-95fe-4ed7950d210f" ,
"observed-data--5abcf8df-cb18-4d66-b9dc-4453950d210f" ,
"url--5abcf8df-cb18-4d66-b9dc-4453950d210f" ,
"indicator--4cca3ed7-3809-49d4-b41c-2e0827db2d75" ,
"indicator--fdd73209-3bfc-4cc4-b70c-28f6bb7624f5"
] ,
"labels" : [
"Threat-Report" ,
"misp:tool=\"MISP-STIX-Converter\"" ,
"osint:source-type=\"technical-report\"" ,
"misp-galaxy:tool=\"SHARPKNOT\""
] ,
"object_marking_refs" : [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5abc9cfc-3014-460b-bc7a-4f1d950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-03-29T08:06:43.000Z" ,
"modified" : "2018-03-29T08:06:43.000Z" ,
"first_observed" : "2018-03-29T08:06:43Z" ,
"last_observed" : "2018-03-29T08:06:43Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--5abc9cfc-3014-460b-bc7a-4f1d950d210f" ,
"artifact--5abc9cfc-3014-460b-bc7a-4f1d950d210f"
] ,
"labels" : [
"misp:type=\"attachment\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--5abc9cfc-3014-460b-bc7a-4f1d950d210f" ,
"name" : "Figure 1" ,
"content_ref" : "artifact--5abc9cfc-3014-460b-bc7a-4f1d950d210f"
} ,
{
"type" : "artifact" ,
"spec_version" : "2.1" ,
"id" : "artifact--5abc9cfc-3014-460b-bc7a-4f1d950d210f" ,
"payload_bin" : " / 9 j / 4 A A Q S k Z J R g A B A Q A A A Q A B A A D / 2 w B D A A g G B g c G B Q g H B w c J C Q g K D B Q N D A s L D B k S E w 8 U H R o f H h 0 a H B w g J C 4 n I C I s I x w c K D c p L D A x N D Q 0 H y c 5 P T g y P C 4 z N D L / 2 w B D A Q k J C Q w L D B g N D R g y I R w h M j I y M j I y M j I y M j I y M j I y M j I y M j I y M j I y M j I y M j I y M j I y M j I y M j I y M j I y M j I y M j I y M j L / w A A R C A I 7 A l g D A S I A A h E B A x E B / 8 Q A H w A A A Q U B A Q E B A Q E A A A A A A A A A A A E C A w Q F B g c I C Q o L / 8 Q A t R A A A g E D A w I E A w U F B A Q A A A F 9 A Q I D A A Q R B R I h M U E G E 1 F h B y J x F D K B k a E I I 0 K x w R V S 0 f A k M 2 J y g g k K F h c Y G R o l J i c o K S o 0 N T Y 3 O D k 6 Q 0 R F R k d I S U p T V F V W V 1 h Z W m N k Z W Z n a G l q c 3 R 1 d n d 4 e X q D h I W G h 4 i J i p K T l J W W l 5 i Z m q K j p K W m p 6 i p q r K z t L W 2 t 7 i 5 u s L D x M X G x 8 j J y t L T 1 N X W 19 j Z 2 u H i 4 + T l 5 u f o 6 e r x 8 v P 0 9 f b 3 + P n 6 / 8 Q A H w E A A w E B A Q E B A Q E B A Q A A A A A A A A E C A w Q F B g c I C Q o L / 8 Q A t R E A A g E C B A Q D B A c F B A Q A A Q J 3 A A E C A x E E B S E x B h J B U Q d h c R M i M o E I F E K R o b H B C S M z U v A V Y n L R C h Y k N O E l 8 R c Y G R o m J y g p K j U 2 N z g 5 O k N E R U Z H S E l K U 1 R V V l d Y W V p j Z G V m Z 2 h p a n N 0 d X Z 3 e H l 6 g o O E h Y a H i I m K k p O U l Z a X m J m a o q O k p a a n q K m q s r O 0 t b a 3 u L m 6 w s P E x c b H y M n K 0 t P U 1 d b X 2 N n a 4 u P k 5 e b n 6 O n q 8 v P 0 9 f b 3 + P n 6 / 9 o A D A M B A A I R A x E A P w D 3 + i i i g A o o o o A K K K K A C i i i g B K 57 x S x F l Z l S 4 Y X c Z B R d z A 4 b o O 59 q 6 G s P x G c R 6 c T 0 F / C f 501 u O O 6 P H 7 X X f i H H D u C 6 x c T y Q Y K T a a A I y U R i y / K M s D 5 g A P o B 3 r b F 94 w G i X d 9 b S 6 n P b W V 6 h h W e y W K 6 v L c q A 42 F e C r H g 4 G R m t e H 4 g P L p b 6 q 2 h z x a Y 9 v J P b 3 U l 1 G B K F Y K A R / A W J 4 z U d 54 w v 77 w N q u s W M R 0 + 902 Z o 5 I p 4 / N D F d u Q M 7 T y G H J A I 9 K 9 B u T f w J a r + v 0 8 j T T u d R o M G o 2 + h 2 c e r X R u t Q E Y N x K V C 5 c 8 k A A A Y H T 8 K 0 q w N X v r + z 8 T a H D D P G L O 8 l l h m h M Q L E r G z h g + e O g G M V v n p X N J P f u b R 7 B R R R U l H n n i L V P F t t 4 y M N i t y t m D B 9 l W K 0 M s c w J / e 7 y F O C P d k w O e a x 9 F m 8 Q a d q l / a 2 c W r 2 + m y X d / N J F / Z v y w w k E x y R M R l n L Y w n O f T v X b 6 l 4 k v b T X x p F n o V x e z t A s 4 d L i N F 2 b t r E 7 u m D + d Z M v x M t I 5 L p m 0 u 9 + x w e e q 3 C j O 5 o g d w I x h c 4 O D k + + K 7 a V K t O C U K a d 0 u q + T 3 + 75 n P J x 5 t W Q e E f E W s 2 u g 6 x q H i w 6 i r 2 a L L s m s x E v l h c g o c D c 5 P U d j g V 3 N r M L m 0 h n a G S E y I r m K T G 5 M j O D j u K 42 T x 8 W s N R a 78 P y l r T y F e E T p K G M 3 K 8 q D w B y e D 9 K d J 8 R Y R p t h P D p k t x P d p N K I Y p g 21 I 22 t 8 w H J P G B g e + K V T C V p u 6 p 2 u + j V t r 9 / m O M 4 r q V N R 1 T x Z F 46 M E S 3 K 6 e L q B Y Y 0 t C 8 M s B A 8 x m c K Q G B z y X X G O h q r a a l 4 o k S 6 e + v d d g u 44 b k z 20 O k q 0 U T A 4 i 8 l s f P 2 w M t n J z i t 7 T f F 15 q P i Z 7 F N J m W y a 1 h u E m d k Q p 5 m 7 l w W z g 4 A A A z k H t i o I f i G j v e r L p U s T W M U 0 l 0 H u E / c l G 2 h W 9 C x 6e3 N H s a r 0 V N X S X V d d v 67 i 5 o 73 J v h / f a 9e6 Z c t 4 i F 4 t + s w D J P b C J F X H H l k D 5 g e p P Y 8 V 159 q 4 i 48 W 3 u o e C d a 1 K y h O n X u m s w Z J k 80 N t U N j k L 1 B H J H H v W h r n i 0 a B M Y p L C S 422 B v i 6 y q o K h 1 R h z 3 G 4 H 3 r O e G q z n Z R V 7 t W 9 E n 6 d V 1 L j O K W 509 G c 1 y U f j q G X x I 2 l R 6 f c t E t 39 j e 4 X k L L j P K 4 + 72 z n 8 K 2 d e 1 m L Q N H n 1 G a J 5 V Q q q x o Q C 7 M w V R k 8 D k j k 1 n K h U j K M H H W W 3 z K U 0 0 32 N W m s R 0 N c f r G v 61 F 4 b v b 0 W X 9 l 3 V l c R q 0 c p S d Z V J U H B G M f e 6 + 1 T + I P G s W h a u + n r p 0 928 M S z z G H q i M x A w M H c e C c c f W r j h K 0 2 l B X e u z X S 3 X b q u o v a x W 51 d F c n Z e N Y 73 x M 2 j R W D s G a Z I r h Z Q V d 4 x l l 6 Y H X H U k H q B V N f H l 2 d I / t R v D d y t m z r E k j X M X z O Z P L w B 6 b u 9 C w d a 9 u X t 1 X X b r 5 M P a w 7 n b 4 o r h r r 4 i x 2 t g 0 h 0 m U 3 k U 80E9 r 56 k o Y l D O Q V B 3 D D D k D H r i n 3 n x C h h u z D b a V N c R p 9 m W V z M k Z V 5 w D G o U 8 t 15 I 6 U 1 g q / 8 v 4 r / A D 89 O / Q P a w 7 n b Z o 5 z X I a T 46 i 1 b V v s d v p d 0 Y p D M s E 2 R i R o s 5 B 4 w u c H H J 98 V n 6 f 4 k 8 Q 3 P h H X N d u I D H 5 a y m 2 j R I h 5 S o z q z A 7 j v 27 e Q 2 M k c c G h 4 O q t J p L Z a t f a d l / w A H s H t Y 9 D 0 D t S Y r k 9 b 8 X v o k N o 50 q a 8 E t m 127 p K i b U Q K X y D 3 w w P H X p S z e N 4 I v E t t p K 2 M k k c 0 k U R n W Q f I 8 i b 1 B X H H H q Q f Q G p j h q k l z K O m r 3 X T f q H t Y r q d Z R X L W u u X 1 k n i Z 74 f b F 0 u T M S w R B G Z D G r h c Z 5 P O M 1 j f 8 J 3 q G o 2 t l c 6 b Y D z P t 62 k t o Z F L S B o i 4 + Y g e X g j u O x p x w t S T f L a y t r f T V X X 4 A 6 k V u e g 5 p a 4 l / i H C l p B c J p k 7 R y W U d 4 M y q M K 0 o i K / U E / j 2 q 1 Z e L L p t e 1 u 0 u t M k i s 9 P Y Y u A 6 c D y 9 / z D d k l s Z G B 0 64 o e G q p N u O 3 m u 9 u / c P a R e x 1 d G B X n N p 4 + u 47 u / v L 2 y m W w e 0 t 57 C 2 x H 5 j e c + x P m B x g n n 5 s Y 5 / G 6 / x I t r K / a 0 1 T T J r G S N 2 i n d p 0 d U k A U h Q R 97 I Z e e 3 O e h q n g M R e y j f 0 a / z 6 b O 19 d B K t D u d z u p a 4 O L 4 i l x b y y a B c x 28 k c M r y / a I z s j k k 8 t W w O v z d v T m u 77 Y r K r Q n S s p q 1 / N P 8 m y 4 z j L Y W i i i s y g o o o o A K K K K A C i i i g A o o o o A K K K K A C i i i g A o o o o A K K K K A A d K 5 j x r / w A e G m / 9 h K D + T 1046 V z H j X / j w 0 3 / A L C U H 8 n p P Y i p 8 L O 4 i / 1 S f 7 o q S o 4 v 9 U n + 6 K k r I 5 Q o o o o A K K K K A C i i i g A o o o o A K K K K A C i k z R m g Q t F J m j N A C 0 U m a M 0 A L R S Z o z Q A G s P x G Q E 0 4 k 4 A v 4 S T + d b m a w f E b F Y d P Z V L k X 0 R C g / e P P H P r T W 447 n J Q W 3 w 5 l F / J A d D c S x 4 u i k q k B X Y e / y g t j p j n F S z 6 P 4 B i 0 q Z J 4 d K W w + 1 b Z d 0 v y m d R j B O 7 l g C e K 53 Q f h 7 f X u h z Q 62 x s J F h u L a 2 g W K J v L E r h y 5 Z S d + C A A D j G D 7 V o X 3 g a d 9 M l T U P E N k J J d T + 3 m Z 7 T y V D m P Z t U i Q E H o Q Q 2 e O 9 d 75 U 7e0 Z v r a / K T S r 8 P 5 t Y s N P u b O y B W 1 j k 0 + 4 k k A i k R n I V Y 23 Z J 3 Z 7 d 673 P N e b 3 v w 9 m m S 3 s 28 S w C Y W E V o n n 2 q t K w j m 83 c P n B 6 j H H Y d a 9 I H T D H J 7 n H e s p 8 t l y y u V C 93 d C 0 U U V k a H O X 0 f h S L x N b T X x 0 + P X G 2 + S Z Z g s p x w u B n 8 u K y f t H h G X x l e 2 N v p 0 B 1 J I n a 6 v F 8 s x w F k O 4 s G b r j h i F P X D d a k 1 n w I d W 1 W 9 u l 1 N Y b T U X g e 7 h a 2 V 5 C Y c b f L k J + Q H A z w f a r d n 4 V u 7 X x J q + r / b 7 J l 1 B c C L + z x u j I B C 5 b d y O f m G B u 9 q 6 I 1 L R + N 7 W 3 f 3 e n l s Y N O + 3 U 5 j w n b + E J d I 1 e S Z z L p w u I / M u r o Q w Q s y b l T Y s T Z U 9 T k g E 5 B F d F c 2 / g V 9 E s j c f 2 S N O D u L V 2 m A U s T 8 + 1 s 5 O T 15 + t U k 8 A X I 8 J P o c m p 2 b / 6 U t w k y 6 f 5 f R i x B C v k n J 4 Y E E D g V F P 8 A D e a X T t O h G t F 7 m 0 j n h a S e F n S S O V t x G B I G 492 O e + a 1 l W 5 p 8 z q v f u + 2 / Q U Y t K 3 K a p H g 298 U Q 2 T w 6 e + q W M M R g B K 5 V e S i p z y R j O M c Z B 71 o 6 r b a F Y 6 f q 99 f 2 s K 208 e + / c p n z V U Y G 4 D k 8 d M V k W / g d 7 D W r K / 0 + / t 4 F i t o L a Z W s U d 3 E W e U Y n 5 C w O C c E 4 x 6 V 0 G u 6 d J q + h 3 m n w 3 C 273 E Z j E r R i Q L n 1 U 8 E d s V z u b v G 0 3 b 1 e m t / 8 A g + u p c V v d H K 2 c P g e 70 W 7 k m 0 u O x s l m j 84 a h G 0 G 59 u U P z H 5 v l b 8 c 1 a 1 C 18
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5abc9cfc-0ab0-4e02-a662-40d9950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-03-29T08:06:43.000Z" ,
"modified" : "2018-03-29T08:06:43.000Z" ,
"first_observed" : "2018-03-29T08:06:43Z" ,
"last_observed" : "2018-03-29T08:06:43Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--5abc9cfc-0ab0-4e02-a662-40d9950d210f" ,
"artifact--5abc9cfc-0ab0-4e02-a662-40d9950d210f"
] ,
"labels" : [
"misp:type=\"attachment\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--5abc9cfc-0ab0-4e02-a662-40d9950d210f" ,
"name" : "Figure 2" ,
"content_ref" : "artifact--5abc9cfc-0ab0-4e02-a662-40d9950d210f"
} ,
{
"type" : "artifact" ,
"spec_version" : "2.1" ,
"id" : "artifact--5abc9cfc-0ab0-4e02-a662-40d9950d210f" ,
"payload_bin" : " / 9 j / 4 A A Q S k Z J R g A B A Q A A A Q A B A A D / 2 w B D A A g G B g c G B Q g H B w c J C Q g K D B Q N D A s L D B k S E w 8 U H R o f H h 0 a H B w g J C 4 n I C I s I x w c K D c p L D A x N D Q 0 H y c 5 P T g y P C 4 z N D L / 2 w B D A Q k J C Q w L D B g N D R g y I R w h M j I y M j I y M j I y M j I y M j I y M j I y M j I y M j I y M j I y M j I y M j I y M j I y M j I y M j I y M j I y M j I y M j L / w A A R C A J Y A b w D A S I A A h E B A x E B / 8 Q A H w A A A Q U B A Q E B A Q E A A A A A A A A A A A E C A w Q F B g c I C Q o L / 8 Q A t R A A A g E D A w I E A w U F B A Q A A A F 9 A Q I D A A Q R B R I h M U E G E 1 F h B y J x F D K B k a E I I 0 K x w R V S 0 f A k M 2 J y g g k K F h c Y G R o l J i c o K S o 0 N T Y 3 O D k 6 Q 0 R F R k d I S U p T V F V W V 1 h Z W m N k Z W Z n a G l q c 3 R 1 d n d 4 e X q D h I W G h 4 i J i p K T l J W W l 5 i Z m q K j p K W m p 6 i p q r K z t L W 2 t 7 i 5 u s L D x M X G x 8 j J y t L T 1 N X W 19 j Z 2 u H i 4 + T l 5 u f o 6 e r x 8 v P 0 9 f b 3 + P n 6 / 8 Q A H w E A A w E B A Q E B A Q E B A Q A A A A A A A A E C A w Q F B g c I C Q o L / 8 Q A t R E A A g E C B A Q D B A c F B A Q A A Q J 3 A A E C A x E E B S E x B h J B U Q d h c R M i M o E I F E K R o b H B C S M z U v A V Y n L R C h Y k N O E l 8 R c Y G R o m J y g p K j U 2 N z g 5 O k N E R U Z H S E l K U 1 R V V l d Y W V p j Z G V m Z 2 h p a n N 0 d X Z 3 e H l 6 g o O E h Y a H i I m K k p O U l Z a X m J m a o q O k p a a n q K m q s r O 0 t b a 3 u L m 6 w s P E x c b H y M n K 0 t P U 1 d b X 2 N n a 4 u P k 5 e b n 6 O n q 8 v P 0 9 f b 3 + P n 6 / 9 o A D A M B A A I R A x E A P w D 2 X x T / A M i n q 3 / X p J / 6 C a q N r m k N q b a c N V s j f B y v 2 Y T r 5 m f T b n O a t + K T n w n q 3 / X p J / 6 C a 8 x 1 j w t r t x 4 z v d Z i 0 x p r O P U I L h L Y T R J 9 p C J t L B s 5 V g Q D g k A g + t d W E p Q q O S q S 5 b L T b V 9 t S o y l F X i r n o E W u 6 T c J c v D q N p I l q C b h k n U i E D O d 3 P y 9 D 19 K h k 8 T a D D / r d a 0 9 P k E n z X S D 5 T j D d e h y O f e v O 9 O 0 D x f Y a n d a n J p C y n V I b p L u 3 R 4 l K F y T H k 78 P j j H A w C R W f B 4E8 R 22 j X t v / A G W Z j L Y Q w w R P N E W i c T B 5 F 3 Z w R k M w 9 m A 7 V 6 H 1 D C 8 z 5 q q t p 1 j 8 / u d / V F O r P p H 8 z 1063 p g 0 0 6 j / A G n Z / Y c 4 + 0 + c v l 59 N 2 c U R a z p c z h Y d S s 5 G a H 7 Q o S d S T F / f 6 / d 9 + l e e t 4 V 1 c 37 a 7 / Y c K p / a i 3 P 9 i r M h + Q R F C 2 f u b 8 n d j p W a n g T X r m 8 l k f T 2 s o p I 7 i U L B P G Q i y v k 23 X u u R n o C c 1 E c F h n e 9 W 3 / g P l p v r b u t H 0 6 l e 0 n / K e u Q X c F 1 b R 3 F p P H P B I M p J E w Z W H s R 1 q p / b u j v f P Y D V b I 3 i k q b f z 0 8 w E d R t z m s r w 3 q N l p H h r T t O 1 S 7 s 7 G + t Y F i m t 5 L q L K E D H O G 7 j B / G u T v f D e t X f j G 41 u L T h c a c m o Q X c c C z w g X K q m 3 z F b q C C A 2 C Q C D W E M L T l O c Z y 5 U r 2 e m u u m + j v p t 37 D d R 8 q a W p 3 c X i v w 9 M z L F r W m S F F L s F u k O F A y S e e g F P P i L Q 13E6 t p 42 R r K 2 b l O E O M M e e h y M H 3 F e a a H 4 Y 1 + x a Z r j w 48 h e K 52 e d c w F Y C 4 k 2 i I K 3 V t 4 D b h j j 8 q 1 t 4 N 8 T 2 G l X t p F p n m G 7 s o b a P d L E W g B f d K C S f m x z t 9 m H p x 1 P B Y b m a V X t 1 j r 369 C P a V P 5 f z P W 0 1 b T p D a l L + 1 b 7 X n 7 N i Z T 52 O u z n 5 v w q t N 4 o 8 P 2 / w D r t b 0 6 P L F D v u k H z D q O v U V 5 v F 4 S 8 T t F a a K 9 i Y r e z 1 K W 4 t d R i e N V h V g d p E e 4 n a H 52 + h x U D + D / E K Q a d b J o t 2 i W c t 1 + 9 h u Y P M d Z G U r k s 3 O c H P f m l H A Y a 9 n W / G O 2 t n v 6 a b p + Q 3 V q f y n s M F 1 D c 28 c 9 v K k 0 M i 7 k k j Y M r D 1 B H W p M F v v A / l W Z 4 f i m t t A s Y Z 7 G K w l S I B r W J s p E f 7 o O T n 8680 t r e 41 b x 7 q Y 0 a R m k t d T S Y 3 f 29 s Q w A D z U 8 o n k M 2 R 0 x n j j F c d P D R q + 0 t K y h 13623 W n 3 X 8 i 3 U c Y p 21 Z 69 n 2 H 5 U Z P p X m e k + F d U M e r y n T 77 T 9 S x O 2 m 3 M 2 o e Y k Q k 4 V A q s c Y B z k j r z 2 F V o f D H i f + z t S T T 7 a 50 x J L S G N r a W / 8 x r m Z X B k d X B O z c u V z x n P a t Y 4 S n d r 2 q 0 t v b r b s 33 + 9 O 9 l q L 2 k v 5 T 1 U Z 9 M U Y H c V z H h D T D p y 37 j S b n S 4 p p E 8 u C e 7E5 A V c Z G C d o 9 s n P t 0 r K 8 f a F q W s a h Z v Z 6 d c X U K W d w j m K 7 E Q 8 w r + 6 y C w z h h n 8 R 6 V l G h C V X k c r L v p 29 b e W 5 X O + X m s d 7 h v S k w 2 M 44 r y e + 8 N + L 7 u 6 t b i W G 8 a X 7 N b L C 8 V 3 G D a y I A J M k t x k j J I D Z B x V / + w / E i / E J d W F h K Y V v S W l j u E C P b l N o 4 L 7 u D y V w B x x W z w d J L + L H Z v 5 r p v 1 / p N a k e 1 l / K e k h S O g / S l y f S u A 8 J + H L i D X r m 81 L S L + 2 a O 4 l l t J Z d Q 8 y N E b j Y E D n q C S c j 0 r v 81 y 1 q c a c u V S 5 v P 8 A 4 Z s 1 j J y V 2 h a K K K g o K K K K A C i i i g A o o o o A K K K K A C i i i g A o o o o A K K K K A C i i i g A o o o o A K K K K A C i i i g A o o o o A K K K K A C i i i g A o o o o A Q 968 + t P + Q n r n / Y U n / m K 9 B P e v P r T / A J C e u f 8 A Y U n / A J i p m Y V t k d 94 r / 5 F P V v + v S T / A N B N S s f n b 6 m o v F X / A C K e r f 8 A X p J / 6 C a Y 99 a C 9 N o b q A X J J I h M g 3 n / A I D n N K L F S a V 7 k 9 F V U v 7 K S V Y k v L d p G y F V Z V J O O u B n t S w X 9 l d O U t 7 y 3 m c Z J W O V W I x 9 D V X R t z R 7 l n p R 1 q h q m q 22 k W y z X P m N v c R x x x I X e R z 0 V Q O p q K 31 / S r q z i u V v Y Y k k z h Z 3 E b A g 4 I I J y C C M U J p v l W 4 u e P N y 31 J 5 d K 0 6 e V p Z r C 1 k k b l n e B G J + p I q 0 i L G i o i h V U Y C q M A D 0 A p I 3 j m j W S J 1 d G G V Z C C C P Y i s b V v F O n a N q N l Y 3 R k M l 3 I I w 6 b S s R P T z M s C o P P O O x q r S l 7 u r H o t T d z R m q i 6 l Y s I C t 7 b E T 5 E J E y / v M d d v P P 4 U x N X 0 y S C W e P U b N 4 Y m 2 y S L O h V D 6E5 w D 9 a L P s O 6 L 1 F Z 0 2 t a d F Z 3 V y l 3 B M t t x I s M q M Q 2 M h e u N x 7 A 4 p N D 1 m 28 Q a R D q V o k y Q y l g F m U K 4 K s V I I B P c H v T 9617 C u t j S p A i q S Q o B P U g V T l 1 T T o L k W 0 1 / a x z s w Q R P M o c s e Q M E 5 z U d v r W n 3 O r X e m R X K m 8 t N n m x n j G 8 E j H r w D n H T v R 7 w 7 o 0 a K p R a r p 0 86 Q Q 6 h a S S y Z K R p O r M 2 O u A D k 471 d p N N b h c M Y o x m q l / f 2 + m W E 17 d P s h h X c x x k / Q D u T U l r c x 3 l n D d Q 58 q Z F k T I w c E Z F I n m V + W + p P R R R Q W F F F F A B R R R Q A U U U U A F F F F A B R R R Q A U U U U A F F F F A B R R R Q A U U U U A F F F F A B R R R Q A U U U U A F F F F A B R R R Q A U U U U A F F F F A B R R R Q A h 7159 a f 8 h P X P + w p P / M V 6 C e 9 e f W n / I T 1 z / s K T / z F T M w r b I 7 z x V / y K e q / 9 e k n / o N c j e + F 9 V m 8 T N q a z W b R r e J c J v L K 21 R j a V A w T 1 + b N d d 4 q / 5 F P V f + v S T / A N B r j b 3 x d c w e L v s I n t h Z L e L b S J I o V x k c t n d u 698 Y r C f J p z 9 z m q e z 5 f 3 m 10 S W f h O W P + 1 f t k O m I b z z X i u L V G M 0 R c Y w M g Y A G e n r W d 4 Z U a V q V x e 31 m b a 3 W 1 i t I 5E0 + S I u w J z 8 u C S S B k n p 0 q 5 Z e I 9 V v p d R a G 70 u 6 W w a Y i 2 h j b z Z l U f K R y c D O B 781 P 4 W 8 R a h q + q S Q T 3 V p c Q p a J O T B C y F X Y / c O T / D W c P Z 80 e T 5 f j / w f 6 s Z L 2 T l H l u n d 9 u / + f z + R c v 3 X x G k E m j 3 I F 3 Y X C X K r c Q y I j c E b S S o P Q n p W d / w r 62 v b a D + 0 b q Q 3 Q a R 5 D b h A m X c s Q N 6 k 4 G c V s e L b 65 s 9 A l e 3 E o 3 s E l m j I z B G f v O M k D O O B z 1 N c z b 674 n m 0 L S J d E s m u o j a h Z p J I l l J k U k H n z V 9 K 6 q L / f N J 2 l b + v 0 O j 3 F V t L W V v l 22 O 706 x i 0 z T r e y h Z m j g Q I p f G S B 64 A H 6 V 57 e / D v U 5 v E k l 9 G N H u L d 9 U G o N P c o 5 u C h A D Q E g E b M Z x z X o G l S X c + l W s l / H 5 d 20 Y M q b d u 1 v T G T j 8 z X l H i H x P f X v j G 1 i O o W m n v Z a 0 t l D b M 8 g l Z M A + a 6 h g r R s c d R 9 D z
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5abc9cfd-c088-465d-b61c-452d950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-03-29T08:06:43.000Z" ,
"modified" : "2018-03-29T08:06:43.000Z" ,
"first_observed" : "2018-03-29T08:06:43Z" ,
"last_observed" : "2018-03-29T08:06:43Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--5abc9cfd-c088-465d-b61c-452d950d210f" ,
"artifact--5abc9cfd-c088-465d-b61c-452d950d210f"
] ,
"labels" : [
"misp:type=\"attachment\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--5abc9cfd-c088-465d-b61c-452d950d210f" ,
"name" : "Figure 3" ,
"content_ref" : "artifact--5abc9cfd-c088-465d-b61c-452d950d210f"
} ,
{
"type" : "artifact" ,
"spec_version" : "2.1" ,
"id" : "artifact--5abc9cfd-c088-465d-b61c-452d950d210f" ,
"payload_bin" : " / 9 j / 4 A A Q S k Z J R g A B A Q A A A Q A B A A D / 2 w B D A A g G B g c G B Q g H B w c J C Q g K D B Q N D A s L D B k S E w 8 U H R o f H h 0 a H B w g J C 4 n I C I s I x w c K D c p L D A x N D Q 0 H y c 5 P T g y P C 4 z N D L / 2 w B D A Q k J C Q w L D B g N D R g y I R w h M j I y M j I y M j I y M j I y M j I y M j I y M j I y M j I y M j I y M j I y M j I y M j I y M j I y M j I y M j I y M j I y M j L / w A A R C A D U A l g D A S I A A h E B A x E B / 8 Q A H w A A A Q U B A Q E B A Q E A A A A A A A A A A A E C A w Q F B g c I C Q o L / 8 Q A t R A A A g E D A w I E A w U F B A Q A A A F 9 A Q I D A A Q R B R I h M U E G E 1 F h B y J x F D K B k a E I I 0 K x w R V S 0 f A k M 2 J y g g k K F h c Y G R o l J i c o K S o 0 N T Y 3 O D k 6 Q 0 R F R k d I S U p T V F V W V 1 h Z W m N k Z W Z n a G l q c 3 R 1 d n d 4 e X q D h I W G h 4 i J i p K T l J W W l 5 i Z m q K j p K W m p 6 i p q r K z t L W 2 t 7 i 5 u s L D x M X G x 8 j J y t L T 1 N X W 19 j Z 2 u H i 4 + T l 5 u f o 6 e r x 8 v P 0 9 f b 3 + P n 6 / 8 Q A H w E A A w E B A Q E B A Q E B A Q A A A A A A A A E C A w Q F B g c I C Q o L / 8 Q A t R E A A g E C B A Q D B A c F B A Q A A Q J 3 A A E C A x E E B S E x B h J B U Q d h c R M i M o E I F E K R o b H B C S M z U v A V Y n L R C h Y k N O E l 8 R c Y G R o m J y g p K j U 2 N z g 5 O k N E R U Z H S E l K U 1 R V V l d Y W V p j Z G V m Z 2 h p a n N 0 d X Z 3 e H l 6 g o O E h Y a H i I m K k p O U l Z a X m J m a o q O k p a a n q K m q s r O 0 t b a 3 u L m 6 w s P E x c b H y M n K 0 t P U 1 d b X 2 N n a 4 u P k 5 e b n 6 O n q 8 v P 0 9 f b 3 + P n 6 / 9 o A D A M B A A I R A x E A P w D 26 T E c C M I 1 J I G S V p Y y r W 5 d o 0 3 D 2 q R S B C g I B B U c N S C e M j A Z c d O h x / L 3 o A j t m W V j u j X G O M L T N / 7 / A G + W m M 4 x t q 3 y o P y q P X F B P z / K o z 60 A H l R / w B x f y o 8 q P 8 A u L + V N a X a 204 z 36 n H 44 p x L A E 4 G P r Q A e V H / c X 8 q P K j / u L + V I W I T c Q A o 9 z / A I U i S F x l c e / + c U A O 8 q P + 4 v 5 U e V H / A H F / K l B 65 H T m k + Y 84 H 5 //WoAPKj/ALi/lR5Uf9xfypscvmAlMHBweT/hTwc5z2oATyo/7i/lR5Uf9xfyp1FADfKj/uL+VHlR/wBxfyp1FADfKj/uL+VHlR/3F/KnUUAN8qP+4v5UeVH/AHF/KnUUAN8qP+4v5UeVH/cX8qdRQA3yo/7i/lR5Uf8AcX8qdRQA3yo/7i/lR5Uf9xfyp1FADfKj/uL+VHlR/wBxfyp1FAEEyxxpuZBgdlHJqNZYns2mjVGAHG5cVaI3DH8jSKioMAYFAFFbpMENEjMODjC5OegB/wDr0fbYQ2PsxyG29BV/AHYelGB6DrmgCp5yNC8ghRCuMbsd8f561Et2gGXhQqMAkADnn/CtHFAAAwBQBSSdHjmby4lCIGBbkd+uO1MSZiwXyoSSpIGMZ4JzxnjoK0MCkwB2FAGfFcbp0RolwVBO1cnOAfy/D8aRrnEm0JBknAGOepGOv0rSwPT2pMD0HXNAFOWVUmCKkQ+Ukhxggc8n24/nTftMcdqJZY0J3FeMDPX/AD1q/gelJgYAxwO1AFJ5gLdZBHCrs7IA38WM4x78CpXZUfiJHTYWwoycjHH86sYHoKWgCgZx5MJCQ+Y/G0jr7DpSJPugmYRR7kYAYX35FX8A9RS0AZclzJEXRrePfj5flxk8k559BmrElzBHIyCJWAHUFfT/AOtVykCgMWAGT3xQBUjnjedYjAFJJBzjg4PHv07VZ8qP+4v5UeUnmebtXf03U+gBvlR/3F/Kjyo/7i/lTqKAG+VH/cX8qPKj/uL+VBY5OAOB60wzKJRGWQSHou7r+lAD/Kj/ALi/lR5Uf9xfypMtkjA/OlBOcED86ADyo/7i/lR5Uf8AcX8qMkjOAB9aZFMJlDRkHvjkf0oAf5Uf9xfyo8qP+4v5Uu7gkjpSEsqljtAHqf8A61AB5Uf9xfyo8qP+4v5UiuXXKlSPrz/KnL81ACeVH/cX8qPKj/uL+VS+X70eX70AReVH/cX8qPKj/uL+VS+X70eX70AReVH/AHF/Kjyo/wC4v5VL5fvSbB2bNAEflR/3F/Kjyo/7i/lUgUE4Dc0vl+9AEXlR/wBxfyo8qP8AuL+VSbPRqXy/egCLyo/7i/lR5Uf9xfyqXy/ejy/egCLyo/7i/lR5Uf8AcX8ql8v3o8v3oAryRoInIRc4PaipZUxC5z/CaKAIcHyF7fJ1/CowjiNkBTBIPBPt7e1Ykvik20zwfZs+WSmd3XFM/wCEvP8Az6f+PVusNVavYz9pA6PaA0jB3O7oOuPpTzwcnpiuZ/4S8/8APp/49Sf8Jef+fX/x+j6tV7B7WB0UkW9m2vjd22+lSBv3YB+9jp61zX/CXn/n0/8AHqP+EvP/AD6f+PUfVqvYPawOkcK8e1jjp2qOJPKdjuBU9TjpXP8A/CXn/n0/8eo/4S8/8+n/AI9R9Wq9g9rA6bqWx6CmSfNAyD7xXAFc7/wlx/59f/HqP+EuP/Pr/wCPUfVqvYPawN+MBZNwUKMdjnnOanHJY+tcz/wlp/59f/HqP+EsP/PqP++qX1ar2D2sDp6K5j/hLD/z6j/vqj/hLD/z6j/vqj6tV7B7WB09Fcz/AMJYf+fUf99Uf8JYf+fUf99UfVqvYPawOmormf8AhLD/AM+o/wC+qP8AhLD/AM+o/wC+qPq9XsHtYHTUVzX/AAlh/wCfUfnR/wAJWf8An1H50fV6vYPaQOlormv+ErP/AD6j/vqj/hKz/wA+o/76o+r1ewe1gdLRXNf8JWf+fUfnR/wlR/59R/31R9Xq9g9pA6Wiua/4So/8+o/76pf+EpP/AD6j86Pq9XsHtIHSUVzf/CUn/n1H/fVL/wAJT/07D/vqj6vU7B7SB0dFc5/wlJ/59h+dH/CUH/n2H/fVH1ep2D2sDo6K5z/hKD/z7D/vqj/hKD/z7D/vqj6vU7B7SB0dFc7/AMJOf+fYf99Uf8JOf+fYfnR9Xqdg9rA6Kiuc/wCEnb/n2H51atteinDbzHCQcYY9aTo1Er2GqkGbNFYtzr8cGBGUmY9l7VX/AOEmb/n2H50KjUavYTqQOiornf8AhJm/59h/31S/8JM3/PsP++qf1ep2D2kDoaK57/hJj/z7j86P+EmP/PuPzo+r1Owe0gdDRXPf8JKf+fcfnS/8JKf+fcfnR9Xqdg9pA6Ciuf8A+ElP/PuPzpP+EkP/ADwH50fV6nYPaQOhornv+EkP/PAfnS/8JIf+eA/Oj6vU7B7SB0FFc/8A8JI3/PAfnR/wkjf88B+dH1ep2D2kDeJwW6AnpmoLeFYSXbDSscs/P+FZP/CSN/zwH50DxGxIzAPzo+r1Ow/aQNtsNuG4jOORSrwRgkgL1NZE+veTLsRVlG3OVPFRf8JG3/PAfnSVGo+ge0gbL5MW0E7gRxkikjQByxyOwGScVkf8JEf+eA/Oj/hIm/54D86PY1Owe0gbZ+ZXxUU6+YU28jB44/rWT/wkR/54D86P+Ehb/ngPzo9jU7B7SBp28RidSTnAIJ45/ACrUZA5J71hf8JCx/5YD86P+Egb/ngPzo9jU7B7SB0XmJ/eX86PMT+8v51z3/CQN/zwH50f8JA3/PEfnR7Gp2D2kDofMT+8v50eYn95fzrnv+Egb/niPzo/4SBv+eI/Oj2NTsHtIHQb1P8AEv500EBvvrisL/hIG/54j86P+Egb/niPzo9jPsL2kDVaAbmYTKuTnA//AF0oh+8TcZJPHJ/xrJ/t9v8AniPzo/t9v+eI/Oj2M+we0gbEYWLnevI6Z/xNT+Yn95fzrA/t9v8AniPzo/t9v+eI/Oj2M+w/aQOg8xf7y/nR5if3l/Ouf/t9h/yxH51orcs8SPujG5A2McjIz61E4OGshxkpOyL/AJif3l/OjzE/vL+dZV9qRsrGa5+STy13bF6kfnVlpmViN8WRxj/JrPmRdixNIphkG5funv7UVmX+pG1ijJCP5sqw4U8jccZ/WijmEcHqur6Xa3t408GrARSP5ki2pMYweSGx0rLufF3hexSJrufULZZl3wmaEIH
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5abcf6c9-60b0-4aa8-b52b-4f7d950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-03-29T14:23:05.000Z" ,
"modified" : "2018-03-29T14:23:05.000Z" ,
"pattern" : "[rule r4_wiper_1\r\n{\r\nmeta:\r\nsource = \"NCCIC Partner\"\r\ndate = \"2017-12-12\"\r\nstrings:\r\n$mbr_code = { 33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 5D 7C 33 C9 41 81 F9 00 ?? 74 24 B4 43 B0 00 CD 13 FE C2 80 FA 84 \r\n7C F3 B2 80 BF 65 7C 81 05 00 04 83 55 02 00 83 55 04 00 83 55 06 00 EB D5 BE 4D 7C B4 43 B0 00 CD 13 33 C9 BE 5D 7C EB C5 }\r\n$controlServiceFoundlnBoth = { 83 EC 1C 57 68 3F 00 0F 00 6A \r\n00 6A 00 FF 15 ?? ?? ?? ?? 8B F8 85 FF 74 44 8B 44 24 24 53 56 6A \r\n24 50 57 FF 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B F0 85 F6 74 1C 8D 4C 24 0C 51 6A 01 56 FF 15 ?? ?? ?? ?? 68 E8 03 00 00 FF 15 ?\r\n? \r\n?? ?? ?? 56 FF D3 57 FF D3 5E 5B 33 C0 5F 83 C4 1C C3 33 C0 5F 83 C4 1C C3 }\r\ncondition:\r\nuint16(0) == 0x5a4d and uint16(uint32(0x3c)) == 0x4550 and any of them\r\n}]" ,
"pattern_type" : "yara" ,
2023-12-14 14:30:15 +00:00
"pattern_version" : "2.1" ,
2023-04-21 14:44:17 +00:00
"valid_from" : "2018-03-29T14:23:05Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"yara\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5abcf6f8-e8c4-4164-95fe-4ed7950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-03-29T14:23:52.000Z" ,
"modified" : "2018-03-29T14:23:52.000Z" ,
"pattern" : "[rule r4_wiper_2\r\n{\r\nmeta:\r\nsource = \"NCCIC Partner\"\r\ndate = \"2017-12-12\" \r\nstrings:\r\n// BIOS Extended Write\r\n$PhysicalDriveSTR = \"\\\\\\\\.\\\\PhysicalDrive\" wide\r\n$ExtendedWrite = { B4 43 B0 00 CD 13 } \r\ncondition:\r\nuint16(0) == 0x5a4d and uint16(uint32(0x3c)) == 0x4550 and all of them\r\n}]" ,
"pattern_type" : "yara" ,
2023-12-14 14:30:15 +00:00
"pattern_version" : "2.1" ,
2023-04-21 14:44:17 +00:00
"valid_from" : "2018-03-29T14:23:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Artifacts dropped"
}
] ,
"labels" : [
"misp:type=\"yara\"" ,
"misp:category=\"Artifacts dropped\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5abcf8df-cb18-4d66-b9dc-4453950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-03-29T14:31:59.000Z" ,
"modified" : "2018-03-29T14:31:59.000Z" ,
"first_observed" : "2018-03-29T14:31:59Z" ,
"last_observed" : "2018-03-29T14:31:59Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5abcf8df-cb18-4d66-b9dc-4453950d210f"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5abcf8df-cb18-4d66-b9dc-4453950d210f" ,
"value" : "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--4cca3ed7-3809-49d4-b41c-2e0827db2d75" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-03-29T07:59:57.000Z" ,
"modified" : "2018-03-29T07:59:57.000Z" ,
"pattern" : "[file:hashes.MD5 = '350cba65e28c723cbf0724c19bd7ee69' AND file:hashes.SHA1 = 'c8cb01bc1f62c6d6b95caa7bf2cae167d5736ffa' AND file:hashes.SHA256 = 'ca057fd197fc99cfb60b7379cb64475e6bd206fdd4b019f1f70c2214115f3b83']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-03-29T07:59:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--fdd73209-3bfc-4cc4-b70c-28f6bb7624f5" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-03-29T07:59:59.000Z" ,
"modified" : "2018-03-29T07:59:59.000Z" ,
"pattern" : "[file:hashes.MD5 = '350cba65e28c723cbf0724c19bd7ee69' AND file:hashes.SHA1 = 'c8cb01bc1f62c6d6b95caa7bf2cae167d5736ffa' AND file:hashes.SHA256 = 'ca057fd197fc99cfb60b7379cb64475e6bd206fdd4b019f1f70c2214115f3b83' AND file:hashes.SHA512 = 'a1642a8011d5196a4efcbea6ec37e3c1c5f56e1d0160f33d681c5c673757d4e0688a031aebf40a8ec485cf55f4eb5b5fd4e268850a58e684d0fc3c7dc3b632ea' AND file:hashes.SSDEEP = '192:s/7pzppvWcUcHfHxSnx5LqSe/7m8EI2K3A+Y6Geny6VuwjZhfJP4oynQ6f:K7pvWc/HfHsFGqrI2K3AZwuwzV4+6f' AND file:name = '350CBA65E28C723CBF0724C19BD7EE69' AND file:size = '20480' AND file:x_misp_mimetype = 'PE32 executable (console) Intel 80386, for MS Windows' AND file:x_misp_entropy = '2.914359']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-03-29T07:59:59Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "marking-definition" ,
"spec_version" : "2.1" ,
"id" : "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ,
"created" : "2017-01-20T00:00:00.000Z" ,
"definition_type" : "tlp" ,
"name" : "TLP:WHITE" ,
"definition" : {
"tlp" : "white"
}
}
]
}
