283 lines
128 KiB
JSON
283 lines
128 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--5c8f9bb3-c244-4dba-89cb-4fdc950d210f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-06-06T12:23:49.000Z",
|
||
|
|
"modified": "2019-06-06T12:23:49.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--5c8f9bb3-c244-4dba-89cb-4fdc950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-06-06T12:23:49.000Z",
|
||
|
|
"modified": "2019-06-06T12:23:49.000Z",
|
||
|
|
"name": "OSINT - Spam Warns about Boeing 737 Max Crashes While Pushing Malware",
|
||
|
|
"published": "2019-06-06T12:50:36Z",
|
||
|
|
"object_refs": [
|
||
|
|
"observed-data--5c8f9bd5-55cc-458e-8cbc-4a08950d210f",
|
||
|
|
"url--5c8f9bd5-55cc-458e-8cbc-4a08950d210f",
|
||
|
|
"x-misp-attribute--5c8f9bef-6d90-475c-91bd-4309950d210f",
|
||
|
|
"observed-data--5c8fab3f-6100-477b-a7fa-443b950d210f",
|
||
|
|
"file--5c8fab3f-6100-477b-a7fa-443b950d210f",
|
||
|
|
"artifact--5c8fab3f-6100-477b-a7fa-443b950d210f",
|
||
|
|
"indicator--5c8faf7d-0148-415c-a1d6-4f16950d210f",
|
||
|
|
"indicator--5c8faf7d-f368-49fa-92e7-4198950d210f",
|
||
|
|
"x-misp-object--5c8fa219-3e68-48d7-9fd3-446f950d210f",
|
||
|
|
"indicator--5c8fb070-9b58-46d1-842d-4183950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"circl:incident-classification=\"spam\"",
|
||
|
|
"type:OSINT",
|
||
|
|
"osint:lifetime=\"perpetual\"",
|
||
|
|
"osint:certainty=\"50\"",
|
||
|
|
"misp-galaxy:android=\"Adwind\"",
|
||
|
|
"misp-galaxy:malpedia=\"AdWind\"",
|
||
|
|
"misp-galaxy:mitre-malware=\"jRAT - S0283\"",
|
||
|
|
"misp-galaxy:rat=\"Adwind RAT\"",
|
||
|
|
"misp-galaxy:rat=\"H-w0rm\"",
|
||
|
|
"misp-galaxy:rat=\"H-worm\"",
|
||
|
|
"misp-galaxy:tool=\"Adwind\""
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5c8f9bd5-55cc-458e-8cbc-4a08950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-03-18T13:23:33.000Z",
|
||
|
|
"modified": "2019-03-18T13:23:33.000Z",
|
||
|
|
"first_observed": "2019-03-18T13:23:33Z",
|
||
|
|
"last_observed": "2019-03-18T13:23:33Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5c8f9bd5-55cc-458e-8cbc-4a08950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5c8f9bd5-55cc-458e-8cbc-4a08950d210f",
|
||
|
|
"value": "https://www.bleepingcomputer.com/news/security/spam-warns-about-boeing-737-max-crashes-while-pushing-malware/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--5c8f9bef-6d90-475c-91bd-4309950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-03-18T13:23:59.000Z",
|
||
|
|
"modified": "2019-03-18T13:23:59.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "External analysis",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "A new malspam campaign is underway that is trying to utilize the tragic Boeing 737 Max crashes as a way to spread malware on a recipient's computer. These spam emails pretend to be leaked documents about imminent crashes that the sender states should be reviewed and shared with loved ones to warn them."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5c8fab3f-6100-477b-a7fa-443b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-03-18T14:29:19.000Z",
|
||
|
|
"modified": "2019-03-18T14:29:19.000Z",
|
||
|
|
"first_observed": "2019-03-18T14:29:19Z",
|
||
|
|
"last_observed": "2019-03-18T14:29:19Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--5c8fab3f-6100-477b-a7fa-443b950d210f",
|
||
|
|
"artifact--5c8fab3f-6100-477b-a7fa-443b950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"attachment\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--5c8fab3f-6100-477b-a7fa-443b950d210f",
|
||
|
|
"name": "D1sqKsyU0AA0HeV.jpg:large.jpeg",
|
||
|
|
"content_ref": "artifact--5c8fab3f-6100-477b-a7fa-443b950d210f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "artifact",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "artifact--5c8fab3f-6100-477b-a7fa-443b950d210f",
|
||
|
|
"payload_bin": "/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAUDBAQEAwUEBAQFBQUGBwwIBwcHBw8LCwkMEQ8SEhEPERETFhwXExQaFRERGCEYGh0dHx8fExciJCIeJBweHx7/2wBDAQUFBQcGBw4ICA4eFBEUHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh7/wgARCALHA/EDASIAAhEBAxEB/8QAGwABAAIDAQEAAAAAAAAAAAAAAAQFAgMGAQf/xAAZAQEBAQEBAQAAAAAAAAAAAAAAAQIDBQT/2gAMAwEAAhADEAAAAfq7XB1zsmEXPSarcS0Q9BZufxs6JW1h0qllrPV28lK2Il6gR1t1bYRkq9lWCthSX7TzFvWq3dExU+VbqudG5QZ1eOdsIslTosvVFEOoQYK3jJGLIYshiyGLIYshiyGLIYshiyGLIYshiyGLIYshiyGLIYshiyGLIYshiyGLIYshiyGLIYshiyGLIYshiyGLIYshiyGLIYshh61G3zmujM9GrYSPI0gyc1bl4Cnrr1vlHhWrjun03zeuEt+kWc1XdsXkd3UE43LsC8rJ6EnIedRIOFkdkOI6C3LzO7oBwtz0JKbmPoBeWg9uOXi9kTien1WhT1vVCnXBeXidmOXjdiSorepKEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGMO5nIDUnoAnoA27og36fBGuIBPZ0SXncwSwwAa6O+rY827tVeytWZnCsKwi5zYsbtXlSW/mMOrrz3URYkv2NtFZ1dWkyNWly5+0LWLrxNu6vnVKkQ5kAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVfzv6N809Ly/UfP1/IzxbpctOjdqV1vTzenNu17uXTHbE2F19G+ZfTfF9qYPg9GGAA1VMXaq22WCDKXYwhFgrsC0VmJaub2l+5nKOkUEqrVFiFqqci0Y5ICgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAAEwLDaxsa1ewZqTTqlq1Z5I2Vk8tVqulczr6pFNpvxQ49ASiqO0W1eFukpMrkuxrWbGtLsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxsaxYAr8dVZFrjUV9X+/krE6DXAyibH5vOuh2VemOglcho07bTVosvIGBc6tUMuAgKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMBV1fULOatbAV6wS0M2xFesBXrAUsqwFf5YivWAr/ACxFesBXrAV6wFesBXrAV6wFesBXrAV6wFesBXrAV6wFesBXrAV6wFesBXrAV6wFesBXrAV6wFesBXrAV6wFesBXrAV6wFesBXrAV6wFesBXrAV6wFesBXrAV6wFesBXrAV6wFesBXrAV6wFesBXrAV6wFesBXrAV6wFesBXrAV6wFesBXrAAQt9ZKSSj4LLR68uGkblZ6WSDrLJAkpuaS7mmGWTSNzSNzSNzTELFpqC9aRuQZBuafDeoN9XClmROV3hZK0WSFCLppG5pG5pG5pG5pG5pG5pG5pG5pG5pG5pG5pG5pG5pG5pG5pG5pG5pG5pG5pG5pG5pG5pG5pG5pG5pG5pG5pG5pG5pG5pG5pG5pG5pG5pG5pG32PkblRYm32D4T/IW4ke1EgtAc/z3TTOvz4V1po+ft7y3Y471wU3qvNTk4ncbY5So75XFyer2Rx+/ofaoajpLSOIw7XbbyN9MmRy8Lqc04iR1e6qbl/okSKWn7XavIQ+59s5yZ7YSV0Tpo61trtzmvnU7ssdZ4TPvMZYvJ9xHSYJQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPMcxztvLELRaDnug8yOftJmRKBTTYU0AVdpQRaa4+yyburdyzIsqpJvtNojqHJR67XRyOS9m52Qlnr56OdnA5urXu5vJQrO6cFtjuHNxDr3H7K6xSXcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAK2x4g6XKHWR0mHPSbLjdTQprqovtbc2+mkmLY583pOksuX6glAppsKaACvLBF1E9p3AikpFlBoxJLz0AI0kIuJM1bRDmAR5AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABh7kAAAAGWORKBTTYU0A8pLwVOdmSt3TCqm2HPV3ZI42D9AW8k63SnE2PVjgM+8HE6u7HAS+0HLxeyHEbOzVy8PtEcbdXCggAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABljkSgUe7COS99NXx1LiNtdk52Sly4z1eyc9BOvctIs6FXJbFW6y2RNBZMN1mDNLgzGDMYMxgzGDMYMxgzGDMYMxgzGDMYMxgzGDMYMxgzGDMYMxgzGDMYMxgzGDMYMxgzGDMYMxgzGDMYMxgzGDMYMxgzGDMYMxgzGDMYMxgzGDMYMxgzGDMYMxgzGDMYMxgzGDMYZe5EoFNSXk255ToJZa6fkKyRLRHg2xYPk8nPyrX00YSREzklw0Shhl6s8epfHo8ejx6PHo8ejx6PHo8ejx6PHo8ejx6PHo8ejx6PHo8ejx6PHo8ejx6PHo8ejx6PHo8ejx6PHo8ejx6PHo8ejx6PHo8ejx6PHo8ejx6PHo8ejx6PHo8ejx6PHo8ejx6PHo8ejzLVkTQQZ0GcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAARXkcswQdW2tiTu5GadJW0EU7vVyceu7mUN8gKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABzMLphNBBnV9gAAK+wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFBr2azowQJ8HGLBWWYU9mbRQArYshQrYshRjBLBBkxtNdbGuDFkVhZteyjDMAIEo2qeYTCNEk1G1T76sVfiWSvxiyUdmSUKbRWyIlIEo2q2yAoAAAV0WIoha4sRQBWzo2KpVqhbEktdPLeK2yAoAAAArrEAAAECJ6LRp0xXLYo0mirtIChGJKusQ17ACg17NZ0YINLcz45nnfpA+SzPpyuPgd+Tkq7spkvzS57IfM930ZXz+d2SPlG76ir5tfdWT5LYfSvJfntb9VHJc79PHz/wB78fKJf0wfMus6FXzzz6H6fLrztUnEct9gL8+pvrQ+R/Va+zsofOjRUcr9BL8/w+hj590l6OYo/oazhef+tJeD39qs+Y7fpOqa+UXvRWtny3telJ871/SEvF1H0r0+W7/pavk/fWO1OeqO8S8nzv04fF+569Xy/vrJHA592OW2dLHsqOI+reS8xE7OrOO1fSfbPn1N9aS/KrPrpZ8/6HqFnzWv+tJeDmdgrjed+qeRwvR3A4Tnvrg4fPtR8zh/WFfJOq7D1Pl3WdKl+UZ/U/Sh4b6us4aL9DS/KNn1NXzb6SAFBr2azowQZ0GcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUGvZrOjBBnQaOOq0cRpO+3cXGO33cQrt1Zykdxq42oPqjkolnceQOKl7vZ81l19FcJYx1XnMRa7JwU6Tr4ldzK/QnMUtfQVB5HQaOQrTvpXzTt9S008XHzfoWrla0+gub9ro9HCZx3O7iPa7DdxVinSOfgy9c5+nOy3fOLo6dwM87U+YJ9PcZivauSk10isp46vVy1ave58doueyc5VTXd58R7c9jlwNhL2OiNxJ9A3fPbCuy85yHHVbvnU6uzg8tnHcCgAAAAAAAAAAAAAAAAAAAKDXs1nRgg4Zziiw6AUlb1oo8L9FWtBRR+lFRpvVRY9kjkt/TKo5VkisxtVQYlyIUG7RVaLxVXunCgX6Oet5Sq2B0Io14O
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c8faf7d-0148-415c-a1d6-4f16950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-03-18T14:47:25.000Z",
|
||
|
|
"modified": "2019-03-18T14:47:25.000Z",
|
||
|
|
"description": "C2",
|
||
|
|
"pattern": "[domain-name:value = 'pm2bitcoin.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-03-18T14:47:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c8faf7d-f368-49fa-92e7-4198950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-03-18T14:47:25.000Z",
|
||
|
|
"modified": "2019-03-18T14:47:25.000Z",
|
||
|
|
"description": "C2",
|
||
|
|
"pattern": "[domain-name:value = 'brothersjoy.nl']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-03-18T14:47:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--5c8fa219-3e68-48d7-9fd3-446f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-03-18T13:50:17.000Z",
|
||
|
|
"modified": "2019-03-18T13:50:17.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"microblog\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "post",
|
||
|
|
"value": "Attackers are using topics regarding #Boeing 737 MAX 8 crash and seems an email account from @IsgecPresses has been abused to deliver the mails. The attachment is a JAR file which drops H-WORM RAT. C2: pm2bitcoin[.]com brothersjoy[.]nl https://www.virustotal.com/#/file/0d53ae6b78d37bff74cd6458624a9157b1a7d60d5722f9c4ebc83e5a7a058463/detection",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5c8fa219-94cc-40c3-898e-44cb950d210f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "Twitter",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5c8fa219-d24c-453d-a924-4ef6950d210f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"object_relation": "url",
|
||
|
|
"value": "https://twitter.com/360TIC/status/1106524508612026369",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5c8fa219-abdc-48b6-884f-4947950d210f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "username-quoted",
|
||
|
|
"value": "@IsgecPresses",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5c8fa219-b210-4b04-afac-4687950d210f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"object_relation": "link",
|
||
|
|
"value": "https://t.co/qs6XhKMU3k",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5c8fa219-9454-4300-b649-42f0950d210f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"object_relation": "link",
|
||
|
|
"value": "https://www.virustotal.com/#/file/0d53ae6b78d37bff74cd6458624a9157b1a7d60d5722f9c4ebc83e5a7a058463/detection",
|
||
|
|
"category": "Network activity",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5c8fa219-be38-4ece-9e5b-4a2c950d210f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "creation-date",
|
||
|
|
"value": "2019-03-15T04:56:00",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5c8fa219-0d38-475c-b5b2-4eaf950d210f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "username",
|
||
|
|
"value": "360TIC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5c8fa219-9164-4a70-9a22-449e950d210f"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "microblog"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c8fb070-9b58-46d1-842d-4183950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-03-18T14:52:13.000Z",
|
||
|
|
"modified": "2019-03-18T14:52:13.000Z",
|
||
|
|
"pattern": "[email-message:body = 'Greetings \r\n\r\nI believe you have heard about the latest crash Boeing 737 MAX 8 which happen on sunday 10 march 2019, All passengers and crew were killed in the accident\r\n\r\nEthiopian Airlines Flight ET302 from Addis Ababa, Ethiopia, to Nairobi, Kenya, crashed shortly after takeoff \r\n\r\nThe dead were of 35 different nationalities, including eight Americans.\r\n\r\nOn 29 October 2018, the Boeing 737 MAX 8 operating the route crashed into the Java Sea 12 minutes after takeoff.\r\n\r\nAll 189 passengers and crew were killed in the accident.\r\n\r\nnote: there was a leak information from Darkweb which listed all the airline companies that will go down soon.\r\n\r\nkindly notify your love ones about the informations on these file.\r\n \r\nRegards\r\n\r\nJoshua Berlinger \r\nprivate inteligent analyst' AND email-message:from_ref.value = 'info@isgec.com' AND email-message:subject = 'Fwd: Airlines plane crash Boeing 737 Max 8' AND email-message:body_multipart[0].body_raw_ref.name = 'MP4_142019.jar' AND email-message:body_multipart[0].content_disposition = 'attachment']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-03-18T14:52:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "network"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"email\"",
|
||
|
|
"misp:meta-category=\"network\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|