19022 lines
816 KiB
JSON
19022 lines
816 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--58b532d4-db1c-4cdd-8615-4bb502de0b81",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T09:13:17.000Z",
|
||
|
|
"modified": "2017-02-28T09:13:17.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--58b532d4-db1c-4cdd-8615-4bb502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T09:13:17.000Z",
|
||
|
|
"modified": "2017-02-28T09:13:17.000Z",
|
||
|
|
"name": "OSINT - The Gamaredon Group Toolset Evolution",
|
||
|
|
"published": "2017-02-28T09:13:27Z",
|
||
|
|
"object_refs": [
|
||
|
|
"observed-data--58b5331f-5198-4521-849b-403902de0b81",
|
||
|
|
"url--58b5331f-5198-4521-849b-403902de0b81",
|
||
|
|
"x-misp-attribute--58b5336a-9814-425a-9f77-48f702de0b81",
|
||
|
|
"indicator--58b533c4-f980-4d7a-bd0c-4a4c02de0b81",
|
||
|
|
"indicator--58b533c5-e280-454d-a6a5-48c102de0b81",
|
||
|
|
"indicator--58b533c6-6c20-40e3-89f5-464902de0b81",
|
||
|
|
"indicator--58b533c6-8f04-4cd6-b803-447f02de0b81",
|
||
|
|
"indicator--58b533c7-7610-475b-be8f-4dcb02de0b81",
|
||
|
|
"indicator--58b53404-7110-4008-8dcf-4a9102de0b81",
|
||
|
|
"indicator--58b53405-3fb0-40ad-a122-4c5302de0b81",
|
||
|
|
"indicator--58b53406-bb74-4a66-901f-493302de0b81",
|
||
|
|
"indicator--58b53407-bb08-4bbe-87c3-418402de0b81",
|
||
|
|
"indicator--58b53407-02e8-40fb-a079-492202de0b81",
|
||
|
|
"indicator--58b53408-e404-4bb5-909d-46dc02de0b81",
|
||
|
|
"indicator--58b53409-e2f4-4858-b398-419502de0b81",
|
||
|
|
"indicator--58b5340a-4468-4f39-be5b-44ca02de0b81",
|
||
|
|
"indicator--58b5340b-33c4-4d67-b700-456402de0b81",
|
||
|
|
"indicator--58b5340c-9b2c-45dd-8744-48a702de0b81",
|
||
|
|
"indicator--58b5340d-5a1c-449b-8e1f-4a7502de0b81",
|
||
|
|
"indicator--58b5340d-a0a8-4fcb-9e04-431702de0b81",
|
||
|
|
"indicator--58b5340e-2e04-4fba-bafe-43cb02de0b81",
|
||
|
|
"indicator--58b5340f-30bc-404e-9c35-4c8c02de0b81",
|
||
|
|
"indicator--58b53410-9140-4726-b2df-4b8702de0b81",
|
||
|
|
"indicator--58b53411-5df4-487a-8974-4d0602de0b81",
|
||
|
|
"indicator--58b53412-9c08-4a8e-a83a-474002de0b81",
|
||
|
|
"indicator--58b53413-140c-4104-95d2-421d02de0b81",
|
||
|
|
"indicator--58b53414-6828-4757-b4de-453002de0b81",
|
||
|
|
"indicator--58b53414-9918-4600-828f-4f0002de0b81",
|
||
|
|
"indicator--58b53415-7c6c-487b-b2ef-417d02de0b81",
|
||
|
|
"indicator--58b53416-0ee0-4e12-a21c-4d1502de0b81",
|
||
|
|
"indicator--58b53417-ba0c-4776-9f4d-4da102de0b81",
|
||
|
|
"indicator--58b53418-1748-4973-b0b1-485002de0b81",
|
||
|
|
"indicator--58b53419-7e50-4b17-8621-408c02de0b81",
|
||
|
|
"indicator--58b5341a-35a4-41c6-89e1-40ff02de0b81",
|
||
|
|
"indicator--58b5341a-5704-41b2-af22-417702de0b81",
|
||
|
|
"indicator--58b5341b-feb0-4998-891b-462f02de0b81",
|
||
|
|
"indicator--58b5341c-aa2c-40c1-9dea-4fe302de0b81",
|
||
|
|
"indicator--58b5341d-4560-4e80-aa2e-454002de0b81",
|
||
|
|
"indicator--58b5341e-7814-4cc3-ba8f-4e1102de0b81",
|
||
|
|
"indicator--58b5341f-6d14-47b2-9a52-478502de0b81",
|
||
|
|
"indicator--58b53420-8268-4d70-8fb9-41b202de0b81",
|
||
|
|
"indicator--58b53421-41c4-482b-ac50-4df602de0b81",
|
||
|
|
"indicator--58b53422-4598-4afd-9a15-423302de0b81",
|
||
|
|
"indicator--58b53423-ece4-4f93-8482-4fe702de0b81",
|
||
|
|
"indicator--58b53424-3a24-4053-8e36-45ee02de0b81",
|
||
|
|
"indicator--58b53425-69bc-4297-8b34-447502de0b81",
|
||
|
|
"indicator--58b53426-f288-4a30-ab5f-490e02de0b81",
|
||
|
|
"indicator--58b53427-efd8-40e0-8c5e-44d102de0b81",
|
||
|
|
"indicator--58b53427-be4c-4ab5-8bee-4be702de0b81",
|
||
|
|
"indicator--58b53428-17d0-4c47-81f4-4bf302de0b81",
|
||
|
|
"indicator--58b53429-c324-4273-a03e-47cd02de0b81",
|
||
|
|
"indicator--58b5342a-4798-4d06-b127-4a5102de0b81",
|
||
|
|
"indicator--58b5342b-f644-4c29-ad00-4b1e02de0b81",
|
||
|
|
"indicator--58b5342c-8708-4df6-a189-41b202de0b81",
|
||
|
|
"indicator--58b5342d-ea0c-47ee-8c7a-4ccf02de0b81",
|
||
|
|
"indicator--58b5342e-54c0-4e4c-a54e-4f9f02de0b81",
|
||
|
|
"indicator--58b5342f-a9b4-4458-b169-4e7702de0b81",
|
||
|
|
"indicator--58b5342f-d064-4d44-b7f4-4e5e02de0b81",
|
||
|
|
"indicator--58b53430-0088-4003-abcf-42d202de0b81",
|
||
|
|
"indicator--58b53431-130c-4802-94e4-43fa02de0b81",
|
||
|
|
"indicator--58b53432-19b4-4be4-a7a5-4d6f02de0b81",
|
||
|
|
"indicator--58b53433-4ecc-45e1-b52f-4be402de0b81",
|
||
|
|
"indicator--58b53434-5604-4a4a-8fac-48c602de0b81",
|
||
|
|
"indicator--58b53434-7148-4c29-8206-4d1b02de0b81",
|
||
|
|
"indicator--58b53457-a020-49bc-a759-4c0d02de0b81",
|
||
|
|
"indicator--58b53458-2584-4725-9db0-472902de0b81",
|
||
|
|
"indicator--58b53458-05bc-42d9-ab62-4fdf02de0b81",
|
||
|
|
"indicator--58b53459-5a34-4cfb-9ece-453302de0b81",
|
||
|
|
"indicator--58b5345a-b3a0-4acb-8957-4a0b02de0b81",
|
||
|
|
"indicator--58b5345b-c1e0-4c85-a750-43c302de0b81",
|
||
|
|
"indicator--58b5345c-5730-42b1-a7dd-4eb602de0b81",
|
||
|
|
"indicator--58b5345d-2e58-4aaf-bfff-472b02de0b81",
|
||
|
|
"indicator--58b5345d-1a60-4869-a026-4cb302de0b81",
|
||
|
|
"indicator--58b5345e-e6e0-4b7e-bc90-472602de0b81",
|
||
|
|
"indicator--58b5345f-5be4-4979-8336-494402de0b81",
|
||
|
|
"indicator--58b53460-6d34-46a9-975b-4a0802de0b81",
|
||
|
|
"indicator--58b53461-b0a0-4d26-9dce-42d902de0b81",
|
||
|
|
"indicator--58b53462-915c-4143-8c3f-497d02de0b81",
|
||
|
|
"indicator--58b53462-3b74-48ba-8d4f-471302de0b81",
|
||
|
|
"indicator--58b53463-9874-4a32-bf21-4dd602de0b81",
|
||
|
|
"indicator--58b53464-4500-4515-b778-4ef602de0b81",
|
||
|
|
"indicator--58b53465-2968-4e58-a435-446402de0b81",
|
||
|
|
"indicator--58b53466-1f04-4eef-a18b-4aa802de0b81",
|
||
|
|
"indicator--58b53467-91b4-42b4-ad51-435702de0b81",
|
||
|
|
"indicator--58b53468-ca64-43e4-9b31-43e702de0b81",
|
||
|
|
"indicator--58b53469-82f8-496a-821f-42b802de0b81",
|
||
|
|
"indicator--58b5346a-7a80-4ba3-8a68-478702de0b81",
|
||
|
|
"indicator--58b5346b-7134-4013-b1aa-476802de0b81",
|
||
|
|
"indicator--58b5346b-a804-4cec-bf79-4f2802de0b81",
|
||
|
|
"indicator--58b5346c-7c4c-4f76-8d07-416402de0b81",
|
||
|
|
"indicator--58b5346d-4f54-433f-acd8-4fc802de0b81",
|
||
|
|
"indicator--58b5346e-e418-4d10-b97f-4a8402de0b81",
|
||
|
|
"indicator--58b5346e-f134-4185-bb83-435d02de0b81",
|
||
|
|
"indicator--58b5346f-d960-4951-b85a-4ceb02de0b81",
|
||
|
|
"indicator--58b53470-fc40-4655-afd5-4b9702de0b81",
|
||
|
|
"indicator--58b53471-82f0-4ecd-8ca1-47a002de0b81",
|
||
|
|
"indicator--58b53472-0988-49be-a7c0-486302de0b81",
|
||
|
|
"indicator--58b53472-6b10-41b3-867b-44bc02de0b81",
|
||
|
|
"indicator--58b5352c-469c-4075-bdaa-43d802de0b81",
|
||
|
|
"indicator--58b5352d-a294-4a83-949a-458402de0b81",
|
||
|
|
"indicator--58b5352e-c81c-4b1b-ad1e-43bb02de0b81",
|
||
|
|
"indicator--58b5352f-8188-4c27-a591-48ba02de0b81",
|
||
|
|
"indicator--58b53530-1d20-4382-afd8-4f8d02de0b81",
|
||
|
|
"indicator--58b53531-5150-4a90-adaa-4dcd02de0b81",
|
||
|
|
"indicator--58b53532-ddac-4a12-a097-434e02de0b81",
|
||
|
|
"indicator--58b53533-80a8-481e-8a8f-417902de0b81",
|
||
|
|
"indicator--58b53534-56fc-4d6a-863c-458202de0b81",
|
||
|
|
"indicator--58b53535-fe28-4684-9f2f-46a602de0b81",
|
||
|
|
"indicator--58b53536-f47c-407c-9e37-4d3202de0b81",
|
||
|
|
"indicator--58b53537-b224-4c51-a7e0-46c402de0b81",
|
||
|
|
"indicator--58b53537-7e6c-4432-8c92-4fd102de0b81",
|
||
|
|
"indicator--58b53538-c428-4193-86ca-453e02de0b81",
|
||
|
|
"indicator--58b53539-e2a0-4a66-8b6e-40db02de0b81",
|
||
|
|
"indicator--58b5353a-84cc-4289-a4ed-4eaa02de0b81",
|
||
|
|
"indicator--58b5353b-6494-455c-823a-47b802de0b81",
|
||
|
|
"indicator--58b5353c-2d64-4e9a-8c0b-47d402de0b81",
|
||
|
|
"indicator--58b5353d-06b4-45a5-9881-487902de0b81",
|
||
|
|
"indicator--58b5353e-eeb0-4f3e-b810-4f3902de0b81",
|
||
|
|
"indicator--58b5353f-f880-4108-b24d-4d4602de0b81",
|
||
|
|
"indicator--58b53540-e238-41f4-aa03-41db02de0b81",
|
||
|
|
"indicator--58b53541-19f0-4c4d-bc30-4f4702de0b81",
|
||
|
|
"indicator--58b53542-5208-4685-936c-40fd02de0b81",
|
||
|
|
"indicator--58b53543-bd88-4030-8531-496c02de0b81",
|
||
|
|
"indicator--58b53544-2a30-4186-bfed-4a6c02de0b81",
|
||
|
|
"indicator--58b53545-c62c-4df1-bc2a-485002de0b81",
|
||
|
|
"indicator--58b53546-0f5c-4eb5-abd5-4e1002de0b81",
|
||
|
|
"indicator--58b53547-bc40-4ccf-aec8-424802de0b81",
|
||
|
|
"indicator--58b53548-08d0-4e8d-a16c-450902de0b81",
|
||
|
|
"indicator--58b53549-f1e0-4564-87d2-4f7502de0b81",
|
||
|
|
"indicator--58b5354a-3e58-40f4-a322-45aa02de0b81",
|
||
|
|
"indicator--58b5354b-4dd4-4881-922c-41a502de0b81",
|
||
|
|
"indicator--58b5354c-fa38-46be-b0b0-457002de0b81",
|
||
|
|
"indicator--58b5354d-daf0-407d-83c7-457a02de0b81",
|
||
|
|
"indicator--58b5354e-1904-40f6-abb3-479a02de0b81",
|
||
|
|
"indicator--58b5354f-887c-4604-9f3f-4bc302de0b81",
|
||
|
|
"indicator--58b53550-2e68-4799-882a-46cd02de0b81",
|
||
|
|
"indicator--58b53551-88c4-4470-b2c8-4cd802de0b81",
|
||
|
|
"indicator--58b53552-ed64-4007-9ad6-469a02de0b81",
|
||
|
|
"indicator--58b53553-dcdc-43d2-bcdf-4efd02de0b81",
|
||
|
|
"indicator--58b53554-72e8-4a32-a7b6-4c0402de0b81",
|
||
|
|
"indicator--58b53555-b884-443f-8622-4a7a02de0b81",
|
||
|
|
"indicator--58b53556-d5c0-4e96-96be-428502de0b81",
|
||
|
|
"indicator--58b53557-e71c-4a59-8c9b-48a002de0b81",
|
||
|
|
"indicator--58b53558-d708-41e9-800e-45c102de0b81",
|
||
|
|
"indicator--58b53559-b644-4174-a457-416302de0b81",
|
||
|
|
"indicator--58b5355a-bb90-4258-aa7c-41b702de0b81",
|
||
|
|
"indicator--58b5355b-c67c-4db7-8189-45cb02de0b81",
|
||
|
|
"indicator--58b5355c-d0a8-43d8-9e32-4d8002de0b81",
|
||
|
|
"indicator--58b5355d-be18-448c-b5e3-47f202de0b81",
|
||
|
|
"indicator--58b5355e-7c0c-4ae1-a0da-43b202de0b81",
|
||
|
|
"indicator--58b5355f-afe0-4e7e-9074-43b602de0b81",
|
||
|
|
"indicator--58b53560-a01c-47d4-aac4-44fa02de0b81",
|
||
|
|
"indicator--58b53561-f030-4e3a-a34c-45eb02de0b81",
|
||
|
|
"indicator--58b53562-91a8-49a2-b33c-46fb02de0b81",
|
||
|
|
"indicator--58b53563-ebc0-43da-af90-4ba202de0b81",
|
||
|
|
"indicator--58b53564-d484-426a-b9bb-4ae302de0b81",
|
||
|
|
"indicator--58b53565-c540-471d-877d-4d4102de0b81",
|
||
|
|
"indicator--58b53566-6240-4962-911d-493302de0b81",
|
||
|
|
"indicator--58b53567-e124-4404-963c-401b02de0b81",
|
||
|
|
"indicator--58b53568-4494-4b93-a392-413c02de0b81",
|
||
|
|
"indicator--58b53569-c1f8-4ddf-8b4b-435502de0b81",
|
||
|
|
"indicator--58b5356a-4d90-42d3-bda7-4c6f02de0b81",
|
||
|
|
"indicator--58b5356a-d76c-406e-a227-443c02de0b81",
|
||
|
|
"indicator--58b5356b-77cc-495c-833c-44db02de0b81",
|
||
|
|
"indicator--58b5356c-83b0-4fd6-b3c7-48f802de0b81",
|
||
|
|
"indicator--58b5356d-4440-46d9-91bc-40a002de0b81",
|
||
|
|
"indicator--58b5356e-9dc8-45ad-8278-4dd902de0b81",
|
||
|
|
"indicator--58b5356f-074c-4455-91cf-434302de0b81",
|
||
|
|
"indicator--58b53570-27f0-49cd-b2d9-416202de0b81",
|
||
|
|
"indicator--58b53571-fae0-4730-8c18-40a502de0b81",
|
||
|
|
"indicator--58b53572-3ecc-4526-b5c9-42b402de0b81",
|
||
|
|
"indicator--58b53573-41d4-4503-b25f-481902de0b81",
|
||
|
|
"indicator--58b53574-8bc4-4eb1-a112-48c002de0b81",
|
||
|
|
"indicator--58b53575-f60c-4c5c-b037-425e02de0b81",
|
||
|
|
"indicator--58b53576-acd4-47a3-89c4-42ba02de0b81",
|
||
|
|
"indicator--58b53577-3910-4b1a-bc48-464702de0b81",
|
||
|
|
"indicator--58b53577-c6b8-4de6-b3a2-4e7602de0b81",
|
||
|
|
"indicator--58b53578-18b0-4178-b145-459102de0b81",
|
||
|
|
"indicator--58b53579-4438-46b3-9879-4e1f02de0b81",
|
||
|
|
"indicator--58b5357a-08c4-4ef3-821a-4b8702de0b81",
|
||
|
|
"indicator--58b5357b-ed6c-4e82-b92f-410602de0b81",
|
||
|
|
"indicator--58b5357c-8fa4-41dc-a847-4b5702de0b81",
|
||
|
|
"indicator--58b5357d-3408-489c-8d32-4d8d02de0b81",
|
||
|
|
"indicator--58b5357e-8ab8-4f6d-9283-412b02de0b81",
|
||
|
|
"indicator--58b5357f-c540-4c25-8391-401d02de0b81",
|
||
|
|
"indicator--58b53580-3680-4e5a-8ec7-424b02de0b81",
|
||
|
|
"indicator--58b53581-7910-4abe-9266-482602de0b81",
|
||
|
|
"indicator--58b53582-7f64-4583-a21c-424202de0b81",
|
||
|
|
"indicator--58b53583-ed9c-4ae6-a124-4be902de0b81",
|
||
|
|
"indicator--58b53584-deec-4e77-8d42-4e6902de0b81",
|
||
|
|
"indicator--58b53585-3eb8-4d61-954a-4b5802de0b81",
|
||
|
|
"indicator--58b53586-f81c-4f99-acb2-45db02de0b81",
|
||
|
|
"indicator--58b53587-8bc0-4c89-ba4d-495102de0b81",
|
||
|
|
"indicator--58b53588-9a38-4f22-a36e-484c02de0b81",
|
||
|
|
"indicator--58b53589-f560-4a11-8056-436202de0b81",
|
||
|
|
"indicator--58b5358a-e94c-4a72-acb4-48fb02de0b81",
|
||
|
|
"indicator--58b5358b-6c44-44ea-b1e9-412902de0b81",
|
||
|
|
"indicator--58b5358c-94c8-43de-8c1e-472f02de0b81",
|
||
|
|
"indicator--58b5358d-e408-4a81-8835-4c6702de0b81",
|
||
|
|
"indicator--58b5358e-f168-4fc8-8ce4-46e502de0b81",
|
||
|
|
"indicator--58b5358f-9b60-4415-aaa6-4df202de0b81",
|
||
|
|
"indicator--58b53590-f804-45d8-9623-4e6e02de0b81",
|
||
|
|
"indicator--58b53591-b73c-449c-b414-4ca002de0b81",
|
||
|
|
"indicator--58b53592-2ba0-43f1-96c1-4c2602de0b81",
|
||
|
|
"indicator--58b53593-3810-48b7-a267-4c6202de0b81",
|
||
|
|
"indicator--58b53593-1854-4df2-a072-4fea02de0b81",
|
||
|
|
"indicator--58b53594-49a0-43a8-a901-4f8402de0b81",
|
||
|
|
"indicator--58b53595-3288-43ad-b0c4-44c102de0b81",
|
||
|
|
"indicator--58b53596-74bc-49dd-b978-412702de0b81",
|
||
|
|
"indicator--58b53597-1b24-4933-a346-428802de0b81",
|
||
|
|
"indicator--58b53597-40fc-466b-873c-4edf02de0b81",
|
||
|
|
"indicator--58b53598-8050-43a3-918e-4b4f02de0b81",
|
||
|
|
"indicator--58b53599-eb98-454b-83ee-40c302de0b81",
|
||
|
|
"indicator--58b5359a-3f2c-408a-9774-46ca02de0b81",
|
||
|
|
"indicator--58b5359b-d648-43ae-9929-4e9502de0b81",
|
||
|
|
"indicator--58b5359b-0720-47b1-93e7-4a9e02de0b81",
|
||
|
|
"indicator--58b5359c-6e70-44c0-abb0-48cc02de0b81",
|
||
|
|
"indicator--58b5359d-ee58-46fc-bd4f-465002de0b81",
|
||
|
|
"indicator--58b5359e-8160-4a23-b990-4e6402de0b81",
|
||
|
|
"indicator--58b5359f-2678-4392-83e2-4bf202de0b81",
|
||
|
|
"indicator--58b5359f-6de0-4c7f-9f94-405602de0b81",
|
||
|
|
"indicator--58b535a0-e7f8-4495-8b04-4fab02de0b81",
|
||
|
|
"indicator--58b535a1-5834-476c-83e3-4bb402de0b81",
|
||
|
|
"indicator--58b535a2-c2e0-4060-b2e2-430a02de0b81",
|
||
|
|
"indicator--58b535a3-58e8-46f4-9b8e-46ba02de0b81",
|
||
|
|
"indicator--58b535a4-4b30-4888-bce8-447a02de0b81",
|
||
|
|
"indicator--58b535a4-1ca4-4e00-9507-44b902de0b81",
|
||
|
|
"indicator--58b535a5-3820-4183-8daa-4bfe02de0b81",
|
||
|
|
"indicator--58b535a7-57a0-4cd4-99c7-415802de0b81",
|
||
|
|
"indicator--58b535a8-b4f0-40c8-ba8c-48c802de0b81",
|
||
|
|
"indicator--58b535a9-f55c-459e-9642-44c902de0b81",
|
||
|
|
"indicator--58b535aa-3bd4-4c39-bee5-4b4702de0b81",
|
||
|
|
"indicator--58b535ab-6090-4a82-ac21-42c702de0b81",
|
||
|
|
"indicator--58b535ac-c000-4337-83af-42f902de0b81",
|
||
|
|
"indicator--58b535ac-0550-4b7a-9f10-4a7802de0b81",
|
||
|
|
"indicator--58b535ad-e54c-42ef-9b9e-4b9502de0b81",
|
||
|
|
"indicator--58b535ae-f744-42b5-a476-4a2202de0b81",
|
||
|
|
"indicator--58b535af-eda8-442b-a2ad-427002de0b81",
|
||
|
|
"indicator--58b535b0-0754-42d1-b8cf-45eb02de0b81",
|
||
|
|
"indicator--58b535b0-1cc0-449a-adc6-439e02de0b81",
|
||
|
|
"indicator--58b535b1-6190-40ee-830a-4d1e02de0b81",
|
||
|
|
"indicator--58b535b2-39e0-4f39-a37c-4dd902de0b81",
|
||
|
|
"indicator--58b535b3-f804-498d-993a-49e902de0b81",
|
||
|
|
"indicator--58b535b3-13f0-47fe-93df-457302de0b81",
|
||
|
|
"indicator--58b535b4-7978-49be-be6f-469a02de0b81",
|
||
|
|
"indicator--58b535b5-1ebc-4f22-a1af-46cb02de0b81",
|
||
|
|
"indicator--58b535b6-242c-426c-8e2a-4ed402de0b81",
|
||
|
|
"indicator--58b535b6-5f44-4bd9-aa09-440f02de0b81",
|
||
|
|
"indicator--58b535b7-62c8-4514-97e1-484702de0b81",
|
||
|
|
"indicator--58b535b8-ca4c-4ddf-b9be-478702de0b81",
|
||
|
|
"indicator--58b535b9-4324-44f8-aea3-450c02de0b81",
|
||
|
|
"indicator--58b535b9-7ea0-4f64-9872-485902de0b81",
|
||
|
|
"indicator--58b535ba-c50c-49f7-84b2-4b3002de0b81",
|
||
|
|
"indicator--58b535bb-730c-4ffa-b606-483302de0b81",
|
||
|
|
"indicator--58b535bc-9b10-48dd-bfb8-4d6002de0b81",
|
||
|
|
"indicator--58b535bc-ed20-41ee-a25f-409502de0b81",
|
||
|
|
"indicator--58b535bd-33e0-4f76-bcdd-451f02de0b81",
|
||
|
|
"indicator--58b535be-edf4-4590-a470-427002de0b81",
|
||
|
|
"indicator--58b535bf-1908-4245-acf0-4d5e02de0b81",
|
||
|
|
"indicator--58b535c0-3f84-4c6f-8f77-45f602de0b81",
|
||
|
|
"indicator--58b535c1-4920-4b80-82eb-4c5b02de0b81",
|
||
|
|
"indicator--58b5375c-24a0-460e-a2db-454602de0b81",
|
||
|
|
"indicator--58b5375d-8138-4acd-b41c-40f202de0b81",
|
||
|
|
"observed-data--58b5375e-978c-466a-9dd4-4f1d02de0b81",
|
||
|
|
"url--58b5375e-978c-466a-9dd4-4f1d02de0b81",
|
||
|
|
"indicator--58b5375f-eee4-43df-961e-492002de0b81",
|
||
|
|
"indicator--58b5375f-0954-4a04-9875-47b302de0b81",
|
||
|
|
"observed-data--58b53760-4eac-4afd-bcc4-443002de0b81",
|
||
|
|
"url--58b53760-4eac-4afd-bcc4-443002de0b81",
|
||
|
|
"indicator--58b53761-aa60-4a92-944d-40a802de0b81",
|
||
|
|
"indicator--58b53762-2ec4-4904-b239-4d2802de0b81",
|
||
|
|
"observed-data--58b53763-868c-4f8d-90a9-40f802de0b81",
|
||
|
|
"url--58b53763-868c-4f8d-90a9-40f802de0b81",
|
||
|
|
"indicator--58b53764-e018-4a38-8b82-457a02de0b81",
|
||
|
|
"indicator--58b53765-d1dc-4e1c-8d04-46ec02de0b81",
|
||
|
|
"observed-data--58b53766-9740-490d-ad83-47c202de0b81",
|
||
|
|
"url--58b53766-9740-490d-ad83-47c202de0b81",
|
||
|
|
"indicator--58b53766-6858-442d-bc5a-47cb02de0b81",
|
||
|
|
"indicator--58b53767-22a8-48db-846c-423b02de0b81",
|
||
|
|
"observed-data--58b53768-3df0-47d9-86f6-4fc902de0b81",
|
||
|
|
"url--58b53768-3df0-47d9-86f6-4fc902de0b81",
|
||
|
|
"indicator--58b53769-d724-4720-989b-430402de0b81",
|
||
|
|
"indicator--58b5376a-8348-4f6f-a0e8-4f6e02de0b81",
|
||
|
|
"observed-data--58b5376a-6ef4-484b-8735-40a702de0b81",
|
||
|
|
"url--58b5376a-6ef4-484b-8735-40a702de0b81",
|
||
|
|
"indicator--58b5376b-660c-4423-9b79-49dc02de0b81",
|
||
|
|
"indicator--58b5376c-ccc8-45c9-86aa-4ec602de0b81",
|
||
|
|
"observed-data--58b5376d-7580-49a0-be6f-453602de0b81",
|
||
|
|
"url--58b5376d-7580-49a0-be6f-453602de0b81",
|
||
|
|
"indicator--58b5376e-7a98-4734-92c3-488902de0b81",
|
||
|
|
"indicator--58b5376e-73f8-4727-8c0a-467e02de0b81",
|
||
|
|
"observed-data--58b5376f-f6b8-4bfb-99c8-478402de0b81",
|
||
|
|
"url--58b5376f-f6b8-4bfb-99c8-478402de0b81",
|
||
|
|
"indicator--58b53770-0d3c-47a4-9d10-414802de0b81",
|
||
|
|
"indicator--58b53771-fddc-408f-b253-422b02de0b81",
|
||
|
|
"observed-data--58b53772-fc10-438c-a96f-452602de0b81",
|
||
|
|
"url--58b53772-fc10-438c-a96f-452602de0b81",
|
||
|
|
"indicator--58b53772-f9c0-4c3e-90d9-4a8702de0b81",
|
||
|
|
"indicator--58b53773-fb60-496d-a96f-446f02de0b81",
|
||
|
|
"observed-data--58b53774-8320-4f93-a4ce-48e602de0b81",
|
||
|
|
"url--58b53774-8320-4f93-a4ce-48e602de0b81",
|
||
|
|
"indicator--58b53775-91cc-4a44-b663-4f6002de0b81",
|
||
|
|
"indicator--58b53775-6f24-40f8-8f99-454102de0b81",
|
||
|
|
"observed-data--58b53776-8314-4d86-a8a6-435402de0b81",
|
||
|
|
"url--58b53776-8314-4d86-a8a6-435402de0b81",
|
||
|
|
"indicator--58b53777-37c4-46db-a7ff-455a02de0b81",
|
||
|
|
"indicator--58b53778-1b28-481b-b85b-433a02de0b81",
|
||
|
|
"observed-data--58b53779-8e60-4097-b394-464802de0b81",
|
||
|
|
"url--58b53779-8e60-4097-b394-464802de0b81",
|
||
|
|
"indicator--58b53779-9b9c-49bf-b59c-404c02de0b81",
|
||
|
|
"indicator--58b5377a-c30c-4e4d-9b7e-4e3b02de0b81",
|
||
|
|
"observed-data--58b5377b-d1ec-43e3-8297-4c5a02de0b81",
|
||
|
|
"url--58b5377b-d1ec-43e3-8297-4c5a02de0b81",
|
||
|
|
"indicator--58b5377c-74a8-4211-9e5c-4af702de0b81",
|
||
|
|
"indicator--58b5377c-a6d0-4bd9-bc05-479702de0b81",
|
||
|
|
"observed-data--58b5377d-8560-495f-87fe-426d02de0b81",
|
||
|
|
"url--58b5377d-8560-495f-87fe-426d02de0b81",
|
||
|
|
"indicator--58b5377e-4e58-423a-8f50-482c02de0b81",
|
||
|
|
"indicator--58b5377f-ff30-4eed-9e6d-45d102de0b81",
|
||
|
|
"observed-data--58b53780-c4c4-40fa-a4c7-403602de0b81",
|
||
|
|
"url--58b53780-c4c4-40fa-a4c7-403602de0b81",
|
||
|
|
"indicator--58b53782-9bec-4348-bfc1-4fdd02de0b81",
|
||
|
|
"indicator--58b53783-6cc8-4e21-a824-4e6c02de0b81",
|
||
|
|
"observed-data--58b53785-2018-42fe-9130-437a02de0b81",
|
||
|
|
"url--58b53785-2018-42fe-9130-437a02de0b81",
|
||
|
|
"indicator--58b53786-4cf0-4330-9f32-454402de0b81",
|
||
|
|
"indicator--58b53787-5058-4e88-9a7c-4fa102de0b81",
|
||
|
|
"observed-data--58b53788-de9c-4400-b110-406902de0b81",
|
||
|
|
"url--58b53788-de9c-4400-b110-406902de0b81",
|
||
|
|
"indicator--58b53789-b040-43c5-90ae-412202de0b81",
|
||
|
|
"indicator--58b5378b-ab60-4df6-bde4-48e902de0b81",
|
||
|
|
"observed-data--58b5378c-9280-47c8-9649-451e02de0b81",
|
||
|
|
"url--58b5378c-9280-47c8-9649-451e02de0b81",
|
||
|
|
"indicator--58b5378e-57f0-44b6-847d-419602de0b81",
|
||
|
|
"indicator--58b5378f-4d34-4d6b-85da-4d3002de0b81",
|
||
|
|
"observed-data--58b53791-7834-47d2-9db7-493b02de0b81",
|
||
|
|
"url--58b53791-7834-47d2-9db7-493b02de0b81",
|
||
|
|
"indicator--58b53792-7d28-40df-9819-4cb702de0b81",
|
||
|
|
"indicator--58b53794-493c-48e0-a7f7-47d502de0b81",
|
||
|
|
"observed-data--58b53796-1de0-49b2-a601-48cb02de0b81",
|
||
|
|
"url--58b53796-1de0-49b2-a601-48cb02de0b81",
|
||
|
|
"indicator--58b53797-cdb0-42aa-a5a1-4d5702de0b81",
|
||
|
|
"indicator--58b53799-1a80-4ecb-858e-459802de0b81",
|
||
|
|
"observed-data--58b5379a-ff00-457b-9793-415302de0b81",
|
||
|
|
"url--58b5379a-ff00-457b-9793-415302de0b81",
|
||
|
|
"indicator--58b5379c-3374-4ffe-b89d-4c8002de0b81",
|
||
|
|
"indicator--58b5379d-ec44-4dc7-b36b-4cb902de0b81",
|
||
|
|
"observed-data--58b5379f-7cd4-46d8-a6ee-455702de0b81",
|
||
|
|
"url--58b5379f-7cd4-46d8-a6ee-455702de0b81",
|
||
|
|
"indicator--58b537a0-c0b0-420c-acfd-46b002de0b81",
|
||
|
|
"indicator--58b537a2-3940-4ef7-8d89-4e0c02de0b81",
|
||
|
|
"observed-data--58b537a3-8944-4c6e-88b3-49c802de0b81",
|
||
|
|
"url--58b537a3-8944-4c6e-88b3-49c802de0b81",
|
||
|
|
"indicator--58b537a5-c714-4f1b-b644-487002de0b81",
|
||
|
|
"indicator--58b537a6-10c8-4909-a5c5-4e1d02de0b81",
|
||
|
|
"observed-data--58b537a8-2234-4d40-9052-490802de0b81",
|
||
|
|
"url--58b537a8-2234-4d40-9052-490802de0b81",
|
||
|
|
"indicator--58b537aa-9228-4e0c-a94d-4d8d02de0b81",
|
||
|
|
"indicator--58b537ab-f174-484a-9732-49b802de0b81",
|
||
|
|
"observed-data--58b537ad-631c-43d2-a1e6-468802de0b81",
|
||
|
|
"url--58b537ad-631c-43d2-a1e6-468802de0b81",
|
||
|
|
"indicator--58b537ae-fa3c-42b1-a36a-494102de0b81",
|
||
|
|
"indicator--58b537b0-6818-43fc-97bd-4bfb02de0b81",
|
||
|
|
"observed-data--58b537b2-ce88-4e74-a936-4d1402de0b81",
|
||
|
|
"url--58b537b2-ce88-4e74-a936-4d1402de0b81",
|
||
|
|
"indicator--58b537b3-8d28-4960-80ae-4f3602de0b81",
|
||
|
|
"indicator--58b537b5-25d8-405c-b941-4edb02de0b81",
|
||
|
|
"observed-data--58b537b6-a944-47cb-8556-4c4202de0b81",
|
||
|
|
"url--58b537b6-a944-47cb-8556-4c4202de0b81",
|
||
|
|
"indicator--58b537b8-1370-4cc7-898b-4dc002de0b81",
|
||
|
|
"indicator--58b537b9-06bc-43d6-9150-403702de0b81",
|
||
|
|
"observed-data--58b537bb-a2b0-42b9-9bb2-46f302de0b81",
|
||
|
|
"url--58b537bb-a2b0-42b9-9bb2-46f302de0b81",
|
||
|
|
"indicator--58b537bc-5540-475b-b5f2-477202de0b81",
|
||
|
|
"indicator--58b537be-f5f8-46fb-814d-48ae02de0b81",
|
||
|
|
"observed-data--58b537bf-34bc-4f91-a126-452d02de0b81",
|
||
|
|
"url--58b537bf-34bc-4f91-a126-452d02de0b81",
|
||
|
|
"indicator--58b537c1-e300-47fe-8b08-48f802de0b81",
|
||
|
|
"indicator--58b537c2-29fc-4ca8-aae0-414f02de0b81",
|
||
|
|
"observed-data--58b537c4-96a4-485d-8371-4de202de0b81",
|
||
|
|
"url--58b537c4-96a4-485d-8371-4de202de0b81",
|
||
|
|
"indicator--58b537c5-96fc-44ae-8eeb-4d3a02de0b81",
|
||
|
|
"indicator--58b537c7-a22c-4fa5-99dc-42ad02de0b81",
|
||
|
|
"observed-data--58b537c8-8d00-47e7-bca1-4eda02de0b81",
|
||
|
|
"url--58b537c8-8d00-47e7-bca1-4eda02de0b81",
|
||
|
|
"indicator--58b537ca-8650-49cd-8e57-4fcb02de0b81",
|
||
|
|
"indicator--58b537cc-46e4-4c46-b46b-457002de0b81",
|
||
|
|
"observed-data--58b537cd-581c-4828-a01d-4f4e02de0b81",
|
||
|
|
"url--58b537cd-581c-4828-a01d-4f4e02de0b81",
|
||
|
|
"indicator--58b537cf-3ff4-4cc9-b785-409302de0b81",
|
||
|
|
"indicator--58b537d0-33d8-449b-8544-460402de0b81",
|
||
|
|
"observed-data--58b537d2-4bdc-48e5-a0a1-47c802de0b81",
|
||
|
|
"url--58b537d2-4bdc-48e5-a0a1-47c802de0b81",
|
||
|
|
"indicator--58b537d3-cbd8-4f81-828d-4f7f02de0b81",
|
||
|
|
"indicator--58b537d5-f25c-4e76-8cd2-412702de0b81",
|
||
|
|
"observed-data--58b537d6-2bd4-4a44-a98f-49c102de0b81",
|
||
|
|
"url--58b537d6-2bd4-4a44-a98f-49c102de0b81",
|
||
|
|
"indicator--58b537d8-cc80-4b76-8d15-408702de0b81",
|
||
|
|
"indicator--58b537d9-9dc8-41e7-bf44-420b02de0b81",
|
||
|
|
"observed-data--58b537db-0f0c-4eed-9821-4b8702de0b81",
|
||
|
|
"url--58b537db-0f0c-4eed-9821-4b8702de0b81",
|
||
|
|
"indicator--58b537dd-2c4c-4f48-9b26-4e5b02de0b81",
|
||
|
|
"indicator--58b537de-7f50-4c91-97cd-40fb02de0b81",
|
||
|
|
"observed-data--58b537e0-5a20-4d73-b9c0-4f1502de0b81",
|
||
|
|
"url--58b537e0-5a20-4d73-b9c0-4f1502de0b81",
|
||
|
|
"indicator--58b537e1-d644-48d6-884d-438502de0b81",
|
||
|
|
"indicator--58b537e3-92d8-4d82-8a74-4cf602de0b81",
|
||
|
|
"observed-data--58b537e4-4e58-4f2d-bb44-4af902de0b81",
|
||
|
|
"url--58b537e4-4e58-4f2d-bb44-4af902de0b81",
|
||
|
|
"indicator--58b537e6-0b04-4c48-b6c1-4d8502de0b81",
|
||
|
|
"indicator--58b537e7-65b4-44b0-9fb8-4a0402de0b81",
|
||
|
|
"observed-data--58b537e9-ee58-409c-867e-467a02de0b81",
|
||
|
|
"url--58b537e9-ee58-409c-867e-467a02de0b81",
|
||
|
|
"indicator--58b537ea-5c18-4bee-a50f-42fb02de0b81",
|
||
|
|
"indicator--58b537ec-fb64-4449-9faf-4fcf02de0b81",
|
||
|
|
"observed-data--58b537ed-87bc-4c77-bb45-4e1e02de0b81",
|
||
|
|
"url--58b537ed-87bc-4c77-bb45-4e1e02de0b81",
|
||
|
|
"indicator--58b537ef-c448-4d0d-9e72-417c02de0b81",
|
||
|
|
"indicator--58b537f1-66b8-4576-b42c-409402de0b81",
|
||
|
|
"observed-data--58b537f2-0d58-4ccc-8607-4c8302de0b81",
|
||
|
|
"url--58b537f2-0d58-4ccc-8607-4c8302de0b81",
|
||
|
|
"indicator--58b537f4-a844-42c6-9b2c-469702de0b81",
|
||
|
|
"indicator--58b537f5-ddac-4791-ac5e-46e602de0b81",
|
||
|
|
"observed-data--58b537f7-1be0-4d26-b208-4c1502de0b81",
|
||
|
|
"url--58b537f7-1be0-4d26-b208-4c1502de0b81",
|
||
|
|
"indicator--58b537f8-93c0-4b5b-9d1f-418f02de0b81",
|
||
|
|
"indicator--58b537fa-3478-419d-ab46-446602de0b81",
|
||
|
|
"observed-data--58b537fb-fb6c-42a3-bae4-44e102de0b81",
|
||
|
|
"url--58b537fb-fb6c-42a3-bae4-44e102de0b81",
|
||
|
|
"indicator--58b537fd-84d4-4fa4-a8f2-442c02de0b81",
|
||
|
|
"indicator--58b537fe-7ee8-461d-a9d9-464702de0b81",
|
||
|
|
"observed-data--58b53800-e738-48a2-b77a-4de602de0b81",
|
||
|
|
"url--58b53800-e738-48a2-b77a-4de602de0b81",
|
||
|
|
"indicator--58b53801-8ea0-40b9-b6b2-410e02de0b81",
|
||
|
|
"indicator--58b53803-0064-4055-b7cb-4e4302de0b81",
|
||
|
|
"observed-data--58b53805-a500-4afd-82b1-40c802de0b81",
|
||
|
|
"url--58b53805-a500-4afd-82b1-40c802de0b81",
|
||
|
|
"indicator--58b53806-d208-4419-9a09-482a02de0b81",
|
||
|
|
"indicator--58b53808-c0e0-4a13-98b9-48d102de0b81",
|
||
|
|
"observed-data--58b53809-9458-47d1-8faf-476f02de0b81",
|
||
|
|
"url--58b53809-9458-47d1-8faf-476f02de0b81",
|
||
|
|
"indicator--58b5380b-c6c8-4280-9753-477e02de0b81",
|
||
|
|
"indicator--58b5380c-d3c4-4eb8-a25e-4cd702de0b81",
|
||
|
|
"observed-data--58b5380e-1f38-4ce6-a24d-4ddb02de0b81",
|
||
|
|
"url--58b5380e-1f38-4ce6-a24d-4ddb02de0b81",
|
||
|
|
"indicator--58b5380f-8bac-4332-8874-469f02de0b81",
|
||
|
|
"indicator--58b53811-8b24-422d-a7a6-445a02de0b81",
|
||
|
|
"observed-data--58b53812-cf7c-4e48-9b2d-42fb02de0b81",
|
||
|
|
"url--58b53812-cf7c-4e48-9b2d-42fb02de0b81",
|
||
|
|
"indicator--58b53814-8910-4195-8e28-476502de0b81",
|
||
|
|
"indicator--58b53815-0c18-48ae-9a2b-43cc02de0b81",
|
||
|
|
"observed-data--58b53817-bdcc-4c05-afc7-493c02de0b81",
|
||
|
|
"url--58b53817-bdcc-4c05-afc7-493c02de0b81",
|
||
|
|
"indicator--58b53819-d514-4026-a364-484702de0b81",
|
||
|
|
"indicator--58b5381a-eb50-4eee-9b82-409002de0b81",
|
||
|
|
"observed-data--58b5381c-caf8-4fd6-9c25-417c02de0b81",
|
||
|
|
"url--58b5381c-caf8-4fd6-9c25-417c02de0b81",
|
||
|
|
"indicator--58b5381d-4040-4398-9aee-433e02de0b81",
|
||
|
|
"indicator--58b5381f-e834-4b97-aae7-456c02de0b81",
|
||
|
|
"observed-data--58b53820-7f08-4c70-b146-481e02de0b81",
|
||
|
|
"url--58b53820-7f08-4c70-b146-481e02de0b81",
|
||
|
|
"indicator--58b53822-a448-48b9-bbd5-409302de0b81",
|
||
|
|
"indicator--58b53823-3334-4951-bd47-4e6802de0b81",
|
||
|
|
"observed-data--58b53825-778c-4d12-b396-49a902de0b81",
|
||
|
|
"url--58b53825-778c-4d12-b396-49a902de0b81",
|
||
|
|
"indicator--58b53826-0844-4039-92e3-47cc02de0b81",
|
||
|
|
"indicator--58b53828-1400-4ff9-815e-4a5202de0b81",
|
||
|
|
"observed-data--58b53829-17a8-4713-87ae-439602de0b81",
|
||
|
|
"url--58b53829-17a8-4713-87ae-439602de0b81",
|
||
|
|
"indicator--58b5382b-1f98-4636-87f0-4c8702de0b81",
|
||
|
|
"indicator--58b5382c-43c4-47ee-b4ee-42f702de0b81",
|
||
|
|
"observed-data--58b5382e-deb0-4981-9027-4d9c02de0b81",
|
||
|
|
"url--58b5382e-deb0-4981-9027-4d9c02de0b81",
|
||
|
|
"indicator--58b5382f-2ca8-4aad-af10-48a102de0b81",
|
||
|
|
"indicator--58b53831-e248-449e-bdde-442b02de0b81",
|
||
|
|
"observed-data--58b53832-8acc-4e89-ac4e-498702de0b81",
|
||
|
|
"url--58b53832-8acc-4e89-ac4e-498702de0b81",
|
||
|
|
"indicator--58b53834-b09c-44c0-8b30-4cd202de0b81",
|
||
|
|
"indicator--58b53835-8660-4237-bd37-46c702de0b81",
|
||
|
|
"observed-data--58b53837-bf98-459d-9444-460902de0b81",
|
||
|
|
"url--58b53837-bf98-459d-9444-460902de0b81",
|
||
|
|
"indicator--58b53839-ee04-46a4-8291-475702de0b81",
|
||
|
|
"indicator--58b5383a-5ecc-4a51-8b39-490502de0b81",
|
||
|
|
"observed-data--58b5383c-dff0-46ab-a027-40bf02de0b81",
|
||
|
|
"url--58b5383c-dff0-46ab-a027-40bf02de0b81",
|
||
|
|
"indicator--58b5383d-8f20-48bd-b0b1-49f902de0b81",
|
||
|
|
"indicator--58b5383f-21e0-4b9b-8919-406a02de0b81",
|
||
|
|
"observed-data--58b53840-c7d0-4901-b84b-424602de0b81",
|
||
|
|
"url--58b53840-c7d0-4901-b84b-424602de0b81",
|
||
|
|
"indicator--58b53842-69c4-4718-9820-4aa502de0b81",
|
||
|
|
"indicator--58b53843-73d0-4d59-8fe3-4a7302de0b81",
|
||
|
|
"observed-data--58b53845-dca8-4e9e-af54-412d02de0b81",
|
||
|
|
"url--58b53845-dca8-4e9e-af54-412d02de0b81",
|
||
|
|
"indicator--58b53846-fbd4-4dcd-b701-4a9a02de0b81",
|
||
|
|
"indicator--58b53848-8900-4a1d-982d-480b02de0b81",
|
||
|
|
"observed-data--58b53849-6288-46f3-a4b2-43ff02de0b81",
|
||
|
|
"url--58b53849-6288-46f3-a4b2-43ff02de0b81",
|
||
|
|
"indicator--58b5384b-e4ac-4257-895d-4ecf02de0b81",
|
||
|
|
"indicator--58b5384d-21f8-4e01-967b-4a2602de0b81",
|
||
|
|
"observed-data--58b5384e-059c-422a-a0b6-444902de0b81",
|
||
|
|
"url--58b5384e-059c-422a-a0b6-444902de0b81",
|
||
|
|
"indicator--58b53850-6ba0-470b-b1f7-415202de0b81",
|
||
|
|
"indicator--58b53851-4df0-4a8e-8e4c-42e302de0b81",
|
||
|
|
"observed-data--58b53853-3ed8-4496-bf94-4d2e02de0b81",
|
||
|
|
"url--58b53853-3ed8-4496-bf94-4d2e02de0b81",
|
||
|
|
"indicator--58b53855-0838-4c09-af75-45fa02de0b81",
|
||
|
|
"indicator--58b53856-a1e8-4e82-acc1-4a0c02de0b81",
|
||
|
|
"observed-data--58b53858-adf8-420b-a124-44a802de0b81",
|
||
|
|
"url--58b53858-adf8-420b-a124-44a802de0b81",
|
||
|
|
"indicator--58b53859-2664-4e59-b75a-42e802de0b81",
|
||
|
|
"indicator--58b5385b-c5f8-4fa0-9bb7-41ba02de0b81",
|
||
|
|
"observed-data--58b5385c-15e4-4434-a607-4eba02de0b81",
|
||
|
|
"url--58b5385c-15e4-4434-a607-4eba02de0b81",
|
||
|
|
"indicator--58b5385e-499c-46cc-b217-4af102de0b81",
|
||
|
|
"indicator--58b53860-b860-4fc1-854b-419f02de0b81",
|
||
|
|
"observed-data--58b53861-a964-4b71-8abb-4f3c02de0b81",
|
||
|
|
"url--58b53861-a964-4b71-8abb-4f3c02de0b81",
|
||
|
|
"indicator--58b53863-504c-4363-b526-4b4502de0b81",
|
||
|
|
"indicator--58b53864-26cc-4d72-9195-456202de0b81",
|
||
|
|
"observed-data--58b53866-44b4-4116-8316-4a6a02de0b81",
|
||
|
|
"url--58b53866-44b4-4116-8316-4a6a02de0b81",
|
||
|
|
"indicator--58b53867-5d38-40e9-adad-429102de0b81",
|
||
|
|
"indicator--58b53869-af44-4891-b68e-4e8802de0b81",
|
||
|
|
"observed-data--58b5386a-be90-44ed-bb8a-413602de0b81",
|
||
|
|
"url--58b5386a-be90-44ed-bb8a-413602de0b81",
|
||
|
|
"indicator--58b5386c-caec-437d-b4c0-4f1902de0b81",
|
||
|
|
"indicator--58b5386e-5ac4-4832-9fcb-473f02de0b81",
|
||
|
|
"observed-data--58b5386f-ca94-4b69-8f5d-46bf02de0b81",
|
||
|
|
"url--58b5386f-ca94-4b69-8f5d-46bf02de0b81",
|
||
|
|
"indicator--58b53871-f0d8-4cbb-8243-40c802de0b81",
|
||
|
|
"indicator--58b53873-11bc-4005-9440-454502de0b81",
|
||
|
|
"observed-data--58b53874-0f04-49e2-92f0-408d02de0b81",
|
||
|
|
"url--58b53874-0f04-49e2-92f0-408d02de0b81",
|
||
|
|
"indicator--58b53876-fe7c-43bb-9f36-429302de0b81",
|
||
|
|
"indicator--58b53877-c480-4fed-ab51-42c102de0b81",
|
||
|
|
"observed-data--58b53879-3bc4-4768-b1e3-43ad02de0b81",
|
||
|
|
"url--58b53879-3bc4-4768-b1e3-43ad02de0b81",
|
||
|
|
"indicator--58b5387a-6444-4830-8898-462602de0b81",
|
||
|
|
"indicator--58b5387c-5bac-46ca-830b-4cb102de0b81",
|
||
|
|
"observed-data--58b5387d-c77c-4153-b114-47d902de0b81",
|
||
|
|
"url--58b5387d-c77c-4153-b114-47d902de0b81",
|
||
|
|
"indicator--58b5387f-3384-475e-959d-46e202de0b81",
|
||
|
|
"indicator--58b53880-1b38-42c2-a37a-44aa02de0b81",
|
||
|
|
"observed-data--58b53882-8bb8-41c9-951e-4ceb02de0b81",
|
||
|
|
"url--58b53882-8bb8-41c9-951e-4ceb02de0b81",
|
||
|
|
"indicator--58b53883-8374-4f6b-9bc5-463f02de0b81",
|
||
|
|
"indicator--58b53884-4360-4c7d-8de3-438102de0b81",
|
||
|
|
"observed-data--58b53885-b540-4e57-a77d-4d1202de0b81",
|
||
|
|
"url--58b53885-b540-4e57-a77d-4d1202de0b81",
|
||
|
|
"indicator--58b53887-a980-4ff4-8ea1-472502de0b81",
|
||
|
|
"indicator--58b53888-0a00-44d7-a0a8-467102de0b81",
|
||
|
|
"observed-data--58b5388a-a350-4ea4-8c10-400502de0b81",
|
||
|
|
"url--58b5388a-a350-4ea4-8c10-400502de0b81",
|
||
|
|
"indicator--58b5388b-9470-4b5a-9617-486302de0b81",
|
||
|
|
"indicator--58b5388d-7cf4-454e-8009-4ed602de0b81",
|
||
|
|
"observed-data--58b5388e-0b00-46d7-8d53-44ad02de0b81",
|
||
|
|
"url--58b5388e-0b00-46d7-8d53-44ad02de0b81",
|
||
|
|
"indicator--58b53890-39f0-4203-b89f-457c02de0b81",
|
||
|
|
"indicator--58b53891-1fe8-49e9-8f0c-47ef02de0b81",
|
||
|
|
"observed-data--58b53893-b8e0-4af2-a7cb-439802de0b81",
|
||
|
|
"url--58b53893-b8e0-4af2-a7cb-439802de0b81",
|
||
|
|
"indicator--58b53894-ab7c-48be-8413-43dc02de0b81",
|
||
|
|
"indicator--58b53896-8ca8-4934-814c-491b02de0b81",
|
||
|
|
"observed-data--58b53898-e588-4fb0-90c1-40b002de0b81",
|
||
|
|
"url--58b53898-e588-4fb0-90c1-40b002de0b81",
|
||
|
|
"indicator--58b53899-ac74-4d07-a2bc-4c7502de0b81",
|
||
|
|
"indicator--58b5389b-ebf4-4077-b094-4e3f02de0b81",
|
||
|
|
"observed-data--58b5389c-9444-4566-a9f0-42f402de0b81",
|
||
|
|
"url--58b5389c-9444-4566-a9f0-42f402de0b81",
|
||
|
|
"indicator--58b5389e-12d4-420e-afda-489d02de0b81",
|
||
|
|
"indicator--58b5389f-9258-4fee-8411-4a7302de0b81",
|
||
|
|
"observed-data--58b538a1-7038-47e0-ba47-4a1a02de0b81",
|
||
|
|
"url--58b538a1-7038-47e0-ba47-4a1a02de0b81",
|
||
|
|
"indicator--58b538a2-fd5c-4407-a162-43d402de0b81",
|
||
|
|
"indicator--58b538a3-8bb8-42e3-917d-40d402de0b81",
|
||
|
|
"observed-data--58b538a5-4118-4fbf-b94f-4deb02de0b81",
|
||
|
|
"url--58b538a5-4118-4fbf-b94f-4deb02de0b81",
|
||
|
|
"indicator--58b538a7-37b8-473d-88b5-497702de0b81",
|
||
|
|
"indicator--58b538a8-d1d4-44dd-8f4e-4a7902de0b81",
|
||
|
|
"observed-data--58b538aa-aec4-4bef-8d3d-4d5c02de0b81",
|
||
|
|
"url--58b538aa-aec4-4bef-8d3d-4d5c02de0b81",
|
||
|
|
"indicator--58b538ab-6cc8-4082-9cfd-416102de0b81",
|
||
|
|
"indicator--58b538ad-eb88-4158-b242-497f02de0b81",
|
||
|
|
"observed-data--58b538ae-be44-446d-9272-4add02de0b81",
|
||
|
|
"url--58b538ae-be44-446d-9272-4add02de0b81",
|
||
|
|
"indicator--58b538b0-a0c8-4d7b-b3e7-45b302de0b81",
|
||
|
|
"indicator--58b538b1-88a8-428b-8c1f-4d5d02de0b81",
|
||
|
|
"observed-data--58b538b3-fd6c-4803-bd37-47b202de0b81",
|
||
|
|
"url--58b538b3-fd6c-4803-bd37-47b202de0b81",
|
||
|
|
"indicator--58b538b4-0914-44bd-bae5-418102de0b81",
|
||
|
|
"indicator--58b538b6-c1d4-466c-887a-427c02de0b81",
|
||
|
|
"observed-data--58b538b7-d6f8-4f77-a547-4be602de0b81",
|
||
|
|
"url--58b538b7-d6f8-4f77-a547-4be602de0b81",
|
||
|
|
"indicator--58b538b9-38ec-4c0b-9556-488102de0b81",
|
||
|
|
"indicator--58b538bb-f308-4e23-9872-482a02de0b81",
|
||
|
|
"observed-data--58b538bc-2bf4-43b3-994a-4fbe02de0b81",
|
||
|
|
"url--58b538bc-2bf4-43b3-994a-4fbe02de0b81",
|
||
|
|
"indicator--58b538be-fb38-4e77-9f63-4efa02de0b81",
|
||
|
|
"indicator--58b538bf-db24-422f-a185-456202de0b81",
|
||
|
|
"observed-data--58b538c1-2854-41ec-94cc-4f5002de0b81",
|
||
|
|
"url--58b538c1-2854-41ec-94cc-4f5002de0b81",
|
||
|
|
"indicator--58b538c2-b028-491f-acb7-450e02de0b81",
|
||
|
|
"indicator--58b538c4-ffb8-48aa-b6eb-49ab02de0b81",
|
||
|
|
"observed-data--58b538c5-720c-43ec-b1af-44ee02de0b81",
|
||
|
|
"url--58b538c5-720c-43ec-b1af-44ee02de0b81",
|
||
|
|
"indicator--58b538c7-5be0-44fd-9ffe-45b902de0b81",
|
||
|
|
"indicator--58b538c8-643c-4925-8195-457e02de0b81",
|
||
|
|
"observed-data--58b538ca-a838-4e86-ad7c-47e602de0b81",
|
||
|
|
"url--58b538ca-a838-4e86-ad7c-47e602de0b81",
|
||
|
|
"indicator--58b538cb-7b2c-4c61-9ce3-4bd002de0b81",
|
||
|
|
"indicator--58b538cd-0ac8-436b-9984-40b002de0b81",
|
||
|
|
"observed-data--58b538ce-fc9c-477c-bea9-4ac102de0b81",
|
||
|
|
"url--58b538ce-fc9c-477c-bea9-4ac102de0b81",
|
||
|
|
"indicator--58b538cf-c6fc-4c44-b127-4de702de0b81",
|
||
|
|
"indicator--58b538d0-802c-48d4-80b4-42d002de0b81",
|
||
|
|
"observed-data--58b538d2-0030-430d-9111-488502de0b81",
|
||
|
|
"url--58b538d2-0030-430d-9111-488502de0b81",
|
||
|
|
"indicator--58b538d3-cbdc-4b43-8fe7-43e102de0b81",
|
||
|
|
"indicator--58b538d5-eb60-47c4-8981-486f02de0b81",
|
||
|
|
"observed-data--58b538d6-09b4-4baf-a419-494402de0b81",
|
||
|
|
"url--58b538d6-09b4-4baf-a419-494402de0b81",
|
||
|
|
"indicator--58b538d8-a798-4f7c-9e6f-44d402de0b81",
|
||
|
|
"indicator--58b538d9-c368-420a-bd91-4e9d02de0b81",
|
||
|
|
"observed-data--58b538db-e6ac-42d4-8ef3-482802de0b81",
|
||
|
|
"url--58b538db-e6ac-42d4-8ef3-482802de0b81",
|
||
|
|
"indicator--58b538dc-3be4-4b7d-bb52-4fd002de0b81",
|
||
|
|
"indicator--58b538de-b948-447e-9655-4d8302de0b81",
|
||
|
|
"observed-data--58b538df-0f98-4e36-9cd3-403502de0b81",
|
||
|
|
"url--58b538df-0f98-4e36-9cd3-403502de0b81",
|
||
|
|
"indicator--58b538e1-3324-43d1-8e38-483b02de0b81",
|
||
|
|
"indicator--58b538e2-3a98-4e5f-b2da-4d3702de0b81",
|
||
|
|
"observed-data--58b538e4-eac8-44d9-a786-49bc02de0b81",
|
||
|
|
"url--58b538e4-eac8-44d9-a786-49bc02de0b81",
|
||
|
|
"indicator--58b538e5-3768-425e-8578-478102de0b81",
|
||
|
|
"indicator--58b538e7-e9d4-45f3-b075-49b002de0b81",
|
||
|
|
"observed-data--58b538e9-34dc-4b85-a528-45c202de0b81",
|
||
|
|
"url--58b538e9-34dc-4b85-a528-45c202de0b81",
|
||
|
|
"indicator--58b538ea-57dc-4607-9c73-496d02de0b81",
|
||
|
|
"indicator--58b538ec-4c5c-4128-b54f-47ac02de0b81",
|
||
|
|
"observed-data--58b538ed-33a0-4d14-a97b-477102de0b81",
|
||
|
|
"url--58b538ed-33a0-4d14-a97b-477102de0b81",
|
||
|
|
"indicator--58b538ef-f14c-454b-acfb-44d902de0b81",
|
||
|
|
"indicator--58b538f0-2468-4b1e-9235-4e2002de0b81",
|
||
|
|
"observed-data--58b538f2-c3b4-47dd-8c56-49dc02de0b81",
|
||
|
|
"url--58b538f2-c3b4-47dd-8c56-49dc02de0b81",
|
||
|
|
"indicator--58b538f3-ce8c-4521-8df7-482f02de0b81",
|
||
|
|
"indicator--58b538f5-60b0-4ebd-98cb-49ce02de0b81",
|
||
|
|
"observed-data--58b538f6-0174-4c9e-9809-4e6402de0b81",
|
||
|
|
"url--58b538f6-0174-4c9e-9809-4e6402de0b81",
|
||
|
|
"indicator--58b538f8-7d4c-4de0-b974-445602de0b81",
|
||
|
|
"indicator--58b538fa-458c-46e3-8225-4d3a02de0b81",
|
||
|
|
"observed-data--58b538fb-370c-4976-b83d-417e02de0b81",
|
||
|
|
"url--58b538fb-370c-4976-b83d-417e02de0b81",
|
||
|
|
"indicator--58b538fd-7cec-4f4b-96de-49c202de0b81",
|
||
|
|
"indicator--58b538fe-cfa0-4043-90f8-45b102de0b81",
|
||
|
|
"observed-data--58b53900-4f60-4615-b9bd-439e02de0b81",
|
||
|
|
"url--58b53900-4f60-4615-b9bd-439e02de0b81",
|
||
|
|
"indicator--58b53901-42a0-41d7-9b70-4da202de0b81",
|
||
|
|
"indicator--58b53903-6ea0-4ed9-840c-428702de0b81",
|
||
|
|
"observed-data--58b53904-f970-4d3d-92f4-430b02de0b81",
|
||
|
|
"url--58b53904-f970-4d3d-92f4-430b02de0b81",
|
||
|
|
"indicator--58b53906-9cac-4698-80cf-47bd02de0b81",
|
||
|
|
"indicator--58b53907-1428-4fe5-b9af-416c02de0b81",
|
||
|
|
"observed-data--58b53909-e8d8-40cc-b3d9-452902de0b81",
|
||
|
|
"url--58b53909-e8d8-40cc-b3d9-452902de0b81",
|
||
|
|
"indicator--58b5390b-3510-4b7d-b86a-4c8002de0b81",
|
||
|
|
"indicator--58b5390c-1304-4cda-a2f6-4c5602de0b81",
|
||
|
|
"observed-data--58b5390e-9d40-4419-a690-43fe02de0b81",
|
||
|
|
"url--58b5390e-9d40-4419-a690-43fe02de0b81",
|
||
|
|
"indicator--58b5390f-bd38-4842-8dab-476802de0b81",
|
||
|
|
"indicator--58b53911-6bf0-4f67-9a77-474002de0b81",
|
||
|
|
"observed-data--58b53911-de60-4535-a3b3-402902de0b81",
|
||
|
|
"url--58b53911-de60-4535-a3b3-402902de0b81",
|
||
|
|
"indicator--58b53911-bd64-4d37-a99d-4d8202de0b81",
|
||
|
|
"indicator--58b53912-a26c-407a-9192-4bbb02de0b81",
|
||
|
|
"observed-data--58b53913-8454-437d-b3ef-476602de0b81",
|
||
|
|
"url--58b53913-8454-437d-b3ef-476602de0b81",
|
||
|
|
"indicator--58b53914-c670-4b5a-ab34-48f702de0b81",
|
||
|
|
"indicator--58b53915-3660-4302-82d8-4f8402de0b81",
|
||
|
|
"observed-data--58b53915-54f0-4753-aab1-45dd02de0b81",
|
||
|
|
"url--58b53915-54f0-4753-aab1-45dd02de0b81",
|
||
|
|
"indicator--58b53916-dc4c-45d3-809f-496602de0b81",
|
||
|
|
"indicator--58b53917-2758-47bc-9a35-46f302de0b81",
|
||
|
|
"observed-data--58b53918-3a90-4819-a197-40a202de0b81",
|
||
|
|
"url--58b53918-3a90-4819-a197-40a202de0b81",
|
||
|
|
"indicator--58b53918-0bc0-456b-91c2-44ad02de0b81",
|
||
|
|
"indicator--58b53919-f968-4cb6-9017-441502de0b81",
|
||
|
|
"observed-data--58b5391a-4848-460f-a372-49ea02de0b81",
|
||
|
|
"url--58b5391a-4848-460f-a372-49ea02de0b81",
|
||
|
|
"indicator--58b5391b-1d5c-4731-8538-443502de0b81",
|
||
|
|
"indicator--58b5391b-6cbc-4b47-b2f2-4cec02de0b81",
|
||
|
|
"observed-data--58b5391c-af74-47dd-ab9d-462d02de0b81",
|
||
|
|
"url--58b5391c-af74-47dd-ab9d-462d02de0b81",
|
||
|
|
"indicator--58b5391d-f41c-48b2-99c6-495002de0b81",
|
||
|
|
"indicator--58b5391e-3f6c-4b56-bd40-4df402de0b81",
|
||
|
|
"observed-data--58b5391f-4fa8-4a39-b72f-4cb902de0b81",
|
||
|
|
"url--58b5391f-4fa8-4a39-b72f-4cb902de0b81",
|
||
|
|
"indicator--58b5391f-c698-4aab-9998-49e202de0b81",
|
||
|
|
"indicator--58b53920-5724-4514-8476-4bca02de0b81",
|
||
|
|
"observed-data--58b53921-b218-4ffb-a74a-424102de0b81",
|
||
|
|
"url--58b53921-b218-4ffb-a74a-424102de0b81",
|
||
|
|
"indicator--58b53922-3e8c-49f8-a7bc-4bf602de0b81",
|
||
|
|
"indicator--58b53922-49ac-4475-8bce-46d802de0b81",
|
||
|
|
"observed-data--58b53923-d0f4-45fb-bd48-44a802de0b81",
|
||
|
|
"url--58b53923-d0f4-45fb-bd48-44a802de0b81",
|
||
|
|
"indicator--58b53924-a5b8-4fd6-80f6-4f2a02de0b81",
|
||
|
|
"indicator--58b53925-fa38-4027-9757-4be802de0b81",
|
||
|
|
"observed-data--58b53926-53b0-4046-9368-47df02de0b81",
|
||
|
|
"url--58b53926-53b0-4046-9368-47df02de0b81",
|
||
|
|
"indicator--58b53926-ad18-4973-8455-440002de0b81",
|
||
|
|
"indicator--58b53927-b160-4d88-a974-458e02de0b81",
|
||
|
|
"observed-data--58b53928-7728-4773-9950-449102de0b81",
|
||
|
|
"url--58b53928-7728-4773-9950-449102de0b81",
|
||
|
|
"indicator--58b53929-dc68-4018-bfd8-45b702de0b81",
|
||
|
|
"indicator--58b53929-e7fc-4428-aba9-4ff202de0b81",
|
||
|
|
"observed-data--58b5392a-064c-4d00-ae1b-404f02de0b81",
|
||
|
|
"url--58b5392a-064c-4d00-ae1b-404f02de0b81",
|
||
|
|
"indicator--58b5392b-ff2c-498c-8f4b-475c02de0b81",
|
||
|
|
"indicator--58b5392c-de80-4947-aeb9-4c1002de0b81",
|
||
|
|
"observed-data--58b5392d-8944-4e8f-b726-4fcd02de0b81",
|
||
|
|
"url--58b5392d-8944-4e8f-b726-4fcd02de0b81",
|
||
|
|
"indicator--58b5392d-58b4-4eeb-a5fa-41f102de0b81",
|
||
|
|
"indicator--58b5392e-a87c-4794-9cce-415702de0b81",
|
||
|
|
"observed-data--58b5392f-dea8-4fc5-aaa3-418e02de0b81",
|
||
|
|
"url--58b5392f-dea8-4fc5-aaa3-418e02de0b81",
|
||
|
|
"indicator--58b53930-3bb0-4796-8a9f-45a802de0b81",
|
||
|
|
"indicator--58b53930-b830-4241-9237-419602de0b81",
|
||
|
|
"observed-data--58b53931-2bf8-47b0-b12a-45f102de0b81",
|
||
|
|
"url--58b53931-2bf8-47b0-b12a-45f102de0b81",
|
||
|
|
"indicator--58b53932-5924-4769-903f-461502de0b81",
|
||
|
|
"indicator--58b53933-5f18-4636-b19d-45e202de0b81",
|
||
|
|
"observed-data--58b53933-f378-4ffa-910c-4da202de0b81",
|
||
|
|
"url--58b53933-f378-4ffa-910c-4da202de0b81",
|
||
|
|
"indicator--58b53934-4fd4-46b4-9db1-400102de0b81",
|
||
|
|
"indicator--58b53935-39cc-4d4c-ad52-47b902de0b81",
|
||
|
|
"observed-data--58b53936-65f0-43ef-9c81-42bf02de0b81",
|
||
|
|
"url--58b53936-65f0-43ef-9c81-42bf02de0b81",
|
||
|
|
"indicator--58b53936-5b14-438a-90d9-419402de0b81",
|
||
|
|
"indicator--58b53937-cd18-427a-9e0a-409d02de0b81",
|
||
|
|
"observed-data--58b53938-ec58-4f36-944f-4c6102de0b81",
|
||
|
|
"url--58b53938-ec58-4f36-944f-4c6102de0b81",
|
||
|
|
"indicator--58b53939-4918-4d56-96d6-4dd102de0b81",
|
||
|
|
"indicator--58b53939-d844-4b00-b1ce-43a202de0b81",
|
||
|
|
"observed-data--58b5393a-5bec-438e-afe4-4b9002de0b81",
|
||
|
|
"url--58b5393a-5bec-438e-afe4-4b9002de0b81",
|
||
|
|
"indicator--58b5393b-f0bc-408f-b941-483d02de0b81",
|
||
|
|
"indicator--58b5393c-dd34-4a16-ab64-4e0802de0b81",
|
||
|
|
"observed-data--58b5393c-edb8-47aa-a02f-423b02de0b81",
|
||
|
|
"url--58b5393c-edb8-47aa-a02f-423b02de0b81",
|
||
|
|
"indicator--58b5393d-a348-4e15-b995-486602de0b81",
|
||
|
|
"indicator--58b5393e-14e8-429e-8724-4d2602de0b81",
|
||
|
|
"observed-data--58b5393f-030c-47ba-b344-4bb102de0b81",
|
||
|
|
"url--58b5393f-030c-47ba-b344-4bb102de0b81",
|
||
|
|
"indicator--58b5393f-6254-4c60-ac15-40ff02de0b81",
|
||
|
|
"indicator--58b53940-7d08-499a-a2e8-4a9d02de0b81",
|
||
|
|
"observed-data--58b53941-1044-4113-ae09-486002de0b81",
|
||
|
|
"url--58b53941-1044-4113-ae09-486002de0b81",
|
||
|
|
"indicator--58b53942-3f44-4a4b-9bbd-435402de0b81",
|
||
|
|
"indicator--58b53942-5f78-43f0-bd22-438202de0b81",
|
||
|
|
"observed-data--58b53943-2f00-43ff-9de3-43c402de0b81",
|
||
|
|
"url--58b53943-2f00-43ff-9de3-43c402de0b81",
|
||
|
|
"indicator--58b53944-694c-4c73-942a-45c602de0b81",
|
||
|
|
"indicator--58b53945-8b5c-4d3e-9340-451602de0b81",
|
||
|
|
"observed-data--58b53945-1990-4ccf-8353-4fc902de0b81",
|
||
|
|
"url--58b53945-1990-4ccf-8353-4fc902de0b81",
|
||
|
|
"indicator--58b53946-4528-48e4-b7e4-4ba602de0b81",
|
||
|
|
"indicator--58b53947-18b8-4f0f-84e2-4bc402de0b81",
|
||
|
|
"observed-data--58b53948-0f04-474a-95b1-49a102de0b81",
|
||
|
|
"url--58b53948-0f04-474a-95b1-49a102de0b81",
|
||
|
|
"indicator--58b53948-11f4-4058-970e-451c02de0b81",
|
||
|
|
"indicator--58b53949-6224-4721-8e71-4c2702de0b81",
|
||
|
|
"observed-data--58b5394a-11a4-4f5b-bd26-45f502de0b81",
|
||
|
|
"url--58b5394a-11a4-4f5b-bd26-45f502de0b81",
|
||
|
|
"indicator--58b5394b-eeb4-40fd-bb04-4da302de0b81",
|
||
|
|
"indicator--58b5394b-2938-4ece-94fa-4b8202de0b81",
|
||
|
|
"observed-data--58b5394c-5898-47dc-bb1e-495c02de0b81",
|
||
|
|
"url--58b5394c-5898-47dc-bb1e-495c02de0b81",
|
||
|
|
"indicator--58b5394d-b1d8-4b4f-b211-4f6602de0b81",
|
||
|
|
"indicator--58b5394e-c114-4139-8818-406c02de0b81",
|
||
|
|
"observed-data--58b5394f-3c64-436f-b972-419502de0b81",
|
||
|
|
"url--58b5394f-3c64-436f-b972-419502de0b81",
|
||
|
|
"indicator--58b5394f-4bf0-4733-8303-4bc602de0b81",
|
||
|
|
"indicator--58b53950-4de8-4f08-bc94-423c02de0b81",
|
||
|
|
"observed-data--58b53951-4b8c-4638-9085-448602de0b81",
|
||
|
|
"url--58b53951-4b8c-4638-9085-448602de0b81",
|
||
|
|
"indicator--58b53952-53e4-44fa-824d-459e02de0b81",
|
||
|
|
"indicator--58b53952-3794-4fc2-9257-4e1d02de0b81",
|
||
|
|
"observed-data--58b53953-8c54-4896-872a-411a02de0b81",
|
||
|
|
"url--58b53953-8c54-4896-872a-411a02de0b81",
|
||
|
|
"indicator--58b53954-2e58-489a-b5eb-466102de0b81",
|
||
|
|
"indicator--58b53955-b68c-49b6-ab75-41eb02de0b81",
|
||
|
|
"observed-data--58b53956-442c-4b73-a155-488602de0b81",
|
||
|
|
"url--58b53956-442c-4b73-a155-488602de0b81",
|
||
|
|
"indicator--58b53956-ff40-44ec-b325-410102de0b81",
|
||
|
|
"indicator--58b53957-ac64-41ec-9ee1-45dd02de0b81",
|
||
|
|
"observed-data--58b53958-9d7c-43a9-b2af-4dd702de0b81",
|
||
|
|
"url--58b53958-9d7c-43a9-b2af-4dd702de0b81",
|
||
|
|
"indicator--58b53959-04f4-4719-86e2-488f02de0b81",
|
||
|
|
"indicator--58b5395a-4b48-4384-be62-458302de0b81",
|
||
|
|
"observed-data--58b5395b-9e40-47e9-b815-465602de0b81",
|
||
|
|
"url--58b5395b-9e40-47e9-b815-465602de0b81",
|
||
|
|
"indicator--58b5395b-1014-42be-8e10-4b1802de0b81",
|
||
|
|
"indicator--58b5395c-b7bc-4419-b93a-47f002de0b81",
|
||
|
|
"observed-data--58b5395d-b558-40b7-b8a2-40f002de0b81",
|
||
|
|
"url--58b5395d-b558-40b7-b8a2-40f002de0b81",
|
||
|
|
"indicator--58b5395e-7f10-46d9-850c-42ac02de0b81",
|
||
|
|
"indicator--58b5395f-460c-4fb7-855b-443002de0b81",
|
||
|
|
"observed-data--58b5395f-2208-440e-a551-409302de0b81",
|
||
|
|
"url--58b5395f-2208-440e-a551-409302de0b81",
|
||
|
|
"indicator--58b53960-2268-4134-a27d-456302de0b81",
|
||
|
|
"indicator--58b53961-5720-486d-a265-427f02de0b81",
|
||
|
|
"observed-data--58b53962-7d78-45ea-b943-494c02de0b81",
|
||
|
|
"url--58b53962-7d78-45ea-b943-494c02de0b81",
|
||
|
|
"indicator--58b53962-89c0-4670-9061-413002de0b81",
|
||
|
|
"indicator--58b53963-e010-4578-8001-4ea202de0b81",
|
||
|
|
"observed-data--58b53964-8048-404b-be36-42ac02de0b81",
|
||
|
|
"url--58b53964-8048-404b-be36-42ac02de0b81",
|
||
|
|
"indicator--58b53965-5e38-4a89-b48a-46bc02de0b81",
|
||
|
|
"indicator--58b53965-5950-4325-829a-4db502de0b81",
|
||
|
|
"observed-data--58b53966-e9e4-4153-bb46-4aa902de0b81",
|
||
|
|
"url--58b53966-e9e4-4153-bb46-4aa902de0b81",
|
||
|
|
"indicator--58b53967-271c-466e-a12a-405202de0b81",
|
||
|
|
"indicator--58b53968-5380-4406-affc-474002de0b81",
|
||
|
|
"observed-data--58b53969-6f70-47a5-8766-4dc802de0b81",
|
||
|
|
"url--58b53969-6f70-47a5-8766-4dc802de0b81",
|
||
|
|
"indicator--58b53969-fa88-41e6-8c27-4dab02de0b81",
|
||
|
|
"indicator--58b5396a-6598-4e2f-b549-413702de0b81",
|
||
|
|
"observed-data--58b5396b-d1bc-4892-850c-427202de0b81",
|
||
|
|
"url--58b5396b-d1bc-4892-850c-427202de0b81",
|
||
|
|
"indicator--58b5396c-6ee4-489e-83bc-4e8002de0b81",
|
||
|
|
"indicator--58b5396d-4ce8-48d2-91e3-416002de0b81",
|
||
|
|
"observed-data--58b5396d-cf04-431d-8df5-437002de0b81",
|
||
|
|
"url--58b5396d-cf04-431d-8df5-437002de0b81",
|
||
|
|
"indicator--58b5396e-5594-4217-935d-4b6902de0b81",
|
||
|
|
"indicator--58b5396f-a004-4133-b3cb-42ed02de0b81",
|
||
|
|
"observed-data--58b53970-71f8-42be-a522-49db02de0b81",
|
||
|
|
"url--58b53970-71f8-42be-a522-49db02de0b81",
|
||
|
|
"indicator--58b53970-8a8c-4faa-b6d0-4c0f02de0b81",
|
||
|
|
"indicator--58b53971-bc40-4a82-9ad5-421a02de0b81",
|
||
|
|
"observed-data--58b53972-e078-48f0-847f-429f02de0b81",
|
||
|
|
"url--58b53972-e078-48f0-847f-429f02de0b81",
|
||
|
|
"indicator--58b53973-7e1c-4785-86ef-462d02de0b81",
|
||
|
|
"indicator--58b53973-a044-49e8-8eb5-47b102de0b81",
|
||
|
|
"observed-data--58b53974-0e48-4e62-9d09-46b502de0b81",
|
||
|
|
"url--58b53974-0e48-4e62-9d09-46b502de0b81",
|
||
|
|
"indicator--58b53975-d5d0-4aff-9c6d-47b402de0b81",
|
||
|
|
"indicator--58b53976-8070-4859-936b-43f202de0b81",
|
||
|
|
"observed-data--58b53977-5d7c-4ed4-8af9-446402de0b81",
|
||
|
|
"url--58b53977-5d7c-4ed4-8af9-446402de0b81",
|
||
|
|
"indicator--58b53977-00c0-46b4-86f7-4db902de0b81",
|
||
|
|
"indicator--58b53978-c4c0-4923-a398-404c02de0b81",
|
||
|
|
"observed-data--58b53979-9724-4455-8944-45cd02de0b81",
|
||
|
|
"url--58b53979-9724-4455-8944-45cd02de0b81",
|
||
|
|
"indicator--58b5397a-57f4-4cbf-b232-424b02de0b81",
|
||
|
|
"indicator--58b5397a-3748-4f33-b59c-44b202de0b81",
|
||
|
|
"observed-data--58b5397b-cf04-4740-a98f-486802de0b81",
|
||
|
|
"url--58b5397b-cf04-4740-a98f-486802de0b81",
|
||
|
|
"indicator--58b5397c-b5bc-4eb5-9d67-48f802de0b81",
|
||
|
|
"indicator--58b5397d-52dc-4bd4-b200-4ba802de0b81",
|
||
|
|
"observed-data--58b5397d-5754-43a0-b3d4-43d602de0b81",
|
||
|
|
"url--58b5397d-5754-43a0-b3d4-43d602de0b81",
|
||
|
|
"indicator--58b5397e-0624-4e9e-90da-4dfd02de0b81",
|
||
|
|
"indicator--58b5397f-bda0-4d7f-b223-421402de0b81",
|
||
|
|
"observed-data--58b53980-4760-4b10-98ee-459c02de0b81",
|
||
|
|
"url--58b53980-4760-4b10-98ee-459c02de0b81",
|
||
|
|
"indicator--58b53980-367c-482d-9140-43a002de0b81",
|
||
|
|
"indicator--58b53981-11cc-4ae8-87b6-43cb02de0b81",
|
||
|
|
"observed-data--58b53982-a4b0-47b5-a6ad-408802de0b81",
|
||
|
|
"url--58b53982-a4b0-47b5-a6ad-408802de0b81",
|
||
|
|
"indicator--58b53983-06ec-4706-9a53-4d8c02de0b81",
|
||
|
|
"indicator--58b53984-43b0-4c45-9b5f-444e02de0b81",
|
||
|
|
"observed-data--58b53984-2b08-4752-95a7-43b602de0b81",
|
||
|
|
"url--58b53984-2b08-4752-95a7-43b602de0b81",
|
||
|
|
"indicator--58b53985-ca18-436c-bf5e-49f502de0b81",
|
||
|
|
"indicator--58b53986-d244-47fb-885c-41b902de0b81",
|
||
|
|
"observed-data--58b53987-8ce8-490d-84ca-44db02de0b81",
|
||
|
|
"url--58b53987-8ce8-490d-84ca-44db02de0b81",
|
||
|
|
"indicator--58b53987-65c8-4aec-a519-4f9202de0b81",
|
||
|
|
"indicator--58b53988-47b8-4fd0-9790-48de02de0b81",
|
||
|
|
"observed-data--58b53989-b9c0-4a40-a89e-4b4402de0b81",
|
||
|
|
"url--58b53989-b9c0-4a40-a89e-4b4402de0b81",
|
||
|
|
"indicator--58b5398a-b5d4-40e4-9e47-4aad02de0b81",
|
||
|
|
"indicator--58b5398a-4860-472e-88c7-4b0702de0b81",
|
||
|
|
"observed-data--58b5398b-ab50-4ee2-8ebd-499e02de0b81",
|
||
|
|
"url--58b5398b-ab50-4ee2-8ebd-499e02de0b81",
|
||
|
|
"indicator--58b5398c-9e60-4cfd-94c2-445502de0b81",
|
||
|
|
"indicator--58b5398d-c780-4133-a13b-4dc102de0b81",
|
||
|
|
"observed-data--58b5398e-5a20-4cca-9090-404f02de0b81",
|
||
|
|
"url--58b5398e-5a20-4cca-9090-404f02de0b81",
|
||
|
|
"indicator--58b5398e-e054-4b90-81aa-4d1702de0b81",
|
||
|
|
"indicator--58b5398f-e364-49ff-9e01-43fc02de0b81",
|
||
|
|
"observed-data--58b53990-ec94-43df-8fda-433c02de0b81",
|
||
|
|
"url--58b53990-ec94-43df-8fda-433c02de0b81",
|
||
|
|
"indicator--58b53991-3bbc-4c0e-a1c8-475802de0b81",
|
||
|
|
"indicator--58b53991-eee0-42f5-ad78-492e02de0b81",
|
||
|
|
"observed-data--58b53992-8f74-4024-a743-4ca902de0b81",
|
||
|
|
"url--58b53992-8f74-4024-a743-4ca902de0b81",
|
||
|
|
"indicator--58b53993-1d38-4a5b-aae6-4d2c02de0b81",
|
||
|
|
"indicator--58b53994-a57c-4297-a490-49bf02de0b81",
|
||
|
|
"observed-data--58b53994-68b4-4ed0-96fb-486a02de0b81",
|
||
|
|
"url--58b53994-68b4-4ed0-96fb-486a02de0b81",
|
||
|
|
"indicator--58b53995-6e6c-4770-95da-462402de0b81",
|
||
|
|
"indicator--58b53996-28e0-4a81-8c24-4a1d02de0b81",
|
||
|
|
"observed-data--58b53997-1d40-4b49-8f7e-4f0f02de0b81",
|
||
|
|
"url--58b53997-1d40-4b49-8f7e-4f0f02de0b81",
|
||
|
|
"indicator--58b53998-2f60-40a8-84c6-421e02de0b81",
|
||
|
|
"indicator--58b53998-c67c-4bfb-9c43-4f6e02de0b81",
|
||
|
|
"observed-data--58b53999-5704-4cc6-8ad5-44dd02de0b81",
|
||
|
|
"url--58b53999-5704-4cc6-8ad5-44dd02de0b81",
|
||
|
|
"indicator--58b5399a-ec30-41f5-ae3f-4fbb02de0b81",
|
||
|
|
"indicator--58b5399b-6804-4c70-a471-425302de0b81",
|
||
|
|
"observed-data--58b5399b-1784-41ca-a01e-46ce02de0b81",
|
||
|
|
"url--58b5399b-1784-41ca-a01e-46ce02de0b81",
|
||
|
|
"indicator--58b5399c-de4c-431c-977d-49fd02de0b81",
|
||
|
|
"indicator--58b5399d-698c-43d3-b56c-4d0e02de0b81",
|
||
|
|
"observed-data--58b5399e-099c-4d71-86d2-422102de0b81",
|
||
|
|
"url--58b5399e-099c-4d71-86d2-422102de0b81",
|
||
|
|
"indicator--58b5399e-dca8-497f-8992-444402de0b81",
|
||
|
|
"indicator--58b5399f-2854-467f-9ed6-45ea02de0b81",
|
||
|
|
"observed-data--58b539a0-075c-42c5-91e4-4aca02de0b81",
|
||
|
|
"url--58b539a0-075c-42c5-91e4-4aca02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"osint:source-type=\"blog-post\"",
|
||
|
|
"misp-galaxy:threat-actor=\"Gamaredon Group\""
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5331f-5198-4521-849b-403902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:40:29Z",
|
||
|
|
"last_observed": "2017-02-28T08:40:29Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5331f-5198-4521-849b-403902de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\"",
|
||
|
|
"osint:source-type=\"blog-post\"",
|
||
|
|
"admiralty-scale:source-reliability=\"b\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5331f-5198-4521-849b-403902de0b81",
|
||
|
|
"value": "http://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--58b5336a-9814-425a-9f77-48f702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"External analysis\"",
|
||
|
|
"osint:source-type=\"blog-post\"",
|
||
|
|
"admiralty-scale:source-reliability=\"b\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "External analysis",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Unit 42 threat researchers have recently observed a threat group distributing new, custom developed malware. We have labelled this threat group the Gamaredon Group and our research shows that the Gamaredon Group has been active since at least 2013.\r\n\r\nIn the past, the Gamaredon Group has relied heavily on off-the-shelf tools. Our new research shows the Gamaredon Group have made a shift to custom-developed malware. We believe this shift indicates the Gamaredon Group have improved their technical capabilities. The custom-developed malware is fully featured an includes these capabilities:\r\n\r\nA mechanism for downloading and executing additional payloads of their choice\r\nThe ability to scan system drives for specific file types\r\nThe ability to capture screenshots\r\nThe ability to remotely execute commands on the system in the user\u00e2\u20ac\u2122s security context\r\nThe Gamaredon Group primarily makes use of compromised domains, dynamic DNS providers, Russian and Ukrainian country code top-level domains (ccTLDs), and Russian hosting providers to distribute their custom-built malware.\r\n\r\nAntimalware technologies have a poor record of detecting the malware this group has developed. We believe this is likely due to the modular nature of the malware, the malware\u00e2\u20ac\u2122s heavy use of batch scripts, and the abuse of legitimate applications and tools (such as wget) for malicious purposes.\r\n\r\nPreviously, LookingGlass reported on a campaign they named \u00e2\u20ac\u0153Operation Armageddon,\u00e2\u20ac\u009d targeting individuals involved in the Ukrainian military and national security establishment. Because we believe this group is behind that campaign, we\u00e2\u20ac\u2122ve named them the Gamaredon Group, an anagram of \u00e2\u20ac\u0153Armageddon\u00e2\u20ac\u009d. At this time, it is unknown if the new payloads this group is distributing is a continuation of Operation Armageddon or a new campaign."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b533c4-f980-4d7a-bd0c-4a4c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[url:value = 'http://childrights.in.ua/public/manager/img/scrdll.ini']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b533c5-e280-454d-a6a5-48c102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[url:value = 'http://prestigeclub.frantov.com.ua/press-center/press/chrome-xvnc-v5517.exe']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b533c6-6c20-40e3-89f5-464902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[url:value = 'http://umachka.ua/screen/dk.tmp']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b533c6-8f04-4cd6-b803-447f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[url:value = 'http://umachka.ua/screen/screen.tmp']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b533c7-7610-475b-be8f-4dcb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[url:value = 'http://viberload.ddns.net/viber.nls']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53404-7110-4008-8dcf-4a9102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'admin-ru.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53405-3fb0-40ad-a122-4c5302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'adobe.update-service.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53406-bb74-4a66-901f-493302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'apploadapp.webhop.me']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53407-bb08-4bbe-87c3-418402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'brokbridge.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53407-02e8-40fb-a079-492202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'cat.gotdns.ch']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53408-e404-4bb5-909d-46dc02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'check-update.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53409-e2f4-4858-b398-419502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'childrights.in.ua']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5340a-4468-4f39-be5b-44ca02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'conhost.myftp.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5340b-33c4-4d67-b700-456402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'docdownload.ddns.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5340c-9b2c-45dd-8744-48a702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'downloads.email-attachments.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5340d-5a1c-449b-8e1f-4a7502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'downloads.file-attachments.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5340d-a0a8-4fcb-9e04-431702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'dyndownload.serveirc.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5340e-2e04-4fba-bafe-43cb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'e.muravej.ua']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5340f-30bc-404e-9c35-4c8c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'email-attachments.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53410-9140-4726-b2df-4b8702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'file-attachments.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53411-5df4-487a-8974-4d0602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'freefiles.myftp.biz']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53412-9c08-4a8e-a83a-474002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'getmyfile.webhop.me']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53413-140c-4104-95d2-421d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'googlefiles.serveftp.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53414-6828-4757-b4de-453002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'grom56.ddns.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53414-9918-4600-828f-4f0002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'grom90.ddns.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53415-7c6c-487b-b2ef-417d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'hrome-update.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53416-0ee0-4e12-a21c-4d1502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'hrome-updater.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53417-ba0c-4776-9f4d-4da102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'loaderskypetm.webhop.me']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53418-1748-4973-b0b1-485002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'loadsoulip.serveftp.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53419-7e50-4b17-8621-408c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'mail.file-attachments.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5341a-35a4-41c6-89e1-40ff02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'mails.redirectme.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5341a-5704-41b2-af22-417702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'mars-ru.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5341b-feb0-4998-891b-462f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'msrestore.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5341c-aa2c-40c1-9dea-4fe302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'oficialsite.webhop.me']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5341d-4560-4e80-aa2e-454002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'parkingdoma.webhop.me']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5341e-7814-4cc3-ba8f-4e1102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'poligjong.webhop.me']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5341f-6d14-47b2-9a52-478502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'polistar.ddns.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53420-8268-4d70-8fb9-41b202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'proxy-spread.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53421-41c4-482b-ac50-4df602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'rms.admin-ru.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53422-4598-4afd-9a15-423302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'samotsvety.com.ua']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53423-ece4-4f93-8482-4fe702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'skypeemocache.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53424-3a24-4053-8e36-45ee02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'skypeupdate.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53425-69bc-4297-8b34-447502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'spbpool.ddns.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53426-f288-4a30-ab5f-490e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'spread-service.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53427-efd8-40e0-8c5e-44d102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'spread-ss.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53427-be4c-4ab5-8bee-4be702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'spread-updates.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53428-17d0-4c47-81f4-4bf302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'stor.tainfo.com.ua']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53429-c324-4273-a03e-47cd02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'tortilla.sytes.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5342a-4798-4d06-b127-4a5102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'ukrnet.serveftp.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5342b-f644-4c29-ad00-4b1e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'ukrway.galaktion.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5342c-8708-4df6-a189-41b202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'umachka.ua']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5342d-ea0c-47ee-8c7a-4ccf02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'update-service.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5342e-54c0-4e4c-a54e-4f9f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'updatesp.ddns.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5342f-a9b4-4458-b169-4e7702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'updateviber.sytes.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5342f-d064-4d44-b7f4-4e5e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'webclidie.webhop.me']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53430-0088-4003-abcf-42d202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'win-restore.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53431-130c-4802-94e4-43fa02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'winloaded.sytes.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53432-19b4-4be4-a7a5-4d6f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'winupdateloader.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53433-4ecc-45e1-b52f-4be402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'www.file-attachments.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53434-5604-4a4a-8fac-48c602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'www.win-restore.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53434-7148-4c29-8206-4d1b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'yfperoliz.webhop.me']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53457-a020-49bc-a759-4c0d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '002aff376ec452ec35ae2930dfbb51bd40229c258611d19b86863c3b0d156705']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53458-2584-4725-9db0-472902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '08e69f21c3c60a4a9b78f580c3a55d4cfb74729705b5b7d01c1aecfd58fc49e6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53458-05bc-42d9-ab62-4fdf02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0c47cf984afe87a14d0d4c94557864ed19b4cb52783e49ce96ebf9c2f8b52d27']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53459-5a34-4cfb-9ece-453302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0dc1010c3d3766158e2347d10fc78d9223c6e0e3a44aa8a76622aeff7d429ab9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5345a-b3a0-4acb-8957-4a0b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0f745512940e0efd8f09c6d862571cba2b98fac9a9f7cf30dedcc08ace43a494']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5345b-c1e0-4c85-a750-43c302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '145dab86a43835bb37734c16756d6d64d8e5ac6b87c491c57385e27b564136b8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5345c-5730-42b1-a7dd-4eb602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '222e85e6d07bdc3a2141cdd582d3f2ed4b1ce5285731cc3f54e6202a13737f8d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5345d-2e58-4aaf-bfff-472b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2f2b26f2f7d164ea1f529edbc3cb8a1063b39121dad4dd19d8ee4bbbaf25ed37']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5345d-1a60-4869-a026-4cb302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3242183b1f0176a2e3cfb6bfef96b9d55c5a59ea9614dbde4ef89979336b5a5d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5345e-e6e0-4b7e-bc90-472602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3773ddd462b01f9272656f3150f2c3de19e77199cf5fac1f44287d11593614f9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5345f-5be4-4979-8336-494402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '37c78ee7826d63bb9219de594ed6693f18da5db60e3cbc86795bd10b296f12ac']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53460-6d34-46a9-975b-4a0802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3e5b1116b2dfd99652a001968a05fc962974931a0596153ab0dea8e4a9982f89']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53461-b0a0-4d26-9dce-42d902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '400f53a89d08d47f608e1288d9873bf8d421fc7cd642c5e821674f38e07a1501']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53462-915c-4143-8c3f-497d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '598c55b89e819b23eac34547ad02e5cd59e1b8fcb23b5063a251d8e8fae8b824']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53462-3b74-48ba-8d4f-471302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5b22ace98b57ed19d815c49983c96a3c6ff0b2701e8167d4422c6990982abcf9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53463-9874-4a32-bf21-4dd602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5ec8b7ca4461720bd69fb49b3f6cae637d8ac3bbd675da938bc5a84e9b73b395']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53464-4500-4515-b778-4ef602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '840b3d4cc95dbf311f792a9f50137056deb66bfdbb55eb9f54ff381a0df65656']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53465-2968-4e58-a435-446402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '90ba0f95896736b799f8651ef0600d4fa85c6c3e056e54eab5bb216327912edd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53466-1f04-4eef-a18b-4aa802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '97ebd7bfad63b36b4572132f6ece359ff9991f269048c0b145411699bfe3dc34']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53467-91b4-42b4-ad51-435702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9a1fd88970da3809f45cef00360d1e54ea11a70035c277c130404a67371e142d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53468-ca64-43e4-9b31-43e702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9cb64d3242d2b591bd2ff13b1aadef2e6b4bf9147f4a0926613b7c9343feb312']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53469-82f8-496a-821f-42b802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a46508ec9e48c256261b2d1914532a36ac7da093253320135d77581051751b75']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5346a-7a80-4ba3-8a68-478702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a7e27ff0695a4bdf58c584f48664acd3a385ccebf3a542fdd6d7383f414aa83a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5346b-7134-4013-b1aa-476802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a804beddd22bb76ea207a9607ed5c888f2f640cbd9ed9a32942fcd0b8a25c4d5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5346b-a804-4cec-bf79-4f2802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ae5ab2e887a9b46ea7819b7ebbb8163028e66882c97e75b0698dc3a69a69d7da']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5346c-7c4c-4f76-8d07-416402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b2fb7d2977f42698ea92d1576fdd4da7ad7bb34f52a63e4066f158a4b1ffb875']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5346d-4f54-433f-acd8-4fc802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b9434e5a14159c49af2d1a5a11d570f195797d6b17aa560c3dde4a5b3486bf2a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5346e-e418-4d10-b97f-4a8402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'be2be662cc821a924d5641422dd1116e99188c6923da092ca3f0f8f862bd2d2d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5346e-f134-4185-bb83-435d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd01df47b6187631c9a93bdad1298439ab1a1c5529b3319f3614b6ec2455e5726']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5346f-d960-4951-b85a-4ceb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd1ba365e93ff0a4f3a2cb1d657568e583e3fbd7dbb1c2c52e28f16480324e3bb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53470-fc40-4655-afd5-4b9702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ddfc6bb4819527b2424d6e1a84f04b67adad79401e39efbffba5b7d727e732f0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53471-82f0-4ecd-8ca1-47a002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'df434f54802a6814628f30cae335c302bae7085c4e8314d71a41a47d9c410c39']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53472-0988-49be-a7c0-486302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e24715900aa5c9de807b0c8f6ba8015683af26c42c66f94bee38e50a34e034c4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53472-6b10-41b3-867b-44bc02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "custom developed tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f2296bcb6be68dfb330baec2091fb11a42a51928ba057164213580e6ff0e1126']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5352c-469c-4075-bdaa-43d802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '026be8a873560f1496c6961f6e36c312bdda01beacb17c4b744f35ee1923d061']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5352d-a294-4a83-949a-458402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '03c943f5cba11b09b9c3afa0705d4a027e5a9d81b299711740cc5aedfe4b4aa1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5352e-c81c-4b1b-ad1e-43bb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '03e5e99cc8280de4663c4b65bfd26782d4975258808a63a4b20bc068008df7f5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5352f-8188-4c27-a591-48ba02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '059e40ba91b2b2d827c200476fcbd0fad0d43ab198d0c206c996777d27e6de65']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53530-1d20-4382-afd8-4f8d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0669e61e51cf43daa431d52b5461c90bdce1b1bee03b087e4406c30264dcb9a4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53531-5150-4a90-adaa-4dcd02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '068b9a9194efacc16cf142814e79b7041b6ab3d671a95bb508dbd30061c324aa']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53532-ddac-4a12-a097-434e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0b4a90b823a581311c4acb59f35e32f81f70ca16a2538f54f4dbe03db93350df']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53533-80a8-481e-8a8f-417902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0b5316d723d1ebbec9aba0c9ff6761050305d644c3eeb5291b4e2c4de9e5fa15']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53534-56fc-4d6a-863c-458202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0b8d59312699739b6e6cb7aeb0f22a2eaebbb0fd898a97ef9b83e8d8e9ce67a0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53535-fe28-4684-9f2f-46a602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0dd13d2d0edbcf9d1825c2bfc165876ada2e4d04e2981a0003cb6503fad2287b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53536-f47c-407c-9e37-4d3202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0ddb7867e31f3f30cd1cfe74393f8ac5bbdc61538278de9219a49345f0d3af7f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53537-b224-4c51-a7e0-46c402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '13fed3accac4f38f28e606b110a3b7924d9c7a1a911f8c0613d0bb791e715267']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53537-7e6c-4432-8c92-4fd102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '151cf4c83722ba171ae42640e5e13af67ca06ee0a06a74afa53931acf6ac1506']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53538-c428-4193-86ca-453e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '17006d77cc1459aa3d70e4e9377edb2547a7446647aa9872c9dd9ad860ed7e39']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53539-e2a0-4a66-8b6e-40db02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1ec7e595677038145991c6d84dc7808602142f258c1f90e9486cca0fe531d74f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5353a-84cc-4289-a4ed-4eaa02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '208dc592111a8221a9c633efc120b890585f9a67ed340cbb5ec9db4cd5e164e4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5353b-6494-455c-823a-47b802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2124adbee89f2c1cb65896bed26e7ffa8bf0fcbdfeb99a9e751fea9cca7a896b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5353c-2d64-4e9a-8c0b-47d402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '22e97292671ada8deef4329eb115c52f6f1bc598bcf01a3961f1c35a2230a013']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5353d-06b4-45a5-9881-487902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '259a78122ef51ae503059143bf36941fc6090be83213d196ba3051ba36a0b2a1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5353e-eeb0-4f3e-b810-4f3902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '26564c23530dd14e0042e074f4178a5b2ad6fc8f51f10138fc39941a6303bff9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5353f-f880-4108-b24d-4d4602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '29453fa1772b6d7d33842d6abbe0cb55c4a4b66a00f43284c8724d7c16749a7d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53540-e238-41f4-aa03-41db02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2a072d9ce63a94d2530cf9f18a232c6a09f6c7bdff9dbe27faceef53604145ea']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53541-19f0-4c4d-bc30-4f4702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2c02d3d3fadd76f9d21f5c093459ddc0045c94f17679269eb7a2990a1a88cb42']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53542-5208-4685-936c-40fd02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2d55000bb5cb9e3e1f137810c2e1eb899f68c40e4a6f6307f226c7b8af208abd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53543-bd88-4030-8531-496c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2ded2f3b5b5b6155ce818893c67887cbfa8b539be6c983e314ccf2177552da20']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53544-2a30-4186-bfed-4a6c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2e89436b355550ceb361fac1b03b78b71eda11d25f26223ac5c8c34ed8972a05']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53545-c62c-4df1-bc2a-485002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '32b0e6394b110860371da5541946a6dcc85358a3951eddc86fdaf5794527c150']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53546-0f5c-4eb5-abd5-4e1002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '33934fcfae5760316b3f40e013cbb03d8086f8c30f9a4ba9bed3f9486a530796']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53547-bc40-4ccf-aec8-424802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '34d86602882e86f8aaaeb7513126c8579a4489f2be31c279188e2f2ca8a0e141']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53548-08d0-4e8d-a16c-450902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '390162dae62a0347e35cf5dad093cfc2f7d4ded62fba9d2df7af6133feb41ee0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53549-f1e0-4564-87d2-4f7502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3ef8602579c6b145fbaafc8970b4c9a6e7bebd11eb5e37eecaa67b4572c6038b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5354a-3e58-40f4-a322-45aa02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '420acd7e8598fe994b59bf5d30f89e1c11b36cbef464a4786694cf9eada8dd4c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5354b-4dd4-4881-922c-41a502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '42b4c39179f76ea9eb5835b55a3cf4d8dbb29d42ee0622ad2e89ca48d01e8988']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5354c-fa38-46be-b0b0-457002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '42eed03907c9dfa0e566fbe5968cdb5a1b7b5e18521f7327185ed2208c6c29b4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5354d-daf0-407d-83c7-457a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '46a39da996b01e26ddd71d51c9704de2aa641cd3443f6fe0e5c485f1cd9fa65d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5354e-1904-40f6-abb3-479a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '47d929c69bfd8d8efb9c280eabec2f73d4bddf1c3c30120c3fb6334623469888']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5354f-887c-4604-9f3f-4bc302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '505ef8cbc1271ce32f0c473468d75a1aba5073c37b2e6b49293ddc9efcb4ac96']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53550-2e68-4799-882a-46cd02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5230453eeb98c5a183129ed8b918b429e96020887302ba30941c408108a1ab84']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53551-88c4-4470-b2c8-4cd802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5363220b532d7da378b338e839a501ae5c006cc03c8b2d3627c480d64deb1221']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53552-ed64-4007-9ad6-469a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '558f33d478091993e5b5921604f8c3873efc87f551fddf61612b5c64d5b610f6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53553-dcdc-43d2-bcdf-4efd02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '55c76f4f93f9e155fbb6a28447f97c1ccda0081061dc3cb9973d42c1686964b7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53554-72e8-4a32-a7b6-4c0402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '56c8246819f7de5cba91001793831441d4ce998ccb8237cb96c9f52e88ea384b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53555-b884-443f-8622-4a7a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '59bddb5ccdc1c37c838c8a3d96a865a28c75b5807415fd931eaff0af931d1820']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53556-d5c0-4e96-96be-428502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5ac627f8964d3b9cad69f21e3b8f27305f1f68f49e4f4fae2c73949a04b32692']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53557-e71c-4a59-8c9b-48a002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5ccc76ae1cdf668ba7f89c6cbd0bad44f148cbee736320ead237262ba170ffba']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53558-d708-41e9-800e-45c102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5cd4401c1dae9b9ecd75c96ab29dc64ce40bef3acc6faf7c001ff98ebd3b3413']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53559-b644-4174-a457-416302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5cd72eaf555813f1ee187def594584f5cfc6a5e83086f35e281327b5210adffb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5355a-bb90-4258-aa7c-41b702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5f8293eda9fb40684caddf576eba6c81f3a06911ca9e4ecf84ede3b2891cff5e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5355b-c67c-4db7-8189-45cb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6c258151c593268c13c252d8f275192a6f7a74d5de5754f2cf20fb94be7ee6ea']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5355c-d0a8-43d8-9e32-4d8002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0458e168baa4fa5942892065925ac82b12245551b539d54c2884b3a21c2699d8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5355d-be18-448c-b5e3-47f202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '877f1de209eb9d8b2a20a76f8773d12e5a1fcde4148868c7b73added392f62f6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5355e-7c0c-4ae1-a0da-43b202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '29c728a169c5d18298e77db161dd5d2f6396ceca9ee7849b63ff8a8bc11f911e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5355f-afe0-4e7e-9074-43b602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '98e092b7bfc3bbdaeb82e05de14ba5835c6ac626c17de9eef2049796a031dd10']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53560-a01c-47d4-aac4-44fa02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '27e08fb90ada2fd8ce6b6149786edd3b814dd0324257ebd919ed66ada0334b21']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53561-f030-4e3a-a34c-45eb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9f651ae6ea538238748614a7f86fe2b0f76e881d6c38da581f284e4b6f79b0ca']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53562-91a8-49a2-b33c-46fb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f47115ea58615781e56dcac673c19edf7ce00defd7ada709ae97b0708d3eac1e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53563-ebc0-43da-af90-4ba202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b80719854f8744ba62e9f0e774c09e2e2ed79dd37f9f94ba3ed05ec8507d55e6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53564-d484-426a-b9bb-4ae302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '467f04914a1e6093bdaf5c28884bf95ec738234033b3292d289a0799de196d49']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53565-c540-471d-877d-4d4102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5c47d18b3f0e0274c6a66b2eab27d47c73a0105c263d41c6473aba9a28d0a4ba']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53566-6240-4962-911d-493302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '01c5729ac1ae3928053c085fd616323a3715863ab3d7e9b8106c09e24df34183']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53567-e124-4404-963c-401b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5b6a691cf8faf238b27861941a1b667d889889cc9711a3e561403d6a6ed292c9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53568-4494-4b93-a392-413c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e2688f72cc7ae836be19e765e39318873554ee194a09945eb3f3805d04f256ca']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53569-c1f8-4ddf-8b4b-435502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9f0228e3d1577ffb2533584c2b1d87ebee0c0d490f981e61d18bb27ab02e52cb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5356a-4d90-42d3-bda7-4c6f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2617f9301869304b88d8a3a4f7b2eab6b0edf264cc1a28b99f5685959242ec39']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5356a-d76c-406e-a227-443c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f3107a5a00f36e12be7cc2e37c35903ef855b8043492af374ea918385821443c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5356b-77cc-495c-833c-44db02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '63fcfab8e9b97d9aec3d6f243003ea3e2bf955523f08e6f1c0d1e28c839ee3d5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5356c-83b0-4fd6-b3c7-48f802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '05cbe01b1125897e0e982c587a10a72f4df795b844a4a2c4cec44aee7f30ce94']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5356d-4440-46d9-91bc-40a002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5a7da102c11960b9651650143a4a08ae4ce97d68dff999961f1ffc792531afeb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5356e-9dc8-45ad-8278-4dd902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'df6112e6bad4125b80b8829c13a2ca523bb82cf303cf531389d8795e7512c7e6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5356f-074c-4455-91cf-434302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'cfb8216be1a50aa3d425072942ff70f92102d4f4b155ab2cf1e7059244b99d31']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53570-27f0-49cd-b2d9-416202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e79dbcc8b60da280e53d9cf818eee1de34251e0551b9947bb2b79a31b131417e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53571-fae0-4730-8c18-40a502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a73eac15797130c381b5b4a65c3fb1cfc723b1586a1882c981211787bba285a6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53572-3ecc-4526-b5c9-42b402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3ef3a06605b462ea31b821eb76b1ea0fdf664e17d010c1d5e57284632f339d4b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53573-41d4-4503-b25f-481902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f2355a66af99db5f856ebfcfeb2b9e67e5e83fff9b04cdc09ac0fabb4af556bd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53574-8bc4-4eb1-a112-48c002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ca87eb1a21c6d4ffd782b225b178ba65463f73de6f4c736eb135be5864f556dc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53575-f60c-4c5c-b037-425e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '550ee89d5df17f90ba7689d957cd067dcdbe3d957c5369ea28d925e02ccc8ce6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53576-acd4-47a3-89c4-42ba02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f77d7940c51c2a1eab849dbd77e59c683ebf7820799ef349e7da2583e1aa11ae']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53577-3910-4b1a-bc48-464702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2c5d55619d2f56dc5824a4845334e7804d6d306daac1c23bec6f078f30f1c825']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53577-c6b8-4de6-b3a2-4e7602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7231177a115656041ba4e5b3cf0bf7a547b074f03592351484267e25cda7c899']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53578-18b0-4178-b145-459102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd5405f99cec0166857274b6c02a7ef52b36274fedb805a17d2089fd24ed133cf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53579-4438-46b3-9879-4e1f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '81921b6a7eba39a3f73895a57892ed3a46ab6365ac97d550ca3b9bff46c7a1c2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5357a-08c4-4ef3-821a-4b8702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1eef9f8d7d3099b87be7ac25121f9d2ccacfb5ccf02b508fb2036b6e059c525f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5357b-ed6c-4e82-b92f-410602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5255061c3600df1a94b376fca40f3ccb69d1cb6dd42aa744b20a643c7292d20c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5357c-8fa4-41dc-a847-4b5702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b5199a302f053e5e9cb7e82cc1e502b5edbf04699c2839acb514592f2eeabb13']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5357d-3408-489c-8d32-4d8d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5fb7f6f953be3b65d88bd86d1391ebc9f88fc10b0ef23541463ebf5b157f695c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5357e-8ab8-4f6d-9283-412b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6016cf9898d74e2e9030be7c987964d817ba28ad2253d1da54c81a1bf49db836']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5357f-c540-4c25-8391-401d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '621e55421dffae981e3e933c65626314d5610c7c08f76f83a3d07f0ec6c36e2d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53580-3680-4e5a-8ec7-424b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6ccc24971073d24d90c4cbaf83dfbae2969cbf527e319c7ee9a4babcbe88e456']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53581-7910-4abe-9266-482602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6f8da9180eebe02ba35317cb8aee5c8df6ac29795af70eb9430c3588d457aad6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53582-7f64-4583-a21c-424202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '71c5b899a5187baeb8f605ca39ca56bf05a63025a8f9f84c45590d8345e5d349']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53583-ed9c-4ae6-a124-4be902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '725b7d92ed66be160f2e04395008a65c72814d5ddf842d9778396f6c6679d85e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53584-deec-4e77-8d42-4e6902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '72d4b780a90ede7ea152f5da0973965cab31d2813fa8c2fe0e1cb611f5ca257e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53585-3eb8-4d61-954a-4b5802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '73670d06851f588c7df44dc478f49883406697c48c618438e0f249b7a916552e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53586-f81c-4f99-acb2-45db02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '74e017853fbc85ee77ca7476cd25423815602aaaa02b29e0003c95c9551b8890']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53587-8bc0-4c89-ba4d-495102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '75d2367dc79d9f8aed165729df90ed5d28fefe267778dbe4d3d74aafa75d66e0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53588-9a38-4f22-a36e-484c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7a5a1c6ea0c2f017df9f06975c93a356cac20b19031fcde96136fa5881e5ef3a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53589-f560-4a11-8056-436202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7adb049e0b49312aea904c70e16d0e7f03d01aae4bf8ac867e8219ced4e6e057']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5358a-e94c-4a72-acb4-48fb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7bfa85bec239b6c4419b2d57149c5960263c80e493f888d03ceaaa3f945b1b25']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5358b-6c44-44ea-b1e9-412902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7f324b658f587b3b27921ebeba5ac25aebd669b33e6801fa9581de8c2eb0df2e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5358c-94c8-43de-8c1e-472f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7fee970748eb83045e36911dafdaee0d4069ebe72c059cc7de3d65539012c2e9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5358d-e408-4a81-8835-4c6702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '823793a37d748ffe708864c16c853c67a5db812712481da1d24790b455163940']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5358e-f168-4fc8-8ce4-46e502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8512aabfa0175684bdbb77481d6b272b63dbc4249b04a44e1003b7d8fdea0a89']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5358f-9b60-4415-aaa6-4df202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '86c81f03cf7d8f8af38c2559dbf506cccdc25579f3b29fb574f823a67f99a0a3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53590-f804-45d8-9623-4e6e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '88ae7e60b9dd57fc6b2d667ce33fb29c0f75d37eb7c837ccf56cb7994386d5ef']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53591-b73c-449c-b414-4ca002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8b50e3ca06a22d0be6a71232b320137c776f80ac3f2c81b7440b43854b8a3bf0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53592-2ba0-43f1-96c1-4c2602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8bd40e7fe6bbd4d5810db2c142186bb58da445a132fb6f9ff01c46947a532244']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53593-3810-48b7-a267-4c6202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8c9d690e765c7656152ad980edd2200b81d2afceef882ed81287fe212249f845']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53593-1854-4df2-a072-4fea02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8d38726d674279705fe06b4b45bbbaef10756c547d560cea6998e23dba09f80c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53594-49a0-43a8-a901-4f8402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8db47439685edc683765abb5e6d7d0d05479bf9ee164992db9e8ce97fe43ee2f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53595-3288-43ad-b0c4-44c102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '95de2e16f1b05d1b45b1d182c1503568c2e5fd4a81ac52fe1bc9e881d1a272b1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53596-74bc-49dd-b978-412702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '95e3204228341852b7c97f357f799e7ec9688abe1262436b569e56397f1fd864']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53597-1b24-4933-a346-428802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '98caf00760d772598386eb8d4f26caf92fb891915ac08da6bf830be5e45278d3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53597-40fc-466b-873c-4edf02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '99c9440a84cdc428ce140de901452eb334faec49f1f6258acdde1ddcbb34376e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53598-8050-43a3-918e-4b4f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9a8776e4ae38cf529bab28947b31ade84301262b7996dc37ec47afa4fb4cf6e1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53599-eb98-454b-83ee-40c302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9beb1d2a03ff2d4c15913de0f87b72074155b44df791bd967dac8155e97a0e06']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5359a-3f2c-408a-9774-46ca02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9c8d518fbbc8cbb25fa309f5396efa5749e57a3b0158779404c8d3e92baf6596']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5359b-d648-43ae-9929-4e9502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a064a28e5e7409a96bba93fc57f44cadc3492bb0f49792c89c973e30b0f5d498']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5359b-0720-47b1-93e7-4a9e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a194b47043356fa365d98a5f7c582b6f87fac90acf0f469ed3651cfe2fd7b2c9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5359c-6e70-44c0-abb0-48cc02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a21dfb8e8b7c8dfbeeb4d72e6ef1f22c667b8968b3a3b1dcce99f44faab05903']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5359d-ee58-46fc-bd4f-465002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a2e0fe2d385dabcdfb024100216d259ddd1fa9907e982d297846fd29b8d4d415']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5359e-8160-4a23-b990-4e6402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5359f-2678-4392-83e2-4bf202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a595da9a2fa58d4f8be0bfbcf7f4c950435ff5289dd1ccf2c65eec73a0afe97f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5359f-6de0-4c7f-9f94-405602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a972ad0ddc00d5c04d9fe26f1748e12008efdd6524c9d2ea4e6c2d3e42d82b7b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535a0-e7f8-4495-8b04-4fab02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'aa860d405746401ae4155485326fdeb39718832c77c73540d48f4fbb8e596215']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535a1-5834-476c-83e3-4bb402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ab6832a4432b4bdaec0706f7b00a369c48175eac9abc3e537032b1f5d26a993b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535a2-c2e0-4060-b2e2-430a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ada2f0703614b3447d427827777af5d4ee9ffe9179498970326926751a4f8d65']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535a3-58e8-46f4-9b8e-46ba02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b16d317c11228bd3573126a0e1bc0bbf35d84a4a1f47dfb06b70634a21fd9823']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535a4-4b30-4888-bce8-447a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b3665548cc0f2fce3593fb7139f49588faa1d327b6d23feb564ca4194053ae8a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535a4-1ca4-4e00-9507-44b902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b5578c48a11533871ae91e6d5632aafc25d3976c0626d62abab306663566d024']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535a5-3820-4183-8daa-4bfe02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b67a6f87fc3fd7c5c3666acac5918c8c08a53ab6a966f4d1daf38105a566ede1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535a7-57a0-4cd4-99c7-415802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b6abc8ab631dcf52e028ab26dbe3bb94022d69193c0acc8642cbd6329cbb23ef']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535a8-b4f0-40c8-ba8c-48c802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b7e117eb342b0d450095805073326989c792bf5ccbbdcd5f4a9ace50e517412e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535a9-f55c-459e-9642-44c902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'bb14abc9b0798c7756a6ed887308a3e6210cc08a5149dc1360fdd1f5bca27cca']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535aa-3bd4-4c39-bee5-4b4702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'bdadb319f071f02462d107380102b669e407bb2a0b20e77a9a8a5726b4cbbc4b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535ab-6090-4a82-ac21-42c702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'bf2383cfbee4cbb0bda2614839454ab1724c9bbfff8b4b48e0f48579ae220c10']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535ac-c000-4337-83af-42f902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'bf52b44168de1855d83186163a2d5f29e488ddafdfd5447e211aec4a769cf74a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535ac-0550-4b7a-9f10-4a7802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c0d5cf7a0035deda5646aaf520b3ff632aa6be76ddbc88f38ddc11e77ffb40b4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535ad-e54c-42ef-9b9e-4b9502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c1a82a788df7418712664138c0fdb05232036a27ab0998479d60c656998849f1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535ae-f744-42b5-a476-4a2202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c63a523834ab59ab5621a0acb156a9b901befe806044642fe5fec8a0ba545e70']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535af-eda8-442b-a2ad-427002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd05d3f3582e13eaf5f39d7143ca1a4b1367cc5267bf9958a15e27cf53e059518']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535b0-0754-42d1-b8cf-45eb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd0e456cff03c2483ded9a0f8c1b99f9fefb6ba47dcaf949dae27abe940ee20e6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535b0-1cc0-449a-adc6-439e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd8a01f69840c07ace6ae33e2f76e832c22d4513c07e252b6730b6de51c2e4385']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535b1-6190-40ee-830a-4d1e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'dada74663e3e29ee26bfd03a888f0bda9fc81e148511fa98f73f8e8a915933cc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535b2-39e0-4f39-a37c-4dd902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'db3ffcbf136e0268ec66f28b30fa8ba350f74e02e8e737e61cc6ef8d8258027e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535b3-f804-498d-993a-49e902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'dd26b85b6568595b1d2bbc47ce47d071ede75665fbd779d637b74663ead5539e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535b3-13f0-47fe-93df-457302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'df9038660164623a827a8119d4cb3d71d0a5288b12bdfdd32c72769bf90a9ea0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535b4-7978-49be-be6f-469a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'dfed16e9184a86e6fcd17a98f127410840d058db667e9975b43add100c33122e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535b5-1ebc-4f22-a1af-46cb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e0063d2524a89159cf5da12661225fbb27725bbd72acd9497b7207ecf2f3aeb6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535b6-242c-426c-8e2a-4ed402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e00c55ddda9cbb82fb47924fafdf40c3394dc1127d9901c71a69ef3ef664b817']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535b6-5f44-4bd9-aa09-440f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e14a51d69211948163ab20b0cc68adf410bb821f2890f55d2d202c745f4ec1b8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535b7-62c8-4514-97e1-484702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e2e3f243bbcad666852e64202d35f6dd88c58f5d24435d92975697b0efa8a775']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535b8-ca4c-4ddf-b9be-478702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e37e25739e8bc4620d9d37d8f6b400cd82c85b89d206436ba35930ed96db6eb0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535b9-4324-44f8-aea3-450c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e55b5ede808b6d491f18737d6a1cf34b5178f02e9ea01d7cff31a449888dbd73']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535b9-7ea0-4f64-9872-485902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ed28d9207acac2afff817eaa56d1599422e23946dffa4f8bade376d52a6af7d4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535ba-c50c-49f7-84b2-4b3002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'eda0853e814ee31a66c3b42af45cd66019ffd61eac30e97bd34c27d79253a1bb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535bb-730c-4ffa-b606-483302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f1b3e58d060803b0ff6008386bab47fb8099ac75ee74f385ac34340a28bf716e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535bc-9b10-48dd-bfb8-4d6002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f2091f71227180d74ba1ba4607635e623553b1826314dca91cb31839eb00c4ea']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535bc-ed20-41ee-a25f-409502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f214d55ccb5db5edbaafe7d40b240c79f04c70d441adee01ef438f776eb37037']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535bd-33e0-4f76-bcdd-451f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f571ddc894915dee136cf24731ff3d79fe4f811b112d122a34a128628cb43c4a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535be-edf4-4590-a470-427002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f7676d2a28992a382475af2ae0abca4794e1397ef3327f30f7d4cbdbc2ca0a68']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535bf-1908-4245-acf0-4d5e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f8e20894c8c18d79e80b431008aa8bef46cc10a355a4934f9cc40ffd637b8890']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535c0-3f84-4c6f-8f77-45f602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'fa1bf7565352099b74624c8beeff6620411e1efe00e54f8b4190f69e243d5811']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b535c1-4920-4b80-82eb-4c5b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'fa784f69265ebe5e150cf5956a40d86335d1a5edc57fffcc7ce6eedc591c2751']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5375c-24a0-460e-a2db-454602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:39:56.000Z",
|
||
|
|
"modified": "2017-02-28T08:39:56.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: f8e20894c8c18d79e80b431008aa8bef46cc10a355a4934f9cc40ffd637b8890",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '7b10cde1c7079a7762294ec8237ef167865c241e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:39:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5375d-8138-4acd-b41c-40f202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:39:57.000Z",
|
||
|
|
"modified": "2017-02-28T08:39:57.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: f8e20894c8c18d79e80b431008aa8bef46cc10a355a4934f9cc40ffd637b8890",
|
||
|
|
"pattern": "[file:hashes.MD5 = '07718813324d756b06817736070ef75e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:39:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5375e-978c-466a-9dd4-4f1d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:39:58.000Z",
|
||
|
|
"modified": "2017-02-28T08:39:58.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:39:58Z",
|
||
|
|
"last_observed": "2017-02-28T08:39:58Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5375e-978c-466a-9dd4-4f1d02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5375e-978c-466a-9dd4-4f1d02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/f8e20894c8c18d79e80b431008aa8bef46cc10a355a4934f9cc40ffd637b8890/analysis/1474518450/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5375f-eee4-43df-961e-492002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:39:59.000Z",
|
||
|
|
"modified": "2017-02-28T08:39:59.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: f7676d2a28992a382475af2ae0abca4794e1397ef3327f30f7d4cbdbc2ca0a68",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '922955417c0580305d53161b5e48124b2a4cf40f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:39:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5375f-0954-4a04-9875-47b302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:39:59.000Z",
|
||
|
|
"modified": "2017-02-28T08:39:59.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: f7676d2a28992a382475af2ae0abca4794e1397ef3327f30f7d4cbdbc2ca0a68",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0059a7fd54f47a01a1599d3db38a0b52']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:39:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53760-4eac-4afd-bcc4-443002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:00.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:00.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:40:00Z",
|
||
|
|
"last_observed": "2017-02-28T08:40:00Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53760-4eac-4afd-bcc4-443002de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53760-4eac-4afd-bcc4-443002de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/f7676d2a28992a382475af2ae0abca4794e1397ef3327f30f7d4cbdbc2ca0a68/analysis/1477747471/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53761-aa60-4a92-944d-40a802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:01.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:01.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: f571ddc894915dee136cf24731ff3d79fe4f811b112d122a34a128628cb43c4a",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '5cc1bb3b94ccc32fe8657386b07dcef188da2dca']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53762-2ec4-4904-b239-4d2802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:02.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:02.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: f571ddc894915dee136cf24731ff3d79fe4f811b112d122a34a128628cb43c4a",
|
||
|
|
"pattern": "[file:hashes.MD5 = '7d271963e2053ee9864ad52e8e234942']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53763-868c-4f8d-90a9-40f802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:03.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:03.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:40:03Z",
|
||
|
|
"last_observed": "2017-02-28T08:40:03Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53763-868c-4f8d-90a9-40f802de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53763-868c-4f8d-90a9-40f802de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/f571ddc894915dee136cf24731ff3d79fe4f811b112d122a34a128628cb43c4a/analysis/1470165036/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53764-e018-4a38-8b82-457a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:04.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:04.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: f2091f71227180d74ba1ba4607635e623553b1826314dca91cb31839eb00c4ea",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '8073bcf9a6b5eb0b591495810ff6c22a5739b694']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53765-d1dc-4e1c-8d04-46ec02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:05.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:05.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: f2091f71227180d74ba1ba4607635e623553b1826314dca91cb31839eb00c4ea",
|
||
|
|
"pattern": "[file:hashes.MD5 = '83e41cd0351415727d6a37711b4bfda1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53766-9740-490d-ad83-47c202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:05.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:05.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:40:05Z",
|
||
|
|
"last_observed": "2017-02-28T08:40:05Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53766-9740-490d-ad83-47c202de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53766-9740-490d-ad83-47c202de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/f2091f71227180d74ba1ba4607635e623553b1826314dca91cb31839eb00c4ea/analysis/1475018419/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53766-6858-442d-bc5a-47cb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:06.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:06.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: f1b3e58d060803b0ff6008386bab47fb8099ac75ee74f385ac34340a28bf716e",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '1c238cb192413ebd8f9148649679ce261d9ceb42']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53767-22a8-48db-846c-423b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:07.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:07.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: f1b3e58d060803b0ff6008386bab47fb8099ac75ee74f385ac34340a28bf716e",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0e7ce104af674671dfc457856b478301']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53768-3df0-47d9-86f6-4fc902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:08.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:08.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:40:08Z",
|
||
|
|
"last_observed": "2017-02-28T08:40:08Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53768-3df0-47d9-86f6-4fc902de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53768-3df0-47d9-86f6-4fc902de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/f1b3e58d060803b0ff6008386bab47fb8099ac75ee74f385ac34340a28bf716e/analysis/1469092836/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53769-d724-4720-989b-430402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:09.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:09.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: ed28d9207acac2afff817eaa56d1599422e23946dffa4f8bade376d52a6af7d4",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '1f49c6973d047a4e129a86d6056bb865c5abd5a6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5376a-8348-4f6f-a0e8-4f6e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:10.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:10.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: ed28d9207acac2afff817eaa56d1599422e23946dffa4f8bade376d52a6af7d4",
|
||
|
|
"pattern": "[file:hashes.MD5 = '3639dd544ce68403a80db20d71717ca2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5376a-6ef4-484b-8735-40a702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:10.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:10.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:40:10Z",
|
||
|
|
"last_observed": "2017-02-28T08:40:10Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5376a-6ef4-484b-8735-40a702de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5376a-6ef4-484b-8735-40a702de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/ed28d9207acac2afff817eaa56d1599422e23946dffa4f8bade376d52a6af7d4/analysis/1485245095/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5376b-660c-4423-9b79-49dc02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:11.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:11.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: e55b5ede808b6d491f18737d6a1cf34b5178f02e9ea01d7cff31a449888dbd73",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'cdb65c2655972820ae13af5ff7f6314eab6bac76']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5376c-ccc8-45c9-86aa-4ec602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:12.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:12.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: e55b5ede808b6d491f18737d6a1cf34b5178f02e9ea01d7cff31a449888dbd73",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c62438a6ab1d37df5afc712ce14995d9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5376d-7580-49a0-be6f-453602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:13.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:13.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:40:13Z",
|
||
|
|
"last_observed": "2017-02-28T08:40:13Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5376d-7580-49a0-be6f-453602de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5376d-7580-49a0-be6f-453602de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/e55b5ede808b6d491f18737d6a1cf34b5178f02e9ea01d7cff31a449888dbd73/analysis/1445864779/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5376e-7a98-4734-92c3-488902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:14.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:14.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: e2e3f243bbcad666852e64202d35f6dd88c58f5d24435d92975697b0efa8a775",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'cb37d45efa9e021a284fae288a031c267d414e97']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5376e-73f8-4727-8c0a-467e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:14.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:14.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: e2e3f243bbcad666852e64202d35f6dd88c58f5d24435d92975697b0efa8a775",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd6fd77af20a48c0b2f50507e8d8255fd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5376f-f6b8-4bfb-99c8-478402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:15.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:15.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:40:15Z",
|
||
|
|
"last_observed": "2017-02-28T08:40:15Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5376f-f6b8-4bfb-99c8-478402de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5376f-f6b8-4bfb-99c8-478402de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/e2e3f243bbcad666852e64202d35f6dd88c58f5d24435d92975697b0efa8a775/analysis/1486203374/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53770-0d3c-47a4-9d10-414802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:16.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:16.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: e14a51d69211948163ab20b0cc68adf410bb821f2890f55d2d202c745f4ec1b8",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '29bbc72aed8ab96e07d100cf1bc29448219bdf71']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53771-fddc-408f-b253-422b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:17.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:17.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: e14a51d69211948163ab20b0cc68adf410bb821f2890f55d2d202c745f4ec1b8",
|
||
|
|
"pattern": "[file:hashes.MD5 = '1c92c9f78a62d586c4da3e7f465ab048']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53772-fc10-438c-a96f-452602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:18.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:18.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:40:18Z",
|
||
|
|
"last_observed": "2017-02-28T08:40:18Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53772-fc10-438c-a96f-452602de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53772-fc10-438c-a96f-452602de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/e14a51d69211948163ab20b0cc68adf410bb821f2890f55d2d202c745f4ec1b8/analysis/1483678255/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53772-f9c0-4c3e-90d9-4a8702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:18.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:18.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: dd26b85b6568595b1d2bbc47ce47d071ede75665fbd779d637b74663ead5539e",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '2444e176ab3647acd17a26ea72b910259a3038ac']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53773-fb60-496d-a96f-446f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:19.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:19.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: dd26b85b6568595b1d2bbc47ce47d071ede75665fbd779d637b74663ead5539e",
|
||
|
|
"pattern": "[file:hashes.MD5 = '104af13d191c874bcddf9f8158133ad7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53774-8320-4f93-a4ce-48e602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:20.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:20.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:40:20Z",
|
||
|
|
"last_observed": "2017-02-28T08:40:20Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53774-8320-4f93-a4ce-48e602de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53774-8320-4f93-a4ce-48e602de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/dd26b85b6568595b1d2bbc47ce47d071ede75665fbd779d637b74663ead5539e/analysis/1462774417/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53775-91cc-4a44-b663-4f6002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:21.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:21.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: db3ffcbf136e0268ec66f28b30fa8ba350f74e02e8e737e61cc6ef8d8258027e",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '63952759312c606dad566144b03287660ae41969']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53775-6f24-40f8-8f99-454102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:21.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:21.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: db3ffcbf136e0268ec66f28b30fa8ba350f74e02e8e737e61cc6ef8d8258027e",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd43ff3500b0f36a74d93265a8a24661a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53776-8314-4d86-a8a6-435402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:22.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:22.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:40:22Z",
|
||
|
|
"last_observed": "2017-02-28T08:40:22Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53776-8314-4d86-a8a6-435402de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53776-8314-4d86-a8a6-435402de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/db3ffcbf136e0268ec66f28b30fa8ba350f74e02e8e737e61cc6ef8d8258027e/analysis/1484043201/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53777-37c4-46db-a7ff-455a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:23.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:23.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: dada74663e3e29ee26bfd03a888f0bda9fc81e148511fa98f73f8e8a915933cc",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '98ba86a7b88873cf86896267a018fd6407d0528f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53778-1b28-481b-b85b-433a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:24.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:24.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: dada74663e3e29ee26bfd03a888f0bda9fc81e148511fa98f73f8e8a915933cc",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'f763efb0ea9503aef01efa29756dfbb0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53779-8e60-4097-b394-464802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:25.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:25.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:40:25Z",
|
||
|
|
"last_observed": "2017-02-28T08:40:25Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53779-8e60-4097-b394-464802de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53779-8e60-4097-b394-464802de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/dada74663e3e29ee26bfd03a888f0bda9fc81e148511fa98f73f8e8a915933cc/analysis/1481485981/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53779-9b9c-49bf-b59c-404c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:25.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:25.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: d8a01f69840c07ace6ae33e2f76e832c22d4513c07e252b6730b6de51c2e4385",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '6a28a3821b272c38f9a53b9d6b32395d9008c8f4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5377a-c30c-4e4d-9b7e-4e3b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:26.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:26.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: d8a01f69840c07ace6ae33e2f76e832c22d4513c07e252b6730b6de51c2e4385",
|
||
|
|
"pattern": "[file:hashes.MD5 = '54c6f440dce326a8f7f628d2bd0e757c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5377b-d1ec-43e3-8297-4c5a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:27.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:27.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:40:27Z",
|
||
|
|
"last_observed": "2017-02-28T08:40:27Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5377b-d1ec-43e3-8297-4c5a02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5377b-d1ec-43e3-8297-4c5a02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/d8a01f69840c07ace6ae33e2f76e832c22d4513c07e252b6730b6de51c2e4385/analysis/1488261984/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5377c-74a8-4211-9e5c-4af702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:28.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:28.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: d0e456cff03c2483ded9a0f8c1b99f9fefb6ba47dcaf949dae27abe940ee20e6",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '93dabc67ab3a0a18a21d3bda1e0b9268b75ccbec']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5377c-a6d0-4bd9-bc05-479702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:28.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:28.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: d0e456cff03c2483ded9a0f8c1b99f9fefb6ba47dcaf949dae27abe940ee20e6",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'cbd7444ff56eadceaa498a412b59115d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5377d-8560-495f-87fe-426d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:29.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:40:29Z",
|
||
|
|
"last_observed": "2017-02-28T08:40:29Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5377d-8560-495f-87fe-426d02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5377d-8560-495f-87fe-426d02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/d0e456cff03c2483ded9a0f8c1b99f9fefb6ba47dcaf949dae27abe940ee20e6/analysis/1447045111/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5377e-4e58-423a-8f50-482c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:30.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:30.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: d05d3f3582e13eaf5f39d7143ca1a4b1367cc5267bf9958a15e27cf53e059518",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '098b7d7a3b2039d26cbb3e307dde6e373c2cb0f6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5377f-ff30-4eed-9e6d-45d102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:31.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:31.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: d05d3f3582e13eaf5f39d7143ca1a4b1367cc5267bf9958a15e27cf53e059518",
|
||
|
|
"pattern": "[file:hashes.MD5 = '6d7aab459cbc263266ed819470425c3b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53780-c4c4-40fa-a4c7-403602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:32.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:32.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:40:32Z",
|
||
|
|
"last_observed": "2017-02-28T08:40:32Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53780-c4c4-40fa-a4c7-403602de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53780-c4c4-40fa-a4c7-403602de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/d05d3f3582e13eaf5f39d7143ca1a4b1367cc5267bf9958a15e27cf53e059518/analysis/1479848407/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53782-9bec-4348-bfc1-4fdd02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:34.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:34.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: c63a523834ab59ab5621a0acb156a9b901befe806044642fe5fec8a0ba545e70",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '54836905229eff4b50da25a06e912f02498a0608']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53783-6cc8-4e21-a824-4e6c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:35.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:35.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: c63a523834ab59ab5621a0acb156a9b901befe806044642fe5fec8a0ba545e70",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'bcf527c1c088bba2462eedf5b1db1799']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53785-2018-42fe-9130-437a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:37.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:37.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:40:37Z",
|
||
|
|
"last_observed": "2017-02-28T08:40:37Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53785-2018-42fe-9130-437a02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53785-2018-42fe-9130-437a02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/c63a523834ab59ab5621a0acb156a9b901befe806044642fe5fec8a0ba545e70/analysis/1450031579/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53786-4cf0-4330-9f32-454402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:38.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:38.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: c1a82a788df7418712664138c0fdb05232036a27ab0998479d60c656998849f1",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'ffe5eb3f08e3dba8e5d7548fa2ae370caa02769c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53787-5058-4e88-9a7c-4fa102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:39.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:39.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: c1a82a788df7418712664138c0fdb05232036a27ab0998479d60c656998849f1",
|
||
|
|
"pattern": "[file:hashes.MD5 = '35286bdd954428cd8e7ffaa7208607cb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53788-de9c-4400-b110-406902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:40.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:40.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:40:40Z",
|
||
|
|
"last_observed": "2017-02-28T08:40:40Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53788-de9c-4400-b110-406902de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53788-de9c-4400-b110-406902de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/c1a82a788df7418712664138c0fdb05232036a27ab0998479d60c656998849f1/analysis/1480416045/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53789-b040-43c5-90ae-412202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:41.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:41.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: c0d5cf7a0035deda5646aaf520b3ff632aa6be76ddbc88f38ddc11e77ffb40b4",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c599700f3244f4ea3d5926bc6be693951c85f226']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5378b-ab60-4df6-bde4-48e902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:43.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:43.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: c0d5cf7a0035deda5646aaf520b3ff632aa6be76ddbc88f38ddc11e77ffb40b4",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'b8076c2d4c172e58042244d57630d697']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5378c-9280-47c8-9649-451e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:44.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:44.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:40:44Z",
|
||
|
|
"last_observed": "2017-02-28T08:40:44Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5378c-9280-47c8-9649-451e02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5378c-9280-47c8-9649-451e02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/c0d5cf7a0035deda5646aaf520b3ff632aa6be76ddbc88f38ddc11e77ffb40b4/analysis/1485245123/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5378e-57f0-44b6-847d-419602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:46.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:46.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: bf52b44168de1855d83186163a2d5f29e488ddafdfd5447e211aec4a769cf74a",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '13d0cc488d9a618d526a04785bf24da17ba5828d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5378f-4d34-4d6b-85da-4d3002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:47.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:47.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: bf52b44168de1855d83186163a2d5f29e488ddafdfd5447e211aec4a769cf74a",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'bfafb3f550646ccd6bb85df885a62e79']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53791-7834-47d2-9db7-493b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:49.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:49.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:40:49Z",
|
||
|
|
"last_observed": "2017-02-28T08:40:49Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53791-7834-47d2-9db7-493b02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53791-7834-47d2-9db7-493b02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/bf52b44168de1855d83186163a2d5f29e488ddafdfd5447e211aec4a769cf74a/analysis/1444921972/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53792-7d28-40df-9819-4cb702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:50.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:50.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: bf2383cfbee4cbb0bda2614839454ab1724c9bbfff8b4b48e0f48579ae220c10",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a2454e569fb85adc720ec58c9fbd90f3528c684f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53794-493c-48e0-a7f7-47d502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:52.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:52.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: bf2383cfbee4cbb0bda2614839454ab1724c9bbfff8b4b48e0f48579ae220c10",
|
||
|
|
"pattern": "[file:hashes.MD5 = '3941f4cf764c5ae4c7d84d4e90ab3d75']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53796-1de0-49b2-a601-48cb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:54.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:54.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:40:54Z",
|
||
|
|
"last_observed": "2017-02-28T08:40:54Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53796-1de0-49b2-a601-48cb02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53796-1de0-49b2-a601-48cb02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/bf2383cfbee4cbb0bda2614839454ab1724c9bbfff8b4b48e0f48579ae220c10/analysis/1476552687/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53797-cdb0-42aa-a5a1-4d5702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:55.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:55.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: bdadb319f071f02462d107380102b669e407bb2a0b20e77a9a8a5726b4cbbc4b",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '53361e9c1521f44e8ac0604630c57d1cefa3280e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53799-1a80-4ecb-858e-459802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:57.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:57.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: bdadb319f071f02462d107380102b669e407bb2a0b20e77a9a8a5726b4cbbc4b",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ee5cef330079f879cc34a21212bb374d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:40:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5379a-ff00-457b-9793-415302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:40:58.000Z",
|
||
|
|
"modified": "2017-02-28T08:40:58.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:40:58Z",
|
||
|
|
"last_observed": "2017-02-28T08:40:58Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5379a-ff00-457b-9793-415302de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5379a-ff00-457b-9793-415302de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/bdadb319f071f02462d107380102b669e407bb2a0b20e77a9a8a5726b4cbbc4b/analysis/1484745121/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5379c-3374-4ffe-b89d-4c8002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:00.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:00.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: bb14abc9b0798c7756a6ed887308a3e6210cc08a5149dc1360fdd1f5bca27cca",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '63d790740609d551f178922352ed9763483737cb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:41:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5379d-ec44-4dc7-b36b-4cb902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:01.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:01.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: bb14abc9b0798c7756a6ed887308a3e6210cc08a5149dc1360fdd1f5bca27cca",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ddb20b9e6fc94fc3f44f97aeca0fef0d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:41:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5379f-7cd4-46d8-a6ee-455702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:03.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:03.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:41:03Z",
|
||
|
|
"last_observed": "2017-02-28T08:41:03Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5379f-7cd4-46d8-a6ee-455702de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5379f-7cd4-46d8-a6ee-455702de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/bb14abc9b0798c7756a6ed887308a3e6210cc08a5149dc1360fdd1f5bca27cca/analysis/1461155780/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537a0-c0b0-420c-acfd-46b002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:04.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:04.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: b6abc8ab631dcf52e028ab26dbe3bb94022d69193c0acc8642cbd6329cbb23ef",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '4f022363033a992d2285b45a5da5feb63c10589f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:41:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537a2-3940-4ef7-8d89-4e0c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:06.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:06.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: b6abc8ab631dcf52e028ab26dbe3bb94022d69193c0acc8642cbd6329cbb23ef",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ec13726ed439be12d5ec583346eceb59']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:41:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b537a3-8944-4c6e-88b3-49c802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:07.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:07.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:41:07Z",
|
||
|
|
"last_observed": "2017-02-28T08:41:07Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b537a3-8944-4c6e-88b3-49c802de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b537a3-8944-4c6e-88b3-49c802de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/b6abc8ab631dcf52e028ab26dbe3bb94022d69193c0acc8642cbd6329cbb23ef/analysis/1476698586/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537a5-c714-4f1b-b644-487002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:09.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:09.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: b67a6f87fc3fd7c5c3666acac5918c8c08a53ab6a966f4d1daf38105a566ede1",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '021152c41e6b69616472004e32cfa3823e4c8a4c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:41:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537a6-10c8-4909-a5c5-4e1d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:10.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:10.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: b67a6f87fc3fd7c5c3666acac5918c8c08a53ab6a966f4d1daf38105a566ede1",
|
||
|
|
"pattern": "[file:hashes.MD5 = '2bc435a7020b2efd59cb6130c35f6bb0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:41:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b537a8-2234-4d40-9052-490802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:12.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:12.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:41:12Z",
|
||
|
|
"last_observed": "2017-02-28T08:41:12Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b537a8-2234-4d40-9052-490802de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b537a8-2234-4d40-9052-490802de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/b67a6f87fc3fd7c5c3666acac5918c8c08a53ab6a966f4d1daf38105a566ede1/analysis/1447547531/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537aa-9228-4e0c-a94d-4d8d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:14.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:14.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: b5578c48a11533871ae91e6d5632aafc25d3976c0626d62abab306663566d024",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '6b501bf77c0e2b71b6cab65f3a6de86bc77cb14f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:41:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537ab-f174-484a-9732-49b802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:15.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:15.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: b5578c48a11533871ae91e6d5632aafc25d3976c0626d62abab306663566d024",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'dc7570a3035f64a53862491667cb5974']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:41:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b537ad-631c-43d2-a1e6-468802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:17.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:17.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:41:17Z",
|
||
|
|
"last_observed": "2017-02-28T08:41:17Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b537ad-631c-43d2-a1e6-468802de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b537ad-631c-43d2-a1e6-468802de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/b5578c48a11533871ae91e6d5632aafc25d3976c0626d62abab306663566d024/analysis/1455526669/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537ae-fa3c-42b1-a36a-494102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:18.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:18.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: b3665548cc0f2fce3593fb7139f49588faa1d327b6d23feb564ca4194053ae8a",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '2d79ee6bef7f0d195e586aad5880771bd205fe30']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:41:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537b0-6818-43fc-97bd-4bfb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:20.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:20.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: b3665548cc0f2fce3593fb7139f49588faa1d327b6d23feb564ca4194053ae8a",
|
||
|
|
"pattern": "[file:hashes.MD5 = '5779db00cdafe2b228d0841272648323']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:41:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b537b2-ce88-4e74-a936-4d1402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:22.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:22.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:41:22Z",
|
||
|
|
"last_observed": "2017-02-28T08:41:22Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b537b2-ce88-4e74-a936-4d1402de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b537b2-ce88-4e74-a936-4d1402de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/b3665548cc0f2fce3593fb7139f49588faa1d327b6d23feb564ca4194053ae8a/analysis/1475132375/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537b3-8d28-4960-80ae-4f3602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:23.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:23.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: b16d317c11228bd3573126a0e1bc0bbf35d84a4a1f47dfb06b70634a21fd9823",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '9f1b5eb383ddc882cc29d9b07701ff51e98962e5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:41:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537b5-25d8-405c-b941-4edb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:25.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:25.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: b16d317c11228bd3573126a0e1bc0bbf35d84a4a1f47dfb06b70634a21fd9823",
|
||
|
|
"pattern": "[file:hashes.MD5 = '1d7f91b5082e79d3560756cd7c48d23f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:41:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b537b6-a944-47cb-8556-4c4202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:26.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:26.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:41:26Z",
|
||
|
|
"last_observed": "2017-02-28T08:41:26Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b537b6-a944-47cb-8556-4c4202de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b537b6-a944-47cb-8556-4c4202de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/b16d317c11228bd3573126a0e1bc0bbf35d84a4a1f47dfb06b70634a21fd9823/analysis/1462287136/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537b8-1370-4cc7-898b-4dc002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:28.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:28.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: ada2f0703614b3447d427827777af5d4ee9ffe9179498970326926751a4f8d65",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '859aeccc36a4152bd42c5cd9f9b7231adb7cf55b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:41:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537b9-06bc-43d6-9150-403702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: ada2f0703614b3447d427827777af5d4ee9ffe9179498970326926751a4f8d65",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'f210c9fe5e0fa7b9038688a2281df3b7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:41:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b537bb-a2b0-42b9-9bb2-46f302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:31.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:31.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:41:31Z",
|
||
|
|
"last_observed": "2017-02-28T08:41:31Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b537bb-a2b0-42b9-9bb2-46f302de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b537bb-a2b0-42b9-9bb2-46f302de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/ada2f0703614b3447d427827777af5d4ee9ffe9179498970326926751a4f8d65/analysis/1441519845/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537bc-5540-475b-b5f2-477202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:32.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:32.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: aa860d405746401ae4155485326fdeb39718832c77c73540d48f4fbb8e596215",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'd16bac4f576bcc108024fc5304cfef3fe18b9ca4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:41:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537be-f5f8-46fb-814d-48ae02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:34.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:34.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: aa860d405746401ae4155485326fdeb39718832c77c73540d48f4fbb8e596215",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd0d6e205e5d06fffb8ff10f160e865c0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:41:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b537bf-34bc-4f91-a126-452d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:35.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:35.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:41:35Z",
|
||
|
|
"last_observed": "2017-02-28T08:41:35Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b537bf-34bc-4f91-a126-452d02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b537bf-34bc-4f91-a126-452d02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/aa860d405746401ae4155485326fdeb39718832c77c73540d48f4fbb8e596215/analysis/1445122098/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537c1-e300-47fe-8b08-48f802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:37.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:37.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '457b1cd985ed07baffd8c66ff40e9c1b6da93753']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:41:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537c2-29fc-4ca8-aae0-414f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:38.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:38.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'bd126a7b59d5d1f97ba89a3e71425731']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:41:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b537c4-96a4-485d-8371-4de202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:40.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:40.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:41:40Z",
|
||
|
|
"last_observed": "2017-02-28T08:41:40Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b537c4-96a4-485d-8371-4de202de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b537c4-96a4-485d-8371-4de202de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599/analysis/1488256910/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537c5-96fc-44ae-8eeb-4d3a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:41.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:41.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: a2e0fe2d385dabcdfb024100216d259ddd1fa9907e982d297846fd29b8d4d415",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '3f5931135e5fa14d508e17c88eff938b5ed22a09']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:41:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537c7-a22c-4fa5-99dc-42ad02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:43.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:43.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: a2e0fe2d385dabcdfb024100216d259ddd1fa9907e982d297846fd29b8d4d415",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'bac5cae266200105724871bac7970cb5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:41:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b537c8-8d00-47e7-bca1-4eda02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:44.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:44.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:41:44Z",
|
||
|
|
"last_observed": "2017-02-28T08:41:44Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b537c8-8d00-47e7-bca1-4eda02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b537c8-8d00-47e7-bca1-4eda02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/a2e0fe2d385dabcdfb024100216d259ddd1fa9907e982d297846fd29b8d4d415/analysis/1436697599/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537ca-8650-49cd-8e57-4fcb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:46.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:46.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: a194b47043356fa365d98a5f7c582b6f87fac90acf0f469ed3651cfe2fd7b2c9",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a37bbbf3dc9f847b64c7d71d0e04de1225bc60dd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:41:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537cc-46e4-4c46-b46b-457002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:48.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:48.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: a194b47043356fa365d98a5f7c582b6f87fac90acf0f469ed3651cfe2fd7b2c9",
|
||
|
|
"pattern": "[file:hashes.MD5 = '1e4ed67ada401b03adb03024473697b1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:41:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b537cd-581c-4828-a01d-4f4e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:49.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:49.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:41:49Z",
|
||
|
|
"last_observed": "2017-02-28T08:41:49Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b537cd-581c-4828-a01d-4f4e02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b537cd-581c-4828-a01d-4f4e02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/a194b47043356fa365d98a5f7c582b6f87fac90acf0f469ed3651cfe2fd7b2c9/analysis/1424796723/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537cf-3ff4-4cc9-b785-409302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:51.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:51.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: a064a28e5e7409a96bba93fc57f44cadc3492bb0f49792c89c973e30b0f5d498",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '248f6b82d18a4303531e8812895701f826508cce']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:41:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537d0-33d8-449b-8544-460402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:52.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:52.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: a064a28e5e7409a96bba93fc57f44cadc3492bb0f49792c89c973e30b0f5d498",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'a0db73cb0c06eb2360a7a2e4e8bbcf47']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:41:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b537d2-4bdc-48e5-a0a1-47c802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:54.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:54.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:41:54Z",
|
||
|
|
"last_observed": "2017-02-28T08:41:54Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b537d2-4bdc-48e5-a0a1-47c802de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b537d2-4bdc-48e5-a0a1-47c802de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/a064a28e5e7409a96bba93fc57f44cadc3492bb0f49792c89c973e30b0f5d498/analysis/1481364505/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537d3-cbd8-4f81-828d-4f7f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:55.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:55.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 9c8d518fbbc8cbb25fa309f5396efa5749e57a3b0158779404c8d3e92baf6596",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '5f7a0910e6eec065d33e2605cc21cc507ff5fe11']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:41:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537d5-f25c-4e76-8cd2-412702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:57.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:57.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 9c8d518fbbc8cbb25fa309f5396efa5749e57a3b0158779404c8d3e92baf6596",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0da72058569745e3a1e4a59657239991']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:41:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b537d6-2bd4-4a44-a98f-49c102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:41:58.000Z",
|
||
|
|
"modified": "2017-02-28T08:41:58.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:41:58Z",
|
||
|
|
"last_observed": "2017-02-28T08:41:58Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b537d6-2bd4-4a44-a98f-49c102de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b537d6-2bd4-4a44-a98f-49c102de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/9c8d518fbbc8cbb25fa309f5396efa5749e57a3b0158779404c8d3e92baf6596/analysis/1486156209/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537d8-cc80-4b76-8d15-408702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:00.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:00.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 9beb1d2a03ff2d4c15913de0f87b72074155b44df791bd967dac8155e97a0e06",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '58e28c32c7c0507c45ab05c9205e076f51287c46']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:42:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537d9-9dc8-41e7-bf44-420b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:01.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:01.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 9beb1d2a03ff2d4c15913de0f87b72074155b44df791bd967dac8155e97a0e06",
|
||
|
|
"pattern": "[file:hashes.MD5 = '44cff2e430dc03c063fe71ed8d6c5761']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:42:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b537db-0f0c-4eed-9821-4b8702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:03.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:03.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:42:03Z",
|
||
|
|
"last_observed": "2017-02-28T08:42:03Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b537db-0f0c-4eed-9821-4b8702de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b537db-0f0c-4eed-9821-4b8702de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/9beb1d2a03ff2d4c15913de0f87b72074155b44df791bd967dac8155e97a0e06/analysis/1482257779/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537dd-2c4c-4f48-9b26-4e5b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:05.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:05.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 9a8776e4ae38cf529bab28947b31ade84301262b7996dc37ec47afa4fb4cf6e1",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '70243281605be8e75d5f22915f829dfeacd999e5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:42:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537de-7f50-4c91-97cd-40fb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:06.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:06.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 9a8776e4ae38cf529bab28947b31ade84301262b7996dc37ec47afa4fb4cf6e1",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'e0055e9323f4e97af5a376b5f552f268']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:42:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b537e0-5a20-4d73-b9c0-4f1502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:08.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:08.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:42:08Z",
|
||
|
|
"last_observed": "2017-02-28T08:42:08Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b537e0-5a20-4d73-b9c0-4f1502de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b537e0-5a20-4d73-b9c0-4f1502de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/9a8776e4ae38cf529bab28947b31ade84301262b7996dc37ec47afa4fb4cf6e1/analysis/1461155779/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537e1-d644-48d6-884d-438502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:09.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:09.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 99c9440a84cdc428ce140de901452eb334faec49f1f6258acdde1ddcbb34376e",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '1558683aec66c893a63235a6583c9aea1d723a6f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:42:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537e3-92d8-4d82-8a74-4cf602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:11.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:11.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 99c9440a84cdc428ce140de901452eb334faec49f1f6258acdde1ddcbb34376e",
|
||
|
|
"pattern": "[file:hashes.MD5 = '28de38a9dd33947d312345186f2dc94b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:42:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b537e4-4e58-4f2d-bb44-4af902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:12.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:12.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:42:12Z",
|
||
|
|
"last_observed": "2017-02-28T08:42:12Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b537e4-4e58-4f2d-bb44-4af902de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b537e4-4e58-4f2d-bb44-4af902de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/99c9440a84cdc428ce140de901452eb334faec49f1f6258acdde1ddcbb34376e/analysis/1436697599/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537e6-0b04-4c48-b6c1-4d8502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:14.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:14.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 98caf00760d772598386eb8d4f26caf92fb891915ac08da6bf830be5e45278d3",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '770ecc05279e7b2e5e92a8a0a72d652b62602157']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:42:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537e7-65b4-44b0-9fb8-4a0402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:15.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:15.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 98caf00760d772598386eb8d4f26caf92fb891915ac08da6bf830be5e45278d3",
|
||
|
|
"pattern": "[file:hashes.MD5 = '6512ddfea8e4e3c970907ed8b946d933']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:42:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b537e9-ee58-409c-867e-467a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:17.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:17.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:42:17Z",
|
||
|
|
"last_observed": "2017-02-28T08:42:17Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b537e9-ee58-409c-867e-467a02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b537e9-ee58-409c-867e-467a02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/98caf00760d772598386eb8d4f26caf92fb891915ac08da6bf830be5e45278d3/analysis/1477641714/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537ea-5c18-4bee-a50f-42fb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:18.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:18.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 95e3204228341852b7c97f357f799e7ec9688abe1262436b569e56397f1fd864",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c7e31d8a42eef144194d8b78c3ce04394567ac2a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:42:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537ec-fb64-4449-9faf-4fcf02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:20.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:20.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 95e3204228341852b7c97f357f799e7ec9688abe1262436b569e56397f1fd864",
|
||
|
|
"pattern": "[file:hashes.MD5 = '2c6703aa29f65a66a13ea4b193c2ab04']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:42:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b537ed-87bc-4c77-bb45-4e1e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:21.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:21.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:42:21Z",
|
||
|
|
"last_observed": "2017-02-28T08:42:21Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b537ed-87bc-4c77-bb45-4e1e02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b537ed-87bc-4c77-bb45-4e1e02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/95e3204228341852b7c97f357f799e7ec9688abe1262436b569e56397f1fd864/analysis/1447430224/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537ef-c448-4d0d-9e72-417c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:23.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:23.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 8c9d690e765c7656152ad980edd2200b81d2afceef882ed81287fe212249f845",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '8eb6a454fddbbde2d29ce16816236231bf1f68c2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:42:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537f1-66b8-4576-b42c-409402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:25.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:25.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 8c9d690e765c7656152ad980edd2200b81d2afceef882ed81287fe212249f845",
|
||
|
|
"pattern": "[file:hashes.MD5 = '21abb250dc84029e2eccc6d7c1a9bce9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:42:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b537f2-0d58-4ccc-8607-4c8302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:26.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:26.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:42:26Z",
|
||
|
|
"last_observed": "2017-02-28T08:42:26Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b537f2-0d58-4ccc-8607-4c8302de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b537f2-0d58-4ccc-8607-4c8302de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/8c9d690e765c7656152ad980edd2200b81d2afceef882ed81287fe212249f845/analysis/1487698453/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537f4-a844-42c6-9b2c-469702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:28.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:28.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 8bd40e7fe6bbd4d5810db2c142186bb58da445a132fb6f9ff01c46947a532244",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'b8dc8c2a1b65f60a5f2cf7d185559bb0234922dd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:42:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537f5-ddac-4791-ac5e-46e602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 8bd40e7fe6bbd4d5810db2c142186bb58da445a132fb6f9ff01c46947a532244",
|
||
|
|
"pattern": "[file:hashes.MD5 = '4f070478842a583a0740730c78b76b59']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:42:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b537f7-1be0-4d26-b208-4c1502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:31.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:31.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:42:31Z",
|
||
|
|
"last_observed": "2017-02-28T08:42:31Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b537f7-1be0-4d26-b208-4c1502de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b537f7-1be0-4d26-b208-4c1502de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/8bd40e7fe6bbd4d5810db2c142186bb58da445a132fb6f9ff01c46947a532244/analysis/1480007831/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537f8-93c0-4b5b-9d1f-418f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:32.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:32.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 8b50e3ca06a22d0be6a71232b320137c776f80ac3f2c81b7440b43854b8a3bf0",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '5c9f5fe6785b84813a0303f496ab7042d98fc73d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:42:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537fa-3478-419d-ab46-446602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:34.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:34.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 8b50e3ca06a22d0be6a71232b320137c776f80ac3f2c81b7440b43854b8a3bf0",
|
||
|
|
"pattern": "[file:hashes.MD5 = '834c709455bfefb9b0e8976bad13a8f4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:42:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b537fb-fb6c-42a3-bae4-44e102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:35.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:35.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:42:35Z",
|
||
|
|
"last_observed": "2017-02-28T08:42:35Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b537fb-fb6c-42a3-bae4-44e102de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b537fb-fb6c-42a3-bae4-44e102de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/8b50e3ca06a22d0be6a71232b320137c776f80ac3f2c81b7440b43854b8a3bf0/analysis/1485962958/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537fd-84d4-4fa4-a8f2-442c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:37.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:37.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 88ae7e60b9dd57fc6b2d667ce33fb29c0f75d37eb7c837ccf56cb7994386d5ef",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '8a84b153d015849d354ad76781026d94abb0e9e7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:42:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b537fe-7ee8-461d-a9d9-464702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:38.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:38.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 88ae7e60b9dd57fc6b2d667ce33fb29c0f75d37eb7c837ccf56cb7994386d5ef",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'cf64b1a61432f64a168279e481680fbc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:42:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53800-e738-48a2-b77a-4de602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:40.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:40.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:42:40Z",
|
||
|
|
"last_observed": "2017-02-28T08:42:40Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53800-e738-48a2-b77a-4de602de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53800-e738-48a2-b77a-4de602de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/88ae7e60b9dd57fc6b2d667ce33fb29c0f75d37eb7c837ccf56cb7994386d5ef/analysis/1468390536/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53801-8ea0-40b9-b6b2-410e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:41.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:41.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 86c81f03cf7d8f8af38c2559dbf506cccdc25579f3b29fb574f823a67f99a0a3",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'fb169d6bc62003bcd50e7614c7cd539b975544e7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:42:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53803-0064-4055-b7cb-4e4302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:43.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:43.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 86c81f03cf7d8f8af38c2559dbf506cccdc25579f3b29fb574f823a67f99a0a3",
|
||
|
|
"pattern": "[file:hashes.MD5 = '35f35ff23b31190d670890c27c0b4639']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:42:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53805-a500-4afd-82b1-40c802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:45.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:45.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:42:45Z",
|
||
|
|
"last_observed": "2017-02-28T08:42:45Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53805-a500-4afd-82b1-40c802de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53805-a500-4afd-82b1-40c802de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/86c81f03cf7d8f8af38c2559dbf506cccdc25579f3b29fb574f823a67f99a0a3/analysis/1443126752/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53806-d208-4419-9a09-482a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:46.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:46.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 8512aabfa0175684bdbb77481d6b272b63dbc4249b04a44e1003b7d8fdea0a89",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '2a0da4f844fa2a8b15ed150b544ff20a6c66a377']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:42:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53808-c0e0-4a13-98b9-48d102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:48.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:48.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 8512aabfa0175684bdbb77481d6b272b63dbc4249b04a44e1003b7d8fdea0a89",
|
||
|
|
"pattern": "[file:hashes.MD5 = '72f2f31628c25e0a9e1290a8989ade93']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:42:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53809-9458-47d1-8faf-476f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:49.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:49.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:42:49Z",
|
||
|
|
"last_observed": "2017-02-28T08:42:49Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53809-9458-47d1-8faf-476f02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53809-9458-47d1-8faf-476f02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/8512aabfa0175684bdbb77481d6b272b63dbc4249b04a44e1003b7d8fdea0a89/analysis/1440104415/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5380b-c6c8-4280-9753-477e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:51.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:51.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 823793a37d748ffe708864c16c853c67a5db812712481da1d24790b455163940",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '164301a2c1e953c7d55af1b1279cc612898d5091']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:42:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5380c-d3c4-4eb8-a25e-4cd702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:52.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:52.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 823793a37d748ffe708864c16c853c67a5db812712481da1d24790b455163940",
|
||
|
|
"pattern": "[file:hashes.MD5 = '450f6e3902aca15dc45e5dae9b139e4e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:42:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5380e-1f38-4ce6-a24d-4ddb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:54.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:54.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:42:54Z",
|
||
|
|
"last_observed": "2017-02-28T08:42:54Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5380e-1f38-4ce6-a24d-4ddb02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5380e-1f38-4ce6-a24d-4ddb02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/823793a37d748ffe708864c16c853c67a5db812712481da1d24790b455163940/analysis/1482000085/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5380f-8bac-4332-8874-469f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:55.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:55.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 7fee970748eb83045e36911dafdaee0d4069ebe72c059cc7de3d65539012c2e9",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'b5852268dbeb4d3f512ee9491948de89f721dfa9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:42:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53811-8b24-422d-a7a6-445a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:57.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:57.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 7fee970748eb83045e36911dafdaee0d4069ebe72c059cc7de3d65539012c2e9",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'cd44eba0c960a2d8c2e9b70c847e1f7e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:42:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53812-cf7c-4e48-9b2d-42fb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:42:58.000Z",
|
||
|
|
"modified": "2017-02-28T08:42:58.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:42:58Z",
|
||
|
|
"last_observed": "2017-02-28T08:42:58Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53812-cf7c-4e48-9b2d-42fb02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53812-cf7c-4e48-9b2d-42fb02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/7fee970748eb83045e36911dafdaee0d4069ebe72c059cc7de3d65539012c2e9/analysis/1471970276/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53814-8910-4195-8e28-476502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:00.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:00.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 7f324b658f587b3b27921ebeba5ac25aebd669b33e6801fa9581de8c2eb0df2e",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '530c0b3f6cebe903841d785ff12eca4c78e03c97']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:43:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53815-0c18-48ae-9a2b-43cc02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:01.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:01.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 7f324b658f587b3b27921ebeba5ac25aebd669b33e6801fa9581de8c2eb0df2e",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'f9ac26c5cf816ec4df2c303046f2e635']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:43:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53817-bdcc-4c05-afc7-493c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:03.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:03.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:43:03Z",
|
||
|
|
"last_observed": "2017-02-28T08:43:03Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53817-bdcc-4c05-afc7-493c02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53817-bdcc-4c05-afc7-493c02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/7f324b658f587b3b27921ebeba5ac25aebd669b33e6801fa9581de8c2eb0df2e/analysis/1477338388/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53819-d514-4026-a364-484702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:05.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:05.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 7bfa85bec239b6c4419b2d57149c5960263c80e493f888d03ceaaa3f945b1b25",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '986267bd4d3c8a27c87119ee0015d503168f0646']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:43:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5381a-eb50-4eee-9b82-409002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:06.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:06.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 7bfa85bec239b6c4419b2d57149c5960263c80e493f888d03ceaaa3f945b1b25",
|
||
|
|
"pattern": "[file:hashes.MD5 = '2beced6594f486307f92d2768caeb668']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:43:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5381c-caf8-4fd6-9c25-417c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:08.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:08.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:43:08Z",
|
||
|
|
"last_observed": "2017-02-28T08:43:08Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5381c-caf8-4fd6-9c25-417c02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5381c-caf8-4fd6-9c25-417c02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/7bfa85bec239b6c4419b2d57149c5960263c80e493f888d03ceaaa3f945b1b25/analysis/1426438680/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5381d-4040-4398-9aee-433e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:09.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:09.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 7adb049e0b49312aea904c70e16d0e7f03d01aae4bf8ac867e8219ced4e6e057",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '4d112dd65a3cf08779ca4c0fadb3f96b35345cea']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:43:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5381f-e834-4b97-aae7-456c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:11.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:11.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 7adb049e0b49312aea904c70e16d0e7f03d01aae4bf8ac867e8219ced4e6e057",
|
||
|
|
"pattern": "[file:hashes.MD5 = '4c9b28a327ad3abfc70ebb8b3d2f989b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:43:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53820-7f08-4c70-b146-481e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:12.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:12.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:43:12Z",
|
||
|
|
"last_observed": "2017-02-28T08:43:12Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53820-7f08-4c70-b146-481e02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53820-7f08-4c70-b146-481e02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/7adb049e0b49312aea904c70e16d0e7f03d01aae4bf8ac867e8219ced4e6e057/analysis/1462799587/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53822-a448-48b9-bbd5-409302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:14.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:14.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 7a5a1c6ea0c2f017df9f06975c93a356cac20b19031fcde96136fa5881e5ef3a",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c1a8c65ee9689c421fed9d15ad2bd449fc368651']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:43:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53823-3334-4951-bd47-4e6802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:15.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:15.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 7a5a1c6ea0c2f017df9f06975c93a356cac20b19031fcde96136fa5881e5ef3a",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'aee6941e977f6079130a2739da9c28a3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:43:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53825-778c-4d12-b396-49a902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:17.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:17.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:43:17Z",
|
||
|
|
"last_observed": "2017-02-28T08:43:17Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53825-778c-4d12-b396-49a902de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53825-778c-4d12-b396-49a902de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/7a5a1c6ea0c2f017df9f06975c93a356cac20b19031fcde96136fa5881e5ef3a/analysis/1468430853/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53826-0844-4039-92e3-47cc02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:18.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:18.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 75d2367dc79d9f8aed165729df90ed5d28fefe267778dbe4d3d74aafa75d66e0",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a8998908f9867d5e81584b5e0590fb79ce927018']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:43:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53828-1400-4ff9-815e-4a5202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:20.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:20.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 75d2367dc79d9f8aed165729df90ed5d28fefe267778dbe4d3d74aafa75d66e0",
|
||
|
|
"pattern": "[file:hashes.MD5 = '17b1a12a6f8a2973fa9cde28957b3952']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:43:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53829-17a8-4713-87ae-439602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:21.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:21.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:43:21Z",
|
||
|
|
"last_observed": "2017-02-28T08:43:21Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53829-17a8-4713-87ae-439602de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53829-17a8-4713-87ae-439602de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/75d2367dc79d9f8aed165729df90ed5d28fefe267778dbe4d3d74aafa75d66e0/analysis/1478163542/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5382b-1f98-4636-87f0-4c8702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:23.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:23.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 74e017853fbc85ee77ca7476cd25423815602aaaa02b29e0003c95c9551b8890",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '9ac98ec7205b0f991d7d636605d576a4da45fab2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:43:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5382c-43c4-47ee-b4ee-42f702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:24.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:24.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 74e017853fbc85ee77ca7476cd25423815602aaaa02b29e0003c95c9551b8890",
|
||
|
|
"pattern": "[file:hashes.MD5 = '1997ad7be2b67700efe77966a8949549']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:43:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5382e-deb0-4981-9027-4d9c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:26.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:26.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:43:26Z",
|
||
|
|
"last_observed": "2017-02-28T08:43:26Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5382e-deb0-4981-9027-4d9c02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5382e-deb0-4981-9027-4d9c02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/74e017853fbc85ee77ca7476cd25423815602aaaa02b29e0003c95c9551b8890/analysis/1456335862/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5382f-2ca8-4aad-af10-48a102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:27.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:27.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 73670d06851f588c7df44dc478f49883406697c48c618438e0f249b7a916552e",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '53f22b5b191cddd7b8d5541f180904a0b62e8fa8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:43:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53831-e248-449e-bdde-442b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 73670d06851f588c7df44dc478f49883406697c48c618438e0f249b7a916552e",
|
||
|
|
"pattern": "[file:hashes.MD5 = '3dbba6f056b45206d0096adec4622358']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:43:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53832-8acc-4e89-ac4e-498702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:30.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:30.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:43:30Z",
|
||
|
|
"last_observed": "2017-02-28T08:43:30Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53832-8acc-4e89-ac4e-498702de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53832-8acc-4e89-ac4e-498702de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/73670d06851f588c7df44dc478f49883406697c48c618438e0f249b7a916552e/analysis/1468488985/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53834-b09c-44c0-8b30-4cd202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:32.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:32.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 72d4b780a90ede7ea152f5da0973965cab31d2813fa8c2fe0e1cb611f5ca257e",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '5e27bdb34e9882b4cd97d88162536020277dcaf0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:43:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53835-8660-4237-bd37-46c702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:33.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:33.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 72d4b780a90ede7ea152f5da0973965cab31d2813fa8c2fe0e1cb611f5ca257e",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ed209a8abc48370028d855852d4002b7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:43:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53837-bf98-459d-9444-460902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:35.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:35.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:43:35Z",
|
||
|
|
"last_observed": "2017-02-28T08:43:35Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53837-bf98-459d-9444-460902de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53837-bf98-459d-9444-460902de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/72d4b780a90ede7ea152f5da0973965cab31d2813fa8c2fe0e1cb611f5ca257e/analysis/1485041002/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53839-ee04-46a4-8291-475702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:37.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:37.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 71c5b899a5187baeb8f605ca39ca56bf05a63025a8f9f84c45590d8345e5d349",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'b450a30c9311d4832e487ef946cf341ecf53ca65']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:43:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5383a-5ecc-4a51-8b39-490502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:38.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:38.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 71c5b899a5187baeb8f605ca39ca56bf05a63025a8f9f84c45590d8345e5d349",
|
||
|
|
"pattern": "[file:hashes.MD5 = '84f8d6fb9af89557840abfdcd65d9e89']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:43:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5383c-dff0-46ab-a027-40bf02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:40.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:40.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:43:40Z",
|
||
|
|
"last_observed": "2017-02-28T08:43:40Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5383c-dff0-46ab-a027-40bf02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5383c-dff0-46ab-a027-40bf02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/71c5b899a5187baeb8f605ca39ca56bf05a63025a8f9f84c45590d8345e5d349/analysis/1479496281/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5383d-8f20-48bd-b0b1-49f902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:41.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:41.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 6f8da9180eebe02ba35317cb8aee5c8df6ac29795af70eb9430c3588d457aad6",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '2763dd7f9f6f989eaf5cb175445022cb1dd1af33']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:43:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5383f-21e0-4b9b-8919-406a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:43.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:43.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 6f8da9180eebe02ba35317cb8aee5c8df6ac29795af70eb9430c3588d457aad6",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ed5e02a9da7395e09e31a2dfbfebf755']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:43:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53840-c7d0-4901-b84b-424602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:44.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:44.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:43:44Z",
|
||
|
|
"last_observed": "2017-02-28T08:43:44Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53840-c7d0-4901-b84b-424602de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53840-c7d0-4901-b84b-424602de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/6f8da9180eebe02ba35317cb8aee5c8df6ac29795af70eb9430c3588d457aad6/analysis/1444958403/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53842-69c4-4718-9820-4aa502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:46.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:46.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 6ccc24971073d24d90c4cbaf83dfbae2969cbf527e319c7ee9a4babcbe88e456",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c59d4501748759c50f3bf4c818b18d2f9b776d9c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:43:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53843-73d0-4d59-8fe3-4a7302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:47.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:47.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 6ccc24971073d24d90c4cbaf83dfbae2969cbf527e319c7ee9a4babcbe88e456",
|
||
|
|
"pattern": "[file:hashes.MD5 = '183e15c0f97594107d6682123fe9eac4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:43:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53845-dca8-4e9e-af54-412d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:49.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:49.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:43:49Z",
|
||
|
|
"last_observed": "2017-02-28T08:43:49Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53845-dca8-4e9e-af54-412d02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53845-dca8-4e9e-af54-412d02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/6ccc24971073d24d90c4cbaf83dfbae2969cbf527e319c7ee9a4babcbe88e456/analysis/1467884069/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53846-fbd4-4dcd-b701-4a9a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:50.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:50.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 621e55421dffae981e3e933c65626314d5610c7c08f76f83a3d07f0ec6c36e2d",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '9b3b81c4166dd68406914c68a2908fe4a3cbd829']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:43:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53848-8900-4a1d-982d-480b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:52.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:52.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 621e55421dffae981e3e933c65626314d5610c7c08f76f83a3d07f0ec6c36e2d",
|
||
|
|
"pattern": "[file:hashes.MD5 = '8349f79cffe229cd1ee50a8eba8447ec']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:43:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53849-6288-46f3-a4b2-43ff02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:53.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:53.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:43:53Z",
|
||
|
|
"last_observed": "2017-02-28T08:43:53Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53849-6288-46f3-a4b2-43ff02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53849-6288-46f3-a4b2-43ff02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/621e55421dffae981e3e933c65626314d5610c7c08f76f83a3d07f0ec6c36e2d/analysis/1430913118/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5384b-e4ac-4257-895d-4ecf02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:55.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:55.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 6016cf9898d74e2e9030be7c987964d817ba28ad2253d1da54c81a1bf49db836",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '28fccc5707877c9e6ab5c099b5a38c6e95464e9a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:43:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5384d-21f8-4e01-967b-4a2602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:57.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:57.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 6016cf9898d74e2e9030be7c987964d817ba28ad2253d1da54c81a1bf49db836",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9b48d6d97bf924eda9f896eacb551c73']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:43:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5384e-059c-422a-a0b6-444902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:43:58.000Z",
|
||
|
|
"modified": "2017-02-28T08:43:58.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:43:58Z",
|
||
|
|
"last_observed": "2017-02-28T08:43:58Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5384e-059c-422a-a0b6-444902de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5384e-059c-422a-a0b6-444902de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/6016cf9898d74e2e9030be7c987964d817ba28ad2253d1da54c81a1bf49db836/analysis/1480574516/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53850-6ba0-470b-b1f7-415202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:00.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:00.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 5fb7f6f953be3b65d88bd86d1391ebc9f88fc10b0ef23541463ebf5b157f695c",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '7bd0cf780b41ec00d6ad2f73590787eeadb8aba8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:44:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53851-4df0-4a8e-8e4c-42e302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:01.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:01.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 5fb7f6f953be3b65d88bd86d1391ebc9f88fc10b0ef23541463ebf5b157f695c",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'b6b2848de5dcf672a4b9b827c9bf0fe9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:44:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53853-3ed8-4496-bf94-4d2e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:03.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:03.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:44:03Z",
|
||
|
|
"last_observed": "2017-02-28T08:44:03Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53853-3ed8-4496-bf94-4d2e02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53853-3ed8-4496-bf94-4d2e02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/5fb7f6f953be3b65d88bd86d1391ebc9f88fc10b0ef23541463ebf5b157f695c/analysis/1483801232/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53855-0838-4c09-af75-45fa02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:05.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:05.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: b5199a302f053e5e9cb7e82cc1e502b5edbf04699c2839acb514592f2eeabb13",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a104ea46325b0adbabf397e7e3469ed57d97c2a7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:44:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53856-a1e8-4e82-acc1-4a0c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:06.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:06.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: b5199a302f053e5e9cb7e82cc1e502b5edbf04699c2839acb514592f2eeabb13",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0355db8425d97c343e5a7b4ecbf43852']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:44:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53858-adf8-420b-a124-44a802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:08.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:08.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:44:08Z",
|
||
|
|
"last_observed": "2017-02-28T08:44:08Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53858-adf8-420b-a124-44a802de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53858-adf8-420b-a124-44a802de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/b5199a302f053e5e9cb7e82cc1e502b5edbf04699c2839acb514592f2eeabb13/analysis/1445902129/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53859-2664-4e59-b75a-42e802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:09.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:09.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 5255061c3600df1a94b376fca40f3ccb69d1cb6dd42aa744b20a643c7292d20c",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '0eaaa2dfe2e0e41ae213563430eb8bc51b11a11a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:44:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5385b-c5f8-4fa0-9bb7-41ba02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:11.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:11.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 5255061c3600df1a94b376fca40f3ccb69d1cb6dd42aa744b20a643c7292d20c",
|
||
|
|
"pattern": "[file:hashes.MD5 = '18813bf1bfa68dbb76752c5df32e10ae']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:44:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5385c-15e4-4434-a607-4eba02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:12.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:12.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:44:12Z",
|
||
|
|
"last_observed": "2017-02-28T08:44:12Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5385c-15e4-4434-a607-4eba02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5385c-15e4-4434-a607-4eba02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/5255061c3600df1a94b376fca40f3ccb69d1cb6dd42aa744b20a643c7292d20c/analysis/1432098008/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5385e-499c-46cc-b217-4af102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:14.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:14.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 1eef9f8d7d3099b87be7ac25121f9d2ccacfb5ccf02b508fb2036b6e059c525f",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '08a0c14ec51c31fb140a0a3305d2863537209975']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:44:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53860-b860-4fc1-854b-419f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:16.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:16.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 1eef9f8d7d3099b87be7ac25121f9d2ccacfb5ccf02b508fb2036b6e059c525f",
|
||
|
|
"pattern": "[file:hashes.MD5 = '8d99d6acccee2dbabb82b03b36554b06']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:44:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53861-a964-4b71-8abb-4f3c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:17.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:17.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:44:17Z",
|
||
|
|
"last_observed": "2017-02-28T08:44:17Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53861-a964-4b71-8abb-4f3c02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53861-a964-4b71-8abb-4f3c02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/1eef9f8d7d3099b87be7ac25121f9d2ccacfb5ccf02b508fb2036b6e059c525f/analysis/1416326368/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53863-504c-4363-b526-4b4502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:19.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:19.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 81921b6a7eba39a3f73895a57892ed3a46ab6365ac97d550ca3b9bff46c7a1c2",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'cfcf93f5d454d08e8f2c687a6ad75fc473330f64']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:44:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53864-26cc-4d72-9195-456202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:20.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:20.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 81921b6a7eba39a3f73895a57892ed3a46ab6365ac97d550ca3b9bff46c7a1c2",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'b7e306e05b5cbd6ff64a0803c07cc32d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:44:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53866-44b4-4116-8316-4a6a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:22.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:22.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:44:22Z",
|
||
|
|
"last_observed": "2017-02-28T08:44:22Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53866-44b4-4116-8316-4a6a02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53866-44b4-4116-8316-4a6a02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/81921b6a7eba39a3f73895a57892ed3a46ab6365ac97d550ca3b9bff46c7a1c2/analysis/1445890756/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53867-5d38-40e9-adad-429102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:23.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:23.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: d5405f99cec0166857274b6c02a7ef52b36274fedb805a17d2089fd24ed133cf",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'b5a22efbae3bd03f7fb1cfc552738330e6796034']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:44:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53869-af44-4891-b68e-4e8802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:25.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:25.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: d5405f99cec0166857274b6c02a7ef52b36274fedb805a17d2089fd24ed133cf",
|
||
|
|
"pattern": "[file:hashes.MD5 = '86796d33483ca122612aa82a405f013b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:44:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5386a-be90-44ed-bb8a-413602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:26.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:26.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:44:26Z",
|
||
|
|
"last_observed": "2017-02-28T08:44:26Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5386a-be90-44ed-bb8a-413602de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5386a-be90-44ed-bb8a-413602de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/d5405f99cec0166857274b6c02a7ef52b36274fedb805a17d2089fd24ed133cf/analysis/1445883563/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5386c-caec-437d-b4c0-4f1902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:28.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:28.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 7231177a115656041ba4e5b3cf0bf7a547b074f03592351484267e25cda7c899",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'd2de56e312bd6e4a383886a9c2f670ed17f63b63']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:44:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5386e-5ac4-4832-9fcb-473f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:30.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:30.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 7231177a115656041ba4e5b3cf0bf7a547b074f03592351484267e25cda7c899",
|
||
|
|
"pattern": "[file:hashes.MD5 = '13b82a280efc92d82753b726227e0fcf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:44:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5386f-ca94-4b69-8f5d-46bf02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:31.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:31.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:44:31Z",
|
||
|
|
"last_observed": "2017-02-28T08:44:31Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5386f-ca94-4b69-8f5d-46bf02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5386f-ca94-4b69-8f5d-46bf02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/7231177a115656041ba4e5b3cf0bf7a547b074f03592351484267e25cda7c899/analysis/1434016142/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53871-f0d8-4cbb-8243-40c802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:33.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:33.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 2c5d55619d2f56dc5824a4845334e7804d6d306daac1c23bec6f078f30f1c825",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '45c099d93662579173e672fd78fb889219d737df']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:44:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53873-11bc-4005-9440-454502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:35.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:35.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 2c5d55619d2f56dc5824a4845334e7804d6d306daac1c23bec6f078f30f1c825",
|
||
|
|
"pattern": "[file:hashes.MD5 = '08b36690af8f7a96e918eed11f42aeff']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:44:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53874-0f04-49e2-92f0-408d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:36.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:36.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:44:36Z",
|
||
|
|
"last_observed": "2017-02-28T08:44:36Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53874-0f04-49e2-92f0-408d02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53874-0f04-49e2-92f0-408d02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/2c5d55619d2f56dc5824a4845334e7804d6d306daac1c23bec6f078f30f1c825/analysis/1445915438/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53876-fe7c-43bb-9f36-429302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:38.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:38.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: f77d7940c51c2a1eab849dbd77e59c683ebf7820799ef349e7da2583e1aa11ae",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '9225a8046cae1ee42cc95e37e091bc5dffc2b329']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:44:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53877-c480-4fed-ab51-42c102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:39.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:39.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: f77d7940c51c2a1eab849dbd77e59c683ebf7820799ef349e7da2583e1aa11ae",
|
||
|
|
"pattern": "[file:hashes.MD5 = '7de99aa7219f1d615e17a86866f507ef']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:44:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53879-3bc4-4768-b1e3-43ad02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:41.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:41.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:44:41Z",
|
||
|
|
"last_observed": "2017-02-28T08:44:41Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53879-3bc4-4768-b1e3-43ad02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53879-3bc4-4768-b1e3-43ad02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/f77d7940c51c2a1eab849dbd77e59c683ebf7820799ef349e7da2583e1aa11ae/analysis/1479667092/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5387a-6444-4830-8898-462602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:42.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:42.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 550ee89d5df17f90ba7689d957cd067dcdbe3d957c5369ea28d925e02ccc8ce6",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f7abfa5b3dbb90a3804efc1ee82a1e7d951089d8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:44:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5387c-5bac-46ca-830b-4cb102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:44.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:44.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 550ee89d5df17f90ba7689d957cd067dcdbe3d957c5369ea28d925e02ccc8ce6",
|
||
|
|
"pattern": "[file:hashes.MD5 = '4795fe6f5ce9557f6cbba6457b7931cc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:44:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5387d-c77c-4153-b114-47d902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:45.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:45.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:44:45Z",
|
||
|
|
"last_observed": "2017-02-28T08:44:45Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5387d-c77c-4153-b114-47d902de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5387d-c77c-4153-b114-47d902de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/550ee89d5df17f90ba7689d957cd067dcdbe3d957c5369ea28d925e02ccc8ce6/analysis/1433189614/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5387f-3384-475e-959d-46e202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:47.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:47.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: ca87eb1a21c6d4ffd782b225b178ba65463f73de6f4c736eb135be5864f556dc",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'e95add090f42e16e3702edff5293ae4db347f689']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:44:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53880-1b38-42c2-a37a-44aa02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:48.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:48.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: ca87eb1a21c6d4ffd782b225b178ba65463f73de6f4c736eb135be5864f556dc",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c9de51cab6447bd557eaba11ea8f413f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:44:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53882-8bb8-41c9-951e-4ceb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:50.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:50.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:44:50Z",
|
||
|
|
"last_observed": "2017-02-28T08:44:50Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53882-8bb8-41c9-951e-4ceb02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53882-8bb8-41c9-951e-4ceb02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/ca87eb1a21c6d4ffd782b225b178ba65463f73de6f4c736eb135be5864f556dc/analysis/1450407167/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53883-8374-4f6b-9bc5-463f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:51.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:51.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: f2355a66af99db5f856ebfcfeb2b9e67e5e83fff9b04cdc09ac0fabb4af556bd",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '1eb318592de382c1e80e51b706093acb394ce1f3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:44:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53884-4360-4c7d-8de3-438102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:52.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:52.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: f2355a66af99db5f856ebfcfeb2b9e67e5e83fff9b04cdc09ac0fabb4af556bd",
|
||
|
|
"pattern": "[file:hashes.MD5 = '875768a719c08403f7c4621bc0069fcd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:44:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53885-b540-4e57-a77d-4d1202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:53.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:53.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:44:53Z",
|
||
|
|
"last_observed": "2017-02-28T08:44:53Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53885-b540-4e57-a77d-4d1202de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53885-b540-4e57-a77d-4d1202de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/f2355a66af99db5f856ebfcfeb2b9e67e5e83fff9b04cdc09ac0fabb4af556bd/analysis/1481876422/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53887-a980-4ff4-8ea1-472502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:55.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:55.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 3ef3a06605b462ea31b821eb76b1ea0fdf664e17d010c1d5e57284632f339d4b",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '49c9f937df3cc8aa922426b38b64350ba5d4feb5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:44:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53888-0a00-44d7-a0a8-467102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:56.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:56.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 3ef3a06605b462ea31b821eb76b1ea0fdf664e17d010c1d5e57284632f339d4b",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'bdb7fc0c315df06efa17538fb4eb38cf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:44:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5388a-a350-4ea4-8c10-400502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:58.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:58.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:44:58Z",
|
||
|
|
"last_observed": "2017-02-28T08:44:58Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5388a-a350-4ea4-8c10-400502de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5388a-a350-4ea4-8c10-400502de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/3ef3a06605b462ea31b821eb76b1ea0fdf664e17d010c1d5e57284632f339d4b/analysis/1445922555/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5388b-9470-4b5a-9617-486302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:44:59.000Z",
|
||
|
|
"modified": "2017-02-28T08:44:59.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: a73eac15797130c381b5b4a65c3fb1cfc723b1586a1882c981211787bba285a6",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '7cfe1ab0593d8607887cc0aa64d6c429ad1764c5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:44:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5388d-7cf4-454e-8009-4ed602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:01.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:01.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: a73eac15797130c381b5b4a65c3fb1cfc723b1586a1882c981211787bba285a6",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9fcff92538e35cd213a576d82e318c74']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:45:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5388e-0b00-46d7-8d53-44ad02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:02.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:02.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:45:02Z",
|
||
|
|
"last_observed": "2017-02-28T08:45:02Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5388e-0b00-46d7-8d53-44ad02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5388e-0b00-46d7-8d53-44ad02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/a73eac15797130c381b5b4a65c3fb1cfc723b1586a1882c981211787bba285a6/analysis/1432098096/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53890-39f0-4203-b89f-457c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:04.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:04.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: e79dbcc8b60da280e53d9cf818eee1de34251e0551b9947bb2b79a31b131417e",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'd956d62c99e8d377bfbee69eee305002f3b84599']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:45:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53891-1fe8-49e9-8f0c-47ef02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:05.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:05.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: e79dbcc8b60da280e53d9cf818eee1de34251e0551b9947bb2b79a31b131417e",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'e16756644a505263f52507d188880e4a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:45:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53893-b8e0-4af2-a7cb-439802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:07.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:07.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:45:07Z",
|
||
|
|
"last_observed": "2017-02-28T08:45:07Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53893-b8e0-4af2-a7cb-439802de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53893-b8e0-4af2-a7cb-439802de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/e79dbcc8b60da280e53d9cf818eee1de34251e0551b9947bb2b79a31b131417e/analysis/1444121241/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53894-ab7c-48be-8413-43dc02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:08.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:08.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: cfb8216be1a50aa3d425072942ff70f92102d4f4b155ab2cf1e7059244b99d31",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '33347a00485dd48750cc990b4eb3267177afa6de']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:45:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53896-8ca8-4934-814c-491b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:10.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:10.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: cfb8216be1a50aa3d425072942ff70f92102d4f4b155ab2cf1e7059244b99d31",
|
||
|
|
"pattern": "[file:hashes.MD5 = '33acb5b49688e609ef414ec762f180fb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:45:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53898-e588-4fb0-90c1-40b002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:12.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:12.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:45:12Z",
|
||
|
|
"last_observed": "2017-02-28T08:45:12Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53898-e588-4fb0-90c1-40b002de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53898-e588-4fb0-90c1-40b002de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/cfb8216be1a50aa3d425072942ff70f92102d4f4b155ab2cf1e7059244b99d31/analysis/1436906464/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53899-ac74-4d07-a2bc-4c7502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:13.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:13.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: df6112e6bad4125b80b8829c13a2ca523bb82cf303cf531389d8795e7512c7e6",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '9792248579ba041efd7025cf22a0ce036a0a46fd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:45:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5389b-ebf4-4077-b094-4e3f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:15.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:15.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: df6112e6bad4125b80b8829c13a2ca523bb82cf303cf531389d8795e7512c7e6",
|
||
|
|
"pattern": "[file:hashes.MD5 = '1f0c2bc3a28f074067ebba931861e57b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:45:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5389c-9444-4566-a9f0-42f402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:16.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:16.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:45:16Z",
|
||
|
|
"last_observed": "2017-02-28T08:45:16Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5389c-9444-4566-a9f0-42f402de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5389c-9444-4566-a9f0-42f402de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/df6112e6bad4125b80b8829c13a2ca523bb82cf303cf531389d8795e7512c7e6/analysis/1445886821/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5389e-12d4-420e-afda-489d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:18.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:18.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 5a7da102c11960b9651650143a4a08ae4ce97d68dff999961f1ffc792531afeb",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '4b91f9e3f8febeedbd524d33de605fde07038922']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:45:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5389f-9258-4fee-8411-4a7302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:19.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:19.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 5a7da102c11960b9651650143a4a08ae4ce97d68dff999961f1ffc792531afeb",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'e8d9cbe47d9fc899d1671c42eb572adc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:45:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b538a1-7038-47e0-ba47-4a1a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:20.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:20.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:45:20Z",
|
||
|
|
"last_observed": "2017-02-28T08:45:20Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b538a1-7038-47e0-ba47-4a1a02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b538a1-7038-47e0-ba47-4a1a02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/5a7da102c11960b9651650143a4a08ae4ce97d68dff999961f1ffc792531afeb/analysis/1443871782/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538a2-fd5c-4407-a162-43d402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:22.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:22.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 05cbe01b1125897e0e982c587a10a72f4df795b844a4a2c4cec44aee7f30ce94",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '2eddfcf13dee30820317b2c6bf71c430bf65cae1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:45:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538a3-8bb8-42e3-917d-40d402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:23.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:23.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 05cbe01b1125897e0e982c587a10a72f4df795b844a4a2c4cec44aee7f30ce94",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c282bd00ead12a067b825fd4e6666ee8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:45:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b538a5-4118-4fbf-b94f-4deb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:25.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:25.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:45:25Z",
|
||
|
|
"last_observed": "2017-02-28T08:45:25Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b538a5-4118-4fbf-b94f-4deb02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b538a5-4118-4fbf-b94f-4deb02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/05cbe01b1125897e0e982c587a10a72f4df795b844a4a2c4cec44aee7f30ce94/analysis/1486204133/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538a7-37b8-473d-88b5-497702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:27.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:27.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 63fcfab8e9b97d9aec3d6f243003ea3e2bf955523f08e6f1c0d1e28c839ee3d5",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '1f3363df64a8b0a530080681d94f85c2e16d065e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:45:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538a8-d1d4-44dd-8f4e-4a7902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:28.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:28.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 63fcfab8e9b97d9aec3d6f243003ea3e2bf955523f08e6f1c0d1e28c839ee3d5",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'f125005055aed91873ce71010b67eb55']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:45:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b538aa-aec4-4bef-8d3d-4d5c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:30.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:30.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:45:30Z",
|
||
|
|
"last_observed": "2017-02-28T08:45:30Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b538aa-aec4-4bef-8d3d-4d5c02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b538aa-aec4-4bef-8d3d-4d5c02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/63fcfab8e9b97d9aec3d6f243003ea3e2bf955523f08e6f1c0d1e28c839ee3d5/analysis/1432097897/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538ab-6cc8-4082-9cfd-416102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:31.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:31.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: f3107a5a00f36e12be7cc2e37c35903ef855b8043492af374ea918385821443c",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'd85c375762a6c042bffd7a9c9f791d330c71ff03']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:45:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538ad-eb88-4158-b242-497f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:33.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:33.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: f3107a5a00f36e12be7cc2e37c35903ef855b8043492af374ea918385821443c",
|
||
|
|
"pattern": "[file:hashes.MD5 = '1466fa973aa9fc9c59f5352b2c51a578']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:45:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b538ae-be44-446d-9272-4add02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:34.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:34.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:45:34Z",
|
||
|
|
"last_observed": "2017-02-28T08:45:34Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b538ae-be44-446d-9272-4add02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b538ae-be44-446d-9272-4add02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/f3107a5a00f36e12be7cc2e37c35903ef855b8043492af374ea918385821443c/analysis/1421660294/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538b0-a0c8-4d7b-b3e7-45b302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:36.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:36.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 2617f9301869304b88d8a3a4f7b2eab6b0edf264cc1a28b99f5685959242ec39",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'e6fb19a702090077b5c760cd0540644f6fe15568']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:45:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538b1-88a8-428b-8c1f-4d5d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:37.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:37.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 2617f9301869304b88d8a3a4f7b2eab6b0edf264cc1a28b99f5685959242ec39",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'b23e7f954f1706813a43d7ec86114d08']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:45:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b538b3-fd6c-4803-bd37-47b202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:39.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:39.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:45:39Z",
|
||
|
|
"last_observed": "2017-02-28T08:45:39Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b538b3-fd6c-4803-bd37-47b202de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b538b3-fd6c-4803-bd37-47b202de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/2617f9301869304b88d8a3a4f7b2eab6b0edf264cc1a28b99f5685959242ec39/analysis/1427715327/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538b4-0914-44bd-bae5-418102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:40.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:40.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 9f0228e3d1577ffb2533584c2b1d87ebee0c0d490f981e61d18bb27ab02e52cb",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '20c1b0f39e18f94824745c18dae00a7112694be6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:45:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538b6-c1d4-466c-887a-427c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:42.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:42.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 9f0228e3d1577ffb2533584c2b1d87ebee0c0d490f981e61d18bb27ab02e52cb",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'e5a9dcfd4365cf1aae9a31a45ea5f6a5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:45:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b538b7-d6f8-4f77-a547-4be602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:43.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:43.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:45:43Z",
|
||
|
|
"last_observed": "2017-02-28T08:45:43Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b538b7-d6f8-4f77-a547-4be602de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b538b7-d6f8-4f77-a547-4be602de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/9f0228e3d1577ffb2533584c2b1d87ebee0c0d490f981e61d18bb27ab02e52cb/analysis/1422343830/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538b9-38ec-4c0b-9556-488102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:45.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:45.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: e2688f72cc7ae836be19e765e39318873554ee194a09945eb3f3805d04f256ca",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'dae03e9cd75747bc34e0a65e4924939e965e30af']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:45:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538bb-f308-4e23-9872-482a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:47.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:47.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: e2688f72cc7ae836be19e765e39318873554ee194a09945eb3f3805d04f256ca",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'fe402dd034ae99fb584b7f8f4f257933']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:45:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b538bc-2bf4-43b3-994a-4fbe02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:48.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:48.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:45:48Z",
|
||
|
|
"last_observed": "2017-02-28T08:45:48Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b538bc-2bf4-43b3-994a-4fbe02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b538bc-2bf4-43b3-994a-4fbe02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/e2688f72cc7ae836be19e765e39318873554ee194a09945eb3f3805d04f256ca/analysis/1411370835/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538be-fb38-4e77-9f63-4efa02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:50.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:50.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 5b6a691cf8faf238b27861941a1b667d889889cc9711a3e561403d6a6ed292c9",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '2d907e58bfc961c8fb34c9696c3d71133fca2c8a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:45:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538bf-db24-422f-a185-456202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:51.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:51.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 5b6a691cf8faf238b27861941a1b667d889889cc9711a3e561403d6a6ed292c9",
|
||
|
|
"pattern": "[file:hashes.MD5 = '7d8f93855c55233482d672ed0a00bdca']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:45:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b538c1-2854-41ec-94cc-4f5002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:53.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:53.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:45:53Z",
|
||
|
|
"last_observed": "2017-02-28T08:45:53Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b538c1-2854-41ec-94cc-4f5002de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b538c1-2854-41ec-94cc-4f5002de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/5b6a691cf8faf238b27861941a1b667d889889cc9711a3e561403d6a6ed292c9/analysis/1482068484/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538c2-b028-491f-acb7-450e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:54.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:54.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 01c5729ac1ae3928053c085fd616323a3715863ab3d7e9b8106c09e24df34183",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f5dd3a61297102cfcfcbeda71ea7734853c79917']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:45:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538c4-ffb8-48aa-b6eb-49ab02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:56.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:56.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 01c5729ac1ae3928053c085fd616323a3715863ab3d7e9b8106c09e24df34183",
|
||
|
|
"pattern": "[file:hashes.MD5 = '203d4f3541012300368ee97420f46f5f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:45:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b538c5-720c-43ec-b1af-44ee02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:57.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:57.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:45:57Z",
|
||
|
|
"last_observed": "2017-02-28T08:45:57Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b538c5-720c-43ec-b1af-44ee02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b538c5-720c-43ec-b1af-44ee02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/01c5729ac1ae3928053c085fd616323a3715863ab3d7e9b8106c09e24df34183/analysis/1424713036/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538c7-5be0-44fd-9ffe-45b902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:45:59.000Z",
|
||
|
|
"modified": "2017-02-28T08:45:59.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 5c47d18b3f0e0274c6a66b2eab27d47c73a0105c263d41c6473aba9a28d0a4ba",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '07c4ad7380b0b6b38dbbbd72c7233d3655a4c3dd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:45:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538c8-643c-4925-8195-457e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:00.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:00.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 5c47d18b3f0e0274c6a66b2eab27d47c73a0105c263d41c6473aba9a28d0a4ba",
|
||
|
|
"pattern": "[file:hashes.MD5 = '92736ed1ff137ed26947dec0d9697b17']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:46:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b538ca-a838-4e86-ad7c-47e602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:02.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:02.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:46:02Z",
|
||
|
|
"last_observed": "2017-02-28T08:46:02Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b538ca-a838-4e86-ad7c-47e602de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b538ca-a838-4e86-ad7c-47e602de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/5c47d18b3f0e0274c6a66b2eab27d47c73a0105c263d41c6473aba9a28d0a4ba/analysis/1433310502/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538cb-7b2c-4c61-9ce3-4bd002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:03.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:03.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 467f04914a1e6093bdaf5c28884bf95ec738234033b3292d289a0799de196d49",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'e103e00c907ecead188a9b6a589f84ed13add671']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:46:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538cd-0ac8-436b-9984-40b002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:05.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:05.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 467f04914a1e6093bdaf5c28884bf95ec738234033b3292d289a0799de196d49",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0744320b256d9f8ebf7387982f8efd3d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:46:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b538ce-fc9c-477c-bea9-4ac102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:06.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:06.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:46:06Z",
|
||
|
|
"last_observed": "2017-02-28T08:46:06Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b538ce-fc9c-477c-bea9-4ac102de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b538ce-fc9c-477c-bea9-4ac102de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/467f04914a1e6093bdaf5c28884bf95ec738234033b3292d289a0799de196d49/analysis/1459707778/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538cf-c6fc-4c44-b127-4de702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:07.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:07.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: b80719854f8744ba62e9f0e774c09e2e2ed79dd37f9f94ba3ed05ec8507d55e6",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f8746f0057529207b4a1f9c7cca1b646fa63ea82']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:46:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538d0-802c-48d4-80b4-42d002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:08.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:08.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: b80719854f8744ba62e9f0e774c09e2e2ed79dd37f9f94ba3ed05ec8507d55e6",
|
||
|
|
"pattern": "[file:hashes.MD5 = '46468811253adcabb96000ac0d07ad23']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:46:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b538d2-0030-430d-9111-488502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:10.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:10.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:46:10Z",
|
||
|
|
"last_observed": "2017-02-28T08:46:10Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b538d2-0030-430d-9111-488502de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b538d2-0030-430d-9111-488502de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/b80719854f8744ba62e9f0e774c09e2e2ed79dd37f9f94ba3ed05ec8507d55e6/analysis/1487844547/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538d3-cbdc-4b43-8fe7-43e102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:11.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:11.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: f47115ea58615781e56dcac673c19edf7ce00defd7ada709ae97b0708d3eac1e",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '2353cf16eaac39eb5a269b3a20ed938edf15b86a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:46:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538d5-eb60-47c4-8981-486f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:13.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:13.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: f47115ea58615781e56dcac673c19edf7ce00defd7ada709ae97b0708d3eac1e",
|
||
|
|
"pattern": "[file:hashes.MD5 = '5cf6b8876bf67c707a29b797cceafb0e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:46:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b538d6-09b4-4baf-a419-494402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:14.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:14.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:46:14Z",
|
||
|
|
"last_observed": "2017-02-28T08:46:14Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b538d6-09b4-4baf-a419-494402de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b538d6-09b4-4baf-a419-494402de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/f47115ea58615781e56dcac673c19edf7ce00defd7ada709ae97b0708d3eac1e/analysis/1435828857/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538d8-a798-4f7c-9e6f-44d402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:16.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:16.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 9f651ae6ea538238748614a7f86fe2b0f76e881d6c38da581f284e4b6f79b0ca",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '46a5b8c8132a8f619ab7fcd5494091c727d9d0f1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:46:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538d9-c368-420a-bd91-4e9d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:17.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:17.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 9f651ae6ea538238748614a7f86fe2b0f76e881d6c38da581f284e4b6f79b0ca",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'be6098d5806e306c115c4ecae0e79049']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:46:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b538db-e6ac-42d4-8ef3-482802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:19.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:19.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:46:19Z",
|
||
|
|
"last_observed": "2017-02-28T08:46:19Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b538db-e6ac-42d4-8ef3-482802de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b538db-e6ac-42d4-8ef3-482802de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/9f651ae6ea538238748614a7f86fe2b0f76e881d6c38da581f284e4b6f79b0ca/analysis/1433364111/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538dc-3be4-4b7d-bb52-4fd002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:20.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:20.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 27e08fb90ada2fd8ce6b6149786edd3b814dd0324257ebd919ed66ada0334b21",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '131f07ce6e6e69023e1041017483b050130d56df']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:46:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538de-b948-447e-9655-4d8302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:22.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:22.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 27e08fb90ada2fd8ce6b6149786edd3b814dd0324257ebd919ed66ada0334b21",
|
||
|
|
"pattern": "[file:hashes.MD5 = '89a065947f45c51e79210652449a50d9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:46:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b538df-0f98-4e36-9cd3-403502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:23.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:23.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:46:23Z",
|
||
|
|
"last_observed": "2017-02-28T08:46:23Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b538df-0f98-4e36-9cd3-403502de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b538df-0f98-4e36-9cd3-403502de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/27e08fb90ada2fd8ce6b6149786edd3b814dd0324257ebd919ed66ada0334b21/analysis/1426081320/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538e1-3324-43d1-8e38-483b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:25.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:25.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 98e092b7bfc3bbdaeb82e05de14ba5835c6ac626c17de9eef2049796a031dd10",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '582b067bfa21ccbd5ddd6b8cadcd33bc59c7c2ff']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:46:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538e2-3a98-4e5f-b2da-4d3702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:26.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:26.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 98e092b7bfc3bbdaeb82e05de14ba5835c6ac626c17de9eef2049796a031dd10",
|
||
|
|
"pattern": "[file:hashes.MD5 = '6d0917061ac8260cf1c6084bd7a41a9b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:46:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b538e4-eac8-44d9-a786-49bc02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:28.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:28.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:46:28Z",
|
||
|
|
"last_observed": "2017-02-28T08:46:28Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b538e4-eac8-44d9-a786-49bc02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b538e4-eac8-44d9-a786-49bc02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/98e092b7bfc3bbdaeb82e05de14ba5835c6ac626c17de9eef2049796a031dd10/analysis/1414109886/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538e5-3768-425e-8578-478102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:29.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 29c728a169c5d18298e77db161dd5d2f6396ceca9ee7849b63ff8a8bc11f911e",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '71fa9ea9e4c05fb74ed20a65e6c61e8bb3dc7f59']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:46:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538e7-e9d4-45f3-b075-49b002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:31.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:31.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 29c728a169c5d18298e77db161dd5d2f6396ceca9ee7849b63ff8a8bc11f911e",
|
||
|
|
"pattern": "[file:hashes.MD5 = '11cf0d97e9f18fc3bc658c5b33dd398a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:46:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b538e9-34dc-4b85-a528-45c202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:33.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:33.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:46:33Z",
|
||
|
|
"last_observed": "2017-02-28T08:46:33Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b538e9-34dc-4b85-a528-45c202de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b538e9-34dc-4b85-a528-45c202de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/29c728a169c5d18298e77db161dd5d2f6396ceca9ee7849b63ff8a8bc11f911e/analysis/1431034373/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538ea-57dc-4607-9c73-496d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:34.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:34.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 877f1de209eb9d8b2a20a76f8773d12e5a1fcde4148868c7b73added392f62f6",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '97f61f9317bc7e181db0b221d45b2fd4de77d46e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:46:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538ec-4c5c-4128-b54f-47ac02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:36.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:36.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 877f1de209eb9d8b2a20a76f8773d12e5a1fcde4148868c7b73added392f62f6",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd6f668e848d2d3ae6e039b7feafd3eeb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:46:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b538ed-33a0-4d14-a97b-477102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:37.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:37.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:46:37Z",
|
||
|
|
"last_observed": "2017-02-28T08:46:37Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b538ed-33a0-4d14-a97b-477102de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b538ed-33a0-4d14-a97b-477102de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/877f1de209eb9d8b2a20a76f8773d12e5a1fcde4148868c7b73added392f62f6/analysis/1409824842/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538ef-f14c-454b-acfb-44d902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:39.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:39.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 0458e168baa4fa5942892065925ac82b12245551b539d54c2884b3a21c2699d8",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c3533cab4270ca9b80e5169a1a93697196667822']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:46:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538f0-2468-4b1e-9235-4e2002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:40.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:40.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 0458e168baa4fa5942892065925ac82b12245551b539d54c2884b3a21c2699d8",
|
||
|
|
"pattern": "[file:hashes.MD5 = '690a94b41cdaf7a769417aae02ab5c62']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:46:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b538f2-c3b4-47dd-8c56-49dc02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:42.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:42.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:46:42Z",
|
||
|
|
"last_observed": "2017-02-28T08:46:42Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b538f2-c3b4-47dd-8c56-49dc02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b538f2-c3b4-47dd-8c56-49dc02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/0458e168baa4fa5942892065925ac82b12245551b539d54c2884b3a21c2699d8/analysis/1487844444/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538f3-ce8c-4521-8df7-482f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:43.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:43.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 6c258151c593268c13c252d8f275192a6f7a74d5de5754f2cf20fb94be7ee6ea",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '9c20e54a2bdf30100e4f8556216df9adb0a9be53']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:46:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538f5-60b0-4ebd-98cb-49ce02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:45.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:45.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 6c258151c593268c13c252d8f275192a6f7a74d5de5754f2cf20fb94be7ee6ea",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'b791297a122461b75f46c1c572d9fb52']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:46:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b538f6-0174-4c9e-9809-4e6402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:46.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:46.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:46:46Z",
|
||
|
|
"last_observed": "2017-02-28T08:46:46Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b538f6-0174-4c9e-9809-4e6402de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b538f6-0174-4c9e-9809-4e6402de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/6c258151c593268c13c252d8f275192a6f7a74d5de5754f2cf20fb94be7ee6ea/analysis/1424618709/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538f8-7d4c-4de0-b974-445602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:48.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:48.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 5f8293eda9fb40684caddf576eba6c81f3a06911ca9e4ecf84ede3b2891cff5e",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '1eb9cc47186ba225988382f2e38bbb75dc138128']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:46:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538fa-458c-46e3-8225-4d3a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:50.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:50.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 5f8293eda9fb40684caddf576eba6c81f3a06911ca9e4ecf84ede3b2891cff5e",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd43e1bbae9332de223d13840fcd21a76']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:46:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b538fb-370c-4976-b83d-417e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:51.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:51.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:46:51Z",
|
||
|
|
"last_observed": "2017-02-28T08:46:51Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b538fb-370c-4976-b83d-417e02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b538fb-370c-4976-b83d-417e02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/5f8293eda9fb40684caddf576eba6c81f3a06911ca9e4ecf84ede3b2891cff5e/analysis/1430373200/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538fd-7cec-4f4b-96de-49c202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:53.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:53.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 5ccc76ae1cdf668ba7f89c6cbd0bad44f148cbee736320ead237262ba170ffba",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '6c6ded8d349a2f266a6ddebf0b3d0ac77d1998ab']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:46:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b538fe-cfa0-4043-90f8-45b102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:54.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:54.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 5ccc76ae1cdf668ba7f89c6cbd0bad44f148cbee736320ead237262ba170ffba",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9b2e76a4cec966906402cc5826fbe3db']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:46:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53900-4f60-4615-b9bd-439e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:56.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:56.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:46:56Z",
|
||
|
|
"last_observed": "2017-02-28T08:46:56Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53900-4f60-4615-b9bd-439e02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53900-4f60-4615-b9bd-439e02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/5ccc76ae1cdf668ba7f89c6cbd0bad44f148cbee736320ead237262ba170ffba/analysis/1488132058/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53901-42a0-41d7-9b70-4da202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:57.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:57.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 5ac627f8964d3b9cad69f21e3b8f27305f1f68f49e4f4fae2c73949a04b32692",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '2847f819ab955339646881b57045b3a4a5ca5d82']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:46:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53903-6ea0-4ed9-840c-428702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:46:59.000Z",
|
||
|
|
"modified": "2017-02-28T08:46:59.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 5ac627f8964d3b9cad69f21e3b8f27305f1f68f49e4f4fae2c73949a04b32692",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'a57fefd12f2ef762404169d6ce0fbfe9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:46:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53904-f970-4d3d-92f4-430b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:00.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:00.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:47:00Z",
|
||
|
|
"last_observed": "2017-02-28T08:47:00Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53904-f970-4d3d-92f4-430b02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53904-f970-4d3d-92f4-430b02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/5ac627f8964d3b9cad69f21e3b8f27305f1f68f49e4f4fae2c73949a04b32692/analysis/1448118783/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53906-9cac-4698-80cf-47bd02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:02.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:02.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 59bddb5ccdc1c37c838c8a3d96a865a28c75b5807415fd931eaff0af931d1820",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '45d0296f6eb694a5a23c488c81ac534221afebaf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53907-1428-4fe5-b9af-416c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:03.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:03.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 59bddb5ccdc1c37c838c8a3d96a865a28c75b5807415fd931eaff0af931d1820",
|
||
|
|
"pattern": "[file:hashes.MD5 = '6f0020f104e54165828a9f6239ccc2d6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53909-e8d8-40cc-b3d9-452902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:05.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:05.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:47:05Z",
|
||
|
|
"last_observed": "2017-02-28T08:47:05Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53909-e8d8-40cc-b3d9-452902de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53909-e8d8-40cc-b3d9-452902de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/59bddb5ccdc1c37c838c8a3d96a865a28c75b5807415fd931eaff0af931d1820/analysis/1488261982/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5390b-3510-4b7d-b86a-4c8002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:07.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:07.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 55c76f4f93f9e155fbb6a28447f97c1ccda0081061dc3cb9973d42c1686964b7",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'bc143864f032134a9eba2394482a7a9789415100']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5390c-1304-4cda-a2f6-4c5602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:08.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:08.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 55c76f4f93f9e155fbb6a28447f97c1ccda0081061dc3cb9973d42c1686964b7",
|
||
|
|
"pattern": "[file:hashes.MD5 = '061364ec99059ed44266573bd0a3c738']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5390e-9d40-4419-a690-43fe02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:10.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:10.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:47:10Z",
|
||
|
|
"last_observed": "2017-02-28T08:47:10Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5390e-9d40-4419-a690-43fe02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5390e-9d40-4419-a690-43fe02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/55c76f4f93f9e155fbb6a28447f97c1ccda0081061dc3cb9973d42c1686964b7/analysis/1477564990/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5390f-bd38-4842-8dab-476802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:11.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:11.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 558f33d478091993e5b5921604f8c3873efc87f551fddf61612b5c64d5b610f6",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '5bddd3389b7c60f1a89d5a9498cbd11903cfbaed']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53911-6bf0-4f67-9a77-474002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:13.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:13.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 558f33d478091993e5b5921604f8c3873efc87f551fddf61612b5c64d5b610f6",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'f98781b56fd3cee6574da9002b79cdac']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53911-de60-4535-a3b3-402902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:13.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:13.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:47:13Z",
|
||
|
|
"last_observed": "2017-02-28T08:47:13Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53911-de60-4535-a3b3-402902de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53911-de60-4535-a3b3-402902de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/558f33d478091993e5b5921604f8c3873efc87f551fddf61612b5c64d5b610f6/analysis/1481448930/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53911-bd64-4d37-a99d-4d8202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:13.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:13.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 5363220b532d7da378b338e839a501ae5c006cc03c8b2d3627c480d64deb1221",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'b859f8086e39231fe986883d508cdc6638465b08']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53912-a26c-407a-9192-4bbb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:14.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:14.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 5363220b532d7da378b338e839a501ae5c006cc03c8b2d3627c480d64deb1221",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'be9999490ee70176701adba559772d29']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53913-8454-437d-b3ef-476602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:15.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:15.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:47:15Z",
|
||
|
|
"last_observed": "2017-02-28T08:47:15Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53913-8454-437d-b3ef-476602de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53913-8454-437d-b3ef-476602de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/5363220b532d7da378b338e839a501ae5c006cc03c8b2d3627c480d64deb1221/analysis/1470632430/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53914-c670-4b5a-ab34-48f702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:16.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:16.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 5230453eeb98c5a183129ed8b918b429e96020887302ba30941c408108a1ab84",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '23ae90b9638a93020369876d8eedfa3f15bfcfd3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53915-3660-4302-82d8-4f8402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:17.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:17.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 5230453eeb98c5a183129ed8b918b429e96020887302ba30941c408108a1ab84",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9ec90d083fec4e8df51ebdf72a1cb9df']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53915-54f0-4753-aab1-45dd02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:17.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:17.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:47:17Z",
|
||
|
|
"last_observed": "2017-02-28T08:47:17Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53915-54f0-4753-aab1-45dd02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53915-54f0-4753-aab1-45dd02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/5230453eeb98c5a183129ed8b918b429e96020887302ba30941c408108a1ab84/analysis/1466268496/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53916-dc4c-45d3-809f-496602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:18.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:18.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 47d929c69bfd8d8efb9c280eabec2f73d4bddf1c3c30120c3fb6334623469888",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '6075ffe74d87d3f2f6f283a7bb9a6ba7e29e3f3a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53917-2758-47bc-9a35-46f302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:19.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:19.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 47d929c69bfd8d8efb9c280eabec2f73d4bddf1c3c30120c3fb6334623469888",
|
||
|
|
"pattern": "[file:hashes.MD5 = '2f0f78038c8a2f6177d266c62cadd756']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53918-3a90-4819-a197-40a202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:20.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:20.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:47:20Z",
|
||
|
|
"last_observed": "2017-02-28T08:47:20Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53918-3a90-4819-a197-40a202de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53918-3a90-4819-a197-40a202de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/47d929c69bfd8d8efb9c280eabec2f73d4bddf1c3c30120c3fb6334623469888/analysis/1484302911/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53918-0bc0-456b-91c2-44ad02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:20.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:20.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 42eed03907c9dfa0e566fbe5968cdb5a1b7b5e18521f7327185ed2208c6c29b4",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '0dbaad7cf36aafdb9be015b2ae69242e24a97cab']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53919-f968-4cb6-9017-441502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:21.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:21.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 42eed03907c9dfa0e566fbe5968cdb5a1b7b5e18521f7327185ed2208c6c29b4",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd819f111bea62cc552be0ad1c8e8b6fe']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5391a-4848-460f-a372-49ea02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:22.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:22.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:47:22Z",
|
||
|
|
"last_observed": "2017-02-28T08:47:22Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5391a-4848-460f-a372-49ea02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5391a-4848-460f-a372-49ea02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/42eed03907c9dfa0e566fbe5968cdb5a1b7b5e18521f7327185ed2208c6c29b4/analysis/1430913559/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5391b-1d5c-4731-8538-443502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:23.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:23.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 3ef8602579c6b145fbaafc8970b4c9a6e7bebd11eb5e37eecaa67b4572c6038b",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '4b7241d11cfe8251dce4eadaf221febbc9af721b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5391b-6cbc-4b47-b2f2-4cec02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:23.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:23.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 3ef8602579c6b145fbaafc8970b4c9a6e7bebd11eb5e37eecaa67b4572c6038b",
|
||
|
|
"pattern": "[file:hashes.MD5 = '8140d8803f91c409ddf631d841d53a6d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5391c-af74-47dd-ab9d-462d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:24.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:24.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:47:24Z",
|
||
|
|
"last_observed": "2017-02-28T08:47:24Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5391c-af74-47dd-ab9d-462d02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5391c-af74-47dd-ab9d-462d02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/3ef8602579c6b145fbaafc8970b4c9a6e7bebd11eb5e37eecaa67b4572c6038b/analysis/1460978180/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5391d-f41c-48b2-99c6-495002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:25.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:25.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 390162dae62a0347e35cf5dad093cfc2f7d4ded62fba9d2df7af6133feb41ee0",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c16690941d47550606d804d311b74904ad1cebb1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5391e-3f6c-4b56-bd40-4df402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:26.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:26.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 390162dae62a0347e35cf5dad093cfc2f7d4ded62fba9d2df7af6133feb41ee0",
|
||
|
|
"pattern": "[file:hashes.MD5 = '597460325060aeebea1ff95af257e904']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5391f-4fa8-4a39-b72f-4cb902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:27.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:27.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:47:27Z",
|
||
|
|
"last_observed": "2017-02-28T08:47:27Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5391f-4fa8-4a39-b72f-4cb902de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5391f-4fa8-4a39-b72f-4cb902de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/390162dae62a0347e35cf5dad093cfc2f7d4ded62fba9d2df7af6133feb41ee0/analysis/1482257414/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5391f-c698-4aab-9998-49e202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:27.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:27.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 33934fcfae5760316b3f40e013cbb03d8086f8c30f9a4ba9bed3f9486a530796",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '22d8d5e78c8115482a992596b56f1a2da0e42feb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53920-5724-4514-8476-4bca02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:28.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:28.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 33934fcfae5760316b3f40e013cbb03d8086f8c30f9a4ba9bed3f9486a530796",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'cdf0b679405d2bca9fce83c5bcd2976e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53921-b218-4ffb-a74a-424102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:29.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:47:29Z",
|
||
|
|
"last_observed": "2017-02-28T08:47:29Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53921-b218-4ffb-a74a-424102de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53921-b218-4ffb-a74a-424102de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/33934fcfae5760316b3f40e013cbb03d8086f8c30f9a4ba9bed3f9486a530796/analysis/1460749195/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53922-3e8c-49f8-a7bc-4bf602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:30.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:30.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 2e89436b355550ceb361fac1b03b78b71eda11d25f26223ac5c8c34ed8972a05",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '5f4296492a512697f2aee88eb1a8f9dc8ea48a79']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53922-49ac-4475-8bce-46d802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:30.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:30.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 2e89436b355550ceb361fac1b03b78b71eda11d25f26223ac5c8c34ed8972a05",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'eb815a45efcf3be6f64747ae9ea7eae5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53923-d0f4-45fb-bd48-44a802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:31.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:31.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:47:31Z",
|
||
|
|
"last_observed": "2017-02-28T08:47:31Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53923-d0f4-45fb-bd48-44a802de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53923-d0f4-45fb-bd48-44a802de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/2e89436b355550ceb361fac1b03b78b71eda11d25f26223ac5c8c34ed8972a05/analysis/1467453716/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53924-a5b8-4fd6-80f6-4f2a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:32.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:32.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 2d55000bb5cb9e3e1f137810c2e1eb899f68c40e4a6f6307f226c7b8af208abd",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'dc7310b1f200d93f5ac1135af4c88a6b3031d8ca']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53925-fa38-4027-9757-4be802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:33.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:33.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 2d55000bb5cb9e3e1f137810c2e1eb899f68c40e4a6f6307f226c7b8af208abd",
|
||
|
|
"pattern": "[file:hashes.MD5 = '75ceae20661b497504b58969cb7c4961']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53926-53b0-4046-9368-47df02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:34.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:34.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:47:34Z",
|
||
|
|
"last_observed": "2017-02-28T08:47:34Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53926-53b0-4046-9368-47df02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53926-53b0-4046-9368-47df02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/2d55000bb5cb9e3e1f137810c2e1eb899f68c40e4a6f6307f226c7b8af208abd/analysis/1486170324/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53926-ad18-4973-8455-440002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:34.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:34.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 2c02d3d3fadd76f9d21f5c093459ddc0045c94f17679269eb7a2990a1a88cb42",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '5ab47ffc321203baaeb87e1d2061888cf23e563a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53927-b160-4d88-a974-458e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:35.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:35.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 2c02d3d3fadd76f9d21f5c093459ddc0045c94f17679269eb7a2990a1a88cb42",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c56c677b52e795710e77aa2d4f12b70a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53928-7728-4773-9950-449102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:36.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:36.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:47:36Z",
|
||
|
|
"last_observed": "2017-02-28T08:47:36Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53928-7728-4773-9950-449102de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53928-7728-4773-9950-449102de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/2c02d3d3fadd76f9d21f5c093459ddc0045c94f17679269eb7a2990a1a88cb42/analysis/1476342671/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53929-dc68-4018-bfd8-45b702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:37.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:37.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 2a072d9ce63a94d2530cf9f18a232c6a09f6c7bdff9dbe27faceef53604145ea",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f02865f8364228305c2d9cf61da7e6a021f84279']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53929-e7fc-4428-aba9-4ff202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:37.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:37.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 2a072d9ce63a94d2530cf9f18a232c6a09f6c7bdff9dbe27faceef53604145ea",
|
||
|
|
"pattern": "[file:hashes.MD5 = '2fcf797f2134bb860f784ca8f5bac4d7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5392a-064c-4d00-ae1b-404f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:38.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:38.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:47:38Z",
|
||
|
|
"last_observed": "2017-02-28T08:47:38Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5392a-064c-4d00-ae1b-404f02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5392a-064c-4d00-ae1b-404f02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/2a072d9ce63a94d2530cf9f18a232c6a09f6c7bdff9dbe27faceef53604145ea/analysis/1430505423/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5392b-ff2c-498c-8f4b-475c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:39.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:39.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 29453fa1772b6d7d33842d6abbe0cb55c4a4b66a00f43284c8724d7c16749a7d",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '1c1c46da01d717bc125c07f47505f91a1d8c2c8e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5392c-de80-4947-aeb9-4c1002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:40.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:40.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 29453fa1772b6d7d33842d6abbe0cb55c4a4b66a00f43284c8724d7c16749a7d",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ead8ee9791a4e6d4e83c6b0bbed4375d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5392d-8944-4e8f-b726-4fcd02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:41.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:41.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:47:41Z",
|
||
|
|
"last_observed": "2017-02-28T08:47:41Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5392d-8944-4e8f-b726-4fcd02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5392d-8944-4e8f-b726-4fcd02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/29453fa1772b6d7d33842d6abbe0cb55c4a4b66a00f43284c8724d7c16749a7d/analysis/1479459077/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5392d-58b4-4eeb-a5fa-41f102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:41.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:41.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 26564c23530dd14e0042e074f4178a5b2ad6fc8f51f10138fc39941a6303bff9",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '70c0bac8fd61b8f5b52346d4eb918dcea85445b4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5392e-a87c-4794-9cce-415702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:42.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:42.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 26564c23530dd14e0042e074f4178a5b2ad6fc8f51f10138fc39941a6303bff9",
|
||
|
|
"pattern": "[file:hashes.MD5 = '7c6a9553ce6bc7c9b93cfd9230b612cf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5392f-dea8-4fc5-aaa3-418e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:43.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:43.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:47:43Z",
|
||
|
|
"last_observed": "2017-02-28T08:47:43Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5392f-dea8-4fc5-aaa3-418e02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5392f-dea8-4fc5-aaa3-418e02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/26564c23530dd14e0042e074f4178a5b2ad6fc8f51f10138fc39941a6303bff9/analysis/1464168382/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53930-3bb0-4796-8a9f-45a802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:44.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:44.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 259a78122ef51ae503059143bf36941fc6090be83213d196ba3051ba36a0b2a1",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '734e0a80da25b3d1b1ba61c609c856fb2c872038']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53930-b830-4241-9237-419602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:44.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:44.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 259a78122ef51ae503059143bf36941fc6090be83213d196ba3051ba36a0b2a1",
|
||
|
|
"pattern": "[file:hashes.MD5 = '1aead2f309a67d2234a36850b2b089d3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53931-2bf8-47b0-b12a-45f102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:45.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:45.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:47:45Z",
|
||
|
|
"last_observed": "2017-02-28T08:47:45Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53931-2bf8-47b0-b12a-45f102de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53931-2bf8-47b0-b12a-45f102de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/259a78122ef51ae503059143bf36941fc6090be83213d196ba3051ba36a0b2a1/analysis/1488017944/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53932-5924-4769-903f-461502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:46.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:46.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 22e97292671ada8deef4329eb115c52f6f1bc598bcf01a3961f1c35a2230a013",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '982a52ec2840fa8fca97d327e8d8b670711dd838']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53933-5f18-4636-b19d-45e202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:47.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:47.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 22e97292671ada8deef4329eb115c52f6f1bc598bcf01a3961f1c35a2230a013",
|
||
|
|
"pattern": "[file:hashes.MD5 = '2faf3040e8286d506144a0585d8f4162']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53933-f378-4ffa-910c-4da202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:47.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:47.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:47:47Z",
|
||
|
|
"last_observed": "2017-02-28T08:47:47Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53933-f378-4ffa-910c-4da202de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53933-f378-4ffa-910c-4da202de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/22e97292671ada8deef4329eb115c52f6f1bc598bcf01a3961f1c35a2230a013/analysis/1472888374/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53934-4fd4-46b4-9db1-400102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:48.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:48.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 2124adbee89f2c1cb65896bed26e7ffa8bf0fcbdfeb99a9e751fea9cca7a896b",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'b1eef060e8f433cc442f7118ce52e643073fbf92']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53935-39cc-4d4c-ad52-47b902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:49.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:49.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 2124adbee89f2c1cb65896bed26e7ffa8bf0fcbdfeb99a9e751fea9cca7a896b",
|
||
|
|
"pattern": "[file:hashes.MD5 = '01bf8f97b27acfeaf766493c27eda0e2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53936-65f0-43ef-9c81-42bf02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:50.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:50.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:47:50Z",
|
||
|
|
"last_observed": "2017-02-28T08:47:50Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53936-65f0-43ef-9c81-42bf02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53936-65f0-43ef-9c81-42bf02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/2124adbee89f2c1cb65896bed26e7ffa8bf0fcbdfeb99a9e751fea9cca7a896b/analysis/1455135636/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53936-5b14-438a-90d9-419402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:50.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:50.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 208dc592111a8221a9c633efc120b890585f9a67ed340cbb5ec9db4cd5e164e4",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'd0224cc3b8a93319877332f1567cca295c7fbfa7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53937-cd18-427a-9e0a-409d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:51.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:51.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 208dc592111a8221a9c633efc120b890585f9a67ed340cbb5ec9db4cd5e164e4",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9de8dca3ff7e7d0b06131be8ff9830da']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53938-ec58-4f36-944f-4c6102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:52.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:52.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:47:52Z",
|
||
|
|
"last_observed": "2017-02-28T08:47:52Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53938-ec58-4f36-944f-4c6102de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53938-ec58-4f36-944f-4c6102de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/208dc592111a8221a9c633efc120b890585f9a67ed340cbb5ec9db4cd5e164e4/analysis/1487006023/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53939-4918-4d56-96d6-4dd102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:53.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:53.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 1ec7e595677038145991c6d84dc7808602142f258c1f90e9486cca0fe531d74f",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a21d9ea6d25f0f33d1ed269921da0db67af8b8a4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53939-d844-4b00-b1ce-43a202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:53.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:53.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 1ec7e595677038145991c6d84dc7808602142f258c1f90e9486cca0fe531d74f",
|
||
|
|
"pattern": "[file:hashes.MD5 = '64921e0733865296483bb712ca9faaeb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5393a-5bec-438e-afe4-4b9002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:54.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:54.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:47:54Z",
|
||
|
|
"last_observed": "2017-02-28T08:47:54Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5393a-5bec-438e-afe4-4b9002de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5393a-5bec-438e-afe4-4b9002de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/1ec7e595677038145991c6d84dc7808602142f258c1f90e9486cca0fe531d74f/analysis/1464355452/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5393b-f0bc-408f-b941-483d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:55.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:55.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 17006d77cc1459aa3d70e4e9377edb2547a7446647aa9872c9dd9ad860ed7e39",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '84c904a7eb0b6d89b713b64bfae0ece98de4f508']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5393c-dd34-4a16-ab64-4e0802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:56.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:56.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 17006d77cc1459aa3d70e4e9377edb2547a7446647aa9872c9dd9ad860ed7e39",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd7ebb06b1cd7770e6161ecbb1a30fdb1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5393c-edb8-47aa-a02f-423b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:56.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:56.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:47:56Z",
|
||
|
|
"last_observed": "2017-02-28T08:47:56Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5393c-edb8-47aa-a02f-423b02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5393c-edb8-47aa-a02f-423b02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/17006d77cc1459aa3d70e4e9377edb2547a7446647aa9872c9dd9ad860ed7e39/analysis/1484141188/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5393d-a348-4e15-b995-486602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:57.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:57.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 151cf4c83722ba171ae42640e5e13af67ca06ee0a06a74afa53931acf6ac1506",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '47c7691f7c5bb2f7fecffe3eb9790b1b64f2d567']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5393e-14e8-429e-8724-4d2602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:58.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:58.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 151cf4c83722ba171ae42640e5e13af67ca06ee0a06a74afa53931acf6ac1506",
|
||
|
|
"pattern": "[file:hashes.MD5 = '75a11e9f2e53c95a2ed8e958ab9078fc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5393f-030c-47ba-b344-4bb102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:59.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:59.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:47:59Z",
|
||
|
|
"last_observed": "2017-02-28T08:47:59Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5393f-030c-47ba-b344-4bb102de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5393f-030c-47ba-b344-4bb102de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/151cf4c83722ba171ae42640e5e13af67ca06ee0a06a74afa53931acf6ac1506/analysis/1487968275/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5393f-6254-4c60-ac15-40ff02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:47:59.000Z",
|
||
|
|
"modified": "2017-02-28T08:47:59.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 0ddb7867e31f3f30cd1cfe74393f8ac5bbdc61538278de9219a49345f0d3af7f",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'fbaa7cd077da96523f9966d41287f56b59c1f086']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:47:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53940-7d08-499a-a2e8-4a9d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:00.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:00.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 0ddb7867e31f3f30cd1cfe74393f8ac5bbdc61538278de9219a49345f0d3af7f",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'b94ca0ac6f20b90f02baa03dff0403c1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53941-1044-4113-ae09-486002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:01.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:01.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:48:01Z",
|
||
|
|
"last_observed": "2017-02-28T08:48:01Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53941-1044-4113-ae09-486002de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53941-1044-4113-ae09-486002de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/0ddb7867e31f3f30cd1cfe74393f8ac5bbdc61538278de9219a49345f0d3af7f/analysis/1481942710/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53942-3f44-4a4b-9bbd-435402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:02.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:02.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 0b8d59312699739b6e6cb7aeb0f22a2eaebbb0fd898a97ef9b83e8d8e9ce67a0",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '0bfba3d0897aa0b1691cd4355f46bd652e323197']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53942-5f78-43f0-bd22-438202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:02.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:02.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 0b8d59312699739b6e6cb7aeb0f22a2eaebbb0fd898a97ef9b83e8d8e9ce67a0",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd8be92d5413522f9678a1ceb27456c6a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53943-2f00-43ff-9de3-43c402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:03.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:03.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:48:03Z",
|
||
|
|
"last_observed": "2017-02-28T08:48:03Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53943-2f00-43ff-9de3-43c402de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53943-2f00-43ff-9de3-43c402de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/0b8d59312699739b6e6cb7aeb0f22a2eaebbb0fd898a97ef9b83e8d8e9ce67a0/analysis/1446318107/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53944-694c-4c73-942a-45c602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:04.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:04.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 0b5316d723d1ebbec9aba0c9ff6761050305d644c3eeb5291b4e2c4de9e5fa15",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '52874d8eb1ab0b9fcbe5a71a0542ca3a065649fc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53945-8b5c-4d3e-9340-451602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:05.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:05.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 0b5316d723d1ebbec9aba0c9ff6761050305d644c3eeb5291b4e2c4de9e5fa15",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0431bec00f66a768594e8176be46a5ec']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53945-1990-4ccf-8353-4fc902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:05.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:05.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:48:05Z",
|
||
|
|
"last_observed": "2017-02-28T08:48:05Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53945-1990-4ccf-8353-4fc902de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53945-1990-4ccf-8353-4fc902de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/0b5316d723d1ebbec9aba0c9ff6761050305d644c3eeb5291b4e2c4de9e5fa15/analysis/1480593725/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53946-4528-48e4-b7e4-4ba602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:06.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:06.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 0b4a90b823a581311c4acb59f35e32f81f70ca16a2538f54f4dbe03db93350df",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '9626dfe395148eda44b3d517a90e60438ab9342a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53947-18b8-4f0f-84e2-4bc402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:07.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:07.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 0b4a90b823a581311c4acb59f35e32f81f70ca16a2538f54f4dbe03db93350df",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'b2d1c89d467f62e21e7b7da318886a49']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53948-0f04-474a-95b1-49a102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:08.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:08.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:48:08Z",
|
||
|
|
"last_observed": "2017-02-28T08:48:08Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53948-0f04-474a-95b1-49a102de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53948-0f04-474a-95b1-49a102de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/0b4a90b823a581311c4acb59f35e32f81f70ca16a2538f54f4dbe03db93350df/analysis/1462785393/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53948-11f4-4058-970e-451c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:08.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:08.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 0669e61e51cf43daa431d52b5461c90bdce1b1bee03b087e4406c30264dcb9a4",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '93d0e24dbc17f868f190078470ae96b8d97e2551']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53949-6224-4721-8e71-4c2702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:09.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:09.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 0669e61e51cf43daa431d52b5461c90bdce1b1bee03b087e4406c30264dcb9a4",
|
||
|
|
"pattern": "[file:hashes.MD5 = '036191365577eabe2e9d44a52cfafed5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5394a-11a4-4f5b-bd26-45f502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:10.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:10.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:48:10Z",
|
||
|
|
"last_observed": "2017-02-28T08:48:10Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5394a-11a4-4f5b-bd26-45f502de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5394a-11a4-4f5b-bd26-45f502de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/0669e61e51cf43daa431d52b5461c90bdce1b1bee03b087e4406c30264dcb9a4/analysis/1487567517/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5394b-eeb4-40fd-bb04-4da302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:11.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:11.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 059e40ba91b2b2d827c200476fcbd0fad0d43ab198d0c206c996777d27e6de65",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '646b5ecfbf6bccc3b7f8a4f99d101e04690e7e34']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5394b-2938-4ece-94fa-4b8202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:11.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:11.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 059e40ba91b2b2d827c200476fcbd0fad0d43ab198d0c206c996777d27e6de65",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ec5e0bf8e153bb263bf8cf47d6b9308c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5394c-5898-47dc-bb1e-495c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:12.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:12.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:48:12Z",
|
||
|
|
"last_observed": "2017-02-28T08:48:12Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5394c-5898-47dc-bb1e-495c02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5394c-5898-47dc-bb1e-495c02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/059e40ba91b2b2d827c200476fcbd0fad0d43ab198d0c206c996777d27e6de65/analysis/1476884603/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5394d-b1d8-4b4f-b211-4f6602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:13.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:13.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 03e5e99cc8280de4663c4b65bfd26782d4975258808a63a4b20bc068008df7f5",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '6dff41cc4f94a05156b9c16f2070ae142e1cee2f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5394e-c114-4139-8818-406c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:14.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:14.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 03e5e99cc8280de4663c4b65bfd26782d4975258808a63a4b20bc068008df7f5",
|
||
|
|
"pattern": "[file:hashes.MD5 = '76ac34a7a55a2d9960e98e0d13711fe5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5394f-3c64-436f-b972-419502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:15.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:15.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:48:15Z",
|
||
|
|
"last_observed": "2017-02-28T08:48:15Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5394f-3c64-436f-b972-419502de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5394f-3c64-436f-b972-419502de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/03e5e99cc8280de4663c4b65bfd26782d4975258808a63a4b20bc068008df7f5/analysis/1476954558/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5394f-4bf0-4733-8303-4bc602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:15.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:15.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 03c943f5cba11b09b9c3afa0705d4a027e5a9d81b299711740cc5aedfe4b4aa1",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'de488b22f5da1181780013571a4b3b8226fa0cc0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53950-4de8-4f08-bc94-423c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:16.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:16.000Z",
|
||
|
|
"description": "Sample bundled commodity tools - Xchecked via VT: 03c943f5cba11b09b9c3afa0705d4a027e5a9d81b299711740cc5aedfe4b4aa1",
|
||
|
|
"pattern": "[file:hashes.MD5 = '09503ceeee5eff7fdbc75bb4e45012e7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53951-4b8c-4638-9085-448602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:17.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:17.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:48:17Z",
|
||
|
|
"last_observed": "2017-02-28T08:48:17Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53951-4b8c-4638-9085-448602de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53951-4b8c-4638-9085-448602de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/03c943f5cba11b09b9c3afa0705d4a027e5a9d81b299711740cc5aedfe4b4aa1/analysis/1465541582/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53952-53e4-44fa-824d-459e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:18.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:18.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: f2296bcb6be68dfb330baec2091fb11a42a51928ba057164213580e6ff0e1126",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '4b980da7d7a73b51b3e762923022255b1ef5ced0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53952-3794-4fc2-9257-4e1d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:18.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:18.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: f2296bcb6be68dfb330baec2091fb11a42a51928ba057164213580e6ff0e1126",
|
||
|
|
"pattern": "[file:hashes.MD5 = '4082a9a608a3b117d055ea168b3ff928']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53953-8c54-4896-872a-411a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:19.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:19.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:48:19Z",
|
||
|
|
"last_observed": "2017-02-28T08:48:19Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53953-8c54-4896-872a-411a02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53953-8c54-4896-872a-411a02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/f2296bcb6be68dfb330baec2091fb11a42a51928ba057164213580e6ff0e1126/analysis/1487676669/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53954-2e58-489a-b5eb-466102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:20.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:20.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: e24715900aa5c9de807b0c8f6ba8015683af26c42c66f94bee38e50a34e034c4",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '9cea0d9a633bf4add903f2763cfd86546c8bb989']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53955-b68c-49b6-ab75-41eb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:21.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:21.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: e24715900aa5c9de807b0c8f6ba8015683af26c42c66f94bee38e50a34e034c4",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'bccdddde154ebc491f45173a8339577b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53956-442c-4b73-a155-488602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:22.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:22.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:48:22Z",
|
||
|
|
"last_observed": "2017-02-28T08:48:22Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53956-442c-4b73-a155-488602de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53956-442c-4b73-a155-488602de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/e24715900aa5c9de807b0c8f6ba8015683af26c42c66f94bee38e50a34e034c4/analysis/1485493747/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53956-ff40-44ec-b325-410102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:22.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:22.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: df434f54802a6814628f30cae335c302bae7085c4e8314d71a41a47d9c410c39",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a4737fd501cc549f0a63b409b87e8ff0cf941c0b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53957-ac64-41ec-9ee1-45dd02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:23.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:23.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: df434f54802a6814628f30cae335c302bae7085c4e8314d71a41a47d9c410c39",
|
||
|
|
"pattern": "[file:hashes.MD5 = '994e42c36b90a55a54859bc9b64005f9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53958-9d7c-43a9-b2af-4dd702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:24.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:24.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:48:24Z",
|
||
|
|
"last_observed": "2017-02-28T08:48:24Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53958-9d7c-43a9-b2af-4dd702de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53958-9d7c-43a9-b2af-4dd702de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/df434f54802a6814628f30cae335c302bae7085c4e8314d71a41a47d9c410c39/analysis/1486204279/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53959-04f4-4719-86e2-488f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:25.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:25.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: ddfc6bb4819527b2424d6e1a84f04b67adad79401e39efbffba5b7d727e732f0",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c8ed3c1c52159ccf6088f3a1e0750eb907a05405']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5395a-4b48-4384-be62-458302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:26.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:26.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: ddfc6bb4819527b2424d6e1a84f04b67adad79401e39efbffba5b7d727e732f0",
|
||
|
|
"pattern": "[file:hashes.MD5 = '458085847b5ead066b97514d9bed535e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5395b-9e40-47e9-b815-465602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:27.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:27.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:48:27Z",
|
||
|
|
"last_observed": "2017-02-28T08:48:27Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5395b-9e40-47e9-b815-465602de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5395b-9e40-47e9-b815-465602de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/ddfc6bb4819527b2424d6e1a84f04b67adad79401e39efbffba5b7d727e732f0/analysis/1483936087/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5395b-1014-42be-8e10-4b1802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:27.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:27.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: d1ba365e93ff0a4f3a2cb1d657568e583e3fbd7dbb1c2c52e28f16480324e3bb",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'e4df3ac94147b6e61561d07a662eaa52d5bfa5ad']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5395c-b7bc-4419-b93a-47f002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:28.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:28.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: d1ba365e93ff0a4f3a2cb1d657568e583e3fbd7dbb1c2c52e28f16480324e3bb",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'fd1a0b9a9cdf3996b284f308a064a78e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5395d-b558-40b7-b8a2-40f002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:29.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:48:29Z",
|
||
|
|
"last_observed": "2017-02-28T08:48:29Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5395d-b558-40b7-b8a2-40f002de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5395d-b558-40b7-b8a2-40f002de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/d1ba365e93ff0a4f3a2cb1d657568e583e3fbd7dbb1c2c52e28f16480324e3bb/analysis/1483962060/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5395e-7f10-46d9-850c-42ac02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:30.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:30.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: d01df47b6187631c9a93bdad1298439ab1a1c5529b3319f3614b6ec2455e5726",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '755e04d0cb274ba0199b86589176bf034fff13f2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5395f-460c-4fb7-855b-443002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:31.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:31.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: d01df47b6187631c9a93bdad1298439ab1a1c5529b3319f3614b6ec2455e5726",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd6cca90bbebe8d1bbe957e28012c2ad3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5395f-2208-440e-a551-409302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:31.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:31.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:48:31Z",
|
||
|
|
"last_observed": "2017-02-28T08:48:31Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5395f-2208-440e-a551-409302de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5395f-2208-440e-a551-409302de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/d01df47b6187631c9a93bdad1298439ab1a1c5529b3319f3614b6ec2455e5726/analysis/1478157567/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53960-2268-4134-a27d-456302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:32.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:32.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: be2be662cc821a924d5641422dd1116e99188c6923da092ca3f0f8f862bd2d2d",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '6259fe3e655da02f37979c52eeb4c46447204cbf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53961-5720-486d-a265-427f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:33.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:33.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: be2be662cc821a924d5641422dd1116e99188c6923da092ca3f0f8f862bd2d2d",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'a562c7dba738dc65d3b7deade7ffc31d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53962-7d78-45ea-b943-494c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:34.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:34.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:48:34Z",
|
||
|
|
"last_observed": "2017-02-28T08:48:34Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53962-7d78-45ea-b943-494c02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53962-7d78-45ea-b943-494c02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/be2be662cc821a924d5641422dd1116e99188c6923da092ca3f0f8f862bd2d2d/analysis/1487931064/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53962-89c0-4670-9061-413002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:34.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:34.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: b9434e5a14159c49af2d1a5a11d570f195797d6b17aa560c3dde4a5b3486bf2a",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f700b1ae7177c70e886a698db99504b05b946643']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53963-e010-4578-8001-4ea202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:35.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:35.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: b9434e5a14159c49af2d1a5a11d570f195797d6b17aa560c3dde4a5b3486bf2a",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'a40598df79b569acc6c62f1533aeb673']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53964-8048-404b-be36-42ac02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:36.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:36.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:48:36Z",
|
||
|
|
"last_observed": "2017-02-28T08:48:36Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53964-8048-404b-be36-42ac02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53964-8048-404b-be36-42ac02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/b9434e5a14159c49af2d1a5a11d570f195797d6b17aa560c3dde4a5b3486bf2a/analysis/1486013465/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53965-5e38-4a89-b48a-46bc02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:37.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:37.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: b2fb7d2977f42698ea92d1576fdd4da7ad7bb34f52a63e4066f158a4b1ffb875",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'ae3bf7a655ba5f476904abc1dc23ede6329fa1bc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53965-5950-4325-829a-4db502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:37.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:37.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: b2fb7d2977f42698ea92d1576fdd4da7ad7bb34f52a63e4066f158a4b1ffb875",
|
||
|
|
"pattern": "[file:hashes.MD5 = '58aee970b06e67c9047836710f28e205']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53966-e9e4-4153-bb46-4aa902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:38.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:38.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:48:38Z",
|
||
|
|
"last_observed": "2017-02-28T08:48:38Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53966-e9e4-4153-bb46-4aa902de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53966-e9e4-4153-bb46-4aa902de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/b2fb7d2977f42698ea92d1576fdd4da7ad7bb34f52a63e4066f158a4b1ffb875/analysis/1482910334/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53967-271c-466e-a12a-405202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:39.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:39.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: ae5ab2e887a9b46ea7819b7ebbb8163028e66882c97e75b0698dc3a69a69d7da",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '29541366bc2d5ee32663710a0b84ad765f3b5f11']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53968-5380-4406-affc-474002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:40.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:40.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: ae5ab2e887a9b46ea7819b7ebbb8163028e66882c97e75b0698dc3a69a69d7da",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'e736e8da13160ff26165d4e1265c5d4a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53969-6f70-47a5-8766-4dc802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:40.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:40.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:48:40Z",
|
||
|
|
"last_observed": "2017-02-28T08:48:40Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53969-6f70-47a5-8766-4dc802de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53969-6f70-47a5-8766-4dc802de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/ae5ab2e887a9b46ea7819b7ebbb8163028e66882c97e75b0698dc3a69a69d7da/analysis/1485197879/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53969-fa88-41e6-8c27-4dab02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:41.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:41.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: a804beddd22bb76ea207a9607ed5c888f2f640cbd9ed9a32942fcd0b8a25c4d5",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'eb5faa1631b636125ffea1202811971b8d455583']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5396a-6598-4e2f-b549-413702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:42.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:42.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: a804beddd22bb76ea207a9607ed5c888f2f640cbd9ed9a32942fcd0b8a25c4d5",
|
||
|
|
"pattern": "[file:hashes.MD5 = '8857f61a1cb503fa13b9556f45e7c2ea']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5396b-d1bc-4892-850c-427202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:43.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:43.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:48:43Z",
|
||
|
|
"last_observed": "2017-02-28T08:48:43Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5396b-d1bc-4892-850c-427202de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5396b-d1bc-4892-850c-427202de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/a804beddd22bb76ea207a9607ed5c888f2f640cbd9ed9a32942fcd0b8a25c4d5/analysis/1486409002/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5396c-6ee4-489e-83bc-4e8002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:44.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:44.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: a7e27ff0695a4bdf58c584f48664acd3a385ccebf3a542fdd6d7383f414aa83a",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '889c599090ae2785a664599c9d404cc2e0be2b9f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5396d-4ce8-48d2-91e3-416002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:45.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:45.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: a7e27ff0695a4bdf58c584f48664acd3a385ccebf3a542fdd6d7383f414aa83a",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'a5366c32616f05ffc550f65f046770fc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5396d-cf04-431d-8df5-437002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:45.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:45.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:48:45Z",
|
||
|
|
"last_observed": "2017-02-28T08:48:45Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5396d-cf04-431d-8df5-437002de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5396d-cf04-431d-8df5-437002de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/a7e27ff0695a4bdf58c584f48664acd3a385ccebf3a542fdd6d7383f414aa83a/analysis/1485395874/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5396e-5594-4217-935d-4b6902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:46.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:46.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: a46508ec9e48c256261b2d1914532a36ac7da093253320135d77581051751b75",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '645bfaed98b8276f34e7ee4edf613da93280955c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5396f-a004-4133-b3cb-42ed02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:47.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:47.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: a46508ec9e48c256261b2d1914532a36ac7da093253320135d77581051751b75",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'fdd05c244e23d1ffb74329a7b7f58569']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53970-71f8-42be-a522-49db02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:48.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:48.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:48:48Z",
|
||
|
|
"last_observed": "2017-02-28T08:48:48Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53970-71f8-42be-a522-49db02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53970-71f8-42be-a522-49db02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/a46508ec9e48c256261b2d1914532a36ac7da093253320135d77581051751b75/analysis/1463567124/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53970-8a8c-4faa-b6d0-4c0f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:48.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:48.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 9cb64d3242d2b591bd2ff13b1aadef2e6b4bf9147f4a0926613b7c9343feb312",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'd8491552c1088505c256c7472032b56c7a4dc068']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53971-bc40-4a82-9ad5-421a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:49.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:49.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 9cb64d3242d2b591bd2ff13b1aadef2e6b4bf9147f4a0926613b7c9343feb312",
|
||
|
|
"pattern": "[file:hashes.MD5 = '25b7f547ae16062c77cb43dbbcafef57']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53972-e078-48f0-847f-429f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:50.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:50.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:48:50Z",
|
||
|
|
"last_observed": "2017-02-28T08:48:50Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53972-e078-48f0-847f-429f02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53972-e078-48f0-847f-429f02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/9cb64d3242d2b591bd2ff13b1aadef2e6b4bf9147f4a0926613b7c9343feb312/analysis/1483975816/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53973-7e1c-4785-86ef-462d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:51.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:51.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 9a1fd88970da3809f45cef00360d1e54ea11a70035c277c130404a67371e142d",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'ffb568b2a37de7bb601aa15342b98cac2baa49e7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53973-a044-49e8-8eb5-47b102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:51.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:51.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 9a1fd88970da3809f45cef00360d1e54ea11a70035c277c130404a67371e142d",
|
||
|
|
"pattern": "[file:hashes.MD5 = '27baea207bdb84a3082070f17b58ab4f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53974-0e48-4e62-9d09-46b502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:52.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:52.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:48:52Z",
|
||
|
|
"last_observed": "2017-02-28T08:48:52Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53974-0e48-4e62-9d09-46b502de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53974-0e48-4e62-9d09-46b502de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/9a1fd88970da3809f45cef00360d1e54ea11a70035c277c130404a67371e142d/analysis/1486192047/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53975-d5d0-4aff-9c6d-47b402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:53.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:53.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 97ebd7bfad63b36b4572132f6ece359ff9991f269048c0b145411699bfe3dc34",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '0bf38d11a5b5a1931bd0864523cc6e011802fa06']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53976-8070-4859-936b-43f202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:54.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:54.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 97ebd7bfad63b36b4572132f6ece359ff9991f269048c0b145411699bfe3dc34",
|
||
|
|
"pattern": "[file:hashes.MD5 = '2b4b5d087d1b22f4fe1cc1aa0c8a9ec6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53977-5d7c-4ed4-8af9-446402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:55.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:55.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:48:55Z",
|
||
|
|
"last_observed": "2017-02-28T08:48:55Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53977-5d7c-4ed4-8af9-446402de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53977-5d7c-4ed4-8af9-446402de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/97ebd7bfad63b36b4572132f6ece359ff9991f269048c0b145411699bfe3dc34/analysis/1463567205/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53977-00c0-46b4-86f7-4db902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:55.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:55.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 90ba0f95896736b799f8651ef0600d4fa85c6c3e056e54eab5bb216327912edd",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '8a69cdce0976e20ce73819146480f6e53fb0fa29']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53978-c4c0-4923-a398-404c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:56.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:56.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 90ba0f95896736b799f8651ef0600d4fa85c6c3e056e54eab5bb216327912edd",
|
||
|
|
"pattern": "[file:hashes.MD5 = '913f276a232a56e46564f602871a5f2e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53979-9724-4455-8944-45cd02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:57.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:57.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:48:57Z",
|
||
|
|
"last_observed": "2017-02-28T08:48:57Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53979-9724-4455-8944-45cd02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53979-9724-4455-8944-45cd02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/90ba0f95896736b799f8651ef0600d4fa85c6c3e056e54eab5bb216327912edd/analysis/1484509827/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5397a-57f4-4cbf-b232-424b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:58.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:58.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 840b3d4cc95dbf311f792a9f50137056deb66bfdbb55eb9f54ff381a0df65656",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'e80c3210946d55b0565385fd7a67d5446743621e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5397a-3748-4f33-b59c-44b202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:58.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:58.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 840b3d4cc95dbf311f792a9f50137056deb66bfdbb55eb9f54ff381a0df65656",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c62c993ccbc2d813b7a6bd1114f791b7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:48:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5397b-cf04-4740-a98f-486802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:48:59.000Z",
|
||
|
|
"modified": "2017-02-28T08:48:59.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:48:59Z",
|
||
|
|
"last_observed": "2017-02-28T08:48:59Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5397b-cf04-4740-a98f-486802de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5397b-cf04-4740-a98f-486802de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/840b3d4cc95dbf311f792a9f50137056deb66bfdbb55eb9f54ff381a0df65656/analysis/1485551574/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5397c-b5bc-4eb5-9d67-48f802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:00.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:00.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 5ec8b7ca4461720bd69fb49b3f6cae637d8ac3bbd675da938bc5a84e9b73b395",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a2e35e5acd0be75cb28d9d9be820b48af9ce2c8c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:49:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5397d-52dc-4bd4-b200-4ba802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:01.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:01.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 5ec8b7ca4461720bd69fb49b3f6cae637d8ac3bbd675da938bc5a84e9b73b395",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ef902218a1050f70ca11ea35e851b7cb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:49:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5397d-5754-43a0-b3d4-43d602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:01.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:01.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:49:01Z",
|
||
|
|
"last_observed": "2017-02-28T08:49:01Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5397d-5754-43a0-b3d4-43d602de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5397d-5754-43a0-b3d4-43d602de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/5ec8b7ca4461720bd69fb49b3f6cae637d8ac3bbd675da938bc5a84e9b73b395/analysis/1486213145/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5397e-0624-4e9e-90da-4dfd02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:02.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:02.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 5b22ace98b57ed19d815c49983c96a3c6ff0b2701e8167d4422c6990982abcf9",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '0ccf82bff6df77603457866879e12f11b7dc21c9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:49:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5397f-bda0-4d7f-b223-421402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:03.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:03.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 5b22ace98b57ed19d815c49983c96a3c6ff0b2701e8167d4422c6990982abcf9",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'b964dd5b47efdd48219ec386ba97ca0b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:49:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53980-4760-4b10-98ee-459c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:04.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:04.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:49:04Z",
|
||
|
|
"last_observed": "2017-02-28T08:49:04Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53980-4760-4b10-98ee-459c02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53980-4760-4b10-98ee-459c02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/5b22ace98b57ed19d815c49983c96a3c6ff0b2701e8167d4422c6990982abcf9/analysis/1484509976/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53980-367c-482d-9140-43a002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:04.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:04.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 598c55b89e819b23eac34547ad02e5cd59e1b8fcb23b5063a251d8e8fae8b824",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '4401a442e18f9e3db1b6166f58220e084b795292']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:49:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53981-11cc-4ae8-87b6-43cb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:05.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:05.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 598c55b89e819b23eac34547ad02e5cd59e1b8fcb23b5063a251d8e8fae8b824",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c1dc9dcc70f22aa96053c882fccfb275']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:49:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53982-a4b0-47b5-a6ad-408802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:06.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:06.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:49:06Z",
|
||
|
|
"last_observed": "2017-02-28T08:49:06Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53982-a4b0-47b5-a6ad-408802de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53982-a4b0-47b5-a6ad-408802de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/598c55b89e819b23eac34547ad02e5cd59e1b8fcb23b5063a251d8e8fae8b824/analysis/1457202519/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53983-06ec-4706-9a53-4d8c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:07.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:07.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 400f53a89d08d47f608e1288d9873bf8d421fc7cd642c5e821674f38e07a1501",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'cf35cc18c7feb1f626c87ea5ea01ef9459f3a485']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:49:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53984-43b0-4c45-9b5f-444e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:08.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:08.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 400f53a89d08d47f608e1288d9873bf8d421fc7cd642c5e821674f38e07a1501",
|
||
|
|
"pattern": "[file:hashes.MD5 = '1981f44338dce83e5ac4b1a30384c90e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:49:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53984-2b08-4752-95a7-43b602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:08.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:08.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:49:08Z",
|
||
|
|
"last_observed": "2017-02-28T08:49:08Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53984-2b08-4752-95a7-43b602de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53984-2b08-4752-95a7-43b602de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/400f53a89d08d47f608e1288d9873bf8d421fc7cd642c5e821674f38e07a1501/analysis/1447429399/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53985-ca18-436c-bf5e-49f502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:09.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:09.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 3e5b1116b2dfd99652a001968a05fc962974931a0596153ab0dea8e4a9982f89",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '9ebe5c66d17be6447d619c90de0efe7b70ea208b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:49:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53986-d244-47fb-885c-41b902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:10.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:10.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 3e5b1116b2dfd99652a001968a05fc962974931a0596153ab0dea8e4a9982f89",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'b728afda3cd2c7446651d2996f7fa3eb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:49:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53987-8ce8-490d-84ca-44db02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:11.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:11.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:49:11Z",
|
||
|
|
"last_observed": "2017-02-28T08:49:11Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53987-8ce8-490d-84ca-44db02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53987-8ce8-490d-84ca-44db02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/3e5b1116b2dfd99652a001968a05fc962974931a0596153ab0dea8e4a9982f89/analysis/1485788712/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53987-65c8-4aec-a519-4f9202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:11.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:11.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 37c78ee7826d63bb9219de594ed6693f18da5db60e3cbc86795bd10b296f12ac",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c768e0bcabf35135b386c29235608ca204266a6b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:49:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53988-47b8-4fd0-9790-48de02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:12.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:12.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 37c78ee7826d63bb9219de594ed6693f18da5db60e3cbc86795bd10b296f12ac",
|
||
|
|
"pattern": "[file:hashes.MD5 = '16f41cbc68f17280f9a4598a03ab7b26']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:49:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53989-b9c0-4a40-a89e-4b4402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:13.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:13.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:49:13Z",
|
||
|
|
"last_observed": "2017-02-28T08:49:13Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53989-b9c0-4a40-a89e-4b4402de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53989-b9c0-4a40-a89e-4b4402de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/37c78ee7826d63bb9219de594ed6693f18da5db60e3cbc86795bd10b296f12ac/analysis/1487676582/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5398a-b5d4-40e4-9e47-4aad02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:14.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:14.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 3773ddd462b01f9272656f3150f2c3de19e77199cf5fac1f44287d11593614f9",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'dc6fd9a7f9b946ce7daae5cba0bd6107d511bce8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:49:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5398a-4860-472e-88c7-4b0702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:14.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:14.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 3773ddd462b01f9272656f3150f2c3de19e77199cf5fac1f44287d11593614f9",
|
||
|
|
"pattern": "[file:hashes.MD5 = '8d6d246c5c660691c59405ee2914a020']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:49:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5398b-ab50-4ee2-8ebd-499e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:15.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:15.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:49:15Z",
|
||
|
|
"last_observed": "2017-02-28T08:49:15Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5398b-ab50-4ee2-8ebd-499e02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5398b-ab50-4ee2-8ebd-499e02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/3773ddd462b01f9272656f3150f2c3de19e77199cf5fac1f44287d11593614f9/analysis/1455345531/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5398c-9e60-4cfd-94c2-445502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:16.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:16.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 3242183b1f0176a2e3cfb6bfef96b9d55c5a59ea9614dbde4ef89979336b5a5d",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a73c262249c8ffbbbf2e1bb796eed47706e17b0a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:49:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5398d-c780-4133-a13b-4dc102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:17.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:17.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 3242183b1f0176a2e3cfb6bfef96b9d55c5a59ea9614dbde4ef89979336b5a5d",
|
||
|
|
"pattern": "[file:hashes.MD5 = '87a80e9aa193ea65d64e9e1e675a3e1d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:49:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5398e-5a20-4cca-9090-404f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:18.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:18.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:49:18Z",
|
||
|
|
"last_observed": "2017-02-28T08:49:18Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5398e-5a20-4cca-9090-404f02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5398e-5a20-4cca-9090-404f02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/3242183b1f0176a2e3cfb6bfef96b9d55c5a59ea9614dbde4ef89979336b5a5d/analysis/1487931115/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5398e-e054-4b90-81aa-4d1702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:18.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:18.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 2f2b26f2f7d164ea1f529edbc3cb8a1063b39121dad4dd19d8ee4bbbaf25ed37",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '0eda7f299d42773f383c69f7bdbe06e08984c708']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:49:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5398f-e364-49ff-9e01-43fc02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:19.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:19.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 2f2b26f2f7d164ea1f529edbc3cb8a1063b39121dad4dd19d8ee4bbbaf25ed37",
|
||
|
|
"pattern": "[file:hashes.MD5 = '80dbf502aff3e1a8fd964cc1d9216463']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:49:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53990-ec94-43df-8fda-433c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:20.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:20.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:49:20Z",
|
||
|
|
"last_observed": "2017-02-28T08:49:20Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53990-ec94-43df-8fda-433c02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53990-ec94-43df-8fda-433c02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/2f2b26f2f7d164ea1f529edbc3cb8a1063b39121dad4dd19d8ee4bbbaf25ed37/analysis/1484582867/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53991-3bbc-4c0e-a1c8-475802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:21.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:21.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 222e85e6d07bdc3a2141cdd582d3f2ed4b1ce5285731cc3f54e6202a13737f8d",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '1e1b8a32438828c5bb508db615daeb4f805b18c0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:49:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53991-eee0-42f5-ad78-492e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:21.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:21.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 222e85e6d07bdc3a2141cdd582d3f2ed4b1ce5285731cc3f54e6202a13737f8d",
|
||
|
|
"pattern": "[file:hashes.MD5 = '1b01822dbd4c92c3af42323f67284016']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:49:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53992-8f74-4024-a743-4ca902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:22.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:22.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:49:22Z",
|
||
|
|
"last_observed": "2017-02-28T08:49:22Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53992-8f74-4024-a743-4ca902de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53992-8f74-4024-a743-4ca902de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/222e85e6d07bdc3a2141cdd582d3f2ed4b1ce5285731cc3f54e6202a13737f8d/analysis/1454939329/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53993-1d38-4a5b-aae6-4d2c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:23.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:23.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 145dab86a43835bb37734c16756d6d64d8e5ac6b87c491c57385e27b564136b8",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'eaac188d866bd3af1f38dda3654bd9a6476abf7b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:49:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53994-a57c-4297-a490-49bf02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:24.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:24.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 145dab86a43835bb37734c16756d6d64d8e5ac6b87c491c57385e27b564136b8",
|
||
|
|
"pattern": "[file:hashes.MD5 = '52066c718e8bcfc505a0f996ec3d00c0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:49:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53994-68b4-4ed0-96fb-486a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:24.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:24.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:49:24Z",
|
||
|
|
"last_observed": "2017-02-28T08:49:24Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53994-68b4-4ed0-96fb-486a02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53994-68b4-4ed0-96fb-486a02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/145dab86a43835bb37734c16756d6d64d8e5ac6b87c491c57385e27b564136b8/analysis/1486201693/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53995-6e6c-4770-95da-462402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:25.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:25.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 0f745512940e0efd8f09c6d862571cba2b98fac9a9f7cf30dedcc08ace43a494",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a865a2509f853770d5ae501aa68e13dff6d488ce']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:49:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53996-28e0-4a81-8c24-4a1d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:26.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:26.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 0f745512940e0efd8f09c6d862571cba2b98fac9a9f7cf30dedcc08ace43a494",
|
||
|
|
"pattern": "[file:hashes.MD5 = '8052c552ef6edb526a0e0d8d54966df2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:49:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53997-1d40-4b49-8f7e-4f0f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:27.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:27.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:49:27Z",
|
||
|
|
"last_observed": "2017-02-28T08:49:27Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53997-1d40-4b49-8f7e-4f0f02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53997-1d40-4b49-8f7e-4f0f02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/0f745512940e0efd8f09c6d862571cba2b98fac9a9f7cf30dedcc08ace43a494/analysis/1463567371/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53998-2f60-40a8-84c6-421e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:27.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:27.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 0dc1010c3d3766158e2347d10fc78d9223c6e0e3a44aa8a76622aeff7d429ab9",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a3aacdf84ffe1918f4c6f08edc23cb8784de32f7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:49:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b53998-c67c-4bfb-9c43-4f6e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:28.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:28.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 0dc1010c3d3766158e2347d10fc78d9223c6e0e3a44aa8a76622aeff7d429ab9",
|
||
|
|
"pattern": "[file:hashes.MD5 = '35929f812b95b96e8d2d8fc165e0dbc7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:49:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b53999-5704-4cc6-8ad5-44dd02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:29.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:29.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:49:29Z",
|
||
|
|
"last_observed": "2017-02-28T08:49:29Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b53999-5704-4cc6-8ad5-44dd02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b53999-5704-4cc6-8ad5-44dd02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/0dc1010c3d3766158e2347d10fc78d9223c6e0e3a44aa8a76622aeff7d429ab9/analysis/1487931080/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5399a-ec30-41f5-ae3f-4fbb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:30.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:30.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 0c47cf984afe87a14d0d4c94557864ed19b4cb52783e49ce96ebf9c2f8b52d27",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'e1c4efc734bca1e4fa91e0fddc992fb8cb8ac2ac']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:49:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5399b-6804-4c70-a471-425302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:31.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:31.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 0c47cf984afe87a14d0d4c94557864ed19b4cb52783e49ce96ebf9c2f8b52d27",
|
||
|
|
"pattern": "[file:hashes.MD5 = '3183fb0ba6aa8b5b652389aaa9a65af1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:49:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5399b-1784-41ca-a01e-46ce02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:31.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:31.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:49:31Z",
|
||
|
|
"last_observed": "2017-02-28T08:49:31Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5399b-1784-41ca-a01e-46ce02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5399b-1784-41ca-a01e-46ce02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/0c47cf984afe87a14d0d4c94557864ed19b4cb52783e49ce96ebf9c2f8b52d27/analysis/1485798737/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5399c-de4c-431c-977d-49fd02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:32.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:32.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 08e69f21c3c60a4a9b78f580c3a55d4cfb74729705b5b7d01c1aecfd58fc49e6",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '7e84a0b409da613dd9683bc87864d1d7ca34aca1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:49:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5399d-698c-43d3-b56c-4d0e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:33.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:33.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 08e69f21c3c60a4a9b78f580c3a55d4cfb74729705b5b7d01c1aecfd58fc49e6",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'a4b575a2e66d57b9f3b226fe19670ce8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:49:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b5399e-099c-4d71-86d2-422102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:34.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:34.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:49:34Z",
|
||
|
|
"last_observed": "2017-02-28T08:49:34Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b5399e-099c-4d71-86d2-422102de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b5399e-099c-4d71-86d2-422102de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/08e69f21c3c60a4a9b78f580c3a55d4cfb74729705b5b7d01c1aecfd58fc49e6/analysis/1485396051/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5399e-dca8-497f-8992-444402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:34.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:34.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 002aff376ec452ec35ae2930dfbb51bd40229c258611d19b86863c3b0d156705",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '9abd5df65874e6cddbfb7b814045adfef3d3a925']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:49:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58b5399f-2854-467f-9ed6-45ea02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:35.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:35.000Z",
|
||
|
|
"description": "custom developed tools - Xchecked via VT: 002aff376ec452ec35ae2930dfbb51bd40229c258611d19b86863c3b0d156705",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'a299b76a8b4984e46484c3e1c090614d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-02-28T08:49:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58b539a0-075c-42c5-91e4-4aca02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-02-28T08:49:36.000Z",
|
||
|
|
"modified": "2017-02-28T08:49:36.000Z",
|
||
|
|
"first_observed": "2017-02-28T08:49:36Z",
|
||
|
|
"last_observed": "2017-02-28T08:49:36Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58b539a0-075c-42c5-91e4-4aca02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58b539a0-075c-42c5-91e4-4aca02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/002aff376ec452ec35ae2930dfbb51bd40229c258611d19b86863c3b0d156705/analysis/1486548603/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|