2023-12-14 14:30:15 +00:00
{
"type" : "bundle" ,
"id" : "bundle--98eb923a-6da8-4c63-87a0-a97a2eef3c98" ,
"objects" : [
{
"type" : "identity" ,
"spec_version" : "2.1" ,
"id" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-09-06T03:00:05.000Z" ,
"modified" : "2023-09-06T03:00:05.000Z" ,
"name" : "Centre for Cyber security Belgium" ,
"identity_class" : "organization"
} ,
{
"type" : "report" ,
"spec_version" : "2.1" ,
"id" : "report--98eb923a-6da8-4c63-87a0-a97a2eef3c98" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-09-06T03:00:05.000Z" ,
"modified" : "2023-09-06T03:00:05.000Z" ,
"name" : "CustomerLoader: a new malware distributing a wide variety of payloads" ,
"published" : "2023-09-06T03:01:02Z" ,
"object_refs" : [
"indicator--73079733-94cc-4977-9ae8-21170b01f192" ,
"indicator--7729ec3a-f59b-4f10-aa08-610417e76615" ,
"indicator--e1f2b17b-b81a-4480-9b59-ee02f3d62655" ,
"indicator--c3e1d9f5-4166-4cc1-a255-ede76f3d8093" ,
"indicator--04100f47-87f9-4256-b76d-dc1d4018f2e9" ,
"indicator--bef1438a-58ba-4b7a-b99d-79c18bf3dbf1" ,
"indicator--7a183367-2ccd-4487-8f10-c749658a7a84" ,
"indicator--4a4ec3fd-5047-4fb5-b075-4147499752a1" ,
"indicator--a144d890-79c7-48f9-a832-abc885382a89" ,
"indicator--2da87919-117a-4f9e-b8ca-436be650c645" ,
"indicator--fee765d6-e638-43f5-95f5-4e5b4d296752" ,
"indicator--f70f49e0-2c28-4fb4-ac8a-6c4423f581a4" ,
"indicator--ae8c6189-1237-4bfa-8669-e36124152dad" ,
"indicator--7245836c-7dfa-48fc-8330-85a879ee6343" ,
"indicator--0179392a-bbcb-4fd6-af43-b7910a5f3435" ,
"indicator--fe6e9ac9-bb0a-49f5-a952-5b1f290adb8d" ,
"indicator--3a3c6854-09e2-4c48-b2e7-73d6b1b36d2a" ,
"indicator--7fceb8da-6dfb-4023-9bd6-aa1a96c99624" ,
"indicator--f683883b-5951-4d80-b4d7-b4e6c1c01da5" ,
"indicator--326c6f69-798e-41d5-b88b-6028079609ea" ,
"indicator--117628a6-31c5-4d1c-9fc9-5f5b27a4a73b" ,
"indicator--0ffdaa41-2aaa-42ff-b7bd-aa195e2beb06" ,
"indicator--68dc1111-5ada-4ebb-9d77-4b0c7098cbf8" ,
"indicator--e23b803d-efa5-41a6-8d37-2cbee9fcdcd7" ,
"indicator--97479af0-ef0e-481c-bec1-82c36ad93e81" ,
"indicator--00f1c68a-f030-4809-b4f3-f8bb170e100f" ,
"indicator--7bc33ced-2de0-4bcd-9430-6456f3e05497" ,
"indicator--4ac3880e-1a60-4512-9d97-18d9fd01bf01" ,
"indicator--ebd96dc1-33b0-4d51-b62b-4a712ae8652d" ,
"indicator--ccd1a007-e24b-4f4c-84b1-e975b69f5c1a" ,
"indicator--fbd5612e-97aa-443c-8db9-a2ba8d486828" ,
"indicator--2198b70c-fdc8-4522-8efc-f5df47ac071c" ,
"indicator--a73ebe37-62c8-4325-a594-f19988acc65f" ,
"indicator--d287ec58-197e-4268-bf5e-16dc6468ba1c" ,
"indicator--743a5c1b-fef1-44f1-93af-f8643931ebc8" ,
"indicator--73e3f627-cd30-4740-8003-9876133aa266" ,
"indicator--eccd9c73-ef8f-46b8-aa46-5652a8db3233" ,
"indicator--41c1d377-d8af-47ea-91c0-774a36f8e6f2" ,
"indicator--b4e818c4-5efa-4312-8eb2-a3a3a0ee967f" ,
"indicator--51e4ac8e-95c3-464d-8eb2-da4fb3743c50" ,
"indicator--49dd8434-0ce8-4635-b256-9a291711fb1d" ,
"indicator--725faf44-1d4e-4605-874a-c11d7c8037d4" ,
"indicator--dd1dd5c8-71e4-4431-bd12-872d3863de51" ,
"indicator--09904864-5c88-4074-aeef-dd3070a2d953" ,
"indicator--9e4d0181-601e-4f7b-a85e-d77fdb13df46" ,
"indicator--1e3eaf7d-2868-46c3-bd6a-293f34681e27" ,
"indicator--4cb564c8-0f92-434c-a1b8-64e2d0162493" ,
"indicator--9933c87b-63e9-4545-9b63-f344b3928605" ,
"indicator--b6daf1a9-ae53-4046-965c-058ce949d60d" ,
"indicator--a20cc7c3-aa95-4c45-976e-0819d218a5f2" ,
"indicator--1f9512f6-4df4-4c31-85d2-8cb3bee3bbc0" ,
"indicator--91d40c8e-8cf5-4a56-ae84-1b906fc04e03" ,
"indicator--268abd35-5515-495d-8671-536c285a1ef8" ,
"indicator--ad5e7288-4d3f-419e-84a5-86a7dbb96da6" ,
"indicator--f46ff266-6855-4207-bfc6-60290cf58094" ,
"indicator--d8fb9a0c-c57d-4ea2-8b56-bb00094111b8" ,
"indicator--1dbca102-9c8c-49ce-8a11-17640306433d" ,
"observed-data--c8573245-d288-478e-946f-a1062740dab5" ,
"network-traffic--c8573245-d288-478e-946f-a1062740dab5" ,
"ipv4-addr--c8573245-d288-478e-946f-a1062740dab5" ,
"indicator--88bb0d65-2753-42a8-b143-6a7939ed5e97" ,
"indicator--d6b9d4ae-b825-4299-8458-8c32a546922d" ,
"indicator--b9e4ca36-e6bf-4f5c-97b4-2a28045cc17a" ,
"indicator--ae4e6c5b-1cd1-4aa4-bbbc-dde8c74130c8" ,
"indicator--3a6e54b7-bd2f-4c75-83cb-a755016b0aaa" ,
"indicator--12e1ea86-9f1f-47e0-8d88-72a35d8d6819" ,
"indicator--d0a4f476-384d-46c3-b1dc-86207159f3f9" ,
"indicator--a1731fc0-487f-4d3a-872e-f8f8826bedfe" ,
"indicator--6c15035d-e156-41d7-aeda-fc89eaa19818" ,
"indicator--690ead91-a1de-4a85-b227-64f58a2f79dd" ,
"indicator--a208990a-f956-4cdb-bc5f-09004f922aac" ,
"indicator--4d29bad2-32fa-42a6-9369-4771a05a07ad" ,
"indicator--0724045e-fd3c-4698-98e4-6d493c35ac0c" ,
"indicator--f544867c-5acf-4970-a96a-7468d570c56b" ,
"indicator--2dfde444-2afe-4ca3-9214-c790837a08c5" ,
"indicator--40be5e44-04aa-41c4-8a97-0e642cb84940" ,
"indicator--6fdb80a4-e001-4173-8b30-3ef96ba05954" ,
"x-misp-object--739097b3-9ba6-442c-872f-528f42278bad" ,
"note--4173dc9c-2c55-4e0e-8ef7-341ee4ea63c7" ,
2024-04-05 12:15:17 +00:00
"relationship--8a001688-e19d-4386-9833-0ba29c1e9d2e" ,
"relationship--1cb9f64c-7370-42ca-af4a-fb5f4e1c9534" ,
"relationship--bae49eb3-9c32-4365-8e59-d9441452ce62" ,
"relationship--3630f173-56fb-4245-b5f4-eff8b1bf6ae3" ,
"relationship--bb06fa9e-ed25-4d29-83e8-6c854c38b6e5" ,
"relationship--0d5bf287-c156-4baa-a07d-630f8780e5f6" ,
"relationship--84dc45f2-18e1-4194-8217-d46e0718348b" ,
"relationship--bf7e1278-470b-4b19-838f-ba047757be92" ,
"relationship--54c7c3a2-411e-477d-b189-8c34b02acc9b" ,
"relationship--2fa6b985-fc40-4356-9cd2-5b224e328a7b" ,
"relationship--ef164f6b-ef32-46a7-833b-60908d60f246" ,
"relationship--d62c7df6-ee82-4541-9a50-5ca70a12b9b2" ,
"relationship--a02e2346-bbf2-4847-b4d4-db84889f5f2c" ,
"relationship--643c0dc9-ba74-4bab-8ec5-ef5925abdfb6"
2023-12-14 14:30:15 +00:00
] ,
"labels" : [
"Threat-Report" ,
"misp:tool=\"MISP-STIX-Converter\"" ,
"admiralty-scale:source-reliability=\"b\"" ,
"admiralty-scale:information-credibility=\"2\"" ,
"DOTRUNPEX" ,
"Loader" ,
"feedly:source=\"Sekoia.io Blog\"" ,
"malware_classification:malware-category=\"Downloader\"" ,
"osint:source-type=\"blog-post\"" ,
"misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"" ,
"misp-galaxy:mitre-attack-pattern=\"Impair Defenses - T1562\"" ,
"misp-galaxy:malpedia=\"vidar\"" ,
"misp-galaxy:malpedia=\"XLoader\"" ,
"misp-galaxy:malpedia=\"Agent Tesla\"" ,
"misp-galaxy:malpedia=\"AsyncRAT\"" ,
"misp-galaxy:malpedia=\"Ave Maria\"" ,
"misp-galaxy:malpedia=\"DarkCloud Stealer\"" ,
"misp-galaxy:malpedia=\"LgoogLoader\"" ,
"misp-galaxy:malpedia=\"RedLine Stealer\"" ,
"misp-galaxy:malpedia=\"SectopRAT\"" ,
"misp-galaxy:malpedia=\"Stealc\"" ,
"misp-galaxy:mitre-malware=\"Agent Tesla - S0331\"" ,
"misp-galaxy:mitre-malware=\"WarzoneRAT - S0670\"" ,
"misp-galaxy:mitre-tool=\"QuasarRAT - S0262\"" ,
"misp-galaxy:mitre-tool=\"Remcos - S0332\"" ,
"misp-galaxy:rat=\"AsyncRAT\"" ,
"misp-galaxy:stealer=\"Vidar\"" ,
"misp-galaxy:stealer=\"DarkCloud Stealer\"" ,
"misp-galaxy:tool=\"FormBook\"" ,
"misp-galaxy:tool=\"Agent Tesla\"" ,
"misp-galaxy:malpedia=\"BitRAT\"" ,
"misp-galaxy:mitre-malware=\"WannaCry - S0366\"" ,
"misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"" ,
"misp-galaxy:mitre-attack-pattern=\"Shared Modules - T1129\"" ,
"misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"" ,
"misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"" ,
"misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"" ,
"misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"" ,
"misp-galaxy:mitre-attack-pattern=\"Dynamic API Resolution - T1027.007\"" ,
"misp-galaxy:mitre-attack-pattern=\"Reflective Code Loading - T1620\"" ,
"misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"" ,
"misp-galaxy:mitre-attack-pattern=\"Standard Encoding - T1132.001\"" ,
"misp-galaxy:mitre-attack-pattern=\"Data Obfuscation - T1001\"" ,
"tlp:clear"
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--73079733-94cc-4977-9ae8-21170b01f192" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T13:23:31.000Z" ,
"modified" : "2023-07-14T13:23:31.000Z" ,
"description" : "C2 server associated with CustomLoader" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.42.94.169']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T13:23:31Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--7729ec3a-f59b-4f10-aa08-610417e76615" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T13:23:31.000Z" ,
"modified" : "2023-07-14T13:23:31.000Z" ,
"description" : "C2 server associated with CustomLoader" ,
"pattern" : "[domain-name:value = 'kyliansuperm92139124.sbs']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T13:23:31Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--e1f2b17b-b81a-4480-9b59-ee02f3d62655" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:11:38.000Z" ,
"modified" : "2023-07-14T14:11:38.000Z" ,
"description" : "Domains receiving requets from ccrypter downloaded by CustomerLoader" ,
"pattern" : "[domain-name:value = 'get-vbs.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:11:38Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "External analysis"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"External analysis\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--c3e1d9f5-4166-4cc1-a255-ede76f3d8093" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:11:39.000Z" ,
"modified" : "2023-07-14T14:11:39.000Z" ,
"description" : "Domains receiving requets from ccrypter downloaded by CustomerLoader" ,
"pattern" : "[domain-name:value = 'cmd2.pw']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:11:39Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "External analysis"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"External analysis\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--04100f47-87f9-4256-b76d-dc1d4018f2e9" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:11:39.000Z" ,
"modified" : "2023-07-14T14:11:39.000Z" ,
"description" : "Domains receiving requets from ccrypter downloaded by CustomerLoader" ,
"pattern" : "[domain-name:value = 'mymine.pw']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:11:39Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "External analysis"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"External analysis\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--bef1438a-58ba-4b7a-b99d-79c18bf3dbf1" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:11:39.000Z" ,
"modified" : "2023-07-14T14:11:39.000Z" ,
"description" : "Domains receiving requets from ccrypter downloaded by CustomerLoader" ,
"pattern" : "[domain-name:value = 'vbs1.pw']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:11:39Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "External analysis"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"External analysis\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--7a183367-2ccd-4487-8f10-c749658a7a84" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:11:39.000Z" ,
"modified" : "2023-07-14T14:11:39.000Z" ,
"description" : "Domains receiving requets from ccrypter downloaded by CustomerLoader" ,
"pattern" : "[domain-name:value = 'vbs22.pw']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:11:39Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "External analysis"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"External analysis\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--4a4ec3fd-5047-4fb5-b075-4147499752a1" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:11:39.000Z" ,
"modified" : "2023-07-14T14:11:39.000Z" ,
"description" : "Domains receiving requets from ccrypter downloaded by CustomerLoader" ,
"pattern" : "[domain-name:value = 'vbs3.pw']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:11:39Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "External analysis"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"External analysis\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--a144d890-79c7-48f9-a832-abc885382a89" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:13:04.000Z" ,
"modified" : "2023-07-14T14:13:04.000Z" ,
"description" : "Distribution site (landing page)" ,
"pattern" : "[domain-name:value = 'macros-pro.net']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:13:04Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--2da87919-117a-4f9e-b8ca-436be650c645" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:13:05.000Z" ,
"modified" : "2023-07-14T14:13:05.000Z" ,
"description" : "Distribution site (landing page)" ,
"pattern" : "[domain-name:value = 'plugin4free.net']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:13:05Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--fee765d6-e638-43f5-95f5-4e5b4d296752" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:13:05.000Z" ,
"modified" : "2023-07-14T14:13:05.000Z" ,
"description" : "Distribution site (landing page)" ,
"pattern" : "[domain-name:value = 'self-games.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:13:05Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--f70f49e0-2c28-4fb4-ac8a-6c4423f581a4" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:13:05.000Z" ,
"modified" : "2023-07-14T14:13:05.000Z" ,
"description" : "Distribution site (landing page)" ,
"pattern" : "[domain-name:value = 'slackmessenger.site']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:13:05Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--ae8c6189-1237-4bfa-8669-e36124152dad" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:13:06.000Z" ,
"modified" : "2023-07-14T14:13:06.000Z" ,
"description" : "Distribution site (landing page)" ,
"pattern" : "[domain-name:value = 'soft-got.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:13:06Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--7245836c-7dfa-48fc-8330-85a879ee6343" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:13:06.000Z" ,
"modified" : "2023-07-14T14:13:06.000Z" ,
"description" : "Distribution site (landing page)" ,
"pattern" : "[domain-name:value = 'vpnsget.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:13:06Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--0179392a-bbcb-4fd6-af43-b7910a5f3435" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:13:06.000Z" ,
"modified" : "2023-07-14T14:13:06.000Z" ,
"description" : "Distribution site (landing page)" ,
"pattern" : "[domain-name:value = 'vstget.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:13:06Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--fe6e9ac9-bb0a-49f5-a952-5b1f290adb8d" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:13:35.000Z" ,
"modified" : "2023-07-14T14:13:35.000Z" ,
"description" : "Redirection to distribution website" ,
"pattern" : "[domain-name:value = 'seif-games.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:13:35Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--3a3c6854-09e2-4c48-b2e7-73d6b1b36d2a" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:13:36.000Z" ,
"modified" : "2023-07-14T14:13:36.000Z" ,
"description" : "Redirection to distribution website" ,
"pattern" : "[domain-name:value = 'self-games.host']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:13:36Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--7fceb8da-6dfb-4023-9bd6-aa1a96c99624" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:13:36.000Z" ,
"modified" : "2023-07-14T14:13:36.000Z" ,
"description" : "Redirection to distribution website" ,
"pattern" : "[domain-name:value = 'self-games.pw']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:13:36Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--f683883b-5951-4d80-b4d7-b4e6c1c01da5" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:13:36.000Z" ,
"modified" : "2023-07-14T14:13:36.000Z" ,
"description" : "Redirection to distribution website" ,
"pattern" : "[domain-name:value = 'self-games.site']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:13:36Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--326c6f69-798e-41d5-b88b-6028079609ea" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:13:36.000Z" ,
"modified" : "2023-07-14T14:13:36.000Z" ,
"description" : "Redirection to distribution website" ,
"pattern" : "[domain-name:value = 'self-games.space']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:13:36Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--117628a6-31c5-4d1c-9fc9-5f5b27a4a73b" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:13:36.000Z" ,
"modified" : "2023-07-14T14:13:36.000Z" ,
"description" : "Redirection to distribution website" ,
"pattern" : "[domain-name:value = 'soft-got.co']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:13:36Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--0ffdaa41-2aaa-42ff-b7bd-aa195e2beb06" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:13:36.000Z" ,
"modified" : "2023-07-14T14:13:36.000Z" ,
"description" : "Redirection to distribution website" ,
"pattern" : "[domain-name:value = 'soft-got.net']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:13:36Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--68dc1111-5ada-4ebb-9d77-4b0c7098cbf8" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:13:36.000Z" ,
"modified" : "2023-07-14T14:13:36.000Z" ,
"description" : "Redirection to distribution website" ,
"pattern" : "[domain-name:value = 'soft-got.pw']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:13:36Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--e23b803d-efa5-41a6-8d37-2cbee9fcdcd7" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:13:36.000Z" ,
"modified" : "2023-07-14T14:13:36.000Z" ,
"description" : "Redirection to distribution website" ,
"pattern" : "[domain-name:value = 'vst-dw.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:13:36Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--97479af0-ef0e-481c-bec1-82c36ad93e81" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:13:36.000Z" ,
"modified" : "2023-07-14T14:13:36.000Z" ,
"description" : "Redirection to distribution website" ,
"pattern" : "[domain-name:value = 'vstdw.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:13:36Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--00f1c68a-f030-4809-b4f3-f8bb170e100f" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:14:07.000Z" ,
"modified" : "2023-07-14T14:14:07.000Z" ,
"description" : "File hosting domain" ,
"pattern" : "[domain-name:value = 'hardcoverradio.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:14:07Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--7bc33ced-2de0-4bcd-9430-6456f3e05497" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:14:07.000Z" ,
"modified" : "2023-07-14T14:14:07.000Z" ,
"description" : "File hosting domain" ,
"pattern" : "[domain-name:value = 'macrospro.pw']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:14:07Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--4ac3880e-1a60-4512-9d97-18d9fd01bf01" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:14:07.000Z" ,
"modified" : "2023-07-14T14:14:07.000Z" ,
"description" : "File hosting domain" ,
"pattern" : "[domain-name:value = 'plugin4free.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:14:07Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--ebd96dc1-33b0-4d51-b62b-4a712ae8652d" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:14:08.000Z" ,
"modified" : "2023-07-14T14:14:08.000Z" ,
"description" : "File hosting domain" ,
"pattern" : "[domain-name:value = 'slackmessenger.pw']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:14:08Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--ccd1a007-e24b-4f4c-84b1-e975b69f5c1a" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:14:08.000Z" ,
"modified" : "2023-07-14T14:14:08.000Z" ,
"description" : "File hosting domain" ,
"pattern" : "[domain-name:value = 'vpnsget.pw']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:14:08Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--fbd5612e-97aa-443c-8db9-a2ba8d486828" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:14:48.000Z" ,
"modified" : "2023-07-14T14:14:48.000Z" ,
"description" : "Redirection to file hosting domain" ,
"pattern" : "[domain-name:value = 'adanagram.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:14:48Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--2198b70c-fdc8-4522-8efc-f5df47ac071c" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:14:49.000Z" ,
"modified" : "2023-07-14T14:14:49.000Z" ,
"description" : "Redirection to file hosting domain" ,
"pattern" : "[domain-name:value = 'bin-a.pw']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:14:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--a73ebe37-62c8-4325-a594-f19988acc65f" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:14:49.000Z" ,
"modified" : "2023-07-14T14:14:49.000Z" ,
"description" : "Redirection to file hosting domain" ,
"pattern" : "[domain-name:value = 'bin-b.pw']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:14:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--d287ec58-197e-4268-bf5e-16dc6468ba1c" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:14:49.000Z" ,
"modified" : "2023-07-14T14:14:49.000Z" ,
"description" : "Redirection to file hosting domain" ,
"pattern" : "[domain-name:value = 'bin-c.pw']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:14:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--743a5c1b-fef1-44f1-93af-f8643931ebc8" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:14:49.000Z" ,
"modified" : "2023-07-14T14:14:49.000Z" ,
"description" : "Redirection to file hosting domain" ,
"pattern" : "[domain-name:value = 'bin-d.pw']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:14:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--73e3f627-cd30-4740-8003-9876133aa266" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:14:49.000Z" ,
"modified" : "2023-07-14T14:14:49.000Z" ,
"description" : "Redirection to file hosting domain" ,
"pattern" : "[domain-name:value = 'cmd1.pw']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:14:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--eccd9c73-ef8f-46b8-aa46-5652a8db3233" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:14:49.000Z" ,
"modified" : "2023-07-14T14:14:49.000Z" ,
"description" : "Redirection to file hosting domain" ,
"pattern" : "[domain-name:value = 'cmd2.pw']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:14:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--41c1d377-d8af-47ea-91c0-774a36f8e6f2" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:14:49.000Z" ,
"modified" : "2023-07-14T14:14:49.000Z" ,
"description" : "Redirection to file hosting domain" ,
"pattern" : "[domain-name:value = 'cmd22.pw']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:14:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--b4e818c4-5efa-4312-8eb2-a3a3a0ee967f" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:14:49.000Z" ,
"modified" : "2023-07-14T14:14:49.000Z" ,
"description" : "Redirection to file hosting domain" ,
"pattern" : "[domain-name:value = 'get-a.pw']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:14:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--51e4ac8e-95c3-464d-8eb2-da4fb3743c50" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:14:49.000Z" ,
"modified" : "2023-07-14T14:14:49.000Z" ,
"description" : "Redirection to file hosting domain" ,
"pattern" : "[domain-name:value = 'get-b.pw']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:14:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--49dd8434-0ce8-4635-b256-9a291711fb1d" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:14:49.000Z" ,
"modified" : "2023-07-14T14:14:49.000Z" ,
"description" : "Redirection to file hosting domain" ,
"pattern" : "[domain-name:value = 'get-c.pw']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:14:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--725faf44-1d4e-4605-874a-c11d7c8037d4" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:14:49.000Z" ,
"modified" : "2023-07-14T14:14:49.000Z" ,
"description" : "Redirection to file hosting domain" ,
"pattern" : "[domain-name:value = 'get-d.pw']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:14:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--dd1dd5c8-71e4-4431-bd12-872d3863de51" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:14:49.000Z" ,
"modified" : "2023-07-14T14:14:49.000Z" ,
"description" : "Redirection to file hosting domain" ,
"pattern" : "[domain-name:value = 'get-i.pw']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:14:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--09904864-5c88-4074-aeef-dd3070a2d953" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:14:49.000Z" ,
"modified" : "2023-07-14T14:14:49.000Z" ,
"description" : "Redirection to file hosting domain" ,
"pattern" : "[domain-name:value = 'get-vbs.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:14:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--9e4d0181-601e-4f7b-a85e-d77fdb13df46" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:14:49.000Z" ,
"modified" : "2023-07-14T14:14:49.000Z" ,
"description" : "Redirection to file hosting domain" ,
"pattern" : "[domain-name:value = 'get-y.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:14:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--1e3eaf7d-2868-46c3-bd6a-293f34681e27" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:14:49.000Z" ,
"modified" : "2023-07-14T14:14:49.000Z" ,
"description" : "Redirection to file hosting domain" ,
"pattern" : "[domain-name:value = 'hautegaleria.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:14:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--4cb564c8-0f92-434c-a1b8-64e2d0162493" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:14:49.000Z" ,
"modified" : "2023-07-14T14:14:49.000Z" ,
"description" : "Redirection to file hosting domain" ,
"pattern" : "[domain-name:value = 'jacksmanual.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:14:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--9933c87b-63e9-4545-9b63-f344b3928605" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:14:49.000Z" ,
"modified" : "2023-07-14T14:14:49.000Z" ,
"description" : "Redirection to file hosting domain" ,
"pattern" : "[domain-name:value = 'vbs1.pw']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:14:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--b6daf1a9-ae53-4046-965c-058ce949d60d" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:14:50.000Z" ,
"modified" : "2023-07-14T14:14:50.000Z" ,
"description" : "Redirection to file hosting domain" ,
"pattern" : "[domain-name:value = 'vbs2.pw']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:14:50Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--a20cc7c3-aa95-4c45-976e-0819d218a5f2" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:14:50.000Z" ,
"modified" : "2023-07-14T14:14:50.000Z" ,
"description" : "Redirection to file hosting domain" ,
"pattern" : "[domain-name:value = 'vbs22.pw']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:14:50Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--1f9512f6-4df4-4c31-85d2-8cb3bee3bbc0" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:14:50.000Z" ,
"modified" : "2023-07-14T14:14:50.000Z" ,
"description" : "Redirection to file hosting domain" ,
"pattern" : "[domain-name:value = 'vbs3.pw']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:14:50Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--91d40c8e-8cf5-4a56-ae84-1b906fc04e03" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:15:23.000Z" ,
"modified" : "2023-07-14T14:15:23.000Z" ,
"description" : "Miner\u2019s C2 domain" ,
"pattern" : "[domain-name:value = 'minemy.pw']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:15:23Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--268abd35-5515-495d-8671-536c285a1ef8" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:15:23.000Z" ,
"modified" : "2023-07-14T14:15:23.000Z" ,
"description" : "Miner\u2019s C2 domain" ,
"pattern" : "[domain-name:value = 'mymine.pw']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:15:23Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--ad5e7288-4d3f-419e-84a5-86a7dbb96da6" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:16:02.000Z" ,
"modified" : "2023-07-14T14:16:02.000Z" ,
"description" : "Encrypted file hosting domain" ,
"pattern" : "[domain-name:value = 'crypt1.pw']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:16:02Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--f46ff266-6855-4207-bfc6-60290cf58094" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:16:02.000Z" ,
"modified" : "2023-07-14T14:16:02.000Z" ,
"pattern" : "[domain-name:value = 'gethere.pw']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:16:02Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--d8fb9a0c-c57d-4ea2-8b56-bb00094111b8" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:16:02.000Z" ,
"modified" : "2023-07-14T14:16:02.000Z" ,
"description" : "Server hosting macro-pro.]net" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '77.91.124.25']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:16:02Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--1dbca102-9c8c-49ce-8a11-17640306433d" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:16:02.000Z" ,
"modified" : "2023-07-14T14:16:02.000Z" ,
"description" : "On port 80 - Redline C2 server" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '104.193.255.48' AND network-traffic:dst_port = '80']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:16:02Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst|port\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--c8573245-d288-478e-946f-a1062740dab5" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-17T12:44:03.000Z" ,
"modified" : "2023-07-17T12:44:03.000Z" ,
"first_observed" : "2023-07-17T12:44:03Z" ,
"last_observed" : "2023-07-17T12:44:03Z" ,
"number_observed" : 1 ,
"object_refs" : [
"network-traffic--c8573245-d288-478e-946f-a1062740dab5" ,
"ipv4-addr--c8573245-d288-478e-946f-a1062740dab5"
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "network-traffic" ,
"spec_version" : "2.1" ,
"id" : "network-traffic--c8573245-d288-478e-946f-a1062740dab5" ,
"dst_ref" : "ipv4-addr--c8573245-d288-478e-946f-a1062740dab5" ,
"protocols" : [
"tcp"
]
} ,
{
"type" : "ipv4-addr" ,
"spec_version" : "2.1" ,
"id" : "ipv4-addr--c8573245-d288-478e-946f-a1062740dab5" ,
"value" : "179.43.170.241"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--88bb0d65-2753-42a8-b143-6a7939ed5e97" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T13:12:39.000Z" ,
"modified" : "2023-07-14T13:12:39.000Z" ,
"pattern" : "[url:value = 'http://smartmaster.com.my/48E003A01/48E003A01.7z']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T13:12:39Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "network"
}
] ,
"labels" : [
"misp:name=\"url\"" ,
"misp:meta-category=\"network\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--d6b9d4ae-b825-4299-8458-8c32a546922d" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T13:15:35.000Z" ,
"modified" : "2023-07-14T13:15:35.000Z" ,
"pattern" : "[file:hashes.SHA256 = 'd40af29bbc4ff1ea1827871711e5bfa3470d59723dd8ea29d2b19f5239e509e9']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T13:15:35Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--b9e4ca36-e6bf-4f5c-97b4-2a28045cc17a" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T13:20:52.000Z" ,
"modified" : "2023-07-14T13:20:52.000Z" ,
"pattern" : "[file:hashes.SHA256 = '3fb66e93d12abd992e94244ac7464474d0ff9156811a76a29a76dec0aa910f82']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T13:20:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--ae4e6c5b-1cd1-4aa4-bbbc-dde8c74130c8" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T13:20:17.000Z" ,
"modified" : "2023-07-14T13:20:17.000Z" ,
"pattern" : "[url:value = 'http://5.42.94.169/customer/735']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T13:20:17Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "network"
}
] ,
"labels" : [
"misp:name=\"url\"" ,
"misp:meta-category=\"network\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--3a6e54b7-bd2f-4c75-83cb-a755016b0aaa" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T13:24:59.000Z" ,
"modified" : "2023-07-14T13:24:59.000Z" ,
"pattern" : "[url:value = 'https://telegra.ph/Full-Version-06-03-2']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T13:24:59Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "network"
}
] ,
"labels" : [
"misp:name=\"url\"" ,
"misp:meta-category=\"network\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--12e1ea86-9f1f-47e0-8d88-72a35d8d6819" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T13:29:20.000Z" ,
"modified" : "2023-07-14T13:29:20.000Z" ,
"pattern" : "[url:value = 'https://www.mediafire.com/file/nnamjnckj7h80xz/v2.4_2023.rar/file']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T13:29:20Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "network"
}
] ,
"labels" : [
"misp:name=\"url\"" ,
"misp:meta-category=\"network\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--d0a4f476-384d-46c3-b1dc-86207159f3f9" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T13:30:20.000Z" ,
"modified" : "2023-07-14T13:30:20.000Z" ,
"pattern" : "[url:value = 'https://www.mediafire.com/file/lgoql94feiic0x7/v2.5_2023.rar/file']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T13:30:20Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "network"
}
] ,
"labels" : [
"misp:name=\"url\"" ,
"misp:meta-category=\"network\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--a1731fc0-487f-4d3a-872e-f8f8826bedfe" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T13:48:01.000Z" ,
"modified" : "2023-07-14T13:48:01.000Z" ,
"pattern" : "[file:hashes.SHA256 = 'c05c7ec4570bfc44e87f6e6efc83643b47a378bb088c53da4c5ecf7b93194dc6' AND file:name = 'Setup.exe']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T13:48:01Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--6c15035d-e156-41d7-aeda-fc89eaa19818" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T13:52:33.000Z" ,
"modified" : "2023-07-14T13:52:33.000Z" ,
"description" : "First-stage C2 server used in an infection starting with compromised Youtube channels. An encrypted payload can be downloaded from this address." ,
"pattern" : "[url:value = 'http://5.42.94.169/customer/770']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T13:52:33Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "network"
}
] ,
"labels" : [
"misp:name=\"url\"" ,
"misp:meta-category=\"network\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--690ead91-a1de-4a85-b227-64f58a2f79dd" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T13:49:53.000Z" ,
"modified" : "2023-07-14T13:49:53.000Z" ,
"description" : "C2 server communicating with Raccoon Stealer" ,
"pattern" : "[domain-name:resolves_to_refs[*].value = '45.9.74.99']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T13:49:53Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "network"
}
] ,
"labels" : [
"misp:name=\"domain-ip\"" ,
"misp:meta-category=\"network\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--a208990a-f956-4cdb-bc5f-09004f922aac" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T13:50:20.000Z" ,
"modified" : "2023-07-14T13:50:20.000Z" ,
"description" : "C2 server communicating with Raccoon Stealer" ,
"pattern" : "[domain-name:resolves_to_refs[*].value = '5.42.65.69']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T13:50:20Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "network"
}
] ,
"labels" : [
"misp:name=\"domain-ip\"" ,
"misp:meta-category=\"network\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--4d29bad2-32fa-42a6-9369-4771a05a07ad" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:01:13.000Z" ,
"modified" : "2023-07-14T14:01:13.000Z" ,
"description" : "A webpage impersonating the website of the video conferencing software Slack distributed CustomerLoader as a fake installer. The technique used to spread this fake web site remains unknown at the time of writing, it could be SEO-poisoning, phishing emails or redirections from legitimate forums." ,
"pattern" : "[url:value = 'https://slackmessenger.site/']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:01:13Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "network"
}
] ,
"labels" : [
"misp:name=\"url\"" ,
"misp:meta-category=\"network\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--0724045e-fd3c-4698-98e4-6d493c35ac0c" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:03:43.000Z" ,
"modified" : "2023-07-14T14:03:43.000Z" ,
"description" : "The ZIP file contains the executable SlackSetup.exe, which turns out to be a CustomerLoader sample" ,
"pattern" : "[file:hashes.SHA256 = 'b8f5519f7d66e7940e92f49c9f5f0cac0ae12cc9c9072c5308475bd5d093cdca' AND file:name = 'SlackSetup.exe']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:03:43Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--f544867c-5acf-4970-a96a-7468d570c56b" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T13:57:44.000Z" ,
"modified" : "2023-07-14T13:57:44.000Z" ,
"pattern" : "[url:value = 'https://slackmessenger.pw/slack.zip']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T13:57:44Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "network"
}
] ,
"labels" : [
"misp:name=\"url\"" ,
"misp:meta-category=\"network\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--2dfde444-2afe-4ca3-9214-c790837a08c5" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:02:58.000Z" ,
"modified" : "2023-07-14T14:02:58.000Z" ,
"pattern" : "[url:value = 'http://5.42.94.169/customer/798']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:02:58Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "network"
}
] ,
"labels" : [
"misp:name=\"url\"" ,
"misp:meta-category=\"network\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--40be5e44-04aa-41c4-8a97-0e642cb84940" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:07:33.000Z" ,
"modified" : "2023-07-14T14:07:33.000Z" ,
"description" : "C2 domain for Redline Stealer. Communications over port 80." ,
"pattern" : "[domain-name:value = 'missunno.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:07:33Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "network"
}
] ,
"labels" : [
"misp:name=\"domain-ip\"" ,
"misp:meta-category=\"network\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--6fdb80a4-e001-4173-8b30-3ef96ba05954" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T14:08:40.000Z" ,
"modified" : "2023-07-14T14:08:40.000Z" ,
"description" : "C2 domain communicating with a cryptominer" ,
"pattern" : "[url:value = 'http://179.43.170.241/BEBRIK.php']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2023-07-14T14:08:40Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "network"
}
] ,
"labels" : [
"misp:name=\"url\"" ,
"misp:meta-category=\"network\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--739097b3-9ba6-442c-872f-528f42278bad" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T12:53:33.000Z" ,
"modified" : "2023-07-14T12:53:33.000Z" ,
"labels" : [
"misp:name=\"annotation\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "creation-date" ,
"value" : "2023-07-12T00:00:00+00:00" ,
"category" : "Other" ,
"uuid" : "1e5ba5dd-4d09-4d56-8bb8-79d888160c8e"
} ,
{
"type" : "link" ,
"object_relation" : "ref" ,
"value" : "https://blog.sekoia.io/customerloader-a-new-malware-distributing-a-wide-variety-of-payloads/" ,
"category" : "External analysis" ,
"uuid" : "9f328dc4-ec48-434f-9d26-ff17fa542c35"
} ,
{
"type" : "text" ,
"object_relation" : "text" ,
"value" : "Report from Sekoia.io" ,
"category" : "Other" ,
"uuid" : "64add251-c842-49e9-81b7-de2b5514aa0e"
} ,
{
"type" : "text" ,
"object_relation" : "type" ,
"value" : "Executive Summary" ,
"category" : "Other" ,
"uuid" : "b1cd70e0-fb01-4158-9b09-dacc1b0d2a50"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "annotation"
} ,
{
"type" : "note" ,
"spec_version" : "2.1" ,
"id" : "note--4173dc9c-2c55-4e0e-8ef7-341ee4ea63c7" ,
"created_by_ref" : "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631" ,
"created" : "2023-07-14T12:54:09.000Z" ,
"modified" : "2023-07-14T12:54:09.000Z" ,
"abstract" : "CustomerLoader: a new malware distributing a wide variety of payloads" ,
"content" : "During our daily threat hunting routine, we identified an undocumented .NET loader aimed at downloading, decrypting and executing next-stage payloads. In early June 2023, this new loader was actively distributed by multiple threat actors using malicious phishing emails, YouTube videos, and web pages impersonating legitimate websites. \r\n\r\nWe named this new malware \u201cCustomerLoader\u201d because of the presence of the string \u201ccustomer\u201d in its Command and Control (C2) communications and loading capabilities.\r\n\r\nThe malwrhunterteam and g0njxa researchers also observed campaigns distributing CustomerLoader in early June 2023.\r\n\r\nSekoia.io analysts\u2019 investigation led us to discover that all payloads downloaded by CustomerLoader are dotRunpeX samples that deliver a variety of malware families, including infostealers, Remote Access Trojans (RAT) and commodity ransomware. dotRunpeX is an .NET injector implementing several anti-analysis techniques, first publicly documented by Checkpoint in March 2023.\r\n\r\nWe assess that CustomerLoader is almost certainly associated with a Loader-as-a-Service, which remains unknown at the time of writing. It is possible that CustomerLoader is a new stage added before the execution of the dotRunpeX injector by its developer.\r\n\r\nThis blog post aims at presenting a technical analysis of CustomerLoader focusing on the decryption of the next-stage payloads, an overview of more than 30 known and distributed malware families, and details on three infection chains observed distributing the loader." ,
"object_refs" : [
"report--98eb923a-6da8-4c63-87a0-a97a2eef3c98"
]
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2024-04-05 12:15:17 +00:00
"id" : "relationship--8a001688-e19d-4386-9833-0ba29c1e9d2e" ,
2023-12-14 14:30:15 +00:00
"created" : "2023-07-14T13:15:35.000Z" ,
"modified" : "2023-07-14T13:15:35.000Z" ,
"relationship_type" : "downloaded-from" ,
"source_ref" : "indicator--d6b9d4ae-b825-4299-8458-8c32a546922d" ,
"target_ref" : "indicator--88bb0d65-2753-42a8-b143-6a7939ed5e97"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2024-04-05 12:15:17 +00:00
"id" : "relationship--1cb9f64c-7370-42ca-af4a-fb5f4e1c9534" ,
2023-12-14 14:30:15 +00:00
"created" : "2023-07-14T13:17:46.000Z" ,
"modified" : "2023-07-14T13:17:46.000Z" ,
"relationship_type" : "contained-within" ,
"source_ref" : "indicator--b9e4ca36-e6bf-4f5c-97b4-2a28045cc17a" ,
"target_ref" : "indicator--d6b9d4ae-b825-4299-8458-8c32a546922d"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2024-04-05 12:15:17 +00:00
"id" : "relationship--bae49eb3-9c32-4365-8e59-d9441452ce62" ,
2023-12-14 14:30:15 +00:00
"created" : "2023-07-14T13:20:52.000Z" ,
"modified" : "2023-07-14T13:20:52.000Z" ,
"relationship_type" : "redirects-to" ,
"source_ref" : "indicator--b9e4ca36-e6bf-4f5c-97b4-2a28045cc17a" ,
"target_ref" : "indicator--ae4e6c5b-1cd1-4aa4-bbbc-dde8c74130c8"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2024-04-05 12:15:17 +00:00
"id" : "relationship--3630f173-56fb-4245-b5f4-eff8b1bf6ae3" ,
2023-12-14 14:30:15 +00:00
"created" : "2023-07-14T13:19:32.000Z" ,
"modified" : "2023-07-14T13:19:32.000Z" ,
"relationship_type" : "redirects-to" ,
"source_ref" : "indicator--ae4e6c5b-1cd1-4aa4-bbbc-dde8c74130c8" ,
"target_ref" : "indicator--b9e4ca36-e6bf-4f5c-97b4-2a28045cc17a"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2024-04-05 12:15:17 +00:00
"id" : "relationship--bb06fa9e-ed25-4d29-83e8-6c854c38b6e5" ,
2023-12-14 14:30:15 +00:00
"created" : "2023-07-14T13:29:20.000Z" ,
"modified" : "2023-07-14T13:29:20.000Z" ,
"relationship_type" : "downloaded-from" ,
"source_ref" : "indicator--12e1ea86-9f1f-47e0-8d88-72a35d8d6819" ,
"target_ref" : "indicator--3a6e54b7-bd2f-4c75-83cb-a755016b0aaa"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2024-04-05 12:15:17 +00:00
"id" : "relationship--0d5bf287-c156-4baa-a07d-630f8780e5f6" ,
2023-12-14 14:30:15 +00:00
"created" : "2023-07-14T13:30:20.000Z" ,
"modified" : "2023-07-14T13:30:20.000Z" ,
"relationship_type" : "downloaded-from" ,
"source_ref" : "indicator--d0a4f476-384d-46c3-b1dc-86207159f3f9" ,
"target_ref" : "indicator--3a6e54b7-bd2f-4c75-83cb-a755016b0aaa"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2024-04-05 12:15:17 +00:00
"id" : "relationship--84dc45f2-18e1-4194-8217-d46e0718348b" ,
2023-12-14 14:30:15 +00:00
"created" : "2023-07-14T13:32:45.000Z" ,
"modified" : "2023-07-14T13:32:45.000Z" ,
"relationship_type" : "delivered-by" ,
"source_ref" : "indicator--a1731fc0-487f-4d3a-872e-f8f8826bedfe" ,
"target_ref" : "indicator--12e1ea86-9f1f-47e0-8d88-72a35d8d6819"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2024-04-05 12:15:17 +00:00
"id" : "relationship--bf7e1278-470b-4b19-838f-ba047757be92" ,
2023-12-14 14:30:15 +00:00
"created" : "2023-07-14T13:33:12.000Z" ,
"modified" : "2023-07-14T13:33:12.000Z" ,
"relationship_type" : "delivered-by" ,
"source_ref" : "indicator--a1731fc0-487f-4d3a-872e-f8f8826bedfe" ,
"target_ref" : "indicator--d0a4f476-384d-46c3-b1dc-86207159f3f9"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2024-04-05 12:15:17 +00:00
"id" : "relationship--54c7c3a2-411e-477d-b189-8c34b02acc9b" ,
2023-12-14 14:30:15 +00:00
"created" : "2023-07-14T13:48:00.000Z" ,
"modified" : "2023-07-14T13:48:00.000Z" ,
"relationship_type" : "communicates-with" ,
"source_ref" : "indicator--a1731fc0-487f-4d3a-872e-f8f8826bedfe" ,
"target_ref" : "indicator--6c15035d-e156-41d7-aeda-fc89eaa19818"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2024-04-05 12:15:17 +00:00
"id" : "relationship--2fa6b985-fc40-4356-9cd2-5b224e328a7b" ,
2023-12-14 14:30:15 +00:00
"created" : "2023-07-14T13:52:04.000Z" ,
"modified" : "2023-07-14T13:52:04.000Z" ,
"relationship_type" : "communicates-with" ,
"source_ref" : "indicator--6c15035d-e156-41d7-aeda-fc89eaa19818" ,
"target_ref" : "indicator--690ead91-a1de-4a85-b227-64f58a2f79dd"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2024-04-05 12:15:17 +00:00
"id" : "relationship--ef164f6b-ef32-46a7-833b-60908d60f246" ,
2023-12-14 14:30:15 +00:00
"created" : "2023-07-14T13:52:33.000Z" ,
"modified" : "2023-07-14T13:52:33.000Z" ,
"relationship_type" : "communicates-with" ,
"source_ref" : "indicator--6c15035d-e156-41d7-aeda-fc89eaa19818" ,
"target_ref" : "indicator--a208990a-f956-4cdb-bc5f-09004f922aac"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2024-04-05 12:15:17 +00:00
"id" : "relationship--d62c7df6-ee82-4541-9a50-5ca70a12b9b2" ,
2023-12-14 14:30:15 +00:00
"created" : "2023-07-14T14:01:12.000Z" ,
"modified" : "2023-07-14T14:01:12.000Z" ,
"relationship_type" : "downloads" ,
"source_ref" : "indicator--4d29bad2-32fa-42a6-9369-4771a05a07ad" ,
"target_ref" : "indicator--0724045e-fd3c-4698-98e4-6d493c35ac0c"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2024-04-05 12:15:17 +00:00
"id" : "relationship--a02e2346-bbf2-4847-b4d4-db84889f5f2c" ,
2023-12-14 14:30:15 +00:00
"created" : "2023-07-14T14:03:43.000Z" ,
"modified" : "2023-07-14T14:03:43.000Z" ,
"relationship_type" : "communicates-with" ,
"source_ref" : "indicator--0724045e-fd3c-4698-98e4-6d493c35ac0c" ,
"target_ref" : "indicator--2dfde444-2afe-4ca3-9214-c790837a08c5"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2024-04-05 12:15:17 +00:00
"id" : "relationship--643c0dc9-ba74-4bab-8ec5-ef5925abdfb6" ,
2023-12-14 14:30:15 +00:00
"created" : "2023-07-14T13:57:44.000Z" ,
"modified" : "2023-07-14T13:57:44.000Z" ,
"relationship_type" : "executes" ,
"source_ref" : "indicator--f544867c-5acf-4970-a96a-7468d570c56b" ,
"target_ref" : "indicator--0724045e-fd3c-4698-98e4-6d493c35ac0c"
}
]
}
