2023-04-21 13:25:09 +00:00
|
|
|
{
|
2023-06-14 17:31:25 +00:00
|
|
|
"type": "bundle",
|
|
|
|
|
"id": "bundle--54e1a7eb-4190-424f-bb4a-4d65950d210b",
|
|
|
|
|
"objects": [
|
|
|
|
|
{
|
|
|
|
|
"type": "identity",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T09:17:22.000Z",
|
|
|
|
|
"modified": "2015-02-16T09:17:22.000Z",
|
|
|
|
|
"name": "CthulhuSPRL.be",
|
|
|
|
|
"identity_class": "organization"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "report",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "report--54e1a7eb-4190-424f-bb4a-4d65950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T09:17:22.000Z",
|
|
|
|
|
"modified": "2015-02-16T09:17:22.000Z",
|
|
|
|
|
"name": "OSINT Arid Viper: Gaza vs Israel Cyber Conflict by Trend Micro",
|
|
|
|
|
"published": "2016-02-22T14:00:06Z",
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"x-misp-attribute--54e1a7f7-ba90-406c-b01c-20b7950d210b",
|
|
|
|
|
"observed-data--54e1a817-2978-4713-8001-45c4950d210b",
|
|
|
|
|
"url--54e1a817-2978-4713-8001-45c4950d210b",
|
|
|
|
|
"observed-data--54e1a817-34cc-4c0c-8777-47be950d210b",
|
|
|
|
|
"url--54e1a817-34cc-4c0c-8777-47be950d210b",
|
|
|
|
|
"observed-data--54e1a817-4ac4-4a12-92d5-473a950d210b",
|
|
|
|
|
"url--54e1a817-4ac4-4a12-92d5-473a950d210b",
|
|
|
|
|
"indicator--54e1a89f-66d0-4467-9432-9107950d210b",
|
|
|
|
|
"indicator--54e1a89f-5fe0-4cc6-b7c0-9107950d210b",
|
|
|
|
|
"indicator--54e1a89f-e80c-435a-ae75-9107950d210b",
|
|
|
|
|
"indicator--54e1a9fe-f5a0-4a09-98e1-4973950d210b",
|
|
|
|
|
"indicator--54e1a9fe-5a04-45d4-bf32-490c950d210b",
|
|
|
|
|
"indicator--54e1a9fe-c554-4db4-ad99-43f1950d210b",
|
|
|
|
|
"indicator--54e1a9fe-7a40-4edb-bf2f-4b73950d210b",
|
|
|
|
|
"indicator--54e1a9fe-6b4c-4939-be65-426b950d210b",
|
|
|
|
|
"indicator--54e1acf7-f684-458f-a3a6-20b7950d210b",
|
|
|
|
|
"indicator--54e1acf8-d230-45e4-9368-20b7950d210b",
|
|
|
|
|
"indicator--54e1acf8-edbc-4592-ac6e-20b7950d210b",
|
|
|
|
|
"indicator--54e1acf8-78fc-4223-acff-20b7950d210b",
|
|
|
|
|
"indicator--54e1acf8-087c-4ff2-81d5-20b7950d210b",
|
|
|
|
|
"indicator--54e1acf8-e4b0-4869-936f-20b7950d210b",
|
|
|
|
|
"indicator--54e1acf8-6cf8-43c1-9d67-20b7950d210b",
|
|
|
|
|
"indicator--54e1acf8-3e18-4aea-a0d1-20b7950d210b",
|
|
|
|
|
"indicator--54e1acf8-b0d4-4315-81f6-20b7950d210b",
|
|
|
|
|
"indicator--54e1acf8-1aac-4963-aca9-20b7950d210b",
|
|
|
|
|
"indicator--54e1acf8-1290-458a-a0c8-20b7950d210b",
|
|
|
|
|
"indicator--54e1acf8-3084-4ada-961c-20b7950d210b",
|
|
|
|
|
"indicator--54e1acf9-69d4-440e-8d63-20b7950d210b",
|
|
|
|
|
"indicator--54e1acf9-cf08-4fd9-99ec-20b7950d210b",
|
|
|
|
|
"indicator--54e1ad1d-2030-4bbe-851a-48d1950d210b",
|
|
|
|
|
"indicator--54e1adaa-873c-4f27-9109-9107950d210b",
|
|
|
|
|
"indicator--54e1adaa-36c0-4b84-9ffd-9107950d210b",
|
|
|
|
|
"indicator--54e1adaa-5ff8-4ce9-956e-9107950d210b",
|
|
|
|
|
"indicator--54e1adab-9eb8-45c5-8554-9107950d210b",
|
|
|
|
|
"indicator--54e1adab-0bb0-4e87-ae94-9107950d210b",
|
|
|
|
|
"indicator--54e1adab-d080-4a70-b43c-9107950d210b",
|
|
|
|
|
"indicator--54e1adab-47e0-4ae8-8369-9107950d210b",
|
|
|
|
|
"indicator--54e1adab-75ec-43bb-925a-9107950d210b",
|
|
|
|
|
"indicator--54e1adab-3a64-4a43-92c7-9107950d210b",
|
|
|
|
|
"indicator--54e1adab-9a60-46b4-85af-9107950d210b",
|
|
|
|
|
"indicator--54e1af16-a914-4459-906c-48a1950d210b",
|
|
|
|
|
"indicator--54e1af16-f958-4519-80da-4dc9950d210b",
|
|
|
|
|
"indicator--54e1af16-bf60-4fd2-8b37-40f6950d210b",
|
|
|
|
|
"indicator--54e1af16-dd98-4ef2-8875-4a41950d210b",
|
|
|
|
|
"indicator--54e1af16-3434-4067-b603-43b0950d210b",
|
|
|
|
|
"indicator--54e1af16-0fb8-47b9-8dfc-42ec950d210b",
|
|
|
|
|
"indicator--54e1af16-943c-4621-8d2b-4259950d210b",
|
|
|
|
|
"indicator--54e1af16-1798-42e2-8f53-424e950d210b",
|
|
|
|
|
"indicator--54e1af16-a7f8-4df9-bbfa-44c6950d210b",
|
|
|
|
|
"indicator--54e1af17-85fc-46f8-aefc-48f4950d210b",
|
|
|
|
|
"indicator--54e1af17-39c4-4e44-b44c-4bf9950d210b",
|
|
|
|
|
"indicator--54e1af17-5290-4d72-aaaa-43b4950d210b",
|
|
|
|
|
"indicator--54e1af17-26ac-4819-a5d6-4011950d210b",
|
|
|
|
|
"indicator--54e1af17-8638-420a-a81e-4469950d210b",
|
|
|
|
|
"indicator--54e1af17-31e8-4797-9f94-46df950d210b",
|
|
|
|
|
"indicator--54e1af17-2e18-4ea4-ad58-4b12950d210b",
|
|
|
|
|
"indicator--54e1af17-30b8-497e-be87-479d950d210b",
|
|
|
|
|
"indicator--54e1af17-dca0-4276-a544-4a6f950d210b",
|
|
|
|
|
"indicator--54e1af17-b1c8-4052-8590-457b950d210b",
|
|
|
|
|
"indicator--54e1af17-7348-464e-9280-4332950d210b",
|
|
|
|
|
"indicator--54e1af18-27ec-4bec-aa45-4a27950d210b",
|
|
|
|
|
"indicator--54e1af18-5064-4249-8d56-4a55950d210b",
|
|
|
|
|
"indicator--54e1af18-98dc-408b-8055-4092950d210b",
|
|
|
|
|
"indicator--54e1af18-7754-4882-85bb-42a1950d210b",
|
|
|
|
|
"indicator--54e1af18-0ffc-4c03-96fe-484c950d210b",
|
|
|
|
|
"indicator--54e1af18-0e34-4d82-b042-4072950d210b",
|
|
|
|
|
"indicator--54e1af18-07b0-4569-a5dc-429b950d210b",
|
|
|
|
|
"indicator--54e1af18-0e2c-4900-8d07-43aa950d210b",
|
|
|
|
|
"indicator--54e1af18-c76c-457a-af4f-40c5950d210b",
|
|
|
|
|
"indicator--54e1af18-af3c-404e-abe1-4416950d210b",
|
|
|
|
|
"indicator--54e1af19-9acc-41a6-bcdf-47a2950d210b",
|
|
|
|
|
"indicator--54e1af19-0cac-4fa6-a9f6-46fd950d210b",
|
|
|
|
|
"indicator--54e1af19-89c4-442b-8d6e-4d82950d210b",
|
|
|
|
|
"indicator--54e1af19-7644-4b1f-9d3d-44e4950d210b",
|
|
|
|
|
"indicator--54e1af19-8bec-4804-8235-46e2950d210b",
|
|
|
|
|
"indicator--54e1af19-87c0-46f9-913e-4caa950d210b",
|
|
|
|
|
"indicator--54e1af19-c424-4d24-a177-46f9950d210b",
|
|
|
|
|
"indicator--54e1af19-6c90-4885-a640-44e8950d210b",
|
|
|
|
|
"indicator--54e1af19-313c-4527-aa23-40dc950d210b",
|
|
|
|
|
"indicator--54e1af19-a510-4207-93ef-432c950d210b",
|
|
|
|
|
"indicator--54e1af19-9824-43b7-b466-46f0950d210b",
|
|
|
|
|
"indicator--54e1af1a-0e18-4507-bff7-47a5950d210b",
|
|
|
|
|
"indicator--54e1af1a-9fdc-43da-824c-4e40950d210b",
|
|
|
|
|
"indicator--54e1af1a-5ca0-41a9-9f3e-487e950d210b",
|
|
|
|
|
"indicator--54e1af1a-1d04-4b69-a575-4924950d210b",
|
|
|
|
|
"indicator--54e1af1a-1328-4361-a113-46fa950d210b",
|
|
|
|
|
"indicator--54e1af1a-0014-4178-a229-4cb1950d210b",
|
|
|
|
|
"indicator--54e1af1a-51c8-4e0b-b359-4728950d210b",
|
|
|
|
|
"indicator--54e1af1a-8bdc-43f5-9583-4083950d210b",
|
|
|
|
|
"indicator--54e1af1a-ce80-4eac-bcf1-46d4950d210b",
|
|
|
|
|
"indicator--54e1af1a-37ac-4f9c-ad1a-4a68950d210b",
|
|
|
|
|
"indicator--54e1af1a-6880-4952-a56e-4e09950d210b",
|
|
|
|
|
"indicator--54e1af1b-4f90-44a1-86bf-45e7950d210b",
|
|
|
|
|
"indicator--54e1af1b-8c18-45b4-b782-45e1950d210b",
|
|
|
|
|
"indicator--54e1af1b-2020-4234-a43d-406b950d210b",
|
|
|
|
|
"indicator--54e1af1b-edcc-4ffc-9f1f-4d5e950d210b",
|
|
|
|
|
"indicator--54e1af1b-0c54-4e25-880b-4487950d210b",
|
|
|
|
|
"indicator--54e1af1b-410c-4bbb-839f-4dae950d210b",
|
|
|
|
|
"indicator--54e1af1b-2d5c-4b1c-8f2b-4cfd950d210b",
|
|
|
|
|
"indicator--54e1af1b-5334-4235-b675-48e9950d210b",
|
|
|
|
|
"indicator--54e1af1b-9e30-43dc-b68c-4a59950d210b",
|
|
|
|
|
"indicator--54e1af1b-091c-479f-940d-4da5950d210b",
|
|
|
|
|
"indicator--54e1af1c-9148-4a7b-97b1-4190950d210b",
|
|
|
|
|
"indicator--54e1af1c-74bc-4984-81ec-4001950d210b",
|
|
|
|
|
"indicator--54e1af1c-6d34-4dd7-8a9f-476e950d210b",
|
|
|
|
|
"indicator--54e1af1c-26a0-426f-aeb4-4bd2950d210b",
|
|
|
|
|
"indicator--54e1af1c-ccbc-40c5-92dd-43f9950d210b",
|
|
|
|
|
"indicator--54e1af1c-c840-4395-b64c-437a950d210b",
|
|
|
|
|
"indicator--54e1af1c-6f50-4301-9332-48e4950d210b",
|
|
|
|
|
"indicator--54e1af1c-201c-47b9-ae02-4c68950d210b",
|
|
|
|
|
"indicator--54e1af1c-60e0-4906-b755-4cc0950d210b",
|
|
|
|
|
"indicator--54e1af1c-2380-4982-ad03-451d950d210b",
|
|
|
|
|
"indicator--54e1af1c-f0f4-4e83-81f5-4598950d210b",
|
|
|
|
|
"indicator--54e1af1d-91e0-465a-8dfe-4583950d210b",
|
|
|
|
|
"indicator--54e1af1d-f63c-4c4c-9ff2-48f1950d210b",
|
|
|
|
|
"x-misp-attribute--54e1af39-a430-4cdf-8651-3252950d210b",
|
|
|
|
|
"x-misp-attribute--54e1af39-c7f8-4ac4-ada2-3252950d210b",
|
|
|
|
|
"x-misp-attribute--54e1af39-9668-4d3c-a140-3252950d210b",
|
|
|
|
|
"x-misp-attribute--54e1af39-5e30-40f9-a226-3252950d210b",
|
|
|
|
|
"x-misp-attribute--54e1af39-aa90-418a-a853-3252950d210b",
|
|
|
|
|
"x-misp-attribute--54e1af39-36a4-44c7-a349-3252950d210b",
|
|
|
|
|
"x-misp-attribute--54e1af39-14e4-41dc-9bb7-3252950d210b",
|
|
|
|
|
"x-misp-attribute--54e1af3a-10b0-4e72-84f4-3252950d210b",
|
|
|
|
|
"x-misp-attribute--54e1af3a-9dfc-444a-a2b8-3252950d210b",
|
|
|
|
|
"x-misp-attribute--54e1af3a-3a7c-42c2-b9c6-3252950d210b",
|
|
|
|
|
"indicator--54e1af97-4818-4670-8ce4-48c4950d210b",
|
|
|
|
|
"indicator--54e1af97-c290-4e5e-9f3d-4346950d210b",
|
|
|
|
|
"indicator--54e1afa4-1288-4597-a783-fae5950d210b",
|
|
|
|
|
"x-misp-attribute--54e1aff8-6a54-45f5-899d-4e2c950d210b",
|
|
|
|
|
"x-misp-attribute--54e1aff8-fc88-4dcf-aa9e-47fb950d210b",
|
|
|
|
|
"indicator--54e1b025-1258-40de-83a7-dadf950d210b",
|
|
|
|
|
"indicator--54e1b025-51cc-4d99-9f24-dadf950d210b",
|
|
|
|
|
"x-misp-attribute--54e1b096-6840-4865-a330-9107950d210b",
|
|
|
|
|
"x-misp-attribute--54e1b096-f9ec-43f5-965e-9107950d210b",
|
|
|
|
|
"x-misp-attribute--54e1b0b2-2d54-43f8-97e5-fae5950d210b",
|
|
|
|
|
"indicator--54e1b12a-23e4-4abe-8cf7-dadf950d210b",
|
|
|
|
|
"indicator--54e1b12a-da18-47f9-9922-dadf950d210b",
|
|
|
|
|
"indicator--54e1b12a-9614-4800-81dd-dadf950d210b",
|
|
|
|
|
"indicator--54e1b12b-89e4-4631-9976-dadf950d210b",
|
|
|
|
|
"indicator--54e1b207-4db4-45e3-830d-48c1950d210b",
|
|
|
|
|
"indicator--54e1b208-8e30-4d35-b56b-40d6950d210b",
|
|
|
|
|
"indicator--54e1b208-1eac-42fe-8155-40e3950d210b",
|
|
|
|
|
"indicator--54e1b208-f5a0-45a8-ae03-44f9950d210b",
|
|
|
|
|
"indicator--54e1b208-5698-499a-ad7f-4d1d950d210b",
|
|
|
|
|
"indicator--54e1b208-3da8-4336-bbf4-4724950d210b",
|
|
|
|
|
"indicator--54e1b208-aab0-41cb-874d-402f950d210b",
|
|
|
|
|
"indicator--54e1b208-b130-4401-bfa9-4123950d210b",
|
|
|
|
|
"indicator--54e1b208-c438-4975-86d6-4deb950d210b",
|
|
|
|
|
"indicator--54e1b208-3558-40ae-ab39-4841950d210b",
|
|
|
|
|
"indicator--54e1b208-4230-40bd-97b4-4d54950d210b",
|
|
|
|
|
"indicator--54e1b208-ec5c-4636-887e-4556950d210b",
|
|
|
|
|
"indicator--54e1b209-73c0-414d-b60a-4aa1950d210b",
|
|
|
|
|
"indicator--54e1b209-2ebc-411c-a015-4e7e950d210b",
|
|
|
|
|
"indicator--54e1b209-2254-45d3-8430-4922950d210b",
|
|
|
|
|
"indicator--54e1b209-b894-4c66-8c0c-4c29950d210b",
|
|
|
|
|
"indicator--54e1b209-858c-4b62-8ff1-4576950d210b",
|
|
|
|
|
"indicator--54e1b209-e418-434c-b612-41bb950d210b",
|
|
|
|
|
"indicator--54e1b209-0370-4ac0-9de6-4c20950d210b",
|
|
|
|
|
"indicator--54e1b23d-b290-4542-b5a9-409b950d210b",
|
|
|
|
|
"x-misp-attribute--54e1b2c5-c000-49c9-899b-4fa0950d210b",
|
|
|
|
|
"x-misp-attribute--54e1b559-ed50-4157-9f8a-9108950d210b",
|
|
|
|
|
"indicator--56c64fd9-8d74-4397-afce-48a7950d210f",
|
|
|
|
|
"indicator--56c64fdc-30e0-4929-9b15-59a0950d210f",
|
|
|
|
|
"indicator--56c64fdd-e9bc-4dd9-83b9-45eb950d210f",
|
|
|
|
|
"indicator--56c64fdf-bb94-425d-ad03-599e950d210f",
|
|
|
|
|
"indicator--56c64fe1-26d8-44a4-9957-c654950d210f",
|
|
|
|
|
"indicator--56c64fe3-4820-4d77-a852-59a4950d210f",
|
|
|
|
|
"indicator--56c64fe6-96e0-463e-9922-599d950d210f",
|
|
|
|
|
"indicator--56c64fe8-720c-4751-bf43-4afd950d210f",
|
|
|
|
|
"indicator--56c64feb-f3a0-435a-a918-599d950d210f",
|
|
|
|
|
"indicator--56c64fed-59cc-471a-b633-45ec950d210f",
|
|
|
|
|
"indicator--56c64fef-039c-4255-8592-59a1950d210f",
|
|
|
|
|
"indicator--56c64ff1-db7c-4145-8f47-c652950d210f",
|
|
|
|
|
"indicator--56c64ff3-9c4c-46b0-8e07-59a2950d210f",
|
|
|
|
|
"indicator--56c64ff5-0750-487d-9b10-59a4950d210f",
|
|
|
|
|
"indicator--56c64ff8-a5e0-478c-9eeb-5ca1950d210f",
|
|
|
|
|
"indicator--56c64ffa-953c-45ca-a348-c650950d210f",
|
|
|
|
|
"indicator--56c64ffc-6df8-4c60-a469-5ca1950d210f",
|
|
|
|
|
"indicator--56c64ffd-54b8-452d-8555-41da950d210f",
|
|
|
|
|
"indicator--56c64fff-9eb8-4d13-b648-4899950d210f",
|
|
|
|
|
"indicator--56c65002-c66c-42a6-93b3-5f51950d210f",
|
|
|
|
|
"indicator--56c65005-7fec-4be5-925e-599c950d210f",
|
|
|
|
|
"indicator--56c65008-a15c-424c-876b-59a2950d210f",
|
|
|
|
|
"indicator--56c6500a-3d78-4e09-8365-5ca1950d210f",
|
|
|
|
|
"indicator--56c6500b-f018-433d-9653-599e950d210f",
|
|
|
|
|
"indicator--56c6500d-4174-4f6e-b9df-c654950d210f",
|
|
|
|
|
"indicator--56c65010-be00-4d53-99be-4357950d210f",
|
|
|
|
|
"indicator--56c65012-1008-42e4-ac9a-c650950d210f",
|
|
|
|
|
"indicator--56c65013-bcf0-43bd-a778-c651950d210f",
|
|
|
|
|
"indicator--56c65016-7b2c-4349-8353-59a4950d210f",
|
|
|
|
|
"indicator--56c65019-2ae0-4e6b-8119-4af9950d210f",
|
|
|
|
|
"indicator--56c6501b-7e84-47f5-8cac-599f950d210f",
|
|
|
|
|
"indicator--56c6501c-ff70-4bc9-a508-49c4950d210f",
|
|
|
|
|
"indicator--56c6501e-7698-40c9-a119-4474950d210f",
|
|
|
|
|
"indicator--56c65020-6484-4d17-8292-599c950d210f",
|
|
|
|
|
"indicator--56c65023-d048-455e-a096-c651950d210f",
|
|
|
|
|
"indicator--56c65026-054c-4344-8e06-59a1950d210f",
|
|
|
|
|
"indicator--56c65028-8e54-478d-8800-599f950d210f",
|
|
|
|
|
"indicator--56c65029-20f8-4786-82e3-59a3950d210f",
|
|
|
|
|
"indicator--56c6502b-6164-4c6b-8809-599d950d210f",
|
|
|
|
|
"indicator--56c6502d-83e4-42a2-b52f-c652950d210f",
|
|
|
|
|
"indicator--56c6502f-2e9c-42d7-8a32-59a4950d210f",
|
|
|
|
|
"indicator--56c65030-00a4-4451-84ea-599c950d210f",
|
|
|
|
|
"indicator--56c65032-a8d4-447e-b738-4e47950d210f",
|
|
|
|
|
"indicator--56c65034-e1a8-4123-9c5e-c654950d210f",
|
|
|
|
|
"indicator--56c65035-9994-4390-92d3-599c950d210f",
|
|
|
|
|
"indicator--56c65037-e2e8-4885-b6bc-5ca1950d210f",
|
|
|
|
|
"indicator--56c65039-4e2c-46ae-ad54-59a3950d210f",
|
|
|
|
|
"indicator--56c6503b-8aac-46bd-932c-59a4950d210f",
|
|
|
|
|
"indicator--56c6503e-40a4-4812-837f-c650950d210f",
|
|
|
|
|
"indicator--56c65040-dcc8-4a81-9e90-599e950d210f",
|
|
|
|
|
"indicator--56c65041-12dc-4623-bdf7-c651950d210f",
|
|
|
|
|
"indicator--56c65043-68e4-4b01-9ee3-599c950d210f",
|
|
|
|
|
"indicator--56c65045-7d80-422f-945a-59a3950d210f",
|
|
|
|
|
"indicator--56c65048-a5d8-4ee8-a23e-c651950d210f",
|
|
|
|
|
"indicator--56c6504b-aaf4-4874-b2f7-4fc6950d210f",
|
|
|
|
|
"indicator--56c6504d-6d68-46c8-bc45-4a52950d210f",
|
|
|
|
|
"indicator--56c6504f-1700-482a-bf3a-c652950d210f",
|
|
|
|
|
"indicator--56c65051-3008-4f5d-b918-599c950d210f",
|
|
|
|
|
"indicator--56c65053-26c4-46cb-b95d-4c8b950d210f",
|
|
|
|
|
"indicator--56c65055-fd30-4c11-96b0-c652950d210f",
|
|
|
|
|
"indicator--56c65056-1be8-4407-81c9-599e950d210f",
|
|
|
|
|
"indicator--56c65059-4aa4-4e99-abec-c651950d210f",
|
|
|
|
|
"indicator--56c6505b-8950-4bd4-95a3-c652950d210f",
|
|
|
|
|
"indicator--56c6505d-1238-4f64-937d-59a4950d210f",
|
|
|
|
|
"indicator--56c6505f-1d80-46d8-bb9e-4d11950d210f",
|
|
|
|
|
"indicator--56c65061-f1f4-46de-9b59-59a4950d210f",
|
|
|
|
|
"indicator--56c64fc7-0eb0-4a8d-ab3d-c652950d210f",
|
|
|
|
|
"indicator--56c64fc9-0148-486c-99f3-4642950d210f",
|
|
|
|
|
"indicator--56c64fcb-2e2c-47eb-916a-599e950d210f",
|
|
|
|
|
"indicator--56c64fce-db88-47e5-ac9c-c650950d210f",
|
|
|
|
|
"indicator--56c64fd2-3074-4f7a-b00b-59a3950d210f",
|
|
|
|
|
"indicator--56c64fd4-0e28-4285-9945-c654950d210f",
|
|
|
|
|
"indicator--56c64fd6-6140-49e3-b6be-59a3950d210f",
|
|
|
|
|
"indicator--56c64fd7-bc10-4560-a6d4-59a1950d210f",
|
|
|
|
|
"indicator--56c64fda-4b08-4e66-929c-43fc950d210f",
|
|
|
|
|
"indicator--56c64fdc-0a20-4070-8808-c653950d210f",
|
|
|
|
|
"indicator--56c64fde-be48-4882-9e56-4c64950d210f",
|
|
|
|
|
"indicator--56c64fe0-3c28-44ee-affa-c652950d210f",
|
|
|
|
|
"indicator--56c64fe2-2a44-450a-9f6e-599f950d210f",
|
|
|
|
|
"indicator--56c64fe4-1278-4eb1-9e8a-59a0950d210f",
|
|
|
|
|
"indicator--56c64fe6-47e0-4b65-a752-c652950d210f",
|
|
|
|
|
"indicator--56c64fe9-94c8-47ef-9b5f-5f51950d210f",
|
|
|
|
|
"indicator--56c64fec-6fb4-4a79-9bf8-599e950d210f",
|
|
|
|
|
"indicator--56c64fee-1c2c-47b0-874a-4a2e950d210f",
|
|
|
|
|
"indicator--56c64ff0-ea90-4d28-aeb3-5ca1950d210f",
|
|
|
|
|
"indicator--56c64ff2-1874-4fd4-b2a0-c653950d210f",
|
|
|
|
|
"indicator--56c64ff3-9624-4f79-877a-5f51950d210f",
|
|
|
|
|
"indicator--56c64ff6-ed20-4ad7-bc98-599c950d210f",
|
|
|
|
|
"indicator--56c64ff9-acf4-4c35-a202-59a2950d210f",
|
|
|
|
|
"indicator--56c64ffb-9ec8-43d4-98d1-4a80950d210f",
|
|
|
|
|
"indicator--56c64ffc-da60-4dce-8c7c-59a4950d210f",
|
|
|
|
|
"indicator--56c64ffe-635c-4365-b723-59a3950d210f",
|
|
|
|
|
"indicator--56c65001-46fc-4160-9b74-c653950d210f",
|
|
|
|
|
"indicator--56c65004-5fd4-497e-b8a1-c651950d210f",
|
|
|
|
|
"indicator--56c65007-ae5c-4af6-87ff-c652950d210f",
|
|
|
|
|
"indicator--56c65009-4458-4192-b1ab-c653950d210f",
|
|
|
|
|
"indicator--56c6500a-fc94-44b8-be1a-59a1950d210f",
|
|
|
|
|
"indicator--56c6500c-acc4-4bdb-9e9f-59a0950d210f",
|
|
|
|
|
"indicator--56c6500e-d9e8-4e4c-a2c0-59a3950d210f",
|
|
|
|
|
"indicator--56c65011-3a6c-44ab-88a4-c654950d210f",
|
|
|
|
|
"indicator--56c65012-d78c-422e-a959-59a0950d210f",
|
|
|
|
|
"indicator--56c65014-0350-4402-9561-599c950d210f",
|
|
|
|
|
"indicator--56c65018-34f8-421e-b4f8-c652950d210f",
|
|
|
|
|
"indicator--56c6501a-f1c0-4d67-9f26-c654950d210f",
|
|
|
|
|
"indicator--56c6501b-ac38-4bcd-a3ca-59a4950d210f",
|
|
|
|
|
"indicator--56c6501d-3f38-41c7-a586-4ecb950d210f",
|
|
|
|
|
"indicator--56c6501f-2b64-4a7e-b068-5ca1950d210f",
|
|
|
|
|
"indicator--56c65022-666c-42d5-b48e-4470950d210f",
|
|
|
|
|
"indicator--56c65024-36ac-43ec-870d-59a4950d210f",
|
|
|
|
|
"indicator--56c65027-33a0-42dc-9ef0-c654950d210f",
|
|
|
|
|
"indicator--56c65028-2628-425c-8d1a-4b31950d210f",
|
|
|
|
|
"indicator--56c6502a-dc50-447e-b945-5f51950d210f",
|
|
|
|
|
"indicator--56c6502c-b52c-4089-a6d7-59a2950d210f",
|
|
|
|
|
"indicator--56c6502e-6824-4858-b3eb-c653950d210f",
|
|
|
|
|
"indicator--56c6502f-df5c-46fe-bf24-c652950d210f",
|
|
|
|
|
"indicator--56c65031-2a8c-485b-b063-599e950d210f",
|
|
|
|
|
"indicator--56c65033-7008-419c-b902-c652950d210f",
|
|
|
|
|
"indicator--56c65035-8368-42f4-9571-5f51950d210f",
|
|
|
|
|
"indicator--56c65036-4208-4206-b1f7-599e950d210f",
|
|
|
|
|
"indicator--56c65038-df40-4e7d-a2c7-c653950d210f",
|
|
|
|
|
"indicator--56c6503a-0354-4142-a610-420c950d210f",
|
|
|
|
|
"indicator--56c6503c-ee90-417d-bdd5-42b0950d210f",
|
|
|
|
|
"indicator--56c6503f-d914-41e0-aeec-5ca1950d210f",
|
|
|
|
|
"indicator--56c65040-41f0-4c6e-8a4a-599f950d210f",
|
|
|
|
|
"indicator--56c65042-ab88-4da3-8af6-c653950d210f",
|
|
|
|
|
"indicator--56c65044-4bd8-4e87-9ed5-59a0950d210f",
|
|
|
|
|
"indicator--56c65046-d2bc-4901-85b9-c653950d210f",
|
|
|
|
|
"indicator--56c6504a-c590-4ad5-81e5-c654950d210f",
|
|
|
|
|
"indicator--56c6504c-4e20-4f9d-93f9-599e950d210f",
|
|
|
|
|
"indicator--56c6504e-3f1c-4309-8be6-59a3950d210f",
|
|
|
|
|
"indicator--56c65050-b9b8-4681-921e-4f8b950d210f",
|
|
|
|
|
"indicator--56c65052-72f0-46e6-a8ea-59a0950d210f",
|
|
|
|
|
"indicator--56c65054-2150-4ab6-9586-599d950d210f",
|
|
|
|
|
"indicator--56c65055-7b0c-4673-98ee-59a0950d210f",
|
|
|
|
|
"indicator--56c65057-8f58-4e3e-b448-599d950d210f",
|
|
|
|
|
"indicator--56c6505a-a078-4fe6-a62d-59a2950d210f",
|
|
|
|
|
"indicator--56c6505c-8c84-46e6-874b-4119950d210f",
|
|
|
|
|
"indicator--56c6505e-10d0-4855-83d4-c654950d210f",
|
|
|
|
|
"indicator--56c65060-cec0-4989-a67d-c653950d210f",
|
|
|
|
|
"indicator--56c65061-da48-40f7-bcfe-4e85950d210f",
|
|
|
|
|
"indicator--56c64fc8-fb34-4428-87f5-c654950d210f",
|
|
|
|
|
"indicator--56c64fca-a148-4b34-94e5-4de3950d210f",
|
|
|
|
|
"indicator--56c64fcc-5cbc-4c40-8bfb-5f51950d210f",
|
|
|
|
|
"indicator--56c64fcf-50a8-4af0-a30c-c653950d210f",
|
|
|
|
|
"indicator--56c64fd3-f500-408a-af47-599c950d210f",
|
|
|
|
|
"indicator--56c64fd4-5f1c-427c-b8ee-c651950d210f",
|
|
|
|
|
"indicator--56c64fd6-3ea0-4997-b2bc-59a4950d210f",
|
|
|
|
|
"indicator--56c64fd8-aba8-42a2-9436-59a2950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"Threat-Report",
|
|
|
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
|
|
|
"type:OSINT"
|
|
|
|
|
],
|
|
|
|
|
"object_marking_refs": [
|
|
|
|
|
"marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "x-misp-attribute",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "x-misp-attribute--54e1a7f7-ba90-406c-b01c-20b7950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:19:03.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:19:03.000Z",
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"text\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
],
|
|
|
|
|
"x_misp_category": "External analysis",
|
|
|
|
|
"x_misp_type": "text",
|
|
|
|
|
"x_misp_value": "Arid Viper"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--54e1a817-2978-4713-8001-45c4950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:19:35.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:19:35.000Z",
|
|
|
|
|
"first_observed": "2015-02-16T08:19:35Z",
|
|
|
|
|
"last_observed": "2015-02-16T08:19:35Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--54e1a817-2978-4713-8001-45c4950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--54e1a817-2978-4713-8001-45c4950d210b",
|
|
|
|
|
"value": "http://blog.trendmicro.com/trendlabs-security-intelligence/arid-viper-gaza-vs-israel-cyber-conflict/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--54e1a817-34cc-4c0c-8777-47be950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:19:35.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:19:35.000Z",
|
|
|
|
|
"first_observed": "2015-02-16T08:19:35Z",
|
|
|
|
|
"last_observed": "2015-02-16T08:19:35Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--54e1a817-34cc-4c0c-8777-47be950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--54e1a817-34cc-4c0c-8777-47be950d210b",
|
|
|
|
|
"value": "http://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/operation-arid-viper-bypassing-the-iron-dome"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--54e1a817-4ac4-4a12-92d5-473a950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:19:35.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:19:35.000Z",
|
|
|
|
|
"first_observed": "2015-02-16T08:19:35Z",
|
|
|
|
|
"last_observed": "2015-02-16T08:19:35Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--54e1a817-4ac4-4a12-92d5-473a950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--54e1a817-4ac4-4a12-92d5-473a950d210b",
|
|
|
|
|
"value": "http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-operation-arid-viper.pdf"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1a89f-66d0-4467-9432-9107950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:21:51.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:21:51.000Z",
|
|
|
|
|
"pattern": "[url:value = '/session/aadd_rtemp.php?n=']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:21:51Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1a89f-5fe0-4cc6-b7c0-9107950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:21:51.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:21:51.000Z",
|
|
|
|
|
"pattern": "[url:value = '/session/gget_rtemp.php?n=']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:21:51Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1a89f-e80c-435a-ae75-9107950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:21:51.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:21:51.000Z",
|
|
|
|
|
"pattern": "[url:value = '/flupdate/3.html']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:21:51Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1a9fe-f5a0-4a09-98e1-4973950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:27:42.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:27:42.000Z",
|
|
|
|
|
"pattern": "[url:value = '/new/chang_flag.php']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:27:42Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1a9fe-5a04-45d4-bf32-490c950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:27:42.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:27:42.000Z",
|
|
|
|
|
"pattern": "[url:value = '/new/chang_rfflag.php']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:27:42Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1a9fe-c554-4db4-ad99-43f1950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:27:42.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:27:42.000Z",
|
|
|
|
|
"pattern": "[url:value = '/new/chang_rflag.php']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:27:42Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1a9fe-7a40-4edb-bf2f-4b73950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:27:42.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:27:42.000Z",
|
|
|
|
|
"pattern": "[url:value = '/new/n_chang_fflag.php']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:27:42Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1a9fe-6b4c-4939-be65-426b950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:27:42.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:27:42.000Z",
|
|
|
|
|
"pattern": "[url:value = '/new/update.php']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:27:42Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1acf7-f684-458f-a3a6-20b7950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:40:23.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:40:23.000Z",
|
|
|
|
|
"pattern": "[url:value = '/new/add_tree.php?name=']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:40:23Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1acf8-d230-45e4-9368-20b7950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:40:24.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:40:24.000Z",
|
|
|
|
|
"pattern": "[url:value = '/new/all_file_info1.php?name=']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:40:24Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1acf8-edbc-4592-ac6e-20b7950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:40:24.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:40:24.000Z",
|
|
|
|
|
"pattern": "[url:value = '/new/get_flash.php?name=']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:40:24Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1acf8-78fc-4223-acff-20b7950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:40:24.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:40:24.000Z",
|
|
|
|
|
"pattern": "[url:value = '/new/get_tree.php?name=']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:40:24Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1acf8-087c-4ff2-81d5-20b7950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:40:24.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:40:24.000Z",
|
|
|
|
|
"pattern": "[url:value = '/new/get_statu.php?name=']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:40:24Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1acf8-e4b0-4869-936f-20b7950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:40:24.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:40:24.000Z",
|
|
|
|
|
"pattern": "[url:value = '/new/view_flash_files.php?name=']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:40:24Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1acf8-6cf8-43c1-9d67-20b7950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:40:24.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:40:24.000Z",
|
|
|
|
|
"pattern": "[url:value = '/new/view_flash_random.php?name=']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:40:24Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1acf8-3e18-4aea-a0d1-20b7950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:40:24.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:40:24.000Z",
|
|
|
|
|
"pattern": "[url:value = '/new/view_file_order.php?name=']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:40:24Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1acf8-b0d4-4315-81f6-20b7950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:40:24.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:40:24.000Z",
|
|
|
|
|
"pattern": "[url:value = '/new/view_file_up.php?name=']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:40:24Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1acf8-1aac-4963-aca9-20b7950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:40:24.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:40:24.000Z",
|
|
|
|
|
"pattern": "[url:value = '/new/view_random_order.php?name=']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:40:24Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1acf8-1290-458a-a0c8-20b7950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:40:24.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:40:24.000Z",
|
|
|
|
|
"pattern": "[url:value = '/down/add_temp.php?name=']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:40:24Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1acf8-3084-4ada-961c-20b7950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:40:24.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:40:24.000Z",
|
|
|
|
|
"pattern": "[url:value = '/new/add_tuser.php?name=']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:40:24Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1acf9-69d4-440e-8d63-20b7950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:40:25.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:40:25.000Z",
|
|
|
|
|
"pattern": "[url:value = '/mians/aadd_rtemp.php?n=']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:40:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1acf9-cf08-4fd9-99ec-20b7950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:40:25.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:40:25.000Z",
|
|
|
|
|
"pattern": "[url:value = '/mians/gget_rtemp.php?n=']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:40:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1ad1d-2030-4bbe-851a-48d1950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:41:01.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:41:01.000Z",
|
|
|
|
|
"pattern": "[url:value = 'products/add_user.php?name=']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:41:01Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1adaa-873c-4f27-9109-9107950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:43:22.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:43:22.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'advtravel.info']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:43:22Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"domain\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1adaa-36c0-4b84-9ffd-9107950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:43:22.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:43:22.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'ahmedfaiez.info']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:43:22Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"domain\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1adaa-5ff8-4ce9-956e-9107950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:43:22.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:43:22.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'flushupate.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:43:22Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"domain\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1adab-9eb8-45c5-8554-9107950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:43:23.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:43:23.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'flushupdate.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:43:23Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"domain\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1adab-0bb0-4e87-ae94-9107950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:43:23.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:43:23.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'ineltdriver.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:43:23Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"domain\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1adab-d080-4a70-b43c-9107950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:43:23.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:43:23.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'linksis.info']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:43:23Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"domain\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1adab-47e0-4ae8-8369-9107950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:43:23.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:43:23.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'mediahitech.info']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:43:23Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"domain\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1adab-75ec-43bb-925a-9107950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:43:23.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:43:23.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'mixedwork.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:43:23Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"domain\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1adab-3a64-4a43-92c7-9107950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:43:23.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:43:23.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'pstcmedia.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:43:23Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"domain\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1adab-9a60-46b4-85af-9107950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:43:23.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:43:23.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'plmedgroup.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:43:23Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"domain\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af16-a914-4459-906c-48a1950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:26.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:26.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '17f2eb260f0b6942f80453b30f1a13235f27b7ed80d4e5815fb58ff7322fc765']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:26Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af16-f958-4519-80da-4dc9950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:26.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:26.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '32e2b9cc92dfc1e77a85adb6a8b13c9b6264b7adb286260bd8bf6e47b6cde255']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:26Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af16-bf60-4fd2-8b37-40f6950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:26.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:26.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '4a581d9636a4f00a880b07f6dca1a82a866cf5713c74e722cfa9f71e08c33643']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:26Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af16-dd98-4ef2-8875-4a41950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:26.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:26.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '69589b1691909fa091a901f7323515228594561bc18032f8ffde095993333ecc']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:26Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af16-3434-4067-b603-43b0950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:26.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:26.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '6cc4869f1991df5879d0c4fc002f996a56bf11624d79ea2d34b52ceb98516425']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:26Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af16-0fb8-47b9-8dfc-42ec950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:26.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:26.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '72be7e8903211e37bb3a4b04d7684d49ed8fb21ec3fdf6367e4eed2aa6fdc54c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:26Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af16-943c-4621-8d2b-4259950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:26.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:26.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '856580576be62a0b14a01e9973b2fcb0c344e680b70a3b08b4ea293f84b47a59']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:26Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af16-1798-42e2-8f53-424e950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:26.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:26.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '8c4867a434e0b279c3f7fc5baedb04753c41a79cc52da6e3148c110d82a588e8']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:26Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af16-a7f8-4df9-bbfa-44c6950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:26.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:26.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'ae38be6e54447ddf5a9f16748a749ab0c9c7524f7f4f9878e3b4940415970a19']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:26Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af17-85fc-46f8-aefc-48f4950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:27.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:27.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'ea94498aeeef4535ea1c876a0f7317d6049307c82f9396dc6b9e3542a6aa50a3']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:27Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af17-39c4-4e44-b44c-4bf9950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:27.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:27.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '2a375d2a9c41af31554bafb4a712097cc016d5227cb1f07652f0ef3483d5be30']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:27Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af17-5290-4d72-aaaa-43b4950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:27.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:27.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '55cee457c73aa87258a04562c9d04cd3c865608d5dd64366d9cd9bc2fe2f5dd9']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:27Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af17-26ac-4819-a5d6-4011950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:27.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:27.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'a4cebac7bf4e5faa537a6013e9ae19c683d7cdad9dd318fdd968a966dd3a3010']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:27Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af17-8638-420a-a81e-4469950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:27.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:27.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'cb3039dad0ebd63e40fbcdbb8a2a1cdf9f442b2870383f5d469765387d0c8ec0']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:27Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af17-31e8-4797-9f94-46df950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:27.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:27.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'd4cb58f6167b72764a216d0ce6281d2251f02a696060eb425c9782283422a828']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:27Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af17-2e18-4ea4-ad58-4b12950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:27.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:27.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '91d3a9c6de14197fe3be7c2b86b88b58b1f731d3e82bb0b7b11d5c75fbbed9a5']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:27Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af17-30b8-497e-be87-479d950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:27.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:27.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'b6ca1211159e9fd790790e49db5eb1b7a11c09f746d3135ae7a67ce8f518a403']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:27Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af17-dca0-4276-a544-4a6f950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:27.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:27.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'e18f051ac27ed29f792db49e4333adca9b1762d485a9214b5af12ffe858ca3fc']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:27Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af17-b1c8-4052-8590-457b950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:27.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:27.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '381bcf2b7fefcdade08bb6a02dc32ea535dbef9cb9a43220649916db8bcc39d8']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:27Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af17-7348-464e-9280-4332950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:27.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:27.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '502953496a40661bb6336a693371d3dd29ad96feb5e9f91a5b5ca0ad3ffbf29f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:27Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af18-27ec-4bec-aa45-4a27950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:28.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:28.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '52767ea5e20b8639433c087edf86ef91b0cb7fda46c71dcce625938a9f5d8a74']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:28Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af18-5064-4249-8d56-4a55950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:28.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:28.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '4436c7024366356cd04724e1d6867786f2587a6f6295fc74b3af0c02a257adba']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:28Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af18-98dc-408b-8055-4092950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:28.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:28.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '4619cec6310e16d30e05204b35c084aabafabdd3d3f87661774fec253a103d11']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:28Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af18-7754-4882-85bb-42a1950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:28.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:28.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '8eeab6635982618bebc137cf6c4795aa10010685d9c7bb6ce66932215195eed7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:28Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af18-0ffc-4c03-96fe-484c950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:28.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:28.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '92cd7309723461918b9cd2988a26cd2199749e82636dc6628a46878db7e12db3']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:28Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af18-0e34-4d82-b042-4072950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:28.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:28.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '940a3ed18c4f171c9a6bccc0ab0ee8075aad6da8023e0b0e8883ca56bdddb4c7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:28Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af18-07b0-4569-a5dc-429b950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:28.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:28.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'a348aabfd8aeec855933509c4c0b2aee78408ada89d8b51ce16b2247659b22f7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:28Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af18-0e2c-4900-8d07-43aa950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:28.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:28.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'ae35a7a1b084d09bb913b450944dc6f3205650298e58d19e3e2ee4db93a109ea']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:28Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af18-c76c-457a-af4f-40c5950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:28.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:28.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'b5ba8fbc4f5c9bbf01c9a0a533ecab0735bf8e5e63116fffc570392e6faa9d18']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:28Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af18-af3c-404e-abe1-4416950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:28.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:28.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'b7666d4a0afe5f5b5de8faa541be31bbe34ea51c3b3a3fab77937f816ac6181e']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:28Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af19-9acc-41a6-bcdf-47a2950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:28.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:28.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'bbacf000880a46c7955a27f5dd960a6e253cd357f14f97f8472dd4fc3032f44d']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:28Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af19-0cac-4fa6-a9f6-46fd950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:29.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:29.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'bda7ea39f9105c25250f14e9e1fa3de0f51b91b04349974c7cadbbbe1c06ce2f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:29Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af19-89c4-442b-8d6e-4d82950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:29.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:29.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'd2ccf6fa361ceaf8cebada53bb1f9458b016ad85b74a7dc1bf4ba18774d92645']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:29Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af19-7644-4b1f-9d3d-44e4950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:29.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:29.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'e7b59b841e127c6fe6e02dd98292bba49bd32350b57595e09a6adab8da78235b']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:29Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af19-8bec-4804-8235-46e2950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:29.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:29.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'e810c74aefd63ce4ea674a1a961075a4d86a10b802d365b6b2b98a724d9b86db']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:29Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af19-87c0-46f9-913e-4caa950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:29.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:29.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'f467c72fa8adde6ddf27150122c117a17d1d664876c2f9d87e68e06257eb1904']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:29Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af19-c424-4d24-a177-46f9950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:29.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:29.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '58b48fd39ef718e5bd501f57e83b537668b13176ca682aee36402d18bd0c0733']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:29Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af19-6c90-4885-a640-44e8950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:29.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:29.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '59d880ae82ccc3c8207b745b1b3e55119a5b62af086a1639270b1ba5b7e1893a']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:29Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af19-313c-4527-aa23-40dc950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:29.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:29.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '74d3093a51482a1eaa15e4fc8aa4b7d659d571db0570950272d7aa998aec6f49']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:29Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af19-a510-4207-93ef-432c950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:29.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:29.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '829b90bcf24fdf7f0298edec701c3c45b820f297dd012ac22e27e4bd295ee5f2']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:29Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af19-9824-43b7-b466-46f0950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:29.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:29.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '9b6595980751537adf627e6107c08537de13e39752ed54c73e2b6af23e2a2769']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:29Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1a-0e18-4507-bff7-47a5950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:30.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:30.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'd711dc3c75a60ca0cd2556c267e3c33cee5d677edcfe70fb88b334f08f81ece9']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:30Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1a-9fdc-43da-824c-4e40950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:30.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:30.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'e850650e6982469529768988dfabadfdaa53b25abe1e0c0f0b3894b31a83b061']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:30Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1a-5ca0-41a9-9f3e-487e950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:30.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:30.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'db06c1914c82b52c9f2ee6ddffb13acde22d2227d626c41c35c163266b11d29c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:30Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1a-1d04-4b69-a575-4924950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:30.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:30.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '177d9e42c4e2dfc3641cdc1f92815600c861501f5c880f5ab9cb642feb9b94bd']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:30Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1a-1328-4361-a113-46fa950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:30.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:30.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '390ef820779cd7461792f0aa4fc324cb06e1226e551a158cb87ca4db05358ef3']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:30Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1a-0014-4178-a229-4cb1950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:30.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:30.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '3fbdfcf1eae14daa7b2fa6b7d3fa7cf602cd6ff178483c9019e3bb0aa2bb902c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:30Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1a-51c8-4e0b-b359-4728950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:30.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:30.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '62b10dc88df96e2d3d9cf5521a8d8372d6228fc82587bdee7f0de3c1c1d5a8bd']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:30Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1a-8bdc-43f5-9583-4083950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:30.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:30.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '6e8287bb8909baa65e5c00b853b4f66844e5cf3d7a5f8b707997c02395b93505']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:30Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1a-ce80-4eac-bcf1-46d4950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:30.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:30.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '8c66812d657027f537aa43f406182ba39e9baf3785f067ade003f96397b11ec0']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:30Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1a-37ac-4f9c-ad1a-4a68950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:30.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:30.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'a1bf0e5277f6fc962be778f182971eb4911d9c97cf27526d9e5698d514cef3c0']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:30Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1a-6880-4952-a56e-4e09950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:30.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:30.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'a6eac7a3607713fbeb3b50d227f3742ea23aa21c50eeff8987bbba10138527a9']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:30Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1b-4f90-44a1-86bf-45e7950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:31.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:31.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'b33472608ce524c2750b70c496a696ad6653b8a6ea7b474445d94cd491d255cf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1b-8c18-45b4-b782-45e1950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:31.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:31.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'bcc1a294bc63c3fa873f364bab0a7aa368d85726346106422013c270d55fec3c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1b-2020-4234-a43d-406b950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:31.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:31.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'bd9ab35587fdb450242b7a9ee0298c04dbd2fb254065fa004cda1ad42ac5f338']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1b-edcc-4ffc-9f1f-4d5e950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:31.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:31.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'e29647c7719696bf9d4d5aa8c8f10152b5b63b6d25969db90d9634273c0353f8']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1b-0c54-4e25-880b-4487950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:31.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:31.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '05eb2ecfc731ce222ebe82f6b3428fc5aa4179f7be5f328c5447317950e2d0e7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1b-410c-4bbb-839f-4dae950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:31.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:31.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '0d22606d24911c2128651ba0421c7c5bf7cd3eedef871c460b02b42b2417c457']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1b-2d5c-4b1c-8f2b-4cfd950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:31.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:31.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '11768a3a63458963d1d31be5c94d716b8e4f75dc1593080c2988b22cb6facaa8']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1b-5334-4235-b675-48e9950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:31.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:31.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '21b9b34d4a21ee538e7908727aca5d367f8d400db920187f51be2921a696421f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1b-9e30-43dc-b68c-4a59950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:31.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:31.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '2bd901a246f0b0b90ba891ee37c2ee4f7bd30d36d307b151998769fcc23fd1cb']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1b-091c-479f-940d-4da5950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:31.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:31.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '33fc87cc53eb867dc89e34fe7a46d33d90cab02f84299531d2e677a507ed308c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1c-9148-4a7b-97b1-4190950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:31.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:31.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '62f9839190e2fe50439894c667b3cbe29d64c3808cc471745e3d33b61370a340']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1c-74bc-4984-81ec-4001950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:32.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:32.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '694c01c9ade6258596cfafa6247da71712b2c3273bfc25ad26cb47302b8bbf4d']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:32Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1c-6d34-4dd7-8a9f-476e950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:32.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:32.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '74f22eced680ca26b767b4b07ba26b98536a385249d751586915b15b56509e0d']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:32Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1c-26a0-426f-aeb4-4bd2950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:32.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:32.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '81cc84f29a4c444724cbbfab83185866ecebc68c9c0a37f9623a4954456c4dd1']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:32Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1c-ccbc-40c5-92dd-43f9950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:32.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:32.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'a185dca4bd3b08bdafa80d53eec7ba792fb94b83785210049ba85477ce7c8cda']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:32Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1c-c840-4395-b64c-437a950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:32.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:32.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'a36e2b88b2440aff13bf0473a19e4cd7b7d19e8bc96bb2fd10b991c33e18be7c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:32Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1c-6f50-4301-9332-48e4950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:32.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:32.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'aab2cf709d095d949f662c40e9f889a8f3efa130102fc571f56a84205fdc67cb']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:32Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1c-201c-47b9-ae02-4c68950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:32.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:32.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'b009a87d8de4fae3395a06b2676c483a80b10ca12c5bbc093aa71ea504a77dc7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:32Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1c-60e0-4906-b755-4cc0950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:32.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:32.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'bb3eefa723221e2aa27c4f56f61418319ccda41b70e9e4b0375bf3bb131e974b']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:32Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1c-2380-4982-ad03-451d950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:32.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:32.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'd09a773dab9a20e6b39176e9cf76ac6863fe388d69367407c317c71652c84b9e']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:32Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1c-f0f4-4e83-81f5-4598950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:32.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:32.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'dad8cf7474c71db1512e637db780f4650d30b040903d7a76840a1c099b9b8650']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:32Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1d-91e0-465a-8dfe-4583950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:33.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:33.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'e91216df556bee622e4eab8551fe534cda8f2f1056b8d8442f088a4035815dfe']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:33Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af1d-f63c-4c4c-9ff2-48f1950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:49:33.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:49:33.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '09be9911eedb9b01d8f544252fb0c74f2dadcf850f33a0b947eac740de8c2427']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:49:33Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "x-misp-attribute",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "x-misp-attribute--54e1af39-a430-4cdf-8651-3252950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:50:01.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:50:01.000Z",
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"text\"",
|
|
|
|
|
"misp:category=\"Antivirus detection\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
],
|
|
|
|
|
"x_misp_category": "Antivirus detection",
|
|
|
|
|
"x_misp_comment": "Trend Micro",
|
|
|
|
|
"x_misp_type": "text",
|
|
|
|
|
"x_misp_value": "TROJ_STRPADT.A"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "x-misp-attribute",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "x-misp-attribute--54e1af39-c7f8-4ac4-ada2-3252950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:50:01.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:50:01.000Z",
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"text\"",
|
|
|
|
|
"misp:category=\"Antivirus detection\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
],
|
|
|
|
|
"x_misp_category": "Antivirus detection",
|
|
|
|
|
"x_misp_comment": "Trend Micro",
|
|
|
|
|
"x_misp_type": "text",
|
|
|
|
|
"x_misp_value": "TROJ_STRPSPI.A"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "x-misp-attribute",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "x-misp-attribute--54e1af39-9668-4d3c-a140-3252950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:50:01.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:50:01.000Z",
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"text\"",
|
|
|
|
|
"misp:category=\"Antivirus detection\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
],
|
|
|
|
|
"x_misp_category": "Antivirus detection",
|
|
|
|
|
"x_misp_comment": "Trend Micro",
|
|
|
|
|
"x_misp_type": "text",
|
|
|
|
|
"x_misp_value": "TROJ_STRPSPI.B"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "x-misp-attribute",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "x-misp-attribute--54e1af39-5e30-40f9-a226-3252950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:50:01.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:50:01.000Z",
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"text\"",
|
|
|
|
|
"misp:category=\"Antivirus detection\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
],
|
|
|
|
|
"x_misp_category": "Antivirus detection",
|
|
|
|
|
"x_misp_comment": "Trend Micro",
|
|
|
|
|
"x_misp_type": "text",
|
|
|
|
|
"x_misp_value": "TROJ_STRPSPI.C"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "x-misp-attribute",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "x-misp-attribute--54e1af39-aa90-418a-a853-3252950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:50:01.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:50:01.000Z",
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"text\"",
|
|
|
|
|
"misp:category=\"Antivirus detection\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
],
|
|
|
|
|
"x_misp_category": "Antivirus detection",
|
|
|
|
|
"x_misp_comment": "Trend Micro",
|
|
|
|
|
"x_misp_type": "text",
|
|
|
|
|
"x_misp_value": "TROJ_STRPSPI.D"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "x-misp-attribute",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "x-misp-attribute--54e1af39-36a4-44c7-a349-3252950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:50:01.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:50:01.000Z",
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"text\"",
|
|
|
|
|
"misp:category=\"Antivirus detection\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
],
|
|
|
|
|
"x_misp_category": "Antivirus detection",
|
|
|
|
|
"x_misp_comment": "Trend Micro",
|
|
|
|
|
"x_misp_type": "text",
|
|
|
|
|
"x_misp_value": "TROJ_STRPADT.B"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "x-misp-attribute",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "x-misp-attribute--54e1af39-14e4-41dc-9bb7-3252950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:50:01.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:50:01.000Z",
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"text\"",
|
|
|
|
|
"misp:category=\"Antivirus detection\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
],
|
|
|
|
|
"x_misp_category": "Antivirus detection",
|
|
|
|
|
"x_misp_comment": "Trend Micro",
|
|
|
|
|
"x_misp_type": "text",
|
|
|
|
|
"x_misp_value": "TROJ_STRPSPI.F"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "x-misp-attribute",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "x-misp-attribute--54e1af3a-10b0-4e72-84f4-3252950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:50:02.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:50:02.000Z",
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"text\"",
|
|
|
|
|
"misp:category=\"Antivirus detection\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
],
|
|
|
|
|
"x_misp_category": "Antivirus detection",
|
|
|
|
|
"x_misp_comment": "Trend Micro",
|
|
|
|
|
"x_misp_type": "text",
|
|
|
|
|
"x_misp_value": "TROJ_STRPSPI.E"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "x-misp-attribute",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "x-misp-attribute--54e1af3a-9dfc-444a-a2b8-3252950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:50:02.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:50:02.000Z",
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"text\"",
|
|
|
|
|
"misp:category=\"Antivirus detection\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
],
|
|
|
|
|
"x_misp_category": "Antivirus detection",
|
|
|
|
|
"x_misp_comment": "Trend Micro",
|
|
|
|
|
"x_misp_type": "text",
|
|
|
|
|
"x_misp_value": "TROJ_STRPSPI.G"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "x-misp-attribute",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "x-misp-attribute--54e1af3a-3a7c-42c2-b9c6-3252950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:50:02.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:50:02.000Z",
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"text\"",
|
|
|
|
|
"misp:category=\"Antivirus detection\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
],
|
|
|
|
|
"x_misp_category": "Antivirus detection",
|
|
|
|
|
"x_misp_comment": "Trend Micro",
|
|
|
|
|
"x_misp_type": "text",
|
|
|
|
|
"x_misp_value": "TROJ_STRPSPI.H"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af97-4818-4670-8ce4-48c4950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:51:35.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:51:35.000Z",
|
|
|
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '188.40.81.136']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:51:35Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1af97-c290-4e5e-9f3d-4346950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:51:35.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:51:35.000Z",
|
|
|
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '192.254.132.26']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:51:35Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1afa4-1288-4597-a783-fae5950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:51:48.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:51:48.000Z",
|
|
|
|
|
"description": "Sinkholed",
|
|
|
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '54.255.143.112']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:51:48Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "x-misp-attribute",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "x-misp-attribute--54e1aff8-6a54-45f5-899d-4e2c950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:53:12.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:53:12.000Z",
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"text\"",
|
|
|
|
|
"misp:category=\"Attribution\""
|
|
|
|
|
],
|
|
|
|
|
"x_misp_category": "Attribution",
|
|
|
|
|
"x_misp_comment": "Registrant",
|
|
|
|
|
"x_misp_type": "text",
|
|
|
|
|
"x_misp_value": "khalid.samraa@gmail.com"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "x-misp-attribute",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "x-misp-attribute--54e1aff8-fc88-4dcf-aa9e-47fb950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:53:12.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:53:12.000Z",
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"text\"",
|
|
|
|
|
"misp:category=\"Attribution\""
|
|
|
|
|
],
|
|
|
|
|
"x_misp_category": "Attribution",
|
|
|
|
|
"x_misp_comment": "Registrant",
|
|
|
|
|
"x_misp_type": "text",
|
|
|
|
|
"x_misp_value": "ahmed.jmal1989@gmail.com"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1b025-1258-40de-83a7-dadf950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:53:57.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:53:57.000Z",
|
|
|
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '188.40.75.132']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:53:57Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1b025-51cc-4d99-9f24-dadf950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:53:57.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:53:57.000Z",
|
|
|
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '188.40.106.84']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:53:57Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "x-misp-attribute",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "x-misp-attribute--54e1b096-6840-4865-a330-9107950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:55:50.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:55:50.000Z",
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"text\"",
|
|
|
|
|
"misp:category=\"Attribution\""
|
|
|
|
|
],
|
|
|
|
|
"x_misp_category": "Attribution",
|
|
|
|
|
"x_misp_comment": "Email in DNS SOA or in whois",
|
|
|
|
|
"x_misp_type": "text",
|
|
|
|
|
"x_misp_value": "moh.s009@gmail.com"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "x-misp-attribute",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "x-misp-attribute--54e1b096-f9ec-43f5-965e-9107950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:55:50.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:55:50.000Z",
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"text\"",
|
|
|
|
|
"misp:category=\"Attribution\""
|
|
|
|
|
],
|
|
|
|
|
"x_misp_category": "Attribution",
|
|
|
|
|
"x_misp_comment": "Email in DNS SOA or in whois",
|
|
|
|
|
"x_misp_type": "text",
|
|
|
|
|
"x_misp_value": "mahmoud.hashem12@gmail.com"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "x-misp-attribute",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "x-misp-attribute--54e1b0b2-2d54-43f8-97e5-fae5950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:56:18.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:56:18.000Z",
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"text\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
],
|
|
|
|
|
"x_misp_category": "External analysis",
|
|
|
|
|
"x_misp_type": "text",
|
|
|
|
|
"x_misp_value": "Advtravel"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1b12a-23e4-4abe-8cf7-dadf950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:58:18.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:58:18.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '77f590608eadcbbcc07de8d26607611f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:58:18Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1b12a-da18-47f9-9922-dadf950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:58:18.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:58:18.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '6d63f1c6962f290156c6459d1158a715']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:58:18Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1b12a-9614-4800-81dd-dadf950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:58:18.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:58:18.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'ccaac14d265915f4fdc6229ec6c9e854']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:58:18Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1b12b-89e4-4631-9976-dadf950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T08:58:18.000Z",
|
|
|
|
|
"modified": "2015-02-16T08:58:18.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'b9b763980e33e390480c4a0d7c63adec']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T08:58:18Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1b207-4db4-45e3-830d-48c1950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T09:01:59.000Z",
|
|
|
|
|
"modified": "2015-02-16T09:01:59.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'b2690a9ac508cfe49f9db76695e18f00']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T09:01:59Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1b208-8e30-4d35-b56b-40d6950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T09:02:00.000Z",
|
|
|
|
|
"modified": "2015-02-16T09:02:00.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '1e63925edff6ea3449b7d3468443a52f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T09:02:00Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1b208-1eac-42fe-8155-40e3950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T09:02:00.000Z",
|
|
|
|
|
"modified": "2015-02-16T09:02:00.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'ef5a37a6dcb1c417f4324730ce56be48']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T09:02:00Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1b208-f5a0-45a8-ae03-44f9950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T09:02:00.000Z",
|
|
|
|
|
"modified": "2015-02-16T09:02:00.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '2da94e47a68d9a137504106a513a3559']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T09:02:00Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1b208-5698-499a-ad7f-4d1d950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T09:02:00.000Z",
|
|
|
|
|
"modified": "2015-02-16T09:02:00.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'd6951e596910ec6105512ed002f24aa1']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T09:02:00Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1b208-3da8-4336-bbf4-4724950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T09:02:00.000Z",
|
|
|
|
|
"modified": "2015-02-16T09:02:00.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '293d37cf8c62076de739f4bd68e685bb']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T09:02:00Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1b208-aab0-41cb-874d-402f950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T09:02:00.000Z",
|
|
|
|
|
"modified": "2015-02-16T09:02:00.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '6fa049b83def6c41154558c706b6605d']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T09:02:00Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1b208-b130-4401-bfa9-4123950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T09:02:00.000Z",
|
|
|
|
|
"modified": "2015-02-16T09:02:00.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'c69bb266bede466825f21d900453f45e']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T09:02:00Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1b208-c438-4975-86d6-4deb950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T09:02:00.000Z",
|
|
|
|
|
"modified": "2015-02-16T09:02:00.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '0472d67eadb9aaa0491398bd14f6229f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T09:02:00Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1b208-3558-40ae-ab39-4841950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T09:02:00.000Z",
|
|
|
|
|
"modified": "2015-02-16T09:02:00.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'd8209defc3966076737401d0a22d27d3']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T09:02:00Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1b208-4230-40bd-97b4-4d54950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T09:02:00.000Z",
|
|
|
|
|
"modified": "2015-02-16T09:02:00.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '0ae436d95cc1eb6a9b57df984734973e']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T09:02:00Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1b208-ec5c-4636-887e-4556950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T09:02:00.000Z",
|
|
|
|
|
"modified": "2015-02-16T09:02:00.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'c8d387bb135d9acef3dfcf56464078fb']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T09:02:00Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1b209-73c0-414d-b60a-4aa1950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T09:02:01.000Z",
|
|
|
|
|
"modified": "2015-02-16T09:02:01.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'd57e0f5f0320f1b3fd8ae81a370170d0']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T09:02:01Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1b209-2ebc-411c-a015-4e7e950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T09:02:01.000Z",
|
|
|
|
|
"modified": "2015-02-16T09:02:01.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'e36680a19601f84af6d311e1fb847eef']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T09:02:01Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1b209-2254-45d3-8430-4922950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T09:02:01.000Z",
|
|
|
|
|
"modified": "2015-02-16T09:02:01.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '2a38ff709549b97b4e42b6fae81c6177']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T09:02:01Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1b209-b894-4c66-8c0c-4c29950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T09:02:01.000Z",
|
|
|
|
|
"modified": "2015-02-16T09:02:01.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'f747d5f998e48279cad7e9ed46e86a6b']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T09:02:01Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1b209-858c-4b62-8ff1-4576950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T09:02:01.000Z",
|
|
|
|
|
"modified": "2015-02-16T09:02:01.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '7171feeedd345a7d50091e76fc7e3ac4']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T09:02:01Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1b209-e418-434c-b612-41bb950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T09:02:01.000Z",
|
|
|
|
|
"modified": "2015-02-16T09:02:01.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'aa55cb19c3a61c0177e75198c70d6fa3']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T09:02:01Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1b209-0370-4ac0-9de6-4c20950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T09:02:01.000Z",
|
|
|
|
|
"modified": "2015-02-16T09:02:01.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'dcd2314f1af5dd1fd3e317bdf32faabb']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T09:02:01Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--54e1b23d-b290-4542-b5a9-409b950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T09:02:53.000Z",
|
|
|
|
|
"modified": "2015-02-16T09:02:53.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'devhelx.no-ip.org']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-02-16T09:02:53Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "x-misp-attribute",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "x-misp-attribute--54e1b2c5-c000-49c9-899b-4fa0950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T09:05:09.000Z",
|
|
|
|
|
"modified": "2015-02-16T09:05:09.000Z",
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"text\"",
|
|
|
|
|
"misp:category=\"Attribution\""
|
|
|
|
|
],
|
|
|
|
|
"x_misp_category": "Attribution",
|
|
|
|
|
"x_misp_comment": "Registrant",
|
|
|
|
|
"x_misp_type": "text",
|
|
|
|
|
"x_misp_value": "renold.dave@advtravel.info"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "x-misp-attribute",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "x-misp-attribute--54e1b559-ed50-4157-9f8a-9108950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-02-16T09:16:09.000Z",
|
|
|
|
|
"modified": "2015-02-16T09:16:09.000Z",
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"comment\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
],
|
|
|
|
|
"x_misp_category": "External analysis",
|
|
|
|
|
"x_misp_type": "comment",
|
|
|
|
|
"x_misp_value": "Data entered by David Andr\u00c3\u00a9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fd9-8d74-4397-afce-48a7950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:25.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:25.000Z",
|
|
|
|
|
"description": "Automatically added (via 17f2eb260f0b6942f80453b30f1a13235f27b7ed80d4e5815fb58ff7322fc765)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '7ed79032a1ad8535242428e69507ca0a']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fdc-30e0-4929-9b15-59a0950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:28.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:28.000Z",
|
|
|
|
|
"description": "Automatically added (via 4a581d9636a4f00a880b07f6dca1a82a866cf5713c74e722cfa9f71e08c33643)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '238b48338c14c8ea87ff7ccab4544252']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:28Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fdd-e9bc-4dd9-83b9-45eb950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:29.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:29.000Z",
|
|
|
|
|
"description": "Automatically added (via 69589b1691909fa091a901f7323515228594561bc18032f8ffde095993333ecc)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '7075c9a874ab5b0c27942714394f3885']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:29Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fdf-bb94-425d-ad03-599e950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:31.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:31.000Z",
|
|
|
|
|
"description": "Automatically added (via 6cc4869f1991df5879d0c4fc002f996a56bf11624d79ea2d34b52ceb98516425)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'dff746868a1559de9d25037e73c06c52']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fe1-26d8-44a4-9957-c654950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:33.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:33.000Z",
|
|
|
|
|
"description": "Automatically added (via 72be7e8903211e37bb3a4b04d7684d49ed8fb21ec3fdf6367e4eed2aa6fdc54c)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '003f0ed24b5f70ddc7c6e80f9c4dac73']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:33Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fe3-4820-4d77-a852-59a4950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:35.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:35.000Z",
|
|
|
|
|
"description": "Automatically added (via 8c4867a434e0b279c3f7fc5baedb04753c41a79cc52da6e3148c110d82a588e8)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '2986d9af413cd09d9ffdb40040e5c180']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:35Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fe6-96e0-463e-9922-599d950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:38.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:38.000Z",
|
|
|
|
|
"description": "Automatically added (via ea94498aeeef4535ea1c876a0f7317d6049307c82f9396dc6b9e3542a6aa50a3)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'fa6fbd1dd2d58885772bd0b37633d5d7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fe8-720c-4751-bf43-4afd950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:40.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:40.000Z",
|
|
|
|
|
"description": "Automatically added (via 2a375d2a9c41af31554bafb4a712097cc016d5227cb1f07652f0ef3483d5be30)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '33d56702729fd2bc5eb0f467663b03b4']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64feb-f3a0-435a-a918-599d950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:43.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:43.000Z",
|
|
|
|
|
"description": "Automatically added (via 55cee457c73aa87258a04562c9d04cd3c865608d5dd64366d9cd9bc2fe2f5dd9)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '9469ff12c582cf7943582dd28a1920cc']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:43Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fed-59cc-471a-b633-45ec950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:45.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:45.000Z",
|
|
|
|
|
"description": "Automatically added (via a4cebac7bf4e5faa537a6013e9ae19c683d7cdad9dd318fdd968a966dd3a3010)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'aefea9d795624da16d878dc9bb81bf87']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:45Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fef-039c-4255-8592-59a1950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:47.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:47.000Z",
|
|
|
|
|
"description": "Automatically added (via cb3039dad0ebd63e40fbcdbb8a2a1cdf9f442b2870383f5d469765387d0c8ec0)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '8a9b52ff90bbd585907694e68551b991']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:47Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64ff1-db7c-4145-8f47-c652950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:49.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:49.000Z",
|
|
|
|
|
"description": "Automatically added (via d4cb58f6167b72764a216d0ce6281d2251f02a696060eb425c9782283422a828)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '686779709226c6727bd9ebc4b1ff21b1']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:49Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64ff3-9c4c-46b0-8e07-59a2950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:51.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:51.000Z",
|
|
|
|
|
"description": "Automatically added (via 91d3a9c6de14197fe3be7c2b86b88b58b1f731d3e82bb0b7b11d5c75fbbed9a5)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '96d56c4a5426466f2a0dc3813386818d']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:51Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64ff5-0750-487d-9b10-59a4950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:53.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:53.000Z",
|
|
|
|
|
"description": "Automatically added (via b6ca1211159e9fd790790e49db5eb1b7a11c09f746d3135ae7a67ce8f518a403)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'd048a6a8377a865f07cbc2429ffaa3e7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:53Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64ff8-a5e0-478c-9eeb-5ca1950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:56.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:56.000Z",
|
|
|
|
|
"description": "Automatically added (via e18f051ac27ed29f792db49e4333adca9b1762d485a9214b5af12ffe858ca3fc)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'c60ada815212fc9c58fb801f99c230a4']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:56Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64ffa-953c-45ca-a348-c650950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:58.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:58.000Z",
|
|
|
|
|
"description": "Automatically added (via 381bcf2b7fefcdade08bb6a02dc32ea535dbef9cb9a43220649916db8bcc39d8)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '2607abe604832363514eb58c33a682fc']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:58Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64ffc-6df8-4c60-a469-5ca1950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:00.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:00.000Z",
|
|
|
|
|
"description": "Automatically added (via 502953496a40661bb6336a693371d3dd29ad96feb5e9f91a5b5ca0ad3ffbf29f)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'b08a67892d2198aeb2826b398f8c6c74']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:00Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64ffd-54b8-452d-8555-41da950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:01.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:01.000Z",
|
|
|
|
|
"description": "Automatically added (via 52767ea5e20b8639433c087edf86ef91b0cb7fda46c71dcce625938a9f5d8a74)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'f3d6bb7addc88ad45f79c5199f8db2e0']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:01Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fff-9eb8-4d13-b648-4899950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:03.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:03.000Z",
|
|
|
|
|
"description": "Automatically added (via 4436c7024366356cd04724e1d6867786f2587a6f6295fc74b3af0c02a257adba)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'f78fcd4eaf3d9cd95116b6e6212ad327']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65002-c66c-42a6-93b3-5f51950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:06.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:06.000Z",
|
|
|
|
|
"description": "Automatically added (via 4619cec6310e16d30e05204b35c084aabafabdd3d3f87661774fec253a103d11)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'e1d2543aba350a83c968872fbe957d85']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:06Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65005-7fec-4be5-925e-599c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:09.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:09.000Z",
|
|
|
|
|
"description": "Automatically added (via 8eeab6635982618bebc137cf6c4795aa10010685d9c7bb6ce66932215195eed7)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '7ac102b740b299824e34394f334b5508']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:09Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65008-a15c-424c-876b-59a2950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:12.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:12.000Z",
|
|
|
|
|
"description": "Automatically added (via 92cd7309723461918b9cd2988a26cd2199749e82636dc6628a46878db7e12db3)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '73c46bacc471db08a6c0e31caef3f9e8']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:12Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6500a-3d78-4e09-8365-5ca1950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:14.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:14.000Z",
|
|
|
|
|
"description": "Automatically added (via 940a3ed18c4f171c9a6bccc0ab0ee8075aad6da8023e0b0e8883ca56bdddb4c7)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'bd54d70d473d45b75cc8bf1fbe6fa022']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6500b-f018-433d-9653-599e950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:15.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:15.000Z",
|
|
|
|
|
"description": "Automatically added (via a348aabfd8aeec855933509c4c0b2aee78408ada89d8b51ce16b2247659b22f7)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '63c480b1cc601b02b4acb30309b007e6']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:15Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6500d-4174-4f6e-b9df-c654950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:17.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:17.000Z",
|
|
|
|
|
"description": "Automatically added (via ae35a7a1b084d09bb913b450944dc6f3205650298e58d19e3e2ee4db93a109ea)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '4377b17d7984838993b998c4bab97925']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:17Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65010-be00-4d53-99be-4357950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:20.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:20.000Z",
|
|
|
|
|
"description": "Automatically added (via b5ba8fbc4f5c9bbf01c9a0a533ecab0735bf8e5e63116fffc570392e6faa9d18)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '2219f3941603262dc3478c60df3b02f6']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:20Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65012-1008-42e4-ac9a-c650950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:22.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:22.000Z",
|
|
|
|
|
"description": "Automatically added (via bbacf000880a46c7955a27f5dd960a6e253cd357f14f97f8472dd4fc3032f44d)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '4907a68a3ff0f010ed74214f957746c0']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:22Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65013-bcf0-43bd-a778-c651950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:23.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:23.000Z",
|
|
|
|
|
"description": "Automatically added (via bda7ea39f9105c25250f14e9e1fa3de0f51b91b04349974c7cadbbbe1c06ce2f)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '76f74b24480bc1a42998c9440ddc2fad']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:23Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65016-7b2c-4349-8353-59a4950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:26.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:26.000Z",
|
|
|
|
|
"description": "Automatically added (via d2ccf6fa361ceaf8cebada53bb1f9458b016ad85b74a7dc1bf4ba18774d92645)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '027fc90c13f6d87e1f68d25b0d0ec4a7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:26Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65019-2ae0-4e6b-8119-4af9950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:29.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:29.000Z",
|
|
|
|
|
"description": "Automatically added (via e7b59b841e127c6fe6e02dd98292bba49bd32350b57595e09a6adab8da78235b)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'a4a390f90be49b2bb51194d0844fed7f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:29Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6501b-7e84-47f5-8cac-599f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:31.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:31.000Z",
|
|
|
|
|
"description": "Automatically added (via e810c74aefd63ce4ea674a1a961075a4d86a10b802d365b6b2b98a724d9b86db)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '1e52a293838464e4cd6c1c6d94a55793']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6501c-ff70-4bc9-a508-49c4950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:32.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:32.000Z",
|
|
|
|
|
"description": "Automatically added (via f467c72fa8adde6ddf27150122c117a17d1d664876c2f9d87e68e06257eb1904)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '2b3baed817a79109824d3a8a94f6c317']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:32Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6501e-7698-40c9-a119-4474950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:34.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:34.000Z",
|
|
|
|
|
"description": "Automatically added (via 58b48fd39ef718e5bd501f57e83b537668b13176ca682aee36402d18bd0c0733)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '466667cea81ad59dc210ccb3bebbfa9e']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:34Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65020-6484-4d17-8292-599c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:36.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:36.000Z",
|
|
|
|
|
"description": "Automatically added (via 9b6595980751537adf627e6107c08537de13e39752ed54c73e2b6af23e2a2769)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '9eb3d9e045dba73f449661a2a49a9e6d']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:36Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65023-d048-455e-a096-c651950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:39.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:39.000Z",
|
|
|
|
|
"description": "Automatically added (via db06c1914c82b52c9f2ee6ddffb13acde22d2227d626c41c35c163266b11d29c)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '1b26203d329a6663dfcb286bc4702c77']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:39Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65026-054c-4344-8e06-59a1950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:42.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:42.000Z",
|
|
|
|
|
"description": "Automatically added (via 177d9e42c4e2dfc3641cdc1f92815600c861501f5c880f5ab9cb642feb9b94bd)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'c7a864cbad17223470965cc33133b36e']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:42Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65028-8e54-478d-8800-599f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:44.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:44.000Z",
|
|
|
|
|
"description": "Automatically added (via 390ef820779cd7461792f0aa4fc324cb06e1226e551a158cb87ca4db05358ef3)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '91510aa0bbf961a34f0326fbaf2bcbb1']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:44Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65029-20f8-4786-82e3-59a3950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:45.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:45.000Z",
|
|
|
|
|
"description": "Automatically added (via 3fbdfcf1eae14daa7b2fa6b7d3fa7cf602cd6ff178483c9019e3bb0aa2bb902c)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '0aee50dff0a4c22da5ff3decdb261897']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:45Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6502b-6164-4c6b-8809-599d950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:47.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:47.000Z",
|
|
|
|
|
"description": "Automatically added (via 62b10dc88df96e2d3d9cf5521a8d8372d6228fc82587bdee7f0de3c1c1d5a8bd)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'f75cebd9a5d2f367117109845561e2d4']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:47Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6502d-83e4-42a2-b52f-c652950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:49.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:49.000Z",
|
|
|
|
|
"description": "Automatically added (via 6e8287bb8909baa65e5c00b853b4f66844e5cf3d7a5f8b707997c02395b93505)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '6ff73820c23551225de0ca08c2fc4397']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:49Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6502f-2e9c-42d7-8a32-59a4950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:51.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:51.000Z",
|
|
|
|
|
"description": "Automatically added (via 8c66812d657027f537aa43f406182ba39e9baf3785f067ade003f96397b11ec0)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '436a7ad10b379ddc0a454e5129dc3ba6']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:51Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65030-00a4-4451-84ea-599c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:52.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:52.000Z",
|
|
|
|
|
"description": "Automatically added (via a1bf0e5277f6fc962be778f182971eb4911d9c97cf27526d9e5698d514cef3c0)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '441951e52741195e037b0ed14e5b183c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:52Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65032-a8d4-447e-b738-4e47950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:54.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:54.000Z",
|
|
|
|
|
"description": "Automatically added (via a6eac7a3607713fbeb3b50d227f3742ea23aa21c50eeff8987bbba10138527a9)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'a1b7f8f3cf6dee880028bd6db8111a1d']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:54Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65034-e1a8-4123-9c5e-c654950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:56.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:56.000Z",
|
|
|
|
|
"description": "Automatically added (via b33472608ce524c2750b70c496a696ad6653b8a6ea7b474445d94cd491d255cf)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'a37b7ef490aec8a0d97c1e70733c11c6']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:56Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65035-9994-4390-92d3-599c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:57.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:57.000Z",
|
|
|
|
|
"description": "Automatically added (via bcc1a294bc63c3fa873f364bab0a7aa368d85726346106422013c270d55fec3c)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '00eef6a2ac57e987f4750c6eff4e93d6']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:57Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65037-e2e8-4885-b6bc-5ca1950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:59.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:59.000Z",
|
|
|
|
|
"description": "Automatically added (via bd9ab35587fdb450242b7a9ee0298c04dbd2fb254065fa004cda1ad42ac5f338)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'e763e2a3b0b1ed43447afe281e134e95']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:59Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65039-4e2c-46ae-ad54-59a3950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:01.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:01.000Z",
|
|
|
|
|
"description": "Automatically added (via e29647c7719696bf9d4d5aa8c8f10152b5b63b6d25969db90d9634273c0353f8)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'e85c9666ddb6239fff16fa7b78c8f96b']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:01Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6503b-8aac-46bd-932c-59a4950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:03.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:03.000Z",
|
|
|
|
|
"description": "Automatically added (via 05eb2ecfc731ce222ebe82f6b3428fc5aa4179f7be5f328c5447317950e2d0e7)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'fe326b5439d0cf5683f24b2792807481']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6503e-40a4-4812-837f-c650950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:06.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:06.000Z",
|
|
|
|
|
"description": "Automatically added (via 0d22606d24911c2128651ba0421c7c5bf7cd3eedef871c460b02b42b2417c457)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'fac66827a8cf3197358c1eaf1d6aa2bf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:06Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65040-dcc8-4a81-9e90-599e950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:08.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:08.000Z",
|
|
|
|
|
"description": "Automatically added (via 11768a3a63458963d1d31be5c94d716b8e4f75dc1593080c2988b22cb6facaa8)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'a4c1ceda720e1b3f860a81674588542f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:08Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65041-12dc-4623-bdf7-c651950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:09.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:09.000Z",
|
|
|
|
|
"description": "Automatically added (via 21b9b34d4a21ee538e7908727aca5d367f8d400db920187f51be2921a696421f)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'decb846191be54c441677bb1da264029']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:09Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65043-68e4-4b01-9ee3-599c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:11.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:11.000Z",
|
|
|
|
|
"description": "Automatically added (via 2bd901a246f0b0b90ba891ee37c2ee4f7bd30d36d307b151998769fcc23fd1cb)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'a313d1092c5245da1c20ac05915a3d11']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:11Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65045-7d80-422f-945a-59a3950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:13.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:13.000Z",
|
|
|
|
|
"description": "Automatically added (via 33fc87cc53eb867dc89e34fe7a46d33d90cab02f84299531d2e677a507ed308c)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'b23c2925ee2d48517d17d4886e21c630']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:13Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65048-a5d8-4ee8-a23e-c651950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:16.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:16.000Z",
|
|
|
|
|
"description": "Automatically added (via 62f9839190e2fe50439894c667b3cbe29d64c3808cc471745e3d33b61370a340)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '518a765d999191b9ed7c4730714def31']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:16Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6504b-aaf4-4874-b2f7-4fc6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:19.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:19.000Z",
|
|
|
|
|
"description": "Automatically added (via 694c01c9ade6258596cfafa6247da71712b2c3273bfc25ad26cb47302b8bbf4d)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'a668c1dbdcdf2d561bea512361b101b9']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:19Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6504d-6d68-46c8-bc45-4a52950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:21.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:21.000Z",
|
|
|
|
|
"description": "Automatically added (via 74f22eced680ca26b767b4b07ba26b98536a385249d751586915b15b56509e0d)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'b312d48899c00e8bbaaff72503a07de8']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:21Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6504f-1700-482a-bf3a-c652950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:23.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:23.000Z",
|
|
|
|
|
"description": "Automatically added (via 81cc84f29a4c444724cbbfab83185866ecebc68c9c0a37f9623a4954456c4dd1)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'd72906bc778d710b7ce5c5185280ea3d']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:23Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65051-3008-4f5d-b918-599c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:25.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:25.000Z",
|
|
|
|
|
"description": "Automatically added (via a185dca4bd3b08bdafa80d53eec7ba792fb94b83785210049ba85477ce7c8cda)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'f3d9689121a996f68533bd78eb6a18d9']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65053-26c4-46cb-b95d-4c8b950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:27.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:27.000Z",
|
|
|
|
|
"description": "Automatically added (via a36e2b88b2440aff13bf0473a19e4cd7b7d19e8bc96bb2fd10b991c33e18be7c)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'ef893ee05b6239fd2918e29e50973bc3']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:27Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65055-fd30-4c11-96b0-c652950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:29.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:29.000Z",
|
|
|
|
|
"description": "Automatically added (via aab2cf709d095d949f662c40e9f889a8f3efa130102fc571f56a84205fdc67cb)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'f7ba0e5a7eeaeb359234b204fb1954ae']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:29Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65056-1be8-4407-81c9-599e950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:30.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:30.000Z",
|
|
|
|
|
"description": "Automatically added (via b009a87d8de4fae3395a06b2676c483a80b10ca12c5bbc093aa71ea504a77dc7)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '8ef883fd3e6523975ef9f6310b604feb']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:30Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65059-4aa4-4e99-abec-c651950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:33.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:33.000Z",
|
|
|
|
|
"description": "Automatically added (via bb3eefa723221e2aa27c4f56f61418319ccda41b70e9e4b0375bf3bb131e974b)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '2b94213b0ba7200742a08992b69a127a']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:33Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6505b-8950-4bd4-95a3-c652950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:35.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:35.000Z",
|
|
|
|
|
"description": "Automatically added (via d09a773dab9a20e6b39176e9cf76ac6863fe388d69367407c317c71652c84b9e)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '02ffcfdcfb205cece05597fce1b307b7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:35Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6505d-1238-4f64-937d-59a4950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:37.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:37.000Z",
|
|
|
|
|
"description": "Automatically added (via dad8cf7474c71db1512e637db780f4650d30b040903d7a76840a1c099b9b8650)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'c900f5a9fd675e3ab56d62f03ee76cae']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:37Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6505f-1d80-46d8-bb9e-4d11950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:39.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:39.000Z",
|
|
|
|
|
"description": "Automatically added (via e91216df556bee622e4eab8551fe534cda8f2f1056b8d8442f088a4035815dfe)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '4a0ef41272210f41b987224ff57f6280']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:39Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65061-f1f4-46de-9b59-59a4950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:41.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:41.000Z",
|
|
|
|
|
"description": "Automatically added (via 09be9911eedb9b01d8f544252fb0c74f2dadcf850f33a0b947eac740de8c2427)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'bbc79bca19b0ebb95cb9cc69cc656382']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:41Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fc7-0eb0-4a8d-ab3d-c652950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:07.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:07.000Z",
|
|
|
|
|
"description": "Automatically added (via 77f590608eadcbbcc07de8d26607611f)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '4bceea451a69dfa19e4590ef2672881d2913d05c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:07Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fc9-0148-486c-99f3-4642950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:09.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:09.000Z",
|
|
|
|
|
"description": "Automatically added (via 6d63f1c6962f290156c6459d1158a715)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'e1aaf347d8afc053b966064b79eacf654521990b']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:09Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fcb-2e2c-47eb-916a-599e950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:11.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:11.000Z",
|
|
|
|
|
"description": "Automatically added (via ccaac14d265915f4fdc6229ec6c9e854)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '5b45b3be05dfdea885ef303de0dfd35997549341']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:11Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fce-db88-47e5-ac9c-c650950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:14.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:14.000Z",
|
|
|
|
|
"description": "Automatically added (via b9b763980e33e390480c4a0d7c63adec)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '4e59007e8e961dcdd03a54aea219b6be80997f3d']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fd2-3074-4f7a-b00b-59a3950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:18.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:18.000Z",
|
|
|
|
|
"description": "Automatically added (via d8209defc3966076737401d0a22d27d3)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'ad5f278c33c07237a7f6eb629c4ec7843dddc196']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:18Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fd4-0e28-4285-9945-c654950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:20.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:20.000Z",
|
|
|
|
|
"description": "Automatically added (via d57e0f5f0320f1b3fd8ae81a370170d0)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '93d1801b1bb38b36402361b28c050d1a5acd11f7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:20Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fd6-6140-49e3-b6be-59a3950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:22.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:22.000Z",
|
|
|
|
|
"description": "Automatically added (via 7171feeedd345a7d50091e76fc7e3ac4)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'a82fd05077f6bfc37edd40cd407c8905c4fe285e']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:22Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fd7-bc10-4560-a6d4-59a1950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:23.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:23.000Z",
|
|
|
|
|
"description": "Automatically added (via aa55cb19c3a61c0177e75198c70d6fa3)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '517dc5e12d7393ab7d36604e235d0db53a71b75f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:23Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fda-4b08-4e66-929c-43fc950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:26.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:26.000Z",
|
|
|
|
|
"description": "Automatically added (via 17f2eb260f0b6942f80453b30f1a13235f27b7ed80d4e5815fb58ff7322fc765)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '96da645bebec9683a624a4d3aee6c8b4cca11054']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:26Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fdc-0a20-4070-8808-c653950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:28.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:28.000Z",
|
|
|
|
|
"description": "Automatically added (via 4a581d9636a4f00a880b07f6dca1a82a866cf5713c74e722cfa9f71e08c33643)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '69f9f236f7b6328282ba34e8406ae844cdef58e8']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:28Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fde-be48-4882-9e56-4c64950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:30.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:30.000Z",
|
|
|
|
|
"description": "Automatically added (via 69589b1691909fa091a901f7323515228594561bc18032f8ffde095993333ecc)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '3a8b95c4f698d256a575ae4dc79582b9256d256d']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:30Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fe0-3c28-44ee-affa-c652950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:32.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:32.000Z",
|
|
|
|
|
"description": "Automatically added (via 6cc4869f1991df5879d0c4fc002f996a56bf11624d79ea2d34b52ceb98516425)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'ffb622f9eff567efe6e7005b38b9c50077ea1e36']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:32Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fe2-2a44-450a-9f6e-599f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:34.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:34.000Z",
|
|
|
|
|
"description": "Automatically added (via 72be7e8903211e37bb3a4b04d7684d49ed8fb21ec3fdf6367e4eed2aa6fdc54c)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '75ec7d0d1b6b2b4c816cbc1b71cd0f8f06bd8c1b']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:34Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fe4-1278-4eb1-9e8a-59a0950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:36.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:36.000Z",
|
|
|
|
|
"description": "Automatically added (via 8c4867a434e0b279c3f7fc5baedb04753c41a79cc52da6e3148c110d82a588e8)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'ee934b5189171cad75a97ead2015b5ad416a22d2']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:36Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fe6-47e0-4b65-a752-c652950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:38.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:38.000Z",
|
|
|
|
|
"description": "Automatically added (via ea94498aeeef4535ea1c876a0f7317d6049307c82f9396dc6b9e3542a6aa50a3)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'c1c902764c2ea1793ee960eca3e5f4d5fe343edb']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fe9-94c8-47ef-9b5f-5f51950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:41.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:41.000Z",
|
|
|
|
|
"description": "Automatically added (via 2a375d2a9c41af31554bafb4a712097cc016d5227cb1f07652f0ef3483d5be30)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '57282ea370b5ef64b605b788efa5ae6639983641']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:41Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fec-6fb4-4a79-9bf8-599e950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:44.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:44.000Z",
|
|
|
|
|
"description": "Automatically added (via 55cee457c73aa87258a04562c9d04cd3c865608d5dd64366d9cd9bc2fe2f5dd9)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '1d0390f0def8a38bb2a9b574f8f8597f982226fc']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:44Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fee-1c2c-47b0-874a-4a2e950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:46.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:46.000Z",
|
|
|
|
|
"description": "Automatically added (via a4cebac7bf4e5faa537a6013e9ae19c683d7cdad9dd318fdd968a966dd3a3010)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '5e4b2ed1dacebd1b578c7a99edb58cc89a994119']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:46Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64ff0-ea90-4d28-aeb3-5ca1950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:48.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:48.000Z",
|
|
|
|
|
"description": "Automatically added (via cb3039dad0ebd63e40fbcdbb8a2a1cdf9f442b2870383f5d469765387d0c8ec0)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'f42e9b5a7d20e3cb680637a31d30a26709d4c4cf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:48Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64ff2-1874-4fd4-b2a0-c653950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:50.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:50.000Z",
|
|
|
|
|
"description": "Automatically added (via d4cb58f6167b72764a216d0ce6281d2251f02a696060eb425c9782283422a828)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '985389c8ad8ab95b5f4bab3d843947f122c6c7c6']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:50Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64ff3-9624-4f79-877a-5f51950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:51.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:51.000Z",
|
|
|
|
|
"description": "Automatically added (via 91d3a9c6de14197fe3be7c2b86b88b58b1f731d3e82bb0b7b11d5c75fbbed9a5)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '251b44815f54c57b369fb9e95a243d3ab91f1e13']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:51Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64ff6-ed20-4ad7-bc98-599c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:54.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:54.000Z",
|
|
|
|
|
"description": "Automatically added (via b6ca1211159e9fd790790e49db5eb1b7a11c09f746d3135ae7a67ce8f518a403)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '31eb820a4c0ac8c0b249551d5bac347773853cea']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:54Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64ff9-acf4-4c35-a202-59a2950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:57.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:57.000Z",
|
|
|
|
|
"description": "Automatically added (via e18f051ac27ed29f792db49e4333adca9b1762d485a9214b5af12ffe858ca3fc)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '26527d596981f2939c1c15b2f33aa9f35c61f9bd']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:57Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64ffb-9ec8-43d4-98d1-4a80950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:59.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:59.000Z",
|
|
|
|
|
"description": "Automatically added (via 381bcf2b7fefcdade08bb6a02dc32ea535dbef9cb9a43220649916db8bcc39d8)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'db178046be3bd606d5e22754ce0b8a9fd4943fdd']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:59Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64ffc-da60-4dce-8c7c-59a4950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:00.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:00.000Z",
|
|
|
|
|
"description": "Automatically added (via 502953496a40661bb6336a693371d3dd29ad96feb5e9f91a5b5ca0ad3ffbf29f)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '7621f3652512e7eb33cc3adbc5128affb4593b17']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:00Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64ffe-635c-4365-b723-59a3950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:02.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:02.000Z",
|
|
|
|
|
"description": "Automatically added (via 52767ea5e20b8639433c087edf86ef91b0cb7fda46c71dcce625938a9f5d8a74)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '5277b102367067bda057a42475ac2cad407723bb']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65001-46fc-4160-9b74-c653950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:05.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:05.000Z",
|
|
|
|
|
"description": "Automatically added (via 4436c7024366356cd04724e1d6867786f2587a6f6295fc74b3af0c02a257adba)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'f720ac8ed38e91eaad050a6930a1b60f4a6c22e7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:05Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65004-5fd4-497e-b8a1-c651950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:08.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:08.000Z",
|
|
|
|
|
"description": "Automatically added (via 4619cec6310e16d30e05204b35c084aabafabdd3d3f87661774fec253a103d11)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '6960a295f309287c37589431effd0bd1cdf16b48']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:08Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65007-ae5c-4af6-87ff-c652950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:11.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:11.000Z",
|
|
|
|
|
"description": "Automatically added (via 8eeab6635982618bebc137cf6c4795aa10010685d9c7bb6ce66932215195eed7)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '3722c070a84caedf5f8605d90d8dfb716238a847']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:11Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65009-4458-4192-b1ab-c653950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:13.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:13.000Z",
|
|
|
|
|
"description": "Automatically added (via 92cd7309723461918b9cd2988a26cd2199749e82636dc6628a46878db7e12db3)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'ac11ba146d2240d8c5b61438e91b9f567bf75dd2']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:13Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6500a-fc94-44b8-be1a-59a1950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:14.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:14.000Z",
|
|
|
|
|
"description": "Automatically added (via 940a3ed18c4f171c9a6bccc0ab0ee8075aad6da8023e0b0e8883ca56bdddb4c7)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'f12a647eaae91c50b659be6bd8803d7dbe84988f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6500c-acc4-4bdb-9e9f-59a0950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:16.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:16.000Z",
|
|
|
|
|
"description": "Automatically added (via a348aabfd8aeec855933509c4c0b2aee78408ada89d8b51ce16b2247659b22f7)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '9940ec4ecfb8c51ff0f3be4e0cdb2b3f92145d01']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:16Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6500e-d9e8-4e4c-a2c0-59a3950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:18.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:18.000Z",
|
|
|
|
|
"description": "Automatically added (via ae35a7a1b084d09bb913b450944dc6f3205650298e58d19e3e2ee4db93a109ea)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '93d1d4a475c5495cc52b1b54a2b6a0f0af43262b']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:18Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65011-3a6c-44ab-88a4-c654950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:21.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:21.000Z",
|
|
|
|
|
"description": "Automatically added (via b5ba8fbc4f5c9bbf01c9a0a533ecab0735bf8e5e63116fffc570392e6faa9d18)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '76d873f77968ceda43d09c0b9d15a498cb8eebdf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:21Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65012-d78c-422e-a959-59a0950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:22.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:22.000Z",
|
|
|
|
|
"description": "Automatically added (via bbacf000880a46c7955a27f5dd960a6e253cd357f14f97f8472dd4fc3032f44d)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'dec6b1c25082f3d0da1987b2adac7045d682a139']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:22Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65014-0350-4402-9561-599c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:24.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:24.000Z",
|
|
|
|
|
"description": "Automatically added (via bda7ea39f9105c25250f14e9e1fa3de0f51b91b04349974c7cadbbbe1c06ce2f)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'a8722e87f6287c1c3484e6c0a984960d995b4a57']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:24Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65018-34f8-421e-b4f8-c652950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:28.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:28.000Z",
|
|
|
|
|
"description": "Automatically added (via d2ccf6fa361ceaf8cebada53bb1f9458b016ad85b74a7dc1bf4ba18774d92645)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '4be256f9276cbcee9ca1b6a5c7800e1d86628417']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:28Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6501a-f1c0-4d67-9f26-c654950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:30.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:30.000Z",
|
|
|
|
|
"description": "Automatically added (via e7b59b841e127c6fe6e02dd98292bba49bd32350b57595e09a6adab8da78235b)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '67d1b13026d4200f9f27a29d3c423171ae782fb7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:30Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6501b-ac38-4bcd-a3ca-59a4950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:31.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:31.000Z",
|
|
|
|
|
"description": "Automatically added (via e810c74aefd63ce4ea674a1a961075a4d86a10b802d365b6b2b98a724d9b86db)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'fe2a0fb1ba8fafca00b70c08d275a4772104d712']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6501d-3f38-41c7-a586-4ecb950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:33.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:33.000Z",
|
|
|
|
|
"description": "Automatically added (via f467c72fa8adde6ddf27150122c117a17d1d664876c2f9d87e68e06257eb1904)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '18c49ca0565d782192e04b38212c9e3c15c62b59']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:33Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6501f-2b64-4a7e-b068-5ca1950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:35.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:35.000Z",
|
|
|
|
|
"description": "Automatically added (via 58b48fd39ef718e5bd501f57e83b537668b13176ca682aee36402d18bd0c0733)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'f4b2ef935d02a87939b125e5d4ac743d2ac7c892']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:35Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65022-666c-42d5-b48e-4470950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:38.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:38.000Z",
|
|
|
|
|
"description": "Automatically added (via 9b6595980751537adf627e6107c08537de13e39752ed54c73e2b6af23e2a2769)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '1926f1727c717a1f3c95d56683f9452dc0c1a73f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65024-36ac-43ec-870d-59a4950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:40.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:40.000Z",
|
|
|
|
|
"description": "Automatically added (via db06c1914c82b52c9f2ee6ddffb13acde22d2227d626c41c35c163266b11d29c)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '3ad017646961072db944b4c7a72e9f96beb88af2']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65027-33a0-42dc-9ef0-c654950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:43.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:43.000Z",
|
|
|
|
|
"description": "Automatically added (via 177d9e42c4e2dfc3641cdc1f92815600c861501f5c880f5ab9cb642feb9b94bd)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '82dcbfad84e9e1327405abc0c8ebc4603ff0eb99']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:43Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65028-2628-425c-8d1a-4b31950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:44.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:44.000Z",
|
|
|
|
|
"description": "Automatically added (via 390ef820779cd7461792f0aa4fc324cb06e1226e551a158cb87ca4db05358ef3)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '00fd2f2964a92158ea5992d43d1c9a6f93ca81e2']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:44Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6502a-dc50-447e-b945-5f51950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:46.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:46.000Z",
|
|
|
|
|
"description": "Automatically added (via 3fbdfcf1eae14daa7b2fa6b7d3fa7cf602cd6ff178483c9019e3bb0aa2bb902c)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '1ad9d3e5f77e43f4339688a750f50649417cf985']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:46Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6502c-b52c-4089-a6d7-59a2950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:48.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:48.000Z",
|
|
|
|
|
"description": "Automatically added (via 62b10dc88df96e2d3d9cf5521a8d8372d6228fc82587bdee7f0de3c1c1d5a8bd)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '772d8fa0a1ead40828453a6f8ceae3852405dd22']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:48Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6502e-6824-4858-b3eb-c653950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:50.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:50.000Z",
|
|
|
|
|
"description": "Automatically added (via 6e8287bb8909baa65e5c00b853b4f66844e5cf3d7a5f8b707997c02395b93505)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '2d05aaad88fd05e3fa37d340391258e272835784']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:50Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6502f-df5c-46fe-bf24-c652950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:51.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:51.000Z",
|
|
|
|
|
"description": "Automatically added (via 8c66812d657027f537aa43f406182ba39e9baf3785f067ade003f96397b11ec0)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '7949692e6152c64f4739609094f409ca545ea4e7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:51Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65031-2a8c-485b-b063-599e950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:53.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:53.000Z",
|
|
|
|
|
"description": "Automatically added (via a1bf0e5277f6fc962be778f182971eb4911d9c97cf27526d9e5698d514cef3c0)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'd9d1e3fd225215b02f0296496fa3f7a66830d895']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:53Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65033-7008-419c-b902-c652950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:55.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:55.000Z",
|
|
|
|
|
"description": "Automatically added (via a6eac7a3607713fbeb3b50d227f3742ea23aa21c50eeff8987bbba10138527a9)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'da96fd12386fc91946d54be8da00407bed1e8f17']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:55Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65035-8368-42f4-9571-5f51950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:57.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:57.000Z",
|
|
|
|
|
"description": "Automatically added (via b33472608ce524c2750b70c496a696ad6653b8a6ea7b474445d94cd491d255cf)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '991ab4a75a9765f2e2e3e56bbe18bdb9ad138fd1']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:57Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65036-4208-4206-b1f7-599e950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:13:58.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:13:58.000Z",
|
|
|
|
|
"description": "Automatically added (via bcc1a294bc63c3fa873f364bab0a7aa368d85726346106422013c270d55fec3c)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '5527fa20aadd94dc8afebcd815d55cb65d88e4c3']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:13:58Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65038-df40-4e7d-a2c7-c653950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:00.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:00.000Z",
|
|
|
|
|
"description": "Automatically added (via bd9ab35587fdb450242b7a9ee0298c04dbd2fb254065fa004cda1ad42ac5f338)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'd26eb2dc25b64c74adf1d1137c7915fea7787fd5']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:00Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6503a-0354-4142-a610-420c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:02.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:02.000Z",
|
|
|
|
|
"description": "Automatically added (via e29647c7719696bf9d4d5aa8c8f10152b5b63b6d25969db90d9634273c0353f8)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '0f9b33cfd5483fc8698b7dee6182b583d8bb6b1c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6503c-ee90-417d-bdd5-42b0950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:04.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:04.000Z",
|
|
|
|
|
"description": "Automatically added (via 05eb2ecfc731ce222ebe82f6b3428fc5aa4179f7be5f328c5447317950e2d0e7)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'fb2a4595172c21ac6d7d9a5d91e6f840c7194ed6']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:04Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6503f-d914-41e0-aeec-5ca1950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:07.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:07.000Z",
|
|
|
|
|
"description": "Automatically added (via 0d22606d24911c2128651ba0421c7c5bf7cd3eedef871c460b02b42b2417c457)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '14321dbbe6697440be2a7a3224a9ef128d0ce0b4']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:07Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65040-41f0-4c6e-8a4a-599f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:08.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:08.000Z",
|
|
|
|
|
"description": "Automatically added (via 11768a3a63458963d1d31be5c94d716b8e4f75dc1593080c2988b22cb6facaa8)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '5a20bf4731c151f5fd5a24244a042ea31d9ccb03']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:08Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65042-ab88-4da3-8af6-c653950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:10.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:10.000Z",
|
|
|
|
|
"description": "Automatically added (via 21b9b34d4a21ee538e7908727aca5d367f8d400db920187f51be2921a696421f)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'c744e05f756c5f31ada93c379757cab5d9875f8a']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:10Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65044-4bd8-4e87-9ed5-59a0950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:12.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:12.000Z",
|
|
|
|
|
"description": "Automatically added (via 2bd901a246f0b0b90ba891ee37c2ee4f7bd30d36d307b151998769fcc23fd1cb)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '8017fccde997f6db28351ae71d4790266ff3fb05']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:12Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65046-d2bc-4901-85b9-c653950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:14.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:14.000Z",
|
|
|
|
|
"description": "Automatically added (via 33fc87cc53eb867dc89e34fe7a46d33d90cab02f84299531d2e677a507ed308c)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'c775527b1fcf05fb1b09eb369bc2f3c261804af2']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6504a-c590-4ad5-81e5-c654950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:18.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:18.000Z",
|
|
|
|
|
"description": "Automatically added (via 62f9839190e2fe50439894c667b3cbe29d64c3808cc471745e3d33b61370a340)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '9e86d595a8a753b00e948f9451a5c22dbe5d4c01']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:18Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6504c-4e20-4f9d-93f9-599e950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:20.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:20.000Z",
|
|
|
|
|
"description": "Automatically added (via 694c01c9ade6258596cfafa6247da71712b2c3273bfc25ad26cb47302b8bbf4d)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'bf7feeae495ca459aa9c4422f43940230970c48b']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:20Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6504e-3f1c-4309-8be6-59a3950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:22.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:22.000Z",
|
|
|
|
|
"description": "Automatically added (via 74f22eced680ca26b767b4b07ba26b98536a385249d751586915b15b56509e0d)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '6bdbf1878428856438f14631f240753a78a45583']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:22Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65050-b9b8-4681-921e-4f8b950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:24.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:24.000Z",
|
|
|
|
|
"description": "Automatically added (via 81cc84f29a4c444724cbbfab83185866ecebc68c9c0a37f9623a4954456c4dd1)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'b6962a46717492e2895f2bcab70e75665fa58c5b']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:24Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65052-72f0-46e6-a8ea-59a0950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:26.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:26.000Z",
|
|
|
|
|
"description": "Automatically added (via a185dca4bd3b08bdafa80d53eec7ba792fb94b83785210049ba85477ce7c8cda)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '631361efd2e1c58828d422578b54f5b7e16b71ef']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:26Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65054-2150-4ab6-9586-599d950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:28.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:28.000Z",
|
|
|
|
|
"description": "Automatically added (via a36e2b88b2440aff13bf0473a19e4cd7b7d19e8bc96bb2fd10b991c33e18be7c)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '1672c6ca21318faa2faee18edde291ba2ac5df68']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:28Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65055-7b0c-4673-98ee-59a0950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:29.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:29.000Z",
|
|
|
|
|
"description": "Automatically added (via aab2cf709d095d949f662c40e9f889a8f3efa130102fc571f56a84205fdc67cb)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'e654d26a6dd5ddd59cf5238d20d5da58d72abf28']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:29Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65057-8f58-4e3e-b448-599d950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:31.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:31.000Z",
|
|
|
|
|
"description": "Automatically added (via b009a87d8de4fae3395a06b2676c483a80b10ca12c5bbc093aa71ea504a77dc7)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '380ad1516bd1a060ffb13ff85bc6b322abdf4133']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6505a-a078-4fe6-a62d-59a2950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:34.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:34.000Z",
|
|
|
|
|
"description": "Automatically added (via bb3eefa723221e2aa27c4f56f61418319ccda41b70e9e4b0375bf3bb131e974b)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '2d1f79d9eefedec0d447f0595945cbc00269fae7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:34Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6505c-8c84-46e6-874b-4119950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:36.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:36.000Z",
|
|
|
|
|
"description": "Automatically added (via d09a773dab9a20e6b39176e9cf76ac6863fe388d69367407c317c71652c84b9e)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '774ff8f5ebbde5258cb3c33666a8d1fd11369eae']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:36Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c6505e-10d0-4855-83d4-c654950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:38.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:38.000Z",
|
|
|
|
|
"description": "Automatically added (via dad8cf7474c71db1512e637db780f4650d30b040903d7a76840a1c099b9b8650)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '2f748931518fd03acfb6fd5a7a89b0a1d766ed61']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65060-cec0-4989-a67d-c653950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:39.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:39.000Z",
|
|
|
|
|
"description": "Automatically added (via e91216df556bee622e4eab8551fe534cda8f2f1056b8d8442f088a4035815dfe)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '43f6bd94fcd17e528f4756b802fa353476462427']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:39Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65061-da48-40f7-bcfe-4e85950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:14:41.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:14:41.000Z",
|
|
|
|
|
"description": "Automatically added (via 09be9911eedb9b01d8f544252fb0c74f2dadcf850f33a0b947eac740de8c2427)",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '9a16b1917700f81a60a90e2d4bc710cad7d298d2']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:14:41Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fc8-fb34-4428-87f5-c654950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:08.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:08.000Z",
|
|
|
|
|
"description": "Automatically added (via 77f590608eadcbbcc07de8d26607611f)",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '58dc3eb8b4bfa32dee5ecaf825b8afc177ccfb2fe141168b8280252c50cfb328']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:08Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fca-a148-4b34-94e5-4de3950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:10.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:10.000Z",
|
|
|
|
|
"description": "Automatically added (via 6d63f1c6962f290156c6459d1158a715)",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '0daa42e9b199352de8a35f2973228356f0bfd605f29624903ad494daa14c9554']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:10Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fcc-5cbc-4c40-8bfb-5f51950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:12.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:12.000Z",
|
|
|
|
|
"description": "Automatically added (via ccaac14d265915f4fdc6229ec6c9e854)",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '47adfb751807fe3313aa8ac3ade27d3ac47a6ec4aa3f74e5a48e7faac3df21ee']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:12Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fcf-50a8-4af0-a30c-c653950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:15.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:15.000Z",
|
|
|
|
|
"description": "Automatically added (via b9b763980e33e390480c4a0d7c63adec)",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'de3a6982408bda4c0ef14295eda04fdb4229f0562e5ca0aab8e990a8450308ff']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:15Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fd3-f500-408a-af47-599c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:19.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:19.000Z",
|
|
|
|
|
"description": "Automatically added (via d8209defc3966076737401d0a22d27d3)",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '0f89c049dc252f702f1566caec9a8453229610e274a657ab19b2cde8d8397e9a']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:19Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fd4-5f1c-427c-b8ee-c651950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:20.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:20.000Z",
|
|
|
|
|
"description": "Automatically added (via d57e0f5f0320f1b3fd8ae81a370170d0)",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '33200a3ae51a2be0094597155dcce24af21d8a0c024a2199aa29f54ccde303c3']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:20Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fd6-3ea0-4997-b2bc-59a4950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:22.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:22.000Z",
|
|
|
|
|
"description": "Automatically added (via 7171feeedd345a7d50091e76fc7e3ac4)",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'b4aa8fd95021995fe5612c31988f5a8acf1b0d2848eac5ed923327b230a6effb']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:22Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c64fd8-aba8-42a2-9436-59a2950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-18T23:12:24.000Z",
|
|
|
|
|
"modified": "2016-02-18T23:12:24.000Z",
|
|
|
|
|
"description": "Automatically added (via aa55cb19c3a61c0177e75198c70d6fa3)",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'c3a3919518121ca4a06ffc59c884fae6f69cac9f72e43883a110e7a7521fa10f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-18T23:12:24Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "marking-definition",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da",
|
|
|
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
|
|
|
"definition_type": "tlp",
|
|
|
|
|
"name": "TLP:GREEN",
|
|
|
|
|
"definition": {
|
|
|
|
|
"tlp": "green"
|
|
|
|
|
}
|
|
|
|
|
}
|
2023-04-21 13:25:09 +00:00
|
|
|
]
|
|
|
|
|
}
|
