2023-04-21 13:25:09 +00:00
|
|
|
{
|
2023-06-14 17:31:25 +00:00
|
|
|
"type": "bundle",
|
|
|
|
|
"id": "bundle--553eb3d4-f9d8-4e67-8327-af9d950d210b",
|
|
|
|
|
"objects": [
|
|
|
|
|
{
|
|
|
|
|
"type": "identity",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-04-27T22:11:18.000Z",
|
|
|
|
|
"modified": "2015-04-27T22:11:18.000Z",
|
|
|
|
|
"name": "CthulhuSPRL.be",
|
|
|
|
|
"identity_class": "organization"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "report",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "report--553eb3d4-f9d8-4e67-8327-af9d950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-04-27T22:11:18.000Z",
|
|
|
|
|
"modified": "2015-04-27T22:11:18.000Z",
|
|
|
|
|
"name": "OSINT Without a Trace: Fileless Malware Spotted in the Wild by Trend Micro",
|
|
|
|
|
"published": "2016-03-01T22:15:50Z",
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"observed-data--553eb3e6-13ec-4c6d-a118-cae7950d210b",
|
|
|
|
|
"url--553eb3e6-13ec-4c6d-a118-cae7950d210b",
|
|
|
|
|
"indicator--553eb406-77e0-46ab-863d-7df5950d210b",
|
|
|
|
|
"indicator--553eb406-17fc-4bae-a40b-7df5950d210b",
|
|
|
|
|
"indicator--553eb406-debc-4f67-ae87-7df5950d210b",
|
|
|
|
|
"indicator--553eb406-d7a4-4ea5-8c4d-7df5950d210b",
|
|
|
|
|
"indicator--553eb406-00d8-480a-8205-7df5950d210b",
|
|
|
|
|
"indicator--553eb406-6994-4367-abee-7df5950d210b",
|
|
|
|
|
"indicator--553eb407-bb68-4d14-a099-7df5950d210b",
|
|
|
|
|
"indicator--553eb407-dae4-4542-a7cb-7df5950d210b",
|
|
|
|
|
"indicator--553eb407-b108-43be-9016-7df5950d210b",
|
|
|
|
|
"indicator--553eb407-93ac-4b14-ae5d-7df5950d210b",
|
|
|
|
|
"indicator--553eb407-0818-4265-9e28-7df5950d210b",
|
|
|
|
|
"indicator--553eb407-12a0-42b5-8e16-7df5950d210b",
|
|
|
|
|
"indicator--553eb407-9690-46c8-9788-7df5950d210b",
|
|
|
|
|
"indicator--553eb407-f17c-41ef-9f43-7df5950d210b",
|
|
|
|
|
"indicator--553eb408-6054-478a-ab4b-7df5950d210b",
|
|
|
|
|
"indicator--553eb408-9e6c-4716-85ae-7df5950d210b",
|
|
|
|
|
"indicator--553eb408-7348-492a-8567-7df5950d210b",
|
|
|
|
|
"indicator--553eb408-28e0-4815-b42e-7df5950d210b",
|
|
|
|
|
"indicator--553eb408-fa28-45b2-9c65-7df5950d210b",
|
|
|
|
|
"indicator--553eb408-78bc-4e1e-9dd8-7df5950d210b",
|
|
|
|
|
"indicator--553eb408-af38-4204-a662-7df5950d210b",
|
|
|
|
|
"indicator--553eb408-2d58-4a5c-803e-7df5950d210b",
|
|
|
|
|
"indicator--56c65ba4-4898-4703-807c-c650950d210f",
|
|
|
|
|
"indicator--56c65ba6-e5ec-4242-b2d7-c651950d210f",
|
|
|
|
|
"indicator--56c65ba7-4d6c-4571-905e-461a950d210f",
|
|
|
|
|
"indicator--56c65ba9-1248-463a-b2d0-59a1950d210f",
|
|
|
|
|
"indicator--56c65bab-f408-4e63-8fdb-599c950d210f",
|
|
|
|
|
"indicator--56c65bad-af80-4b2d-aabc-c654950d210f",
|
|
|
|
|
"indicator--56c65baf-7b50-430f-bf13-59a2950d210f",
|
|
|
|
|
"indicator--56c65bb1-59c8-4a31-9975-c651950d210f",
|
|
|
|
|
"indicator--56c65bb2-a18c-42a9-9495-599f950d210f",
|
|
|
|
|
"indicator--56c65bb4-b698-44ed-9c77-59a4950d210f",
|
|
|
|
|
"indicator--56c65bb6-8e04-4401-9456-c653950d210f",
|
|
|
|
|
"indicator--56c65bb7-340c-4323-9676-5f51950d210f",
|
|
|
|
|
"indicator--56c65bb9-2bf4-48ba-ad9f-5ca1950d210f",
|
|
|
|
|
"indicator--56c65bba-6c30-4f16-954f-c650950d210f",
|
|
|
|
|
"indicator--56c65bbc-a1b4-4199-af4d-59a0950d210f",
|
|
|
|
|
"indicator--56c65bbe-05e8-4ddf-b7f5-c652950d210f",
|
|
|
|
|
"indicator--56c65bbf-124c-452c-bbdd-4a9d950d210f",
|
|
|
|
|
"indicator--56c65bc1-047c-419a-a5d9-c653950d210f",
|
|
|
|
|
"indicator--56c65bc3-5344-45db-9aa9-5f51950d210f",
|
|
|
|
|
"indicator--56c65bc4-4024-4adb-8dff-466b950d210f",
|
|
|
|
|
"indicator--56c65bc6-f9b0-493c-be1a-599e950d210f",
|
|
|
|
|
"indicator--56c65ba5-a8f0-4219-a95e-599f950d210f",
|
|
|
|
|
"indicator--56c65ba6-4f9c-4d61-8dd1-428b950d210f",
|
|
|
|
|
"indicator--56c65ba8-0b80-4a25-a470-5ca1950d210f",
|
|
|
|
|
"indicator--56c65baa-76d8-4637-8d39-c652950d210f",
|
|
|
|
|
"indicator--56c65bac-f654-46fe-8046-430a950d210f",
|
|
|
|
|
"indicator--56c65bae-77b0-4d65-ae96-409a950d210f",
|
|
|
|
|
"indicator--56c65bb0-c954-406e-b57a-5ca1950d210f",
|
|
|
|
|
"indicator--56c65bb1-c618-47d7-b683-c652950d210f",
|
|
|
|
|
"indicator--56c65bb3-de0c-4e20-a1cc-4094950d210f",
|
|
|
|
|
"indicator--56c65bb5-da60-4022-aed1-59a2950d210f",
|
|
|
|
|
"indicator--56c65bb6-4128-4c4d-8ae7-59a0950d210f",
|
|
|
|
|
"indicator--56c65bb8-abf0-4288-9f94-c651950d210f",
|
|
|
|
|
"indicator--56c65bb9-405c-449c-9d4c-59a1950d210f",
|
|
|
|
|
"indicator--56c65bbb-f3d4-48ce-9952-c653950d210f",
|
|
|
|
|
"indicator--56c65bbd-79a0-4fab-a614-599c950d210f",
|
|
|
|
|
"indicator--56c65bbe-ae9c-4eaa-a7f6-4b02950d210f",
|
|
|
|
|
"indicator--56c65bc0-a144-4e0f-8243-59a4950d210f",
|
|
|
|
|
"indicator--56c65bc2-a11c-4f2f-a95c-59a2950d210f",
|
|
|
|
|
"indicator--56c65bc3-4ff4-4e69-a1f9-59a4950d210f",
|
|
|
|
|
"indicator--56c65bc5-aad4-4d75-b616-499c950d210f",
|
|
|
|
|
"indicator--56c65bc7-5e7c-420a-bb8c-4dc3950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"Threat-Report",
|
|
|
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
|
|
|
"type:OSINT"
|
|
|
|
|
],
|
|
|
|
|
"object_marking_refs": [
|
|
|
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--553eb3e6-13ec-4c6d-a118-cae7950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-04-27T22:10:46.000Z",
|
|
|
|
|
"modified": "2015-04-27T22:10:46.000Z",
|
|
|
|
|
"first_observed": "2015-04-27T22:10:46Z",
|
|
|
|
|
"last_observed": "2015-04-27T22:10:46Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--553eb3e6-13ec-4c6d-a118-cae7950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--553eb3e6-13ec-4c6d-a118-cae7950d210b",
|
|
|
|
|
"value": "http://blog.trendmicro.com/trendlabs-security-intelligence/without-a-trace-fileless-malware-spotted-in-the-wild/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--553eb406-77e0-46ab-863d-7df5950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-04-27T22:11:18.000Z",
|
|
|
|
|
"modified": "2015-04-27T22:11:18.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '100d0d0286b536951af410116ec9de7bcb27bd8a']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-04-27T22:11:18Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--553eb406-17fc-4bae-a40b-7df5950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-04-27T22:11:18.000Z",
|
|
|
|
|
"modified": "2015-04-27T22:11:18.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '181a018652de15b862df4ccac4189ced00a4a35e']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-04-27T22:11:18Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--553eb406-debc-4f67-ae87-7df5950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-04-27T22:11:18.000Z",
|
|
|
|
|
"modified": "2015-04-27T22:11:18.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '291528630bc5e69a0ea5ab23cd56c13da1780a22']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-04-27T22:11:18Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--553eb406-d7a4-4ea5-8c4d-7df5950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-04-27T22:11:18.000Z",
|
|
|
|
|
"modified": "2015-04-27T22:11:18.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '3a9ebe71b21209335d094385f8845ec745a12177']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-04-27T22:11:18Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--553eb406-00d8-480a-8205-7df5950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-04-27T22:11:18.000Z",
|
|
|
|
|
"modified": "2015-04-27T22:11:18.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '3cec86976816e62f978572f22dd6692efda6e574']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-04-27T22:11:18Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--553eb406-6994-4367-abee-7df5950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-04-27T22:11:18.000Z",
|
|
|
|
|
"modified": "2015-04-27T22:11:18.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '46d47ba7ad687527392304813a1ca68669ecfb5e']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-04-27T22:11:18Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--553eb407-bb68-4d14-a099-7df5950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-04-27T22:11:19.000Z",
|
|
|
|
|
"modified": "2015-04-27T22:11:19.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '475a182e7ca538a697f76ff8031c2407e1f98824']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-04-27T22:11:19Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--553eb407-dae4-4542-a7cb-7df5950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-04-27T22:11:19.000Z",
|
|
|
|
|
"modified": "2015-04-27T22:11:19.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '4791067a88333f4b9ad67449152f168a29b4a684']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-04-27T22:11:19Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--553eb407-b108-43be-9016-7df5950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-04-27T22:11:19.000Z",
|
|
|
|
|
"modified": "2015-04-27T22:11:19.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '52efb07af3a1c05d777000c8af2e2f71ae983041']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-04-27T22:11:19Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--553eb407-93ac-4b14-ae5d-7df5950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-04-27T22:11:19.000Z",
|
|
|
|
|
"modified": "2015-04-27T22:11:19.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '592ac60ee3c3f34d7e77f3ff25a9216c461db169']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-04-27T22:11:19Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--553eb407-0818-4265-9e28-7df5950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-04-27T22:11:19.000Z",
|
|
|
|
|
"modified": "2015-04-27T22:11:19.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '6c6c443afc7b3d385aded4a75df680a62e9f6232']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-04-27T22:11:19Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--553eb407-12a0-42b5-8e16-7df5950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-04-27T22:11:19.000Z",
|
|
|
|
|
"modified": "2015-04-27T22:11:19.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '6cb74b4e309d80efbe674d3d48376ee1f7e2edda']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-04-27T22:11:19Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--553eb407-9690-46c8-9788-7df5950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-04-27T22:11:19.000Z",
|
|
|
|
|
"modified": "2015-04-27T22:11:19.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '76f934e162405ac4c39bcac2af998b00eaaee756']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-04-27T22:11:19Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--553eb407-f17c-41ef-9f43-7df5950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-04-27T22:11:19.000Z",
|
|
|
|
|
"modified": "2015-04-27T22:11:19.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '7b5eec8c1e3f08f3a54477a6a81b6bd5e8aa53b2']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-04-27T22:11:19Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--553eb408-6054-478a-ab4b-7df5950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-04-27T22:11:20.000Z",
|
|
|
|
|
"modified": "2015-04-27T22:11:20.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '891989a3b78a52da247c8e2c33e88760c16b9113']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-04-27T22:11:20Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--553eb408-9e6c-4716-85ae-7df5950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-04-27T22:11:20.000Z",
|
|
|
|
|
"modified": "2015-04-27T22:11:20.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '8d54c588b1f199fcef28c4d6eba3c88421476565']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-04-27T22:11:20Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--553eb408-7348-492a-8567-7df5950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-04-27T22:11:20.000Z",
|
|
|
|
|
"modified": "2015-04-27T22:11:20.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'b57288f641cc5f25d74ff45c06a5ff0e1114e627']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-04-27T22:11:20Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--553eb408-28e0-4815-b42e-7df5950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-04-27T22:11:20.000Z",
|
|
|
|
|
"modified": "2015-04-27T22:11:20.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'bdc2d54e765802dc093a9ec37d53299f800b0b18']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-04-27T22:11:20Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--553eb408-fa28-45b2-9c65-7df5950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-04-27T22:11:20.000Z",
|
|
|
|
|
"modified": "2015-04-27T22:11:20.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'c184bbecee796cbf6f1f200ca37108aaf4397368']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-04-27T22:11:20Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--553eb408-78bc-4e1e-9dd8-7df5950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-04-27T22:11:20.000Z",
|
|
|
|
|
"modified": "2015-04-27T22:11:20.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'c4d2f6de337dc64be5fd5e09480ac4d6096ee5ed']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-04-27T22:11:20Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--553eb408-af38-4204-a662-7df5950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-04-27T22:11:20.000Z",
|
|
|
|
|
"modified": "2015-04-27T22:11:20.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'd9a0f101bddb7e46e4dcff75ab93a8266b91a618']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-04-27T22:11:20Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--553eb408-2d58-4a5c-803e-7df5950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-04-27T22:11:20.000Z",
|
|
|
|
|
"modified": "2015-04-27T22:11:20.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'fe77578097fb5532a0702cae67a199a73480a218']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-04-27T22:11:20Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65ba4-4898-4703-807c-c650950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:02:44.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:02:44.000Z",
|
|
|
|
|
"description": "Automatically added (via 100d0d0286b536951af410116ec9de7bcb27bd8a)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'ef69575e14fa965380242db26675d2df']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:02:44Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65ba6-e5ec-4242-b2d7-c651950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:02:46.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:02:46.000Z",
|
|
|
|
|
"description": "Automatically added (via 181a018652de15b862df4ccac4189ced00a4a35e)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '19fa3927577571c51428f6eee2b5f52f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:02:46Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65ba7-4d6c-4571-905e-461a950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:02:47.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:02:47.000Z",
|
|
|
|
|
"description": "Automatically added (via 291528630bc5e69a0ea5ab23cd56c13da1780a22)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '12dccdec47928e5298055996415a94f2']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:02:47Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65ba9-1248-463a-b2d0-59a1950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:02:49.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:02:49.000Z",
|
|
|
|
|
"description": "Automatically added (via 3a9ebe71b21209335d094385f8845ec745a12177)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '4ec84f1aa91e4cdc12118002244ca582']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:02:49Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65bab-f408-4e63-8fdb-599c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:02:51.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:02:51.000Z",
|
|
|
|
|
"description": "Automatically added (via 3cec86976816e62f978572f22dd6692efda6e574)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'fe5dfa53204a65eca741ceab352c3b00']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:02:51Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65bad-af80-4b2d-aabc-c654950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:02:53.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:02:53.000Z",
|
|
|
|
|
"description": "Automatically added (via 46d47ba7ad687527392304813a1ca68669ecfb5e)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'f89b4e626c7a81544ca7395be3262cf6']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:02:53Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65baf-7b50-430f-bf13-59a2950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:02:55.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:02:55.000Z",
|
|
|
|
|
"description": "Automatically added (via 4791067a88333f4b9ad67449152f168a29b4a684)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '04a03d1329efa04a3e60a04ddadf9715']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:02:55Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65bb1-59c8-4a31-9975-c651950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:02:57.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:02:57.000Z",
|
|
|
|
|
"description": "Automatically added (via 52efb07af3a1c05d777000c8af2e2f71ae983041)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'd1446326bf1c69ea9df6e65bd472f358']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:02:57Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65bb2-a18c-42a9-9495-599f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:02:58.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:02:58.000Z",
|
|
|
|
|
"description": "Automatically added (via 592ac60ee3c3f34d7e77f3ff25a9216c461db169)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'f01c1ea73e968c2309391dcf3f0a2848']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:02:58Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65bb4-b698-44ed-9c77-59a4950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:03:00.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:03:00.000Z",
|
|
|
|
|
"description": "Automatically added (via 6c6c443afc7b3d385aded4a75df680a62e9f6232)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'f8ffcab3324561598ce5c375c07066be']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:03:00Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65bb6-8e04-4401-9456-c653950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:03:02.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:03:02.000Z",
|
|
|
|
|
"description": "Automatically added (via 6cb74b4e309d80efbe674d3d48376ee1f7e2edda)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '5767b9bf9cb6f2b5259f29dd8b873e36']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:03:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65bb7-340c-4323-9676-5f51950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:03:03.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:03:03.000Z",
|
|
|
|
|
"description": "Automatically added (via 76f934e162405ac4c39bcac2af998b00eaaee756)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'ace0a059dc2264c847d4e6c91f829dfd']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:03:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65bb9-2bf4-48ba-ad9f-5ca1950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:03:05.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:03:05.000Z",
|
|
|
|
|
"description": "Automatically added (via 7b5eec8c1e3f08f3a54477a6a81b6bd5e8aa53b2)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'd2ed20b1996e7e5bad2b91fd255732ef']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:03:05Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65bba-6c30-4f16-954f-c650950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:03:06.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:03:06.000Z",
|
|
|
|
|
"description": "Automatically added (via 891989a3b78a52da247c8e2c33e88760c16b9113)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'e4574fbc1014d27e1b6906bfc5351e0e']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:03:06Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65bbc-a1b4-4199-af4d-59a0950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:03:08.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:03:08.000Z",
|
|
|
|
|
"description": "Automatically added (via 8d54c588b1f199fcef28c4d6eba3c88421476565)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '6f53d3cd1acb7541bcc7399c4af001b1']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:03:08Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65bbe-05e8-4ddf-b7f5-c652950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:03:10.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:03:10.000Z",
|
|
|
|
|
"description": "Automatically added (via b57288f641cc5f25d74ff45c06a5ff0e1114e627)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'a10f84153dba7b73980f0ff50d8cc8e6']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:03:10Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65bbf-124c-452c-bbdd-4a9d950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:03:11.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:03:11.000Z",
|
|
|
|
|
"description": "Automatically added (via bdc2d54e765802dc093a9ec37d53299f800b0b18)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '6ce0bb4cd86295f915160d7207a07a47']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:03:11Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65bc1-047c-419a-a5d9-c653950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:03:13.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:03:13.000Z",
|
|
|
|
|
"description": "Automatically added (via c184bbecee796cbf6f1f200ca37108aaf4397368)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'fc586c3ec37e51668e905d0acfc913f6']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:03:13Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65bc3-5344-45db-9aa9-5f51950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:03:15.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:03:15.000Z",
|
|
|
|
|
"description": "Automatically added (via c4d2f6de337dc64be5fd5e09480ac4d6096ee5ed)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '20e3a9ec396ad8b57a36ea3c6b9f151a']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:03:15Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65bc4-4024-4adb-8dff-466b950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:03:16.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:03:16.000Z",
|
|
|
|
|
"description": "Automatically added (via d9a0f101bddb7e46e4dcff75ab93a8266b91a618)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'eb9b56d829c3951b6e9cb5e4a651f7c8']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:03:16Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65bc6-f9b0-493c-be1a-599e950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:03:18.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:03:18.000Z",
|
|
|
|
|
"description": "Automatically added (via fe77578097fb5532a0702cae67a199a73480a218)",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '1f3e808a3ccd981f3e61de227dae93b8']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:03:18Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65ba5-a8f0-4219-a95e-599f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:02:45.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:02:45.000Z",
|
|
|
|
|
"description": "Automatically added (via 100d0d0286b536951af410116ec9de7bcb27bd8a)",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '71e2478442a51b1bdaf07665b6525186fdba67c46228dfda8a987189d1d4c269']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:02:45Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65ba6-4f9c-4d61-8dd1-428b950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:02:46.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:02:46.000Z",
|
|
|
|
|
"description": "Automatically added (via 181a018652de15b862df4ccac4189ced00a4a35e)",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'c75d4453f4f768f2c039092ba78b38cbc464dd587ce6cefbd51605bea33b8002']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:02:46Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65ba8-0b80-4a25-a470-5ca1950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:02:48.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:02:48.000Z",
|
|
|
|
|
"description": "Automatically added (via 291528630bc5e69a0ea5ab23cd56c13da1780a22)",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'eb6e735000f44def5ae179d86532b01a278c5bf4eff7ed26c83500170df5f0fd']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:02:48Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65baa-76d8-4637-8d39-c652950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:02:50.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:02:50.000Z",
|
|
|
|
|
"description": "Automatically added (via 3a9ebe71b21209335d094385f8845ec745a12177)",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '059ce2e9e3ff532b7d766173bed8572c7d8ca46d65e43dbe8eb1ce33c0a397e3']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:02:50Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65bac-f654-46fe-8046-430a950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:02:52.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:02:52.000Z",
|
|
|
|
|
"description": "Automatically added (via 3cec86976816e62f978572f22dd6692efda6e574)",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'b273387f74ff6865aa2e4b742daa0f4adeac92d377cc70d6d8365475875b1d4d']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:02:52Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65bae-77b0-4d65-ae96-409a950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:02:54.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:02:54.000Z",
|
|
|
|
|
"description": "Automatically added (via 46d47ba7ad687527392304813a1ca68669ecfb5e)",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '3362258e807565a784e20fc846fb74d9e6aff1878ca8fac85d99cc9159f740bd']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:02:54Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65bb0-c954-406e-b57a-5ca1950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:02:56.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:02:56.000Z",
|
|
|
|
|
"description": "Automatically added (via 4791067a88333f4b9ad67449152f168a29b4a684)",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '658c180654ebfe962c0032a71a8f2b7849ae010599dd3048d24de8f5ff36f06a']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:02:56Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65bb1-c618-47d7-b683-c652950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:02:57.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:02:57.000Z",
|
|
|
|
|
"description": "Automatically added (via 52efb07af3a1c05d777000c8af2e2f71ae983041)",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '1e628c36d22a9b8e493901bb6c5e17acb1bfcf0dea65f4012c39e6f9bc827a9c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:02:57Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65bb3-de0c-4e20-a1cc-4094950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:02:59.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:02:59.000Z",
|
|
|
|
|
"description": "Automatically added (via 592ac60ee3c3f34d7e77f3ff25a9216c461db169)",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'a758cbd3118b898a3d216b2a64629079b5dc83310c8f07dce2a0c2182308a438']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:02:59Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65bb5-da60-4022-aed1-59a2950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:03:01.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:03:01.000Z",
|
|
|
|
|
"description": "Automatically added (via 6c6c443afc7b3d385aded4a75df680a62e9f6232)",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'f9d714a9ad9f99b5774bb79441abb491c6a7a4cd64ffe61b2fc460df853ce9ba']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:03:01Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65bb6-4128-4c4d-8ae7-59a0950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:03:02.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:03:02.000Z",
|
|
|
|
|
"description": "Automatically added (via 6cb74b4e309d80efbe674d3d48376ee1f7e2edda)",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '3a9f8f9dc215be8bc8d278ab99f5e6bdac2d1732d4a3b536d55696dfe766491a']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:03:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65bb8-abf0-4288-9f94-c651950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:03:04.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:03:04.000Z",
|
|
|
|
|
"description": "Automatically added (via 76f934e162405ac4c39bcac2af998b00eaaee756)",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '900ca1cc2c4d1117cba0bd9c5dbf6de2a993762163787126348d3e97cc54e720']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:03:04Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65bb9-405c-449c-9d4c-59a1950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:03:05.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:03:05.000Z",
|
|
|
|
|
"description": "Automatically added (via 7b5eec8c1e3f08f3a54477a6a81b6bd5e8aa53b2)",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '6efbe4524b39a2eb9a940cc2ebfe4bdf4909387f1cf0309d23a4249db89aca72']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:03:05Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65bbb-f3d4-48ce-9952-c653950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:03:07.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:03:07.000Z",
|
|
|
|
|
"description": "Automatically added (via 891989a3b78a52da247c8e2c33e88760c16b9113)",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'a2561ffdbe889e8ef431e0d69dde985e10fc9de8f2bdf7f7c9aac23a96d48e7d']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:03:07Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65bbd-79a0-4fab-a614-599c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:03:09.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:03:09.000Z",
|
|
|
|
|
"description": "Automatically added (via 8d54c588b1f199fcef28c4d6eba3c88421476565)",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '5a901f634e5e54be021485213b09ad58f031531bef97e803a37fa7ced37207fc']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:03:09Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65bbe-ae9c-4eaa-a7f6-4b02950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:03:10.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:03:10.000Z",
|
|
|
|
|
"description": "Automatically added (via b57288f641cc5f25d74ff45c06a5ff0e1114e627)",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'c805f5acb3b21ee1777be1ee6e04886395b62a414587ef86100a5a73b1b85607']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:03:10Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65bc0-a144-4e0f-8243-59a4950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:03:12.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:03:12.000Z",
|
|
|
|
|
"description": "Automatically added (via bdc2d54e765802dc093a9ec37d53299f800b0b18)",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'a128df4c7bd7c404fc4342cb988c4c2d0a421aa727f9b7e642c950632520d3f6']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:03:12Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65bc2-a11c-4f2f-a95c-59a2950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:03:14.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:03:14.000Z",
|
|
|
|
|
"description": "Automatically added (via c184bbecee796cbf6f1f200ca37108aaf4397368)",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '73df0b8a0c492096127761facae6cffe4b9cac8ce93eeb3d430e4a1f6e4643e7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:03:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65bc3-4ff4-4e69-a1f9-59a4950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:03:15.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:03:15.000Z",
|
|
|
|
|
"description": "Automatically added (via c4d2f6de337dc64be5fd5e09480ac4d6096ee5ed)",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'c85cb0fb52baaa97e0e954acf5bfd018adfd37b06ff41d934eb5a04d1b40d499']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:03:15Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65bc5-aad4-4d75-b616-499c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:03:17.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:03:17.000Z",
|
|
|
|
|
"description": "Automatically added (via d9a0f101bddb7e46e4dcff75ab93a8266b91a618)",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'a300b7e82600d3d8b985855f116689daee44ec1c56951eefc50767b84419ecfc']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:03:17Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56c65bc7-5e7c-420a-bb8c-4dc3950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-02-19T00:03:19.000Z",
|
|
|
|
|
"modified": "2016-02-19T00:03:19.000Z",
|
|
|
|
|
"description": "Automatically added (via fe77578097fb5532a0702cae67a199a73480a218)",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'a82135cffb59ac8082628212e26ce154ec8e9e1331b2f7904a0afb6977be3395']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-19T00:03:19Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "marking-definition",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
|
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
|
|
|
"definition_type": "tlp",
|
|
|
|
|
"name": "TLP:WHITE",
|
|
|
|
|
"definition": {
|
|
|
|
|
"tlp": "white"
|
|
|
|
|
}
|
|
|
|
|
}
|
2023-04-21 13:25:09 +00:00
|
|
|
]
|
|
|
|
|
}
|
