2023-04-21 13:25:09 +00:00
|
|
|
{
|
2023-06-14 17:31:25 +00:00
|
|
|
"type": "bundle",
|
|
|
|
|
"id": "bundle--56bf399d-c46c-4fdb-a9cf-d9bb02de0b81",
|
|
|
|
|
"objects": [
|
|
|
|
|
{
|
|
|
|
|
"type": "identity",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:40.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:40.000Z",
|
|
|
|
|
"name": "CIRCL",
|
|
|
|
|
"identity_class": "organization"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "report",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "report--56bf399d-c46c-4fdb-a9cf-d9bb02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:40.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:40.000Z",
|
|
|
|
|
"name": "OSINT - Hunting for Malware with Machine Learning",
|
|
|
|
|
"published": "2016-02-13T14:21:54Z",
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"observed-data--56bf39c9-c078-4368-9555-6cf802de0b81",
|
|
|
|
|
"url--56bf39c9-c078-4368-9555-6cf802de0b81",
|
|
|
|
|
"indicator--56bf3a11-9f9c-4e98-b974-6cef02de0b81",
|
|
|
|
|
"indicator--56bf3a12-667c-4b13-a5a2-6cef02de0b81",
|
|
|
|
|
"indicator--56bf3a12-ddbc-4e29-a14e-6cef02de0b81",
|
|
|
|
|
"indicator--56bf3a12-9adc-4c07-9732-6cef02de0b81",
|
|
|
|
|
"indicator--56bf3a13-756c-4125-af3b-6cef02de0b81",
|
|
|
|
|
"indicator--56bf3a13-7994-4cf0-9818-6cef02de0b81",
|
|
|
|
|
"indicator--56bf3a13-207c-46b4-b8fe-6cef02de0b81",
|
|
|
|
|
"indicator--56bf3a14-f47c-4c01-b41a-6cef02de0b81",
|
|
|
|
|
"indicator--56bf3a14-642c-4118-8505-6cef02de0b81",
|
|
|
|
|
"indicator--56bf3a14-9008-44c7-a84b-6cef02de0b81",
|
|
|
|
|
"indicator--56bf3a15-4588-466e-86e4-6cef02de0b81",
|
|
|
|
|
"indicator--56bf3a15-0234-46d4-aa77-6cef02de0b81",
|
|
|
|
|
"indicator--56bf3a15-f9e4-4da8-9e59-6cef02de0b81",
|
|
|
|
|
"indicator--56bf3a16-1ed0-43d6-a325-6cef02de0b81",
|
|
|
|
|
"indicator--56bf3a16-2b60-44a9-90ee-6cef02de0b81",
|
|
|
|
|
"indicator--56bf3a16-ec28-4743-b6fc-6cef02de0b81",
|
|
|
|
|
"indicator--56bf3a16-f0e8-433a-9ea8-6cef02de0b81",
|
|
|
|
|
"indicator--56bf3a17-f5b4-49b4-9e42-6cef02de0b81",
|
|
|
|
|
"indicator--56bf3a17-58c8-4bd0-a40c-6cef02de0b81",
|
|
|
|
|
"indicator--56bf3a17-3cf8-44b9-b08e-6cef02de0b81",
|
|
|
|
|
"indicator--56bf3a18-07e8-4a3c-b791-6cef02de0b81",
|
|
|
|
|
"indicator--56bf3a18-b510-4d79-9629-6cef02de0b81",
|
|
|
|
|
"indicator--56bf3a18-c530-4aec-a2bc-6cef02de0b81",
|
|
|
|
|
"indicator--56bf3a19-3a84-469a-aa67-6cef02de0b81",
|
|
|
|
|
"indicator--56bf3a19-5594-442e-a3bc-6cef02de0b81",
|
|
|
|
|
"indicator--56bf3a19-6aec-4e70-bf2d-6cef02de0b81",
|
|
|
|
|
"indicator--56bf3a1a-4e78-4265-9a91-6cef02de0b81",
|
|
|
|
|
"indicator--56bf3a1a-da00-4ff7-b6da-6cef02de0b81",
|
|
|
|
|
"indicator--56bf3a42-53e0-421f-987f-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a42-2bb8-4dfc-8ca8-6cf502de0b81",
|
|
|
|
|
"observed-data--56bf3a43-4624-4667-b38b-6cf502de0b81",
|
|
|
|
|
"url--56bf3a43-4624-4667-b38b-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a43-2408-491d-96c1-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a43-e774-49d8-9301-6cf502de0b81",
|
|
|
|
|
"observed-data--56bf3a44-ba50-41af-a102-6cf502de0b81",
|
|
|
|
|
"url--56bf3a44-ba50-41af-a102-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a44-02d0-4347-a1cb-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a44-78a4-4e4f-97b7-6cf502de0b81",
|
|
|
|
|
"observed-data--56bf3a45-e0a8-4ab8-9c23-6cf502de0b81",
|
|
|
|
|
"url--56bf3a45-e0a8-4ab8-9c23-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a45-8434-497d-9c6f-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a45-5638-400b-8429-6cf502de0b81",
|
|
|
|
|
"observed-data--56bf3a46-2694-4e6a-992b-6cf502de0b81",
|
|
|
|
|
"url--56bf3a46-2694-4e6a-992b-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a46-e1b4-4357-91b3-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a46-addc-48ad-8e53-6cf502de0b81",
|
|
|
|
|
"observed-data--56bf3a47-c528-46f7-af7e-6cf502de0b81",
|
|
|
|
|
"url--56bf3a47-c528-46f7-af7e-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a47-268c-42bd-a629-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a47-15dc-47e7-be58-6cf502de0b81",
|
|
|
|
|
"observed-data--56bf3a48-1f8c-4a32-850e-6cf502de0b81",
|
|
|
|
|
"url--56bf3a48-1f8c-4a32-850e-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a48-3198-4193-8262-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a48-9a88-4def-b1c8-6cf502de0b81",
|
|
|
|
|
"observed-data--56bf3a49-0b7c-4d8c-97ed-6cf502de0b81",
|
|
|
|
|
"url--56bf3a49-0b7c-4d8c-97ed-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a49-86f0-4adc-a3e5-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a49-4020-4dad-805c-6cf502de0b81",
|
|
|
|
|
"observed-data--56bf3a4a-9574-4268-aff8-6cf502de0b81",
|
|
|
|
|
"url--56bf3a4a-9574-4268-aff8-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a4a-4414-4690-b66e-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a4a-8ed4-408e-9db1-6cf502de0b81",
|
|
|
|
|
"observed-data--56bf3a4b-b5e4-4a99-a8b2-6cf502de0b81",
|
|
|
|
|
"url--56bf3a4b-b5e4-4a99-a8b2-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a4b-0e94-4a2a-8056-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a4b-099c-419e-ab90-6cf502de0b81",
|
|
|
|
|
"observed-data--56bf3a4c-afb0-4e7a-8f8e-6cf502de0b81",
|
|
|
|
|
"url--56bf3a4c-afb0-4e7a-8f8e-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a4c-ff74-411a-9047-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a4c-c190-444d-9eee-6cf502de0b81",
|
|
|
|
|
"observed-data--56bf3a4d-5680-4f28-a492-6cf502de0b81",
|
|
|
|
|
"url--56bf3a4d-5680-4f28-a492-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a4d-e388-4e48-9069-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a4d-11bc-455f-a3a8-6cf502de0b81",
|
|
|
|
|
"observed-data--56bf3a4e-8090-4fd2-8747-6cf502de0b81",
|
|
|
|
|
"url--56bf3a4e-8090-4fd2-8747-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a4e-3820-42fc-9b8f-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a4e-720c-4512-9fa1-6cf502de0b81",
|
|
|
|
|
"observed-data--56bf3a4f-064c-4597-b628-6cf502de0b81",
|
|
|
|
|
"url--56bf3a4f-064c-4597-b628-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a4f-ac54-4b91-b4e1-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a4f-a0f0-4a53-b389-6cf502de0b81",
|
|
|
|
|
"observed-data--56bf3a50-1aac-491f-a4ca-6cf502de0b81",
|
|
|
|
|
"url--56bf3a50-1aac-491f-a4ca-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a50-cd34-4d6f-a2dc-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a50-cd90-4d5d-9fad-6cf502de0b81",
|
|
|
|
|
"observed-data--56bf3a51-ed58-4418-aafd-6cf502de0b81",
|
|
|
|
|
"url--56bf3a51-ed58-4418-aafd-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a51-0740-4009-8c0f-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a51-8c90-4002-a916-6cf502de0b81",
|
|
|
|
|
"observed-data--56bf3a52-7ee4-4e3f-bf2d-6cf502de0b81",
|
|
|
|
|
"url--56bf3a52-7ee4-4e3f-bf2d-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a52-cea0-47e7-8f19-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a52-2ee4-4a2a-8ea7-6cf502de0b81",
|
|
|
|
|
"observed-data--56bf3a53-0a7c-4813-9d00-6cf502de0b81",
|
|
|
|
|
"url--56bf3a53-0a7c-4813-9d00-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a53-7074-433f-9971-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a53-48dc-4052-a364-6cf502de0b81",
|
|
|
|
|
"observed-data--56bf3a54-0ba4-4136-b95c-6cf502de0b81",
|
|
|
|
|
"url--56bf3a54-0ba4-4136-b95c-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a54-ba7c-43e3-bbd1-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a54-4190-45ae-ab2e-6cf502de0b81",
|
|
|
|
|
"observed-data--56bf3a55-c224-4ac3-9c62-6cf502de0b81",
|
|
|
|
|
"url--56bf3a55-c224-4ac3-9c62-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a55-e9ac-4b66-9a20-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a55-d320-431e-a6c5-6cf502de0b81",
|
|
|
|
|
"observed-data--56bf3a56-5e54-4143-85d1-6cf502de0b81",
|
|
|
|
|
"url--56bf3a56-5e54-4143-85d1-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a56-9a88-4df4-87c9-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a56-53a0-46ff-9e92-6cf502de0b81",
|
|
|
|
|
"observed-data--56bf3a57-0de0-4f09-a459-6cf502de0b81",
|
|
|
|
|
"url--56bf3a57-0de0-4f09-a459-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a57-4994-4f26-b0f9-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a57-9c5c-4558-a594-6cf502de0b81",
|
|
|
|
|
"observed-data--56bf3a58-a6f8-44bd-882a-6cf502de0b81",
|
|
|
|
|
"url--56bf3a58-a6f8-44bd-882a-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a58-54a0-4d58-9289-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a58-069c-44c6-adab-6cf502de0b81",
|
|
|
|
|
"observed-data--56bf3a59-966c-4d8d-a37a-6cf502de0b81",
|
|
|
|
|
"url--56bf3a59-966c-4d8d-a37a-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a59-b670-44a2-b4f2-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a59-06e0-4d2c-93e4-6cf502de0b81",
|
|
|
|
|
"observed-data--56bf3a5a-e3f8-4545-be7c-6cf502de0b81",
|
|
|
|
|
"url--56bf3a5a-e3f8-4545-be7c-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a5a-4e4c-40a2-9033-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a5a-9be4-42a5-a2fb-6cf502de0b81",
|
|
|
|
|
"observed-data--56bf3a5b-b6e8-4c3c-ac67-6cf502de0b81",
|
|
|
|
|
"url--56bf3a5b-b6e8-4c3c-ac67-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a5b-6b2c-43a4-9b74-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a5b-9d34-4f3f-a13d-6cf502de0b81",
|
|
|
|
|
"observed-data--56bf3a5c-02bc-4b77-a571-6cf502de0b81",
|
|
|
|
|
"url--56bf3a5c-02bc-4b77-a571-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a5c-f298-41f2-9199-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a5c-4a2c-4c51-8bc4-6cf502de0b81",
|
|
|
|
|
"observed-data--56bf3a5d-b738-4370-9d0f-6cf502de0b81",
|
|
|
|
|
"url--56bf3a5d-b738-4370-9d0f-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a5d-300c-42f9-b6cc-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3a5d-320c-4cb5-801c-6cf502de0b81",
|
|
|
|
|
"observed-data--56bf3a5e-f9f8-4110-8ac7-6cf502de0b81",
|
|
|
|
|
"url--56bf3a5e-f9f8-4110-8ac7-6cf502de0b81",
|
|
|
|
|
"indicator--56bf3b67-a994-48b0-a66d-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b67-ef24-482d-911e-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b67-f73c-4de2-9e11-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b68-053c-4b3b-a1e2-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b68-8a9c-41eb-9bfa-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b68-233c-4bcb-b9ed-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b68-e530-41e1-9fb2-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b69-20b4-45ad-8969-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b69-9818-4943-b456-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b69-0218-4d0b-b822-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b6a-87b0-440c-8f92-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b6a-d034-4c29-a954-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b6a-4b5c-47a3-8eb6-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b6b-eaa0-425c-bc8d-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b6b-63d4-4505-b0b7-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b6b-dd20-4dbb-8c33-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b6c-46a0-430f-becd-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b6c-2ec0-4fae-89e6-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b6c-05fc-4528-8c34-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b6d-5844-4e82-8dd1-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b6d-58c4-4d55-8b87-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b6d-fbc4-4014-832d-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b6e-d6e8-444c-9f4a-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b6e-47a8-47d1-95e0-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b6e-e87c-4f64-ad22-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b6f-c69c-42e9-a2d9-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b6f-7700-4972-9a2c-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b6f-49f0-4c8e-b163-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b70-97ac-434a-a4d1-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b70-899c-4edd-8ad4-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b70-c4b4-4b87-ab9f-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b71-b708-4e50-99e5-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b71-7948-4fcb-ab23-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b71-9320-43b0-93e2-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b72-f450-4a9c-8dcb-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b72-6914-4a08-89ba-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b72-0304-4bb7-ad93-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b73-ad54-41f2-bbe2-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3b73-4598-4dc0-8915-6cf002de0b81",
|
|
|
|
|
"indicator--56bf3bb8-669c-425f-9a9f-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bb8-6b1c-41c4-bd67-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bb9-8a20-4ff7-9f0a-6cf702de0b81",
|
|
|
|
|
"url--56bf3bb9-8a20-4ff7-9f0a-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bb9-2294-4a72-ad8b-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bb9-d65c-4562-bf44-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bba-83fc-4534-8578-6cf702de0b81",
|
|
|
|
|
"url--56bf3bba-83fc-4534-8578-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bba-49e4-468d-b4db-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bba-3cc4-433a-9be6-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bbb-d878-4228-9652-6cf702de0b81",
|
|
|
|
|
"url--56bf3bbb-d878-4228-9652-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bbb-8520-4006-9952-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bbb-bccc-40b5-b01c-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bbc-fa78-4d77-8219-6cf702de0b81",
|
|
|
|
|
"url--56bf3bbc-fa78-4d77-8219-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bbc-75c4-4e71-a851-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bbc-3ea4-4be3-bf04-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bbd-f4e8-4449-97cc-6cf702de0b81",
|
|
|
|
|
"url--56bf3bbd-f4e8-4449-97cc-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bbd-a794-4f46-8dcc-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bbd-9e28-4b6b-961f-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bbe-9670-4980-9008-6cf702de0b81",
|
|
|
|
|
"url--56bf3bbe-9670-4980-9008-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bbe-88bc-46a3-8cae-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bbe-631c-4ce6-b242-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bbf-afcc-408a-8414-6cf702de0b81",
|
|
|
|
|
"url--56bf3bbf-afcc-408a-8414-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bbf-fb28-4968-9233-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bbf-4d40-42de-8cb7-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bc0-bd74-4e32-87ed-6cf702de0b81",
|
|
|
|
|
"url--56bf3bc0-bd74-4e32-87ed-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bc0-6f4c-4b75-9d49-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bc0-e3f0-4db9-a49d-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bc1-82e8-4351-889a-6cf702de0b81",
|
|
|
|
|
"url--56bf3bc1-82e8-4351-889a-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bc1-51cc-458e-b695-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bc1-a43c-419b-8e09-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bc1-68d0-4983-94af-6cf702de0b81",
|
|
|
|
|
"url--56bf3bc1-68d0-4983-94af-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bc2-3bb8-401d-90f3-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bc2-7fc8-40bc-8544-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bc2-1068-484b-877f-6cf702de0b81",
|
|
|
|
|
"url--56bf3bc2-1068-484b-877f-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bc3-2ca0-4599-b5e6-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bc3-8564-45e4-acac-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bc3-0470-4f41-96a4-6cf702de0b81",
|
|
|
|
|
"url--56bf3bc3-0470-4f41-96a4-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bc4-0d48-4f41-8ce7-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bc4-1530-4c59-bdf4-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bc4-67b4-474f-a046-6cf702de0b81",
|
|
|
|
|
"url--56bf3bc4-67b4-474f-a046-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bc5-9418-4212-91d7-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bc5-48f8-45f3-8167-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bc5-f298-499e-9347-6cf702de0b81",
|
|
|
|
|
"url--56bf3bc5-f298-499e-9347-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bc6-2c8c-4c1a-b5de-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bc6-60d8-4bd1-8458-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bc6-0e60-4397-995b-6cf702de0b81",
|
|
|
|
|
"url--56bf3bc6-0e60-4397-995b-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bc7-3358-46f0-8a5c-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bc7-3710-4d2f-a7e6-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bc7-a550-49cb-b234-6cf702de0b81",
|
|
|
|
|
"url--56bf3bc7-a550-49cb-b234-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bc8-be2c-4117-b60c-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bc8-94a4-4280-8515-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bc8-4f58-423d-9222-6cf702de0b81",
|
|
|
|
|
"url--56bf3bc8-4f58-423d-9222-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bc9-f174-44a7-9908-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bc9-6628-4a20-a87d-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bc9-409c-4905-b837-6cf702de0b81",
|
|
|
|
|
"url--56bf3bc9-409c-4905-b837-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bca-7b74-425c-b38a-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bca-8938-42fa-8ae7-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bca-8738-44ed-9318-6cf702de0b81",
|
|
|
|
|
"url--56bf3bca-8738-44ed-9318-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bcb-5108-417e-9b35-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bcb-b2a4-49a5-ac7a-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bcb-8bac-4d3d-bfe8-6cf702de0b81",
|
|
|
|
|
"url--56bf3bcb-8bac-4d3d-bfe8-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bcc-8f4c-4a17-aa5b-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bcc-65f4-47fc-8ae1-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bcc-1d64-4090-bd73-6cf702de0b81",
|
|
|
|
|
"url--56bf3bcc-1d64-4090-bd73-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bcd-5048-4fe0-b05c-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bcd-88e0-412c-aae2-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bcd-14f4-4846-b6ff-6cf702de0b81",
|
|
|
|
|
"url--56bf3bcd-14f4-4846-b6ff-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bce-debc-4110-ba8e-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bce-88f8-4c48-b703-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bce-3d58-4b19-b395-6cf702de0b81",
|
|
|
|
|
"url--56bf3bce-3d58-4b19-b395-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bcf-9644-46d4-b1ab-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bcf-249c-4028-9d41-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bcf-bcbc-48e9-aa62-6cf702de0b81",
|
|
|
|
|
"url--56bf3bcf-bcbc-48e9-aa62-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bcf-a310-40e2-8a2b-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bd0-9b04-405e-b8ad-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bd0-dfb8-42c3-9b83-6cf702de0b81",
|
|
|
|
|
"url--56bf3bd0-dfb8-42c3-9b83-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bd0-381c-4d45-9dcb-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bd1-0b6c-4829-818a-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bd1-3a40-4057-9c9d-6cf702de0b81",
|
|
|
|
|
"url--56bf3bd1-3a40-4057-9c9d-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bd1-75bc-4236-8cdf-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bd2-ca68-4639-8f27-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bd2-6ae8-4b1c-815b-6cf702de0b81",
|
|
|
|
|
"url--56bf3bd2-6ae8-4b1c-815b-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bd2-58fc-47cb-95ba-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bd3-4cb0-4e91-b6c0-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bd3-b8cc-4b3b-9338-6cf702de0b81",
|
|
|
|
|
"url--56bf3bd3-b8cc-4b3b-9338-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bd3-ea20-4e12-b861-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bd4-a524-4969-81f4-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bd4-28bc-4f65-a7aa-6cf702de0b81",
|
|
|
|
|
"url--56bf3bd4-28bc-4f65-a7aa-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bd4-7968-4e55-831d-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bd5-f9c4-491c-b567-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bd5-1060-4f93-ad41-6cf702de0b81",
|
|
|
|
|
"url--56bf3bd5-1060-4f93-ad41-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bd5-d304-4467-b13a-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bd6-087c-4904-bdd6-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bd6-20e8-496a-85d9-6cf702de0b81",
|
|
|
|
|
"url--56bf3bd6-20e8-496a-85d9-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bd6-479c-44d8-9e9a-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bd7-3e94-4751-a9be-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bd7-8e78-4bed-92aa-6cf702de0b81",
|
|
|
|
|
"url--56bf3bd7-8e78-4bed-92aa-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bd7-2370-496e-8c56-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bd8-b794-4eab-a030-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bd8-c458-46f4-8c48-6cf702de0b81",
|
|
|
|
|
"url--56bf3bd8-c458-46f4-8c48-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bd8-6690-4209-b12a-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bd9-c918-4082-a561-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bd9-b890-4703-b087-6cf702de0b81",
|
|
|
|
|
"url--56bf3bd9-b890-4703-b087-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bd9-9200-4a3e-ad7a-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bda-977c-4ea3-913d-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bda-93ec-40b8-a8d2-6cf702de0b81",
|
|
|
|
|
"url--56bf3bda-93ec-40b8-a8d2-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bda-0a14-4f04-9a40-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bdb-7738-491c-8f17-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bdb-c0e4-497e-94d9-6cf702de0b81",
|
|
|
|
|
"url--56bf3bdb-c0e4-497e-94d9-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bdb-0708-4bce-8e4b-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bdb-b9a4-47c5-ac94-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bdc-bad4-45e0-a38a-6cf702de0b81",
|
|
|
|
|
"url--56bf3bdc-bad4-45e0-a38a-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bdc-bacc-4289-b7b4-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bdc-5100-4ed3-8410-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bdd-5018-44d6-be3f-6cf702de0b81",
|
|
|
|
|
"url--56bf3bdd-5018-44d6-be3f-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bdd-f0c0-4577-beb2-6cf702de0b81",
|
|
|
|
|
"indicator--56bf3bdd-efd8-47fa-b6cd-6cf702de0b81",
|
|
|
|
|
"observed-data--56bf3bde-b4f4-40ce-aeb7-6cf702de0b81",
|
|
|
|
|
"url--56bf3bde-b4f4-40ce-aeb7-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"Threat-Report",
|
|
|
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
|
|
|
"type:OSINT"
|
|
|
|
|
],
|
|
|
|
|
"object_marking_refs": [
|
|
|
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf39c9-c078-4368-9555-6cf802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:12:25.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:12:25.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:12:25Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:12:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf39c9-c078-4368-9555-6cf802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf39c9-c078-4368-9555-6cf802de0b81",
|
|
|
|
|
"value": "http://blog.cylance.com/hunting-for-malware-with-machine-learning"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a11-9f9c-4e98-b974-6cef02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:13:37.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:13:37.000Z",
|
|
|
|
|
"description": "Evora",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '00a9466358d2b716be215f856c44e2b62df64b29a4d04aaa1ef0a194d825313f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:13:37Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a12-667c-4b13-a5a2-6cef02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:13:38.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:13:38.000Z",
|
|
|
|
|
"description": "Evora",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '0a372eb55d5bc91be510a4d9084a5c15ec22c3b066fe226994566a136564a2ec']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:13:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a12-ddbc-4e29-a14e-6cef02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:13:38.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:13:38.000Z",
|
|
|
|
|
"description": "Evora",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '11107f6f1f41466ae9e01cd6fc3a3c615e1fa8ee8f7e786a2f7b5b371434af9c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:13:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a12-9adc-4c07-9732-6cef02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:13:38.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:13:38.000Z",
|
|
|
|
|
"description": "Evora",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '151f6e3a052ab72e6ac043922415126d19a5085dda1ea70aa7d5c345ef4c905a']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:13:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a13-756c-4125-af3b-6cef02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:13:39.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:13:39.000Z",
|
|
|
|
|
"description": "Evora",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '23753c260e48fd092423aceb6300a9b858eeaa113f6f7040305edb545f4da35f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:13:39Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a13-7994-4cf0-9818-6cef02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:13:39.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:13:39.000Z",
|
|
|
|
|
"description": "Evora",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '349d2e0a3be5e567416c1a5abb1a01ddb0e31f4c80d4543fad1a5766fd3b5002']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:13:39Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a13-207c-46b4-b8fe-6cef02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:13:39.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:13:39.000Z",
|
|
|
|
|
"description": "Evora",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '3d059628f80ca8aa1977c0be001a1c11919f76d983139561e7955af645fa979e']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:13:39Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a14-f47c-4c01-b41a-6cef02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:13:40.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:13:40.000Z",
|
|
|
|
|
"description": "Evora",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '435590115a89427b28f4b7d90850cf92751e23358f2d198bab1d7a22ff793fba']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:13:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a14-642c-4118-8505-6cef02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:13:40.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:13:40.000Z",
|
|
|
|
|
"description": "Evora",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '52e896c6d22929ade6e0cdc54b6a27afd960658955b8ff92996304820c3a03e4']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:13:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a14-9008-44c7-a84b-6cef02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:13:40.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:13:40.000Z",
|
|
|
|
|
"description": "Evora",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '5e2de83e9b24ed78f38b7189c3505aee5d710bc1a7be473e96e0aa3630112b84']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:13:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a15-4588-466e-86e4-6cef02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:13:41.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:13:41.000Z",
|
|
|
|
|
"description": "Evora",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '6c720a4df2acd644bf7153a0c12c70db4a354b20ed14500bbcc91b3e8eaac522']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:13:41Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a15-0234-46d4-aa77-6cef02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:13:41.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:13:41.000Z",
|
|
|
|
|
"description": "Evora",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '7d24387e79a537b17ad4b4d19e24a0010034689d3e2b9812f26d1ad579d21cbe']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:13:41Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a15-f9e4-4da8-9e59-6cef02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:13:41.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:13:41.000Z",
|
|
|
|
|
"description": "Evora",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '81a0f80edf8d41f97d799a81c67e9c8930abaece59a73c1d097ee576c0c8a15c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:13:41Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a16-1ed0-43d6-a325-6cef02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:13:42.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:13:42.000Z",
|
|
|
|
|
"description": "Evora",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '89db78dcf95e887ddf0818016fa5988e44d23d87c6922bd81dfb3c68ef6cfe93']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:13:42Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a16-2b60-44a9-90ee-6cef02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:13:42.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:13:42.000Z",
|
|
|
|
|
"description": "Evora",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '981df8ab5eb36467b595a86a0d6905dc57151d66f4a0a64cfc6734c33d0a4cbe']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:13:42Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a16-ec28-4743-b6fc-6cef02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:13:42.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:13:42.000Z",
|
|
|
|
|
"description": "Evora",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'aacaf259d0e4d6527158a3f97ccf0029abcdefba85c264940fbc2267d59659eb']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:13:42Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a16-f0e8-433a-9ea8-6cef02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:13:42.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:13:42.000Z",
|
|
|
|
|
"description": "Evora",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'b877bc5b9b925fb0056f4b140865c0a89d3c0a31701a6e4feb1b73d2065420d3']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:13:42Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a17-f5b4-49b4-9e42-6cef02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:13:43.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:13:43.000Z",
|
|
|
|
|
"description": "Evora",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'cb92dbfd904821e8e66662734c0bb82ae63879d1f5fa1ab0ee8e60e4052a70ae']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:13:43Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a17-58c8-4bd0-a40c-6cef02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:13:43.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:13:43.000Z",
|
|
|
|
|
"description": "Evora",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'd21022fbee8a919c43fb35d070a3b16832ea565aa6a0b81fb09d49a93e4a7ee9']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:13:43Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a17-3cf8-44b9-b08e-6cef02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:13:43.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:13:43.000Z",
|
|
|
|
|
"description": "Evora",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'da4cbc222be7c51b2cc3d358e03a8f36cc80b7b27243526037d2d2740c48f7a7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:13:43Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a18-07e8-4a3c-b791-6cef02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:13:44.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:13:44.000Z",
|
|
|
|
|
"description": "Evora",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'dbfd0240511cc26767f5b747df2b043334535a36fec03c6bdce0521571d8d52e']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:13:44Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a18-b510-4d79-9629-6cef02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:13:44.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:13:44.000Z",
|
|
|
|
|
"description": "Evora",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'dd0ec1712f8b759b5d4b52f7da9aec9f956a93639a00979790e01caeb5494c09']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:13:44Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a18-c530-4aec-a2bc-6cef02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:13:44.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:13:44.000Z",
|
|
|
|
|
"description": "Evora",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'e08c0173671c7defbef03d9101d8d26f223e8d40ba7bfa6232fea40ea6545c0d']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:13:44Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a19-3a84-469a-aa67-6cef02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:13:45.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:13:45.000Z",
|
|
|
|
|
"description": "Evora",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'e0f92aff03c3aae95ad8a34ca64422fe36e2c491379a5a3a403a57ae1ec72dc7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:13:45Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a19-5594-442e-a3bc-6cef02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:13:45.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:13:45.000Z",
|
|
|
|
|
"description": "Evora",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'e905d54784f2ae2cd040f9bcb792efbdb675207717ff422d7258446389b44165']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:13:45Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a19-6aec-4e70-bf2d-6cef02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:13:45.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:13:45.000Z",
|
|
|
|
|
"description": "Evora",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'efc9ed5d0b554f0cdda8ed8feaeb7cbdaadf46ac3021a2eb3fd532632662fbd0']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:13:45Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a1a-4e78-4265-9a91-6cef02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:13:46.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:13:46.000Z",
|
|
|
|
|
"description": "Evora",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'f0a9c3e055aa54cfdd21dc1028ffbc74ee5da56a81039cb1723747dcfa3c150c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:13:46Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a1a-da00-4ff7-b6da-6cef02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:13:46.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:13:46.000Z",
|
|
|
|
|
"description": "Evora",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'f16d6caa1d454fd2fa6b2d959f1b3664b46dcbb88fff9b14bc23bff1ec667b41']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:13:46Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a42-53e0-421f-987f-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:26.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:26.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: f16d6caa1d454fd2fa6b2d959f1b3664b46dcbb88fff9b14bc23bff1ec667b41",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '8aca7af729cbf4cee6d5f40ad28c22ecee9366f0']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:26Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a42-2bb8-4dfc-8ca8-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:26.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:26.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: f16d6caa1d454fd2fa6b2d959f1b3664b46dcbb88fff9b14bc23bff1ec667b41",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '42126a340bb07ab6c23a1c2d43e7adda']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:26Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3a43-4624-4667-b38b-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:27.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:27.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:14:27Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:14:27Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3a43-4624-4667-b38b-6cf502de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3a43-4624-4667-b38b-6cf502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/f16d6caa1d454fd2fa6b2d959f1b3664b46dcbb88fff9b14bc23bff1ec667b41/analysis/1450863571/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a43-2408-491d-96c1-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:27.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:27.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: f0a9c3e055aa54cfdd21dc1028ffbc74ee5da56a81039cb1723747dcfa3c150c",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '6cc2b1ab6ca7a5c632ab300329a3c42c0a216753']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:27Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a43-e774-49d8-9301-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:27.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:27.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: f0a9c3e055aa54cfdd21dc1028ffbc74ee5da56a81039cb1723747dcfa3c150c",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'd2b6bb7149561756ce4160f78a77f85e']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:27Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3a44-ba50-41af-a102-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:28.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:28.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:14:28Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:14:28Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3a44-ba50-41af-a102-6cf502de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3a44-ba50-41af-a102-6cf502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/f0a9c3e055aa54cfdd21dc1028ffbc74ee5da56a81039cb1723747dcfa3c150c/analysis/1450863893/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a44-02d0-4347-a1cb-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:28.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:28.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: efc9ed5d0b554f0cdda8ed8feaeb7cbdaadf46ac3021a2eb3fd532632662fbd0",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '70bec0c65abadd73a8f8a0b70df5a78ac204ab64']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:28Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a44-78a4-4e4f-97b7-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:28.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:28.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: efc9ed5d0b554f0cdda8ed8feaeb7cbdaadf46ac3021a2eb3fd532632662fbd0",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '0ad154de647b7ab3790ec6e439a106f8']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:28Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3a45-e0a8-4ab8-9c23-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:29.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:29.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:14:29Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:14:29Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3a45-e0a8-4ab8-9c23-6cf502de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3a45-e0a8-4ab8-9c23-6cf502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/efc9ed5d0b554f0cdda8ed8feaeb7cbdaadf46ac3021a2eb3fd532632662fbd0/analysis/1450863980/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a45-8434-497d-9c6f-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:29.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:29.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: e905d54784f2ae2cd040f9bcb792efbdb675207717ff422d7258446389b44165",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'f34a8441e0b8cf1624860dac8611cf1c60bd6ce8']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:29Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a45-5638-400b-8429-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:29.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:29.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: e905d54784f2ae2cd040f9bcb792efbdb675207717ff422d7258446389b44165",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'fdd1ef9a8ff67e37d97227e29a711a9a']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:29Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3a46-2694-4e6a-992b-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:30.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:30.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:14:30Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:14:30Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3a46-2694-4e6a-992b-6cf502de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3a46-2694-4e6a-992b-6cf502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/e905d54784f2ae2cd040f9bcb792efbdb675207717ff422d7258446389b44165/analysis/1418681177/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a46-e1b4-4357-91b3-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:30.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:30.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: e0f92aff03c3aae95ad8a34ca64422fe36e2c491379a5a3a403a57ae1ec72dc7",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '3bdf18f006acad507245eab1c1443fa4bafc284e']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:30Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a46-addc-48ad-8e53-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:30.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:30.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: e0f92aff03c3aae95ad8a34ca64422fe36e2c491379a5a3a403a57ae1ec72dc7",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'faa3e9bd86918e4467aac1a242e6ef01']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:30Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3a47-c528-46f7-af7e-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:31.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:31.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:14:31Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:14:31Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3a47-c528-46f7-af7e-6cf502de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3a47-c528-46f7-af7e-6cf502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/e0f92aff03c3aae95ad8a34ca64422fe36e2c491379a5a3a403a57ae1ec72dc7/analysis/1358809968/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a47-268c-42bd-a629-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:31.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:31.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: e08c0173671c7defbef03d9101d8d26f223e8d40ba7bfa6232fea40ea6545c0d",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'cae483ab5c0ff9e26fde1dd7c6294954126455d5']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a47-15dc-47e7-be58-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:31.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:31.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: e08c0173671c7defbef03d9101d8d26f223e8d40ba7bfa6232fea40ea6545c0d",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'a6fcdffbccea839edb47f3e2e16e1b0c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3a48-1f8c-4a32-850e-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:32.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:32.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:14:32Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:14:32Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3a48-1f8c-4a32-850e-6cf502de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3a48-1f8c-4a32-850e-6cf502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/e08c0173671c7defbef03d9101d8d26f223e8d40ba7bfa6232fea40ea6545c0d/analysis/1417470919/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a48-3198-4193-8262-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:32.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:32.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: dd0ec1712f8b759b5d4b52f7da9aec9f956a93639a00979790e01caeb5494c09",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'b5274467a8837c9c5fd565e0bc27a0f8c6a0a3c3']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:32Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a48-9a88-4def-b1c8-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:32.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:32.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: dd0ec1712f8b759b5d4b52f7da9aec9f956a93639a00979790e01caeb5494c09",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '448ce6d025da1a71d107093963be74e0']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:32Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3a49-0b7c-4d8c-97ed-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:33.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:33.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:14:33Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:14:33Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3a49-0b7c-4d8c-97ed-6cf502de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3a49-0b7c-4d8c-97ed-6cf502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/dd0ec1712f8b759b5d4b52f7da9aec9f956a93639a00979790e01caeb5494c09/analysis/1354157102/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a49-86f0-4adc-a3e5-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:33.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:33.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: dbfd0240511cc26767f5b747df2b043334535a36fec03c6bdce0521571d8d52e",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '5fa7d5840d7b205a7df4d4ae586ee285d6152b76']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:33Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a49-4020-4dad-805c-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:33.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:33.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: dbfd0240511cc26767f5b747df2b043334535a36fec03c6bdce0521571d8d52e",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'ccca0f359d3d79c1a2ea7ce9f5d54879']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:33Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3a4a-9574-4268-aff8-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:34.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:34.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:14:34Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:14:34Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3a4a-9574-4268-aff8-6cf502de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3a4a-9574-4268-aff8-6cf502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/dbfd0240511cc26767f5b747df2b043334535a36fec03c6bdce0521571d8d52e/analysis/1450863880/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a4a-4414-4690-b66e-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:34.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:34.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: da4cbc222be7c51b2cc3d358e03a8f36cc80b7b27243526037d2d2740c48f7a7",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '4ac0ab553500b9c053ac84e57c6388401cef693e']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:34Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a4a-8ed4-408e-9db1-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:34.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:34.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: da4cbc222be7c51b2cc3d358e03a8f36cc80b7b27243526037d2d2740c48f7a7",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '39951cafa1561fe49938c652be57d927']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:34Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3a4b-b5e4-4a99-a8b2-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:35.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:35.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:14:35Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:14:35Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3a4b-b5e4-4a99-a8b2-6cf502de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3a4b-b5e4-4a99-a8b2-6cf502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/da4cbc222be7c51b2cc3d358e03a8f36cc80b7b27243526037d2d2740c48f7a7/analysis/1450863535/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a4b-0e94-4a2a-8056-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:35.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:35.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: d21022fbee8a919c43fb35d070a3b16832ea565aa6a0b81fb09d49a93e4a7ee9",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'b2fefd34e2e718fa68d6ff41fcbff3fcb9cc4a98']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:35Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a4b-099c-419e-ab90-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:35.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:35.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: d21022fbee8a919c43fb35d070a3b16832ea565aa6a0b81fb09d49a93e4a7ee9",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '61c5c4d545470711369a0ccea105b9f1']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:35Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3a4c-afb0-4e7a-8f8e-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:36.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:36.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:14:36Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:14:36Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3a4c-afb0-4e7a-8f8e-6cf502de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3a4c-afb0-4e7a-8f8e-6cf502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/d21022fbee8a919c43fb35d070a3b16832ea565aa6a0b81fb09d49a93e4a7ee9/analysis/1450863650/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a4c-ff74-411a-9047-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:36.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:36.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: cb92dbfd904821e8e66662734c0bb82ae63879d1f5fa1ab0ee8e60e4052a70ae",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '21b980ed3d7f41892523fa443511c0f3e6c0a377']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:36Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a4c-c190-444d-9eee-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:36.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:36.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: cb92dbfd904821e8e66662734c0bb82ae63879d1f5fa1ab0ee8e60e4052a70ae",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '5ddf9fc460c4fc4b8374e5d237680b06']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:36Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3a4d-5680-4f28-a492-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:37.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:37.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:14:37Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:14:37Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3a4d-5680-4f28-a492-6cf502de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3a4d-5680-4f28-a492-6cf502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/cb92dbfd904821e8e66662734c0bb82ae63879d1f5fa1ab0ee8e60e4052a70ae/analysis/1450863641/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a4d-e388-4e48-9069-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:37.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:37.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: b877bc5b9b925fb0056f4b140865c0a89d3c0a31701a6e4feb1b73d2065420d3",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '1caee4d578cac0f9538c0e94f21fcf2017d600cf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:37Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a4d-11bc-455f-a3a8-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:37.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:37.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: b877bc5b9b925fb0056f4b140865c0a89d3c0a31701a6e4feb1b73d2065420d3",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'c10c636e9687dce9e8b6cabf9a66c4f1']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:37Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3a4e-8090-4fd2-8747-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:38.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:38.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:14:38Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:14:38Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3a4e-8090-4fd2-8747-6cf502de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3a4e-8090-4fd2-8747-6cf502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/b877bc5b9b925fb0056f4b140865c0a89d3c0a31701a6e4feb1b73d2065420d3/analysis/1392490188/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a4e-3820-42fc-9b8f-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:38.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:38.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: aacaf259d0e4d6527158a3f97ccf0029abcdefba85c264940fbc2267d59659eb",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '182148fd7490d7fc9d056eebb30af47638363301']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a4e-720c-4512-9fa1-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:38.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:38.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: aacaf259d0e4d6527158a3f97ccf0029abcdefba85c264940fbc2267d59659eb",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'f7cea6272e719315f42385627d6ecee0']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3a4f-064c-4597-b628-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:39.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:39.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:14:39Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:14:39Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3a4f-064c-4597-b628-6cf502de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3a4f-064c-4597-b628-6cf502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/aacaf259d0e4d6527158a3f97ccf0029abcdefba85c264940fbc2267d59659eb/analysis/1418898618/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a4f-ac54-4b91-b4e1-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:39.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:39.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: 981df8ab5eb36467b595a86a0d6905dc57151d66f4a0a64cfc6734c33d0a4cbe",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '12d7381f7c4b29a91b9976b40374c33288069e4f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:39Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a4f-a0f0-4a53-b389-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:39.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:39.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: 981df8ab5eb36467b595a86a0d6905dc57151d66f4a0a64cfc6734c33d0a4cbe",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'c074a788968777c6dc62a914ef90a3ed']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:39Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3a50-1aac-491f-a4ca-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:40.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:40.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:14:40Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:14:40Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3a50-1aac-491f-a4ca-6cf502de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3a50-1aac-491f-a4ca-6cf502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/981df8ab5eb36467b595a86a0d6905dc57151d66f4a0a64cfc6734c33d0a4cbe/analysis/1451545289/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a50-cd34-4d6f-a2dc-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:40.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:40.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: 89db78dcf95e887ddf0818016fa5988e44d23d87c6922bd81dfb3c68ef6cfe93",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '97ea66ba1d74cf0419b2b8e387fd1b516906dbc7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a50-cd90-4d5d-9fad-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:40.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:40.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: 89db78dcf95e887ddf0818016fa5988e44d23d87c6922bd81dfb3c68ef6cfe93",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'af540016121778b52689c9d1f2b8bafe']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3a51-ed58-4418-aafd-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:41.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:41.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:14:41Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:14:41Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3a51-ed58-4418-aafd-6cf502de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3a51-ed58-4418-aafd-6cf502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/89db78dcf95e887ddf0818016fa5988e44d23d87c6922bd81dfb3c68ef6cfe93/analysis/1404380678/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a51-0740-4009-8c0f-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:41.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:41.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: 81a0f80edf8d41f97d799a81c67e9c8930abaece59a73c1d097ee576c0c8a15c",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '7d0635b1141399091aaa278c00e7ceca21b0bb2d']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:41Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a51-8c90-4002-a916-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:41.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:41.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: 81a0f80edf8d41f97d799a81c67e9c8930abaece59a73c1d097ee576c0c8a15c",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '4311cc3b92f4537e75289a44c2b3800e']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:41Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3a52-7ee4-4e3f-bf2d-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:42.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:42.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:14:42Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:14:42Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3a52-7ee4-4e3f-bf2d-6cf502de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3a52-7ee4-4e3f-bf2d-6cf502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/81a0f80edf8d41f97d799a81c67e9c8930abaece59a73c1d097ee576c0c8a15c/analysis/1373859390/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a52-cea0-47e7-8f19-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:42.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:42.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: 7d24387e79a537b17ad4b4d19e24a0010034689d3e2b9812f26d1ad579d21cbe",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '9b47761292e8d3c7b0e74f615fbc7ea759ce0ad4']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:42Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a52-2ee4-4a2a-8ea7-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:42.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:42.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: 7d24387e79a537b17ad4b4d19e24a0010034689d3e2b9812f26d1ad579d21cbe",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '30b788d61843434410a3b3f882c9e658']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:42Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3a53-0a7c-4813-9d00-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:43.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:43.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:14:43Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:14:43Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3a53-0a7c-4813-9d00-6cf502de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3a53-0a7c-4813-9d00-6cf502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/7d24387e79a537b17ad4b4d19e24a0010034689d3e2b9812f26d1ad579d21cbe/analysis/1350867680/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a53-7074-433f-9971-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:43.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:43.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: 6c720a4df2acd644bf7153a0c12c70db4a354b20ed14500bbcc91b3e8eaac522",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '20017eb1c94a273bdb0d35aabe31a37c7c749920']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:43Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a53-48dc-4052-a364-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:43.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:43.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: 6c720a4df2acd644bf7153a0c12c70db4a354b20ed14500bbcc91b3e8eaac522",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'f194aafac4442363d27edf0c0c973d87']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:43Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3a54-0ba4-4136-b95c-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:44.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:44.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:14:44Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:14:44Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3a54-0ba4-4136-b95c-6cf502de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3a54-0ba4-4136-b95c-6cf502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/6c720a4df2acd644bf7153a0c12c70db4a354b20ed14500bbcc91b3e8eaac522/analysis/1385485864/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a54-ba7c-43e3-bbd1-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:44.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:44.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: 5e2de83e9b24ed78f38b7189c3505aee5d710bc1a7be473e96e0aa3630112b84",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '076615c31b7f067c9cfcaae7df67e40fd48be7b9']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:44Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a54-4190-45ae-ab2e-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:44.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:44.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: 5e2de83e9b24ed78f38b7189c3505aee5d710bc1a7be473e96e0aa3630112b84",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '4f350cf78b0875dd3c573322be3c7f8d']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:44Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3a55-c224-4ac3-9c62-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:45.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:45.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:14:45Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:14:45Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3a55-c224-4ac3-9c62-6cf502de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3a55-c224-4ac3-9c62-6cf502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/5e2de83e9b24ed78f38b7189c3505aee5d710bc1a7be473e96e0aa3630112b84/analysis/1452667551/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a55-e9ac-4b66-9a20-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:45.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:45.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: 52e896c6d22929ade6e0cdc54b6a27afd960658955b8ff92996304820c3a03e4",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'edaeeda26a4340b776f5ab8881b5ab6ebb24fd69']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:45Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a55-d320-431e-a6c5-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:45.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:45.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: 52e896c6d22929ade6e0cdc54b6a27afd960658955b8ff92996304820c3a03e4",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '7f8c5faa7aa7e3c307d56bacce9909af']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:45Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3a56-5e54-4143-85d1-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:46.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:46.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:14:46Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:14:46Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3a56-5e54-4143-85d1-6cf502de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3a56-5e54-4143-85d1-6cf502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/52e896c6d22929ade6e0cdc54b6a27afd960658955b8ff92996304820c3a03e4/analysis/1353605210/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a56-9a88-4df4-87c9-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:46.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:46.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: 435590115a89427b28f4b7d90850cf92751e23358f2d198bab1d7a22ff793fba",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '6577f5b80614732db8ab87d302a53b207118991f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:46Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a56-53a0-46ff-9e92-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:46.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:46.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: 435590115a89427b28f4b7d90850cf92751e23358f2d198bab1d7a22ff793fba",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'f513dcf07106e143facae96f3c0a8959']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:46Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3a57-0de0-4f09-a459-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:47.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:47.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:14:47Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:14:47Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3a57-0de0-4f09-a459-6cf502de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3a57-0de0-4f09-a459-6cf502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/435590115a89427b28f4b7d90850cf92751e23358f2d198bab1d7a22ff793fba/analysis/1450863964/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a57-4994-4f26-b0f9-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:47.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:47.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: 3d059628f80ca8aa1977c0be001a1c11919f76d983139561e7955af645fa979e",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '249bdbb94b3f2b5d4c4df048eaf8b438ecd993a8']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:47Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a57-9c5c-4558-a594-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:47.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:47.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: 3d059628f80ca8aa1977c0be001a1c11919f76d983139561e7955af645fa979e",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '080eda5a11d93703470ec5a42498aeee']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:47Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3a58-a6f8-44bd-882a-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:48.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:48.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:14:48Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:14:48Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3a58-a6f8-44bd-882a-6cf502de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3a58-a6f8-44bd-882a-6cf502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/3d059628f80ca8aa1977c0be001a1c11919f76d983139561e7955af645fa979e/analysis/1390053742/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a58-54a0-4d58-9289-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:48.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:48.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: 349d2e0a3be5e567416c1a5abb1a01ddb0e31f4c80d4543fad1a5766fd3b5002",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '2df8b2e2ef41becc1c76fd915fe9dc9ef1a5d827']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:48Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a58-069c-44c6-adab-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:48.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:48.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: 349d2e0a3be5e567416c1a5abb1a01ddb0e31f4c80d4543fad1a5766fd3b5002",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'd3eecb124513fedbb0e0786ccda0c656']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:48Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3a59-966c-4d8d-a37a-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:49.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:49.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:14:49Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:14:49Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3a59-966c-4d8d-a37a-6cf502de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3a59-966c-4d8d-a37a-6cf502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/349d2e0a3be5e567416c1a5abb1a01ddb0e31f4c80d4543fad1a5766fd3b5002/analysis/1451312457/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a59-b670-44a2-b4f2-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:49.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:49.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: 23753c260e48fd092423aceb6300a9b858eeaa113f6f7040305edb545f4da35f",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '3e807e93f344109bc1d3af5f2d4dc809926ad08b']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:49Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a59-06e0-4d2c-93e4-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:49.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:49.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: 23753c260e48fd092423aceb6300a9b858eeaa113f6f7040305edb545f4da35f",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '313303f8b207547c1065110233a38a93']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:49Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3a5a-e3f8-4545-be7c-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:50.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:50.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:14:50Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:14:50Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3a5a-e3f8-4545-be7c-6cf502de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3a5a-e3f8-4545-be7c-6cf502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/23753c260e48fd092423aceb6300a9b858eeaa113f6f7040305edb545f4da35f/analysis/1451308643/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a5a-4e4c-40a2-9033-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:50.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:50.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: 151f6e3a052ab72e6ac043922415126d19a5085dda1ea70aa7d5c345ef4c905a",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '5af96864629fbc6818bb536df9b7739818b28728']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:50Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a5a-9be4-42a5-a2fb-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:50.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:50.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: 151f6e3a052ab72e6ac043922415126d19a5085dda1ea70aa7d5c345ef4c905a",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '9e746e6763448df16cbc3238ccd2feda']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:50Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3a5b-b6e8-4c3c-ac67-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:51.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:51.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:14:51Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:14:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3a5b-b6e8-4c3c-ac67-6cf502de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3a5b-b6e8-4c3c-ac67-6cf502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/151f6e3a052ab72e6ac043922415126d19a5085dda1ea70aa7d5c345ef4c905a/analysis/1384200505/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a5b-6b2c-43a4-9b74-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:51.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:51.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: 11107f6f1f41466ae9e01cd6fc3a3c615e1fa8ee8f7e786a2f7b5b371434af9c",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'f5a8abc725cf83d2e33a98e82de6763a63e280db']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:51Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a5b-9d34-4f3f-a13d-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:51.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:51.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: 11107f6f1f41466ae9e01cd6fc3a3c615e1fa8ee8f7e786a2f7b5b371434af9c",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'acf8842bec894849e599a17a9f7097a2']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:51Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3a5c-02bc-4b77-a571-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:52.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:52.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:14:52Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:14:52Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3a5c-02bc-4b77-a571-6cf502de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3a5c-02bc-4b77-a571-6cf502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/11107f6f1f41466ae9e01cd6fc3a3c615e1fa8ee8f7e786a2f7b5b371434af9c/analysis/1443114885/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a5c-f298-41f2-9199-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:52.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:52.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: 0a372eb55d5bc91be510a4d9084a5c15ec22c3b066fe226994566a136564a2ec",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '54d63b915055bb64fc13cc62dadb77db51a833aa']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:52Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a5c-4a2c-4c51-8bc4-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:52.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:52.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: 0a372eb55d5bc91be510a4d9084a5c15ec22c3b066fe226994566a136564a2ec",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'ebebd26b8e70f4985600efa95de7ac17']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:52Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3a5d-b738-4370-9d0f-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:53.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:53.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:14:53Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:14:53Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3a5d-b738-4370-9d0f-6cf502de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3a5d-b738-4370-9d0f-6cf502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/0a372eb55d5bc91be510a4d9084a5c15ec22c3b066fe226994566a136564a2ec/analysis/1439955643/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a5d-300c-42f9-b6cc-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:53.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:53.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: 00a9466358d2b716be215f856c44e2b62df64b29a4d04aaa1ef0a194d825313f",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'f22b43bfda1a2b32a31803cfc0ca5364dd9b83e3']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:53Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3a5d-320c-4cb5-801c-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:53.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:53.000Z",
|
|
|
|
|
"description": "Evora - Xchecked via VT: 00a9466358d2b716be215f856c44e2b62df64b29a4d04aaa1ef0a194d825313f",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'c520a8fa7d3c753cd23e845767c39202']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:14:53Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload installation"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload installation\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3a5e-f9f8-4110-8ac7-6cf502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:14:54.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:14:54.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:14:54Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:14:54Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3a5e-f9f8-4110-8ac7-6cf502de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3a5e-f9f8-4110-8ac7-6cf502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/00a9466358d2b716be215f856c44e2b62df64b29a4d04aaa1ef0a194d825313f/analysis/1410850666/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b67-a994-48b0-a66d-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:19.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:19.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '016806cce6bd26791b3bdd2dd05b555b2142f402fb2f97616773c17345f4a2b5']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:19Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b67-ef24-482d-911e-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:19.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:19.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '0bca323171b01cd6bee5d923f28d15bc5b15d5afb9984a24c7498f63889ffc62']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:19Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b67-f73c-4de2-9e11-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:19.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:19.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '11bf1d2d32b35884347d7a44c393c3b74691742434132ff374dcdecd700d749f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:19Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b68-053c-4b3b-a1e2-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:20.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:20.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '19916e513c810b1aa0a86d162d3381280a8c1314635026242cb86af2cf1b9cc3']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:20Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b68-8a9c-41eb-9bfa-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:20.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:20.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '22b0308e131a152a21443d34012e18688df6ecd5a8262cf6b9d05b444a4f9bc7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:20Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b68-233c-4bcb-b9ed-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:20.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:20.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '260cac805fdf709b2634d9431c556bbfb7554731e1a766a2484aaebbe6d1f467']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:20Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b68-e530-41e1-9fb2-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:20.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:20.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '268cadedf42eb553d0ff7d0fcbbcd18c3b93a6d590d895fbbeb3b7014c4ecd17']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:20Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b69-20b4-45ad-8969-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:21.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:21.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '2ae86e4e89cd86bde4e612fc9dedbcfa633cc4dd4d046a4f5d80aa85e608bdd5']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:21Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b69-9818-4943-b456-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:21.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:21.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '2d4db05def86adeb92a65721e70105fc0497f6c2633cf7bd80485dc7bd48ebd2']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:21Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b69-0218-4d0b-b822-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:21.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:21.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '2f05eda14c7e5d60d2e04aa4457f16f677f4fcfeb189a2c14ecf3c438a70f951']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:21Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b6a-87b0-440c-8f92-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:22.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:22.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '3bb13fa2c78dd4866c3e753a1e859cdeca2b446a8f9baa5ae8f2a062d4973971']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:22Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b6a-d034-4c29-a954-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:22.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:22.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '418a89d8b047ba06575392dcf430fb901916e6005034806b43cec6a1fd1621bb']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:22Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b6a-4b5c-47a3-8eb6-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:22.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:22.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '42448e3308b6f2ba180663c864ea1a6e75f7150699095a56073bb4396620fcb1']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:22Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b6b-eaa0-425c-bc8d-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:23.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:23.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '4a72a4cc8f3cdd4cc43269619beafff732742ddeca15a81822dafc56676ab073']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:23Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b6b-63d4-4505-b0b7-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:23.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:23.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '5142086a334b07caa4d085c0ac61c9563285a820a9883279b359b21c5a9da24e']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:23Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b6b-dd20-4dbb-8c33-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:23.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:23.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '5570f04292c669e7bb65c4affcb6c4aaabe81f5df5ca6c1c438e34044b90a7f6']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:23Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b6c-46a0-430f-becd-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:24.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:24.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '596e1ba536f75ec37643e1d0259aedeedc3fcd71e9a86b99955bbd51a296aacf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:24Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b6c-2ec0-4fae-89e6-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:24.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:24.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '5f6382437be9ad658990e28e893d2fe7bf3888735ade7bb1b95d8703b0b01422']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:24Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b6c-05fc-4528-8c34-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:24.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:24.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '6002821057ba2df0accd13ccd133465cab150d2675c6e607a12ba463d69967cf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:24Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b6d-5844-4e82-8dd1-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:25.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:25.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '68bdf19e596fa3cc4b08a7743ffa23e1444be6bc9f47da35739e985e1067ae80']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b6d-58c4-4d55-8b87-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:25.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:25.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '705c2279b3d7f9d7f21685b3251c7c850548b8274f41b798e5a5bf981e73f26d']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b6d-fbc4-4014-832d-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:25.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:25.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '7902569e1e64b838362a48ef756810bc3e3bb96783e8ae493b545efaaca20455']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b6e-d6e8-444c-9f4a-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:26.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:26.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '7b65e5513a0c60057517386aa026b4ad52d9af8ef3d927fcb03ac2d890dc0202']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:26Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b6e-47a8-47d1-95e0-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:26.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:26.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '7bd110c746b3b946b69a25cdcbe7e61e81757266d14bf7e604d18457494675ce']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:26Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b6e-e87c-4f64-ad22-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:26.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:26.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '7c617a988bcd3648478e244f67aafb68e7977ba85ee97b3254da5ae3bb0a0bdd']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:26Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b6f-c69c-42e9-a2d9-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:27.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:27.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '8a2c418e80f553667ac4c3b66b13ad6282933747175ac7c2794281b4eebb7fab']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:27Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b6f-7700-4972-9a2c-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:27.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:27.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '8f35cb99a0cdb8c98ebefe43b6c533c4d6a1261511f54c3b20c2c6e54273f606']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:27Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b6f-49f0-4c8e-b163-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:27.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:27.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '9ab669eab0afb239f3d44db4b394a84309efd661af6896f55f62bf33f97ec3cb']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:27Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b70-97ac-434a-a4d1-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:28.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:28.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'a41eade48e93f4f44a177e7cd36ae23219de2415d163ec6abed5b40810a6251e']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:28Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b70-899c-4edd-8ad4-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:28.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:28.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'a812833ea49f2d1d758db88e9ee89c2ab4dacb864ef4a2373a20c0bd505e3ed2']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:28Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b70-c4b4-4b87-ab9f-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:28.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:28.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'a8278e8ebe07b3434553c8bef208ecc04fcd474382e86b9a3bb7293229e2a427']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:28Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b71-b708-4e50-99e5-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:29.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:29.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'c062f8d21f0970e27b2c389aa34827c455a3cc34cb4b9d32c724f97d6177c701']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:29Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b71-7948-4fcb-ab23-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:29.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:29.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'c12c01907256b91f724f3d136a2c0a7ba2d68d389dd59ca87a363733feac101e']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:29Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b71-9320-43b0-93e2-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:29.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:29.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'c94f80033e0906efa3cca3544d505ecccde833c3a0fbf6d65b5dbaa2ae5a4297']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:29Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b72-f450-4a9c-8dcb-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:30.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:30.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'd102152032e25385944fcf9557299be36e155b9e59dbc612faf98f4159c8651e']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:30Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b72-6914-4a08-89ba-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:30.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:30.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'd434bc7989ec691d34729347999dacbc715964cb081b015344f15d1451d17a20']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:30Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b72-0304-4bb7-ad93-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:30.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:30.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'de3a5f84c6c9f6068f2bdf9ec80b92f6f24aae6a06e6d7cec5835a82799b82ac']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:30Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b73-ad54-41f2-bbe2-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:31.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:31.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'f0a15a46c8ba038e49ec98dc4b065ea1dd61c1b4e663e875ff12fb7ac950dd27']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3b73-4598-4dc0-8915-6cf002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:19:31.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:19:31.000Z",
|
|
|
|
|
"description": "Elise",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'ffb011573d4d9f2a307b17df27b67ccfa643318a3a0e6ef8f145c62b3e744619']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:19:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bb8-669c-425f-9a9f-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:40.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:40.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: ffb011573d4d9f2a307b17df27b67ccfa643318a3a0e6ef8f145c62b3e744619",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '583610b3f1e2efa66108e9f246291d1543a4218b']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bb8-6b1c-41c4-bd67-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:40.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:40.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: ffb011573d4d9f2a307b17df27b67ccfa643318a3a0e6ef8f145c62b3e744619",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'b3dd9481bd5ad4ea38f0abf5f1c8d56d']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bb9-8a20-4ff7-9f0a-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:41.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:41.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:20:41Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:20:41Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bb9-8a20-4ff7-9f0a-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bb9-8a20-4ff7-9f0a-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/ffb011573d4d9f2a307b17df27b67ccfa643318a3a0e6ef8f145c62b3e744619/analysis/1372011860/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bb9-2294-4a72-ad8b-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:41.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:41.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: f0a15a46c8ba038e49ec98dc4b065ea1dd61c1b4e663e875ff12fb7ac950dd27",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '04798a4473e78e0af130e9e5c6ad30fa52f1f436']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:41Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bb9-d65c-4562-bf44-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:41.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:41.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: f0a15a46c8ba038e49ec98dc4b065ea1dd61c1b4e663e875ff12fb7ac950dd27",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'e633d387c4932fe18529e91fbfbd52ef']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:41Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bba-83fc-4534-8578-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:42.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:42.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:20:42Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:20:42Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bba-83fc-4534-8578-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bba-83fc-4534-8578-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/f0a15a46c8ba038e49ec98dc4b065ea1dd61c1b4e663e875ff12fb7ac950dd27/analysis/1370656749/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bba-49e4-468d-b4db-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:42.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:42.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: de3a5f84c6c9f6068f2bdf9ec80b92f6f24aae6a06e6d7cec5835a82799b82ac",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '4998bec5abde6ccdb743634491a205bca9494367']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:42Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bba-3cc4-433a-9be6-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:42.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:42.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: de3a5f84c6c9f6068f2bdf9ec80b92f6f24aae6a06e6d7cec5835a82799b82ac",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '09ad967fae0e031bcbbc69d200d180ce']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:42Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bbb-d878-4228-9652-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:43.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:43.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:20:43Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:20:43Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bbb-d878-4228-9652-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bbb-d878-4228-9652-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/de3a5f84c6c9f6068f2bdf9ec80b92f6f24aae6a06e6d7cec5835a82799b82ac/analysis/1369314842/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bbb-8520-4006-9952-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:43.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:43.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: d434bc7989ec691d34729347999dacbc715964cb081b015344f15d1451d17a20",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '0ca809a880fac868b55a582bb8a3d5fa653ffb83']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:43Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bbb-bccc-40b5-b01c-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:43.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:43.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: d434bc7989ec691d34729347999dacbc715964cb081b015344f15d1451d17a20",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'b77311a5202a146049aaacbf48f79499']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:43Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bbc-fa78-4d77-8219-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:44.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:44.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:20:44Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:20:44Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bbc-fa78-4d77-8219-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bbc-fa78-4d77-8219-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/d434bc7989ec691d34729347999dacbc715964cb081b015344f15d1451d17a20/analysis/1435124182/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bbc-75c4-4e71-a851-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:44.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:44.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: d102152032e25385944fcf9557299be36e155b9e59dbc612faf98f4159c8651e",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '8f263b7e18248e4a684a5b77bdbea74ba497b0d7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:44Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bbc-3ea4-4be3-bf04-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:44.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:44.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: d102152032e25385944fcf9557299be36e155b9e59dbc612faf98f4159c8651e",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '452de932d3803923f1e1c4c4c094d50b']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:44Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bbd-f4e8-4449-97cc-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:45.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:45.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:20:45Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:20:45Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bbd-f4e8-4449-97cc-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bbd-f4e8-4449-97cc-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/d102152032e25385944fcf9557299be36e155b9e59dbc612faf98f4159c8651e/analysis/1373782436/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bbd-a794-4f46-8dcc-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:45.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:45.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: c94f80033e0906efa3cca3544d505ecccde833c3a0fbf6d65b5dbaa2ae5a4297",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'c54c9b41f60ed3b94f146b8bbca930efc644dd6c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:45Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bbd-9e28-4b6b-961f-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:45.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:45.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: c94f80033e0906efa3cca3544d505ecccde833c3a0fbf6d65b5dbaa2ae5a4297",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'f3eb2e0c3e6e8ddb8961c61b59da2d24']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:45Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bbe-9670-4980-9008-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:46.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:46.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:20:46Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:20:46Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bbe-9670-4980-9008-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bbe-9670-4980-9008-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/c94f80033e0906efa3cca3544d505ecccde833c3a0fbf6d65b5dbaa2ae5a4297/analysis/1373332430/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bbe-88bc-46a3-8cae-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:46.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:46.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: c12c01907256b91f724f3d136a2c0a7ba2d68d389dd59ca87a363733feac101e",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'dc9bbc1717665d18901aa708e35f4e74334df902']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:46Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bbe-631c-4ce6-b242-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:46.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:46.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: c12c01907256b91f724f3d136a2c0a7ba2d68d389dd59ca87a363733feac101e",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '3f8ef28d738d6732abd983543ddba190']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:46Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bbf-afcc-408a-8414-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:47.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:47.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:20:47Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:20:47Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bbf-afcc-408a-8414-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bbf-afcc-408a-8414-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/c12c01907256b91f724f3d136a2c0a7ba2d68d389dd59ca87a363733feac101e/analysis/1383661345/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bbf-fb28-4968-9233-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:47.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:47.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: c062f8d21f0970e27b2c389aa34827c455a3cc34cb4b9d32c724f97d6177c701",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'cc94fd2ef1a004a8fed51a537e3caade1e89a751']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:47Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bbf-4d40-42de-8cb7-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:47.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:47.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: c062f8d21f0970e27b2c389aa34827c455a3cc34cb4b9d32c724f97d6177c701",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '1430b0595dca50a227714dc01ba792d5']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:47Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bc0-bd74-4e32-87ed-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:48.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:48.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:20:48Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:20:48Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bc0-bd74-4e32-87ed-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bc0-bd74-4e32-87ed-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/c062f8d21f0970e27b2c389aa34827c455a3cc34cb4b9d32c724f97d6177c701/analysis/1371840965/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bc0-6f4c-4b75-9d49-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:48.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:48.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: a8278e8ebe07b3434553c8bef208ecc04fcd474382e86b9a3bb7293229e2a427",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '0dcdbe60df075d8a579200f470e752b2aee62ca9']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:48Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bc0-e3f0-4db9-a49d-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:48.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:48.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: a8278e8ebe07b3434553c8bef208ecc04fcd474382e86b9a3bb7293229e2a427",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '9d2a3b1207f1cdacf4061d3e374e5a1c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:48Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bc1-82e8-4351-889a-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:49.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:49.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:20:49Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:20:49Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bc1-82e8-4351-889a-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bc1-82e8-4351-889a-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/a8278e8ebe07b3434553c8bef208ecc04fcd474382e86b9a3bb7293229e2a427/analysis/1446630899/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bc1-51cc-458e-b695-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:49.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:49.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: a812833ea49f2d1d758db88e9ee89c2ab4dacb864ef4a2373a20c0bd505e3ed2",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '52c913d7dd5d501100f3733702ef391713666591']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:49Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bc1-a43c-419b-8e09-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:49.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:49.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: a812833ea49f2d1d758db88e9ee89c2ab4dacb864ef4a2373a20c0bd505e3ed2",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'd6e46656fbe6e7a7b9377df63ecf3d72']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:49Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bc1-68d0-4983-94af-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:49.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:49.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:20:49Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:20:49Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bc1-68d0-4983-94af-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bc1-68d0-4983-94af-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/a812833ea49f2d1d758db88e9ee89c2ab4dacb864ef4a2373a20c0bd505e3ed2/analysis/1426233350/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bc2-3bb8-401d-90f3-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:50.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:50.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: a41eade48e93f4f44a177e7cd36ae23219de2415d163ec6abed5b40810a6251e",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '3677fc5b7bf33ab6618dea0cc8dd36ca3fa4c829']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:50Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bc2-7fc8-40bc-8544-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:50.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:50.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: a41eade48e93f4f44a177e7cd36ae23219de2415d163ec6abed5b40810a6251e",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'f4d18d4adc6724114a189aff4b020c9f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:50Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bc2-1068-484b-877f-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:50.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:50.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:20:50Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:20:50Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bc2-1068-484b-877f-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bc2-1068-484b-877f-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/a41eade48e93f4f44a177e7cd36ae23219de2415d163ec6abed5b40810a6251e/analysis/1426161322/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bc3-2ca0-4599-b5e6-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:51.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:51.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 9ab669eab0afb239f3d44db4b394a84309efd661af6896f55f62bf33f97ec3cb",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '326d9e7963dfd0074de00e7431742a4059279965']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:51Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bc3-8564-45e4-acac-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:51.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:51.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 9ab669eab0afb239f3d44db4b394a84309efd661af6896f55f62bf33f97ec3cb",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '26fe65b4c2b633ff8b65040f490e470a']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:51Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bc3-0470-4f41-96a4-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:51.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:51.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:20:51Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:20:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bc3-0470-4f41-96a4-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bc3-0470-4f41-96a4-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/9ab669eab0afb239f3d44db4b394a84309efd661af6896f55f62bf33f97ec3cb/analysis/1356743127/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bc4-0d48-4f41-8ce7-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:52.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:52.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 8f35cb99a0cdb8c98ebefe43b6c533c4d6a1261511f54c3b20c2c6e54273f606",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '5faad5af4cb5cbf84adc6f6870689e7af355189c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:52Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bc4-1530-4c59-bdf4-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:52.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:52.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 8f35cb99a0cdb8c98ebefe43b6c533c4d6a1261511f54c3b20c2c6e54273f606",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '060932c7880b6ddc704cf4ff6a4121d9']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:52Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bc4-67b4-474f-a046-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:52.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:52.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:20:52Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:20:52Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bc4-67b4-474f-a046-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bc4-67b4-474f-a046-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/8f35cb99a0cdb8c98ebefe43b6c533c4d6a1261511f54c3b20c2c6e54273f606/analysis/1446630523/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bc5-9418-4212-91d7-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:53.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:53.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 8a2c418e80f553667ac4c3b66b13ad6282933747175ac7c2794281b4eebb7fab",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '91bee68f55e433826487091815ea0115b39346a2']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:53Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bc5-48f8-45f3-8167-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:53.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:53.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 8a2c418e80f553667ac4c3b66b13ad6282933747175ac7c2794281b4eebb7fab",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '0c54c05ca4171e529404e4fac993c32c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:53Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bc5-f298-499e-9347-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:53.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:53.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:20:53Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:20:53Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bc5-f298-499e-9347-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bc5-f298-499e-9347-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/8a2c418e80f553667ac4c3b66b13ad6282933747175ac7c2794281b4eebb7fab/analysis/1376805948/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bc6-2c8c-4c1a-b5de-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:54.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:54.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 7c617a988bcd3648478e244f67aafb68e7977ba85ee97b3254da5ae3bb0a0bdd",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '3e68173d417cea5558e6cfb7d2654c9304658d6d']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:54Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bc6-60d8-4bd1-8458-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:54.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:54.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 7c617a988bcd3648478e244f67aafb68e7977ba85ee97b3254da5ae3bb0a0bdd",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '9f12db080c58fdf0cc5c159352da9075']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:54Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bc6-0e60-4397-995b-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:54.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:54.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:20:54Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:20:54Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bc6-0e60-4397-995b-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bc6-0e60-4397-995b-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/7c617a988bcd3648478e244f67aafb68e7977ba85ee97b3254da5ae3bb0a0bdd/analysis/1377927578/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bc7-3358-46f0-8a5c-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:55.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:55.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 7bd110c746b3b946b69a25cdcbe7e61e81757266d14bf7e604d18457494675ce",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'd915b6cca9d3741a4d6c81e4cfa2984d1352681c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:55Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bc7-3710-4d2f-a7e6-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:55.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:55.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 7bd110c746b3b946b69a25cdcbe7e61e81757266d14bf7e604d18457494675ce",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'ce5d5a352c37e0b4a6c7c3a332d72e59']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:55Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bc7-a550-49cb-b234-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:55.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:55.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:20:55Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:20:55Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bc7-a550-49cb-b234-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bc7-a550-49cb-b234-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/7bd110c746b3b946b69a25cdcbe7e61e81757266d14bf7e604d18457494675ce/analysis/1370394304/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bc8-be2c-4117-b60c-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:56.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:56.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 7b65e5513a0c60057517386aa026b4ad52d9af8ef3d927fcb03ac2d890dc0202",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '69520c27526b7189f862b9f8a1aab03a60d002d4']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:56Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bc8-94a4-4280-8515-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:56.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:56.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 7b65e5513a0c60057517386aa026b4ad52d9af8ef3d927fcb03ac2d890dc0202",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '4e73989932b3ba50f45fc72cf0b05e9b']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:56Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bc8-4f58-423d-9222-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:56.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:56.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:20:56Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:20:56Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bc8-4f58-423d-9222-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bc8-4f58-423d-9222-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/7b65e5513a0c60057517386aa026b4ad52d9af8ef3d927fcb03ac2d890dc0202/analysis/1422780145/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bc9-f174-44a7-9908-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:57.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:57.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 7902569e1e64b838362a48ef756810bc3e3bb96783e8ae493b545efaaca20455",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '9cc3d000ed55b7d881e9d85df9145f9b4d983d5c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:57Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bc9-6628-4a20-a87d-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:57.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:57.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 7902569e1e64b838362a48ef756810bc3e3bb96783e8ae493b545efaaca20455",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '95d3546229518bd0fb5155ddf47b341f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:57Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bc9-409c-4905-b837-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:57.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:57.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:20:57Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:20:57Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bc9-409c-4905-b837-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bc9-409c-4905-b837-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/7902569e1e64b838362a48ef756810bc3e3bb96783e8ae493b545efaaca20455/analysis/1345909515/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bca-7b74-425c-b38a-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:58.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:58.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 705c2279b3d7f9d7f21685b3251c7c850548b8274f41b798e5a5bf981e73f26d",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '010fd02e53491a0203c8e6adf0547c5b8f9296de']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:58Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bca-8938-42fa-8ae7-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:58.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:58.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 705c2279b3d7f9d7f21685b3251c7c850548b8274f41b798e5a5bf981e73f26d",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '94c43b783fcc1226532058838a4b22b4']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:58Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bca-8738-44ed-9318-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:58.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:58.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:20:58Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:20:58Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bca-8738-44ed-9318-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bca-8738-44ed-9318-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/705c2279b3d7f9d7f21685b3251c7c850548b8274f41b798e5a5bf981e73f26d/analysis/1374735771/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bcb-5108-417e-9b35-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:59.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:59.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 68bdf19e596fa3cc4b08a7743ffa23e1444be6bc9f47da35739e985e1067ae80",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '5b6b3c5860f4ee7190ec0e977d73f7395eb583b4']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:59Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bcb-b2a4-49a5-ac7a-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:59.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:59.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 68bdf19e596fa3cc4b08a7743ffa23e1444be6bc9f47da35739e985e1067ae80",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '815f5a52c155d1c3bcbc4f897c08d2b1']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:20:59Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bcb-8bac-4d3d-bfe8-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:20:59.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:20:59.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:20:59Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:20:59Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bcb-8bac-4d3d-bfe8-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bcb-8bac-4d3d-bfe8-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/68bdf19e596fa3cc4b08a7743ffa23e1444be6bc9f47da35739e985e1067ae80/analysis/1359102361/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bcc-8f4c-4a17-aa5b-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:00.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:00.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 6002821057ba2df0accd13ccd133465cab150d2675c6e607a12ba463d69967cf",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'c123c6f5e80b4e948044ec58cb837897a4bc7300']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:00Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bcc-65f4-47fc-8ae1-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:00.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:00.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 6002821057ba2df0accd13ccd133465cab150d2675c6e607a12ba463d69967cf",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '601878431a8a7131b51779457287d9c5']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:00Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bcc-1d64-4090-bd73-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:00.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:00.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:21:00Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:21:00Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bcc-1d64-4090-bd73-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bcc-1d64-4090-bd73-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/6002821057ba2df0accd13ccd133465cab150d2675c6e607a12ba463d69967cf/analysis/1368144681/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bcd-5048-4fe0-b05c-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:01.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:01.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 5f6382437be9ad658990e28e893d2fe7bf3888735ade7bb1b95d8703b0b01422",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '7fe7fa15ac2cfd1cdc85cb9464f6458003beb131']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:01Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bcd-88e0-412c-aae2-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:01.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:01.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 5f6382437be9ad658990e28e893d2fe7bf3888735ade7bb1b95d8703b0b01422",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'd9c98bd85ce03ef851e1e0c2b5d1ab05']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:01Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bcd-14f4-4846-b6ff-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:01.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:01.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:21:01Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:21:01Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bcd-14f4-4846-b6ff-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bcd-14f4-4846-b6ff-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/5f6382437be9ad658990e28e893d2fe7bf3888735ade7bb1b95d8703b0b01422/analysis/1453106131/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bce-debc-4110-ba8e-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:02.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:02.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 596e1ba536f75ec37643e1d0259aedeedc3fcd71e9a86b99955bbd51a296aacf",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '2d7262f4e121f0751fdfe51b2c902947e8bf571c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bce-88f8-4c48-b703-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:02.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:02.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 596e1ba536f75ec37643e1d0259aedeedc3fcd71e9a86b99955bbd51a296aacf",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '7038acc604e1a2c69aa1d9c2a9fd07af']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bce-3d58-4b19-b395-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:02.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:02.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:21:02Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:21:02Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bce-3d58-4b19-b395-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bce-3d58-4b19-b395-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/596e1ba536f75ec37643e1d0259aedeedc3fcd71e9a86b99955bbd51a296aacf/analysis/1435076357/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bcf-9644-46d4-b1ab-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:03.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:03.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 5570f04292c669e7bb65c4affcb6c4aaabe81f5df5ca6c1c438e34044b90a7f6",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '36de648880588471c0342246e1a639d4a52504c6']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bcf-249c-4028-9d41-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:03.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:03.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 5570f04292c669e7bb65c4affcb6c4aaabe81f5df5ca6c1c438e34044b90a7f6",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'c2c6fb0ff727025ea0a9b60f3608b0ff']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bcf-bcbc-48e9-aa62-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:03.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:03.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:21:03Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:21:03Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bcf-bcbc-48e9-aa62-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bcf-bcbc-48e9-aa62-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/5570f04292c669e7bb65c4affcb6c4aaabe81f5df5ca6c1c438e34044b90a7f6/analysis/1385200040/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bcf-a310-40e2-8a2b-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:03.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:03.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 5142086a334b07caa4d085c0ac61c9563285a820a9883279b359b21c5a9da24e",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '91aaf3bbd1ea0081c5eebbb85c2c36e6762aa569']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bd0-9b04-405e-b8ad-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:04.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:04.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 5142086a334b07caa4d085c0ac61c9563285a820a9883279b359b21c5a9da24e",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '2ae5ee3cac48721f3bd9e6a20bb358cf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:04Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bd0-dfb8-42c3-9b83-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:04.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:04.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:21:04Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:21:04Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bd0-dfb8-42c3-9b83-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bd0-dfb8-42c3-9b83-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/5142086a334b07caa4d085c0ac61c9563285a820a9883279b359b21c5a9da24e/analysis/1350374513/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bd0-381c-4d45-9dcb-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:04.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:04.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 4a72a4cc8f3cdd4cc43269619beafff732742ddeca15a81822dafc56676ab073",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'a81f20351a645231d9dbc40982bdd934a57468b4']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:04Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bd1-0b6c-4829-818a-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:05.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:05.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 4a72a4cc8f3cdd4cc43269619beafff732742ddeca15a81822dafc56676ab073",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '6ee4c5664666fbfa80b4978ad16bcc95']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:05Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bd1-3a40-4057-9c9d-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:05.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:05.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:21:05Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:21:05Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bd1-3a40-4057-9c9d-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bd1-3a40-4057-9c9d-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/4a72a4cc8f3cdd4cc43269619beafff732742ddeca15a81822dafc56676ab073/analysis/1370652479/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bd1-75bc-4236-8cdf-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:05.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:05.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 42448e3308b6f2ba180663c864ea1a6e75f7150699095a56073bb4396620fcb1",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'f75ce2a20da8055b672832c97a320828f7ed0992']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:05Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bd2-ca68-4639-8f27-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:06.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:06.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 42448e3308b6f2ba180663c864ea1a6e75f7150699095a56073bb4396620fcb1",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '8773c54974c33db59ee95318292d14e1']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:06Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bd2-6ae8-4b1c-815b-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:06.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:06.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:21:06Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:21:06Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bd2-6ae8-4b1c-815b-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bd2-6ae8-4b1c-815b-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/42448e3308b6f2ba180663c864ea1a6e75f7150699095a56073bb4396620fcb1/analysis/1350824619/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bd2-58fc-47cb-95ba-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:06.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:06.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 418a89d8b047ba06575392dcf430fb901916e6005034806b43cec6a1fd1621bb",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '230171403b72b58104b249f5a9c1f51d76f3ac8f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:06Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bd3-4cb0-4e91-b6c0-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:07.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:07.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 418a89d8b047ba06575392dcf430fb901916e6005034806b43cec6a1fd1621bb",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '7fb40f038bd1b1b2e6f0127f0d53723c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:07Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bd3-b8cc-4b3b-9338-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:07.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:07.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:21:07Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:21:07Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bd3-b8cc-4b3b-9338-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bd3-b8cc-4b3b-9338-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/418a89d8b047ba06575392dcf430fb901916e6005034806b43cec6a1fd1621bb/analysis/1374441773/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bd3-ea20-4e12-b861-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:07.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:07.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 3bb13fa2c78dd4866c3e753a1e859cdeca2b446a8f9baa5ae8f2a062d4973971",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '2681ba06db2ed164d170ad97bc29ef1c3933f085']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:07Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bd4-a524-4969-81f4-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:08.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:08.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 3bb13fa2c78dd4866c3e753a1e859cdeca2b446a8f9baa5ae8f2a062d4973971",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'a34b48535256476c2fd1e4986519f3a6']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:08Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bd4-28bc-4f65-a7aa-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:08.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:08.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:21:08Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:21:08Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bd4-28bc-4f65-a7aa-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bd4-28bc-4f65-a7aa-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/3bb13fa2c78dd4866c3e753a1e859cdeca2b446a8f9baa5ae8f2a062d4973971/analysis/1377960541/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bd4-7968-4e55-831d-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:08.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:08.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 2f05eda14c7e5d60d2e04aa4457f16f677f4fcfeb189a2c14ecf3c438a70f951",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'f70d83ffba4852e9ccf3c9f1b040d2a2dc7962ab']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:08Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bd5-f9c4-491c-b567-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:09.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:09.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 2f05eda14c7e5d60d2e04aa4457f16f677f4fcfeb189a2c14ecf3c438a70f951",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '62677b6664d53fdb337112730da73f5c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:09Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bd5-1060-4f93-ad41-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:09.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:09.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:21:09Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:21:09Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bd5-1060-4f93-ad41-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bd5-1060-4f93-ad41-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/2f05eda14c7e5d60d2e04aa4457f16f677f4fcfeb189a2c14ecf3c438a70f951/analysis/1376015169/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bd5-d304-4467-b13a-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:09.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:09.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 2d4db05def86adeb92a65721e70105fc0497f6c2633cf7bd80485dc7bd48ebd2",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '4ffa658d37af75a3dcbb252dfc24f063cad3af14']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:09Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bd6-087c-4904-bdd6-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:10.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:10.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 2d4db05def86adeb92a65721e70105fc0497f6c2633cf7bd80485dc7bd48ebd2",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '8390955f0fc751677bbf6df6dc4da370']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:10Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bd6-20e8-496a-85d9-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:10.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:10.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:21:10Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:21:10Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bd6-20e8-496a-85d9-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bd6-20e8-496a-85d9-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/2d4db05def86adeb92a65721e70105fc0497f6c2633cf7bd80485dc7bd48ebd2/analysis/1400935956/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bd6-479c-44d8-9e9a-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:10.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:10.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 2ae86e4e89cd86bde4e612fc9dedbcfa633cc4dd4d046a4f5d80aa85e608bdd5",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '007339a4528dd5d07c404b742fafbc1f687401c7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:10Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bd7-3e94-4751-a9be-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:11.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:11.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 2ae86e4e89cd86bde4e612fc9dedbcfa633cc4dd4d046a4f5d80aa85e608bdd5",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '16ec13572c34195214ec2bb0d9bfce48']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:11Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bd7-8e78-4bed-92aa-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:11.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:11.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:21:11Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:21:11Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bd7-8e78-4bed-92aa-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bd7-8e78-4bed-92aa-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/2ae86e4e89cd86bde4e612fc9dedbcfa633cc4dd4d046a4f5d80aa85e608bdd5/analysis/1377968108/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bd7-2370-496e-8c56-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:11.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:11.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 268cadedf42eb553d0ff7d0fcbbcd18c3b93a6d590d895fbbeb3b7014c4ecd17",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'ff650b0651035861cf94c2f24c2daf97bda4337c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:11Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bd8-b794-4eab-a030-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:12.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:12.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 268cadedf42eb553d0ff7d0fcbbcd18c3b93a6d590d895fbbeb3b7014c4ecd17",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '70cba4032355acde7aec3d6a5bbb2185']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:12Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bd8-c458-46f4-8c48-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:12.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:12.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:21:12Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:21:12Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bd8-c458-46f4-8c48-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bd8-c458-46f4-8c48-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/268cadedf42eb553d0ff7d0fcbbcd18c3b93a6d590d895fbbeb3b7014c4ecd17/analysis/1361906413/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bd8-6690-4209-b12a-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:12.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:12.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 260cac805fdf709b2634d9431c556bbfb7554731e1a766a2484aaebbe6d1f467",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '638afbee7053f8cd6c1c3f2bbf7a78db32f57193']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:12Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bd9-c918-4082-a561-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:13.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:13.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 260cac805fdf709b2634d9431c556bbfb7554731e1a766a2484aaebbe6d1f467",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'b517dde9531481cf9f1f251aa2089829']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:13Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bd9-b890-4703-b087-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:13.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:13.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:21:13Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:21:13Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bd9-b890-4703-b087-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bd9-b890-4703-b087-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/260cac805fdf709b2634d9431c556bbfb7554731e1a766a2484aaebbe6d1f467/analysis/1341966080/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bd9-9200-4a3e-ad7a-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:13.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:13.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 22b0308e131a152a21443d34012e18688df6ecd5a8262cf6b9d05b444a4f9bc7",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '987d34aec9d62cb99a5dd8bf9d850882d12e47c4']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:13Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bda-977c-4ea3-913d-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:14.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:14.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 22b0308e131a152a21443d34012e18688df6ecd5a8262cf6b9d05b444a4f9bc7",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '43ee5edc3a5683723a116c0549ca2749']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bda-93ec-40b8-a8d2-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:14.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:14.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:21:14Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:21:14Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bda-93ec-40b8-a8d2-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bda-93ec-40b8-a8d2-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/22b0308e131a152a21443d34012e18688df6ecd5a8262cf6b9d05b444a4f9bc7/analysis/1377960540/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bda-0a14-4f04-9a40-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:14.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:14.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 19916e513c810b1aa0a86d162d3381280a8c1314635026242cb86af2cf1b9cc3",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'edda0c5ffd1505eb45366e7fa7baf304f886a890']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bdb-7738-491c-8f17-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:14.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:14.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 19916e513c810b1aa0a86d162d3381280a8c1314635026242cb86af2cf1b9cc3",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'ba5d1c1f4c48427d683f94dd901a0b1b']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bdb-c0e4-497e-94d9-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:15.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:15.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:21:15Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:21:15Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bdb-c0e4-497e-94d9-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bdb-c0e4-497e-94d9-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/19916e513c810b1aa0a86d162d3381280a8c1314635026242cb86af2cf1b9cc3/analysis/1410336206/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bdb-0708-4bce-8e4b-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:15.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:15.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 11bf1d2d32b35884347d7a44c393c3b74691742434132ff374dcdecd700d749f",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '28116c0541c3e55adecfdacc73bb59e75f53d481']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:15Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bdb-b9a4-47c5-ac94-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:15.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:15.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 11bf1d2d32b35884347d7a44c393c3b74691742434132ff374dcdecd700d749f",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '3a2350adfb1af589cf26e23c79992d8b']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:15Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bdc-bad4-45e0-a38a-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:16.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:16.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:21:16Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:21:16Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bdc-bad4-45e0-a38a-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bdc-bad4-45e0-a38a-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/11bf1d2d32b35884347d7a44c393c3b74691742434132ff374dcdecd700d749f/analysis/1369183473/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bdc-bacc-4289-b7b4-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:16.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:16.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 0bca323171b01cd6bee5d923f28d15bc5b15d5afb9984a24c7498f63889ffc62",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'cc54ed3facb09de9ade70a53368557c4f67f1de0']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:16Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bdc-5100-4ed3-8410-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:16.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:16.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 0bca323171b01cd6bee5d923f28d15bc5b15d5afb9984a24c7498f63889ffc62",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'd0b4bb84e11a8f5892f083c2e08e24f7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:16Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bdd-5018-44d6-be3f-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:17.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:17.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:21:17Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:21:17Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bdd-5018-44d6-be3f-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bdd-5018-44d6-be3f-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/0bca323171b01cd6bee5d923f28d15bc5b15d5afb9984a24c7498f63889ffc62/analysis/1370222894/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bdd-f0c0-4577-beb2-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:17.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:17.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 016806cce6bd26791b3bdd2dd05b555b2142f402fb2f97616773c17345f4a2b5",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'c0af6aaf7c177a53b0ed406a97708b75447d79c0']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:17Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56bf3bdd-efd8-47fa-b6cd-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:17.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:17.000Z",
|
|
|
|
|
"description": "Elise - Xchecked via VT: 016806cce6bd26791b3bdd2dd05b555b2142f402fb2f97616773c17345f4a2b5",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '65abb1da7849078405e9352fe1b5dc17']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-02-13T14:21:17Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56bf3bde-b4f4-40ce-aeb7-6cf702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-02-13T14:21:18.000Z",
|
|
|
|
|
"modified": "2016-02-13T14:21:18.000Z",
|
|
|
|
|
"first_observed": "2016-02-13T14:21:18Z",
|
|
|
|
|
"last_observed": "2016-02-13T14:21:18Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56bf3bde-b4f4-40ce-aeb7-6cf702de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56bf3bde-b4f4-40ce-aeb7-6cf702de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/016806cce6bd26791b3bdd2dd05b555b2142f402fb2f97616773c17345f4a2b5/analysis/1425966430/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "marking-definition",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
|
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
|
|
|
"definition_type": "tlp",
|
|
|
|
|
"name": "TLP:WHITE",
|
|
|
|
|
"definition": {
|
|
|
|
|
"tlp": "white"
|
|
|
|
|
}
|
|
|
|
|
}
|
2023-04-21 13:25:09 +00:00
|
|
|
]
|
|
|
|
|
}
|
