2023-04-21 13:25:09 +00:00
|
|
|
{
|
2023-06-14 17:31:25 +00:00
|
|
|
"type": "bundle",
|
|
|
|
|
"id": "bundle--577375a9-9ab8-4163-84ab-a395950d210f",
|
|
|
|
|
"objects": [
|
|
|
|
|
{
|
|
|
|
|
"type": "identity",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:32.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:32.000Z",
|
|
|
|
|
"name": "CIRCL",
|
|
|
|
|
"identity_class": "organization"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "report",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "report--577375a9-9ab8-4163-84ab-a395950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:32.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:32.000Z",
|
|
|
|
|
"name": "OSINT - The Latest Android Overlay Malware Spreading via SMS Phishing in Europe",
|
|
|
|
|
"published": "2016-06-29T07:43:36Z",
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"indicator--57737649-75a0-48f3-a649-a3c6950d210f",
|
|
|
|
|
"indicator--57737649-8d18-4dd3-aea7-a3c6950d210f",
|
|
|
|
|
"indicator--5773764a-de28-400b-8b3a-a3c6950d210f",
|
|
|
|
|
"indicator--5773764a-d8b8-4fa9-ba08-a3c6950d210f",
|
|
|
|
|
"indicator--5773764a-4b84-4fcf-9435-a3c6950d210f",
|
|
|
|
|
"indicator--5773764a-d3d0-43e9-8822-a3c6950d210f",
|
|
|
|
|
"indicator--5773764a-a43c-4915-ad05-a3c6950d210f",
|
|
|
|
|
"indicator--5773764b-06ec-4910-a581-a3c6950d210f",
|
|
|
|
|
"indicator--5773764b-2714-4857-b257-a3c6950d210f",
|
|
|
|
|
"indicator--5773764b-c514-4c40-9332-a3c6950d210f",
|
|
|
|
|
"indicator--5773764b-9e6c-4efc-b541-a3c6950d210f",
|
|
|
|
|
"indicator--577378b8-37b0-4cb3-8d5f-dbf8950d210f",
|
|
|
|
|
"indicator--577378b8-dbf4-4121-aa38-dbf8950d210f",
|
|
|
|
|
"indicator--577378b9-ba14-4812-837c-dbf8950d210f",
|
|
|
|
|
"indicator--577378b9-be44-466c-8bf5-dbf8950d210f",
|
|
|
|
|
"indicator--577378b9-2e18-4f6a-9466-dbf8950d210f",
|
|
|
|
|
"indicator--577378b9-6fa4-4935-b8f5-dbf8950d210f",
|
|
|
|
|
"indicator--577378ba-361c-4b68-8c33-dbf8950d210f",
|
|
|
|
|
"indicator--577378ba-3a44-4c54-abae-dbf8950d210f",
|
|
|
|
|
"indicator--577378ba-2264-4fe3-9825-dbf8950d210f",
|
|
|
|
|
"indicator--577378ba-1568-4129-8de3-dbf8950d210f",
|
|
|
|
|
"indicator--577378ba-55c8-4f23-aba9-dbf8950d210f",
|
|
|
|
|
"indicator--577378ba-f2b4-4201-8d60-dbf8950d210f",
|
|
|
|
|
"indicator--577378bb-dc68-417e-ab84-dbf8950d210f",
|
|
|
|
|
"indicator--577378bb-edfc-4f10-a82c-dbf8950d210f",
|
|
|
|
|
"indicator--577378bb-c77c-4c0a-989e-dbf8950d210f",
|
|
|
|
|
"indicator--577378bb-61ac-487c-ab87-dbf8950d210f",
|
|
|
|
|
"indicator--577378bc-4a2c-4bf5-bab2-dbf8950d210f",
|
|
|
|
|
"indicator--577378bc-080c-4efd-86a3-dbf8950d210f",
|
|
|
|
|
"indicator--577378bc-da74-47a1-8275-dbf8950d210f",
|
|
|
|
|
"indicator--577379fd-1820-434b-8073-c9c8950d210f",
|
|
|
|
|
"indicator--577379fd-5464-4cf6-b543-c9c8950d210f",
|
|
|
|
|
"indicator--577379fd-4010-4468-a240-c9c8950d210f",
|
|
|
|
|
"indicator--577379fe-f1c8-40c5-8403-c9c8950d210f",
|
|
|
|
|
"indicator--577379fe-a8fc-44bd-9641-c9c8950d210f",
|
|
|
|
|
"indicator--57737a80-fc90-482e-b261-c9c802de0b81",
|
|
|
|
|
"indicator--57737a80-0898-42cb-b207-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a81-4940-40c9-95df-c9c802de0b81",
|
|
|
|
|
"url--57737a81-4940-40c9-95df-c9c802de0b81",
|
|
|
|
|
"indicator--57737a81-e3a4-4103-bc3f-c9c802de0b81",
|
|
|
|
|
"indicator--57737a81-e1f8-417a-9412-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a81-bd50-43d6-9a25-c9c802de0b81",
|
|
|
|
|
"url--57737a81-bd50-43d6-9a25-c9c802de0b81",
|
|
|
|
|
"indicator--57737a81-5e98-4973-a00a-c9c802de0b81",
|
|
|
|
|
"indicator--57737a82-0da0-4a16-bf24-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a82-b620-4646-af16-c9c802de0b81",
|
|
|
|
|
"url--57737a82-b620-4646-af16-c9c802de0b81",
|
|
|
|
|
"indicator--57737a82-b9d8-474f-abc7-c9c802de0b81",
|
|
|
|
|
"indicator--57737a82-b288-493a-a940-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a83-8cc4-4cc0-9be1-c9c802de0b81",
|
|
|
|
|
"url--57737a83-8cc4-4cc0-9be1-c9c802de0b81",
|
|
|
|
|
"indicator--57737a83-6ac4-4b9b-876b-c9c802de0b81",
|
|
|
|
|
"indicator--57737a83-010c-4a02-88f5-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a83-18c4-4a99-a65b-c9c802de0b81",
|
|
|
|
|
"url--57737a83-18c4-4a99-a65b-c9c802de0b81",
|
|
|
|
|
"indicator--57737a83-8fdc-4e03-8451-c9c802de0b81",
|
|
|
|
|
"indicator--57737a84-cc0c-436b-9a0b-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a84-f5a0-4d6d-9ac7-c9c802de0b81",
|
|
|
|
|
"url--57737a84-f5a0-4d6d-9ac7-c9c802de0b81",
|
|
|
|
|
"indicator--57737a84-3580-4c33-823a-c9c802de0b81",
|
|
|
|
|
"indicator--57737a84-d10c-49e2-9a96-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a84-7db0-4141-8d82-c9c802de0b81",
|
|
|
|
|
"url--57737a84-7db0-4141-8d82-c9c802de0b81",
|
|
|
|
|
"indicator--57737a85-b13c-4651-a701-c9c802de0b81",
|
|
|
|
|
"indicator--57737a85-7b3c-4519-8e01-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a85-8368-4366-9165-c9c802de0b81",
|
|
|
|
|
"url--57737a85-8368-4366-9165-c9c802de0b81",
|
|
|
|
|
"indicator--57737a85-b3b0-4ded-b0c2-c9c802de0b81",
|
|
|
|
|
"indicator--57737a85-e738-459d-bbbb-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a86-e5c8-42ad-ad70-c9c802de0b81",
|
|
|
|
|
"url--57737a86-e5c8-42ad-ad70-c9c802de0b81",
|
|
|
|
|
"indicator--57737a86-da1c-48f4-a93e-c9c802de0b81",
|
|
|
|
|
"indicator--57737a86-5260-4e75-a398-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a86-b818-4960-b519-c9c802de0b81",
|
|
|
|
|
"url--57737a86-b818-4960-b519-c9c802de0b81",
|
|
|
|
|
"indicator--57737a86-5f10-40cf-9224-c9c802de0b81",
|
|
|
|
|
"indicator--57737a86-d368-4376-a09e-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a87-c668-4835-9fb2-c9c802de0b81",
|
|
|
|
|
"url--57737a87-c668-4835-9fb2-c9c802de0b81",
|
|
|
|
|
"indicator--57737a87-2ab4-41f9-991c-c9c802de0b81",
|
|
|
|
|
"indicator--57737a87-a698-482e-aa32-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a87-c068-48fb-a489-c9c802de0b81",
|
|
|
|
|
"url--57737a87-c068-48fb-a489-c9c802de0b81",
|
|
|
|
|
"indicator--57737a87-153c-4463-935d-c9c802de0b81",
|
|
|
|
|
"indicator--57737a88-190c-4784-9db4-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a88-4998-4a8f-8b92-c9c802de0b81",
|
|
|
|
|
"url--57737a88-4998-4a8f-8b92-c9c802de0b81",
|
|
|
|
|
"indicator--57737a88-7d0c-42d6-9bf0-c9c802de0b81",
|
|
|
|
|
"indicator--57737a88-adec-426c-909f-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a88-268c-4f19-b5e8-c9c802de0b81",
|
|
|
|
|
"url--57737a88-268c-4f19-b5e8-c9c802de0b81",
|
|
|
|
|
"indicator--57737a89-c8ac-4671-abef-c9c802de0b81",
|
|
|
|
|
"indicator--57737a89-15dc-42c8-b040-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a89-7020-4f9c-ad6f-c9c802de0b81",
|
|
|
|
|
"url--57737a89-7020-4f9c-ad6f-c9c802de0b81",
|
|
|
|
|
"indicator--57737a89-b75c-458f-9e83-c9c802de0b81",
|
|
|
|
|
"indicator--57737a89-28c0-4173-a97f-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a8a-a13c-46db-a6ee-c9c802de0b81",
|
|
|
|
|
"url--57737a8a-a13c-46db-a6ee-c9c802de0b81",
|
|
|
|
|
"indicator--57737a8a-58a4-45fa-b7b3-c9c802de0b81",
|
|
|
|
|
"indicator--57737a8a-7aa0-41e9-bfa3-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a8a-2478-4b67-88e7-c9c802de0b81",
|
|
|
|
|
"url--57737a8a-2478-4b67-88e7-c9c802de0b81",
|
|
|
|
|
"indicator--57737a8a-ad00-44f8-bdc9-c9c802de0b81",
|
|
|
|
|
"indicator--57737a8b-7034-4178-9f84-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a8b-d0a4-4742-b61b-c9c802de0b81",
|
|
|
|
|
"url--57737a8b-d0a4-4742-b61b-c9c802de0b81",
|
|
|
|
|
"indicator--57737a8b-5ad8-40af-8d3e-c9c802de0b81",
|
|
|
|
|
"indicator--57737a8b-7630-4580-bd81-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a8c-ddbc-48ec-8c6e-c9c802de0b81",
|
|
|
|
|
"url--57737a8c-ddbc-48ec-8c6e-c9c802de0b81",
|
|
|
|
|
"indicator--57737a8c-6450-448d-ad8d-c9c802de0b81",
|
|
|
|
|
"indicator--57737a8c-4f38-4218-b73f-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a8c-4900-486a-b9c2-c9c802de0b81",
|
|
|
|
|
"url--57737a8c-4900-486a-b9c2-c9c802de0b81",
|
|
|
|
|
"indicator--57737a8c-89a8-4e82-81c2-c9c802de0b81",
|
|
|
|
|
"indicator--57737a8d-2aa8-4f6e-a52f-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a8d-42a0-409d-a7d5-c9c802de0b81",
|
|
|
|
|
"url--57737a8d-42a0-409d-a7d5-c9c802de0b81",
|
|
|
|
|
"indicator--57737a8d-4f0c-4ca4-91de-c9c802de0b81",
|
|
|
|
|
"indicator--57737a8d-34a0-4471-8d62-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a8e-a578-44a5-9f6d-c9c802de0b81",
|
|
|
|
|
"url--57737a8e-a578-44a5-9f6d-c9c802de0b81",
|
|
|
|
|
"indicator--57737a8e-6470-49f4-a8be-c9c802de0b81",
|
|
|
|
|
"indicator--57737a8e-0ea4-42c0-8802-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a8e-6a00-4827-bbc6-c9c802de0b81",
|
|
|
|
|
"url--57737a8e-6a00-4827-bbc6-c9c802de0b81",
|
|
|
|
|
"indicator--57737a8e-1b30-4395-b960-c9c802de0b81",
|
|
|
|
|
"indicator--57737a8f-d180-4f76-9c7b-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a8f-4d5c-41dc-bf98-c9c802de0b81",
|
|
|
|
|
"url--57737a8f-4d5c-41dc-bf98-c9c802de0b81",
|
|
|
|
|
"indicator--57737a8f-9e48-461f-b576-c9c802de0b81",
|
|
|
|
|
"indicator--57737a8f-0918-499a-a954-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a8f-7788-4d28-88da-c9c802de0b81",
|
|
|
|
|
"url--57737a8f-7788-4d28-88da-c9c802de0b81",
|
|
|
|
|
"indicator--57737a90-b034-429d-ad5e-c9c802de0b81",
|
|
|
|
|
"indicator--57737a90-2330-42c0-919d-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a90-4ad8-4cae-bcf2-c9c802de0b81",
|
|
|
|
|
"url--57737a90-4ad8-4cae-bcf2-c9c802de0b81",
|
|
|
|
|
"indicator--57737a90-bff4-4bd6-92f7-c9c802de0b81",
|
|
|
|
|
"indicator--57737a91-c378-4ba4-8c79-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a91-58f8-4667-9019-c9c802de0b81",
|
|
|
|
|
"url--57737a91-58f8-4667-9019-c9c802de0b81",
|
|
|
|
|
"indicator--57737a91-441c-4cac-ba79-c9c802de0b81",
|
|
|
|
|
"indicator--57737a91-1edc-490f-9153-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a91-bd68-4b5b-97dd-c9c802de0b81",
|
|
|
|
|
"url--57737a91-bd68-4b5b-97dd-c9c802de0b81",
|
|
|
|
|
"indicator--57737a92-ea2c-4a87-a2cf-c9c802de0b81",
|
|
|
|
|
"indicator--57737a92-37cc-476a-b5aa-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a92-85fc-4817-9c8a-c9c802de0b81",
|
|
|
|
|
"url--57737a92-85fc-4817-9c8a-c9c802de0b81",
|
|
|
|
|
"indicator--57737a92-2440-4839-931d-c9c802de0b81",
|
|
|
|
|
"indicator--57737a92-5f84-4fdc-aa0f-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a93-a708-4f47-a0e0-c9c802de0b81",
|
|
|
|
|
"url--57737a93-a708-4f47-a0e0-c9c802de0b81",
|
|
|
|
|
"indicator--57737a93-13e8-4b4b-984d-c9c802de0b81",
|
|
|
|
|
"indicator--57737a93-02b8-49a9-b18c-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a93-f4a8-48db-bc65-c9c802de0b81",
|
|
|
|
|
"url--57737a93-f4a8-48db-bc65-c9c802de0b81",
|
|
|
|
|
"indicator--57737a94-8978-406c-bdcb-c9c802de0b81",
|
|
|
|
|
"indicator--57737a94-7888-4600-bcc5-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a94-ff14-4a47-b7a6-c9c802de0b81",
|
|
|
|
|
"url--57737a94-ff14-4a47-b7a6-c9c802de0b81",
|
|
|
|
|
"indicator--57737a94-8998-47e1-86aa-c9c802de0b81",
|
|
|
|
|
"indicator--57737a94-ed34-4402-bce4-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a95-e7f0-44a9-ab2e-c9c802de0b81",
|
|
|
|
|
"url--57737a95-e7f0-44a9-ab2e-c9c802de0b81",
|
|
|
|
|
"indicator--57737a95-135c-41f7-b505-c9c802de0b81",
|
|
|
|
|
"indicator--57737a95-6a80-427f-9959-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a95-e9fc-4029-8a8e-c9c802de0b81",
|
|
|
|
|
"url--57737a95-e9fc-4029-8a8e-c9c802de0b81",
|
|
|
|
|
"indicator--57737a96-34cc-4915-8c44-c9c802de0b81",
|
|
|
|
|
"indicator--57737a96-5470-47b1-9bc4-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a96-ddf8-430a-9757-c9c802de0b81",
|
|
|
|
|
"url--57737a96-ddf8-430a-9757-c9c802de0b81",
|
|
|
|
|
"indicator--57737a96-10d0-49d8-bca3-c9c802de0b81",
|
|
|
|
|
"indicator--57737a96-846c-4aed-8148-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a97-e5b0-44d2-9b9c-c9c802de0b81",
|
|
|
|
|
"url--57737a97-e5b0-44d2-9b9c-c9c802de0b81",
|
|
|
|
|
"indicator--57737a97-b704-4835-a2b8-c9c802de0b81",
|
|
|
|
|
"indicator--57737a97-9930-4620-8288-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a97-9954-4952-8088-c9c802de0b81",
|
|
|
|
|
"url--57737a97-9954-4952-8088-c9c802de0b81",
|
|
|
|
|
"indicator--57737a97-581c-497f-a0eb-c9c802de0b81",
|
|
|
|
|
"indicator--57737a98-5908-4648-b83e-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a98-0680-4c77-82b3-c9c802de0b81",
|
|
|
|
|
"url--57737a98-0680-4c77-82b3-c9c802de0b81",
|
|
|
|
|
"indicator--57737a98-dbb4-4aee-9550-c9c802de0b81",
|
|
|
|
|
"indicator--57737a98-a4e8-437f-921a-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a99-4878-415f-ae44-c9c802de0b81",
|
|
|
|
|
"url--57737a99-4878-415f-ae44-c9c802de0b81",
|
|
|
|
|
"indicator--57737a99-c7a8-4cc3-befa-c9c802de0b81",
|
|
|
|
|
"indicator--57737a99-9c78-4dc1-a827-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a99-e070-4142-bb77-c9c802de0b81",
|
|
|
|
|
"url--57737a99-e070-4142-bb77-c9c802de0b81",
|
|
|
|
|
"indicator--57737a99-fe24-47f2-b4d0-c9c802de0b81",
|
|
|
|
|
"indicator--57737a9a-4434-4a02-abe3-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a9a-cac8-4718-b5c7-c9c802de0b81",
|
|
|
|
|
"url--57737a9a-cac8-4718-b5c7-c9c802de0b81",
|
|
|
|
|
"indicator--57737a9a-b7b4-4d69-b90f-c9c802de0b81",
|
|
|
|
|
"indicator--57737a9a-c560-4b0b-ab6a-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a9a-5138-4565-9563-c9c802de0b81",
|
|
|
|
|
"url--57737a9a-5138-4565-9563-c9c802de0b81",
|
|
|
|
|
"indicator--57737a9b-3cc0-437d-afb9-c9c802de0b81",
|
|
|
|
|
"indicator--57737a9b-a7c8-4625-99c7-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a9b-350c-44f2-b85a-c9c802de0b81",
|
|
|
|
|
"url--57737a9b-350c-44f2-b85a-c9c802de0b81",
|
|
|
|
|
"indicator--57737a9b-8594-4dcd-859b-c9c802de0b81",
|
|
|
|
|
"indicator--57737a9c-e084-4c89-a220-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a9c-cecc-4252-b348-c9c802de0b81",
|
|
|
|
|
"url--57737a9c-cecc-4252-b348-c9c802de0b81",
|
|
|
|
|
"indicator--57737a9c-da4c-427a-b2ce-c9c802de0b81",
|
|
|
|
|
"indicator--57737a9c-1558-4981-8804-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a9c-a53c-424f-9635-c9c802de0b81",
|
|
|
|
|
"url--57737a9c-a53c-424f-9635-c9c802de0b81",
|
|
|
|
|
"indicator--57737a9d-c494-4225-b313-c9c802de0b81",
|
|
|
|
|
"indicator--57737a9d-980c-4b96-8368-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a9d-e5c4-4f24-a0f9-c9c802de0b81",
|
|
|
|
|
"url--57737a9d-e5c4-4f24-a0f9-c9c802de0b81",
|
|
|
|
|
"indicator--57737a9d-9d48-4b37-ac8b-c9c802de0b81",
|
|
|
|
|
"indicator--57737a9e-8138-4b5f-8ff9-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a9e-2e28-474c-9e5e-c9c802de0b81",
|
|
|
|
|
"url--57737a9e-2e28-474c-9e5e-c9c802de0b81",
|
|
|
|
|
"indicator--57737a9e-2900-4aa9-98d2-c9c802de0b81",
|
|
|
|
|
"indicator--57737a9e-d960-4085-be05-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a9e-8cac-45f5-90bc-c9c802de0b81",
|
|
|
|
|
"url--57737a9e-8cac-45f5-90bc-c9c802de0b81",
|
|
|
|
|
"indicator--57737a9f-933c-412b-be33-c9c802de0b81",
|
|
|
|
|
"indicator--57737a9f-5e1c-4a29-8cff-c9c802de0b81",
|
|
|
|
|
"observed-data--57737a9f-2fe0-4838-954f-c9c802de0b81",
|
|
|
|
|
"url--57737a9f-2fe0-4838-954f-c9c802de0b81",
|
|
|
|
|
"indicator--57737a9f-3a98-41e9-9d03-c9c802de0b81",
|
|
|
|
|
"indicator--57737a9f-2ee0-45af-b662-c9c802de0b81",
|
|
|
|
|
"observed-data--57737aa0-85e8-4584-aa23-c9c802de0b81",
|
|
|
|
|
"url--57737aa0-85e8-4584-aa23-c9c802de0b81",
|
|
|
|
|
"indicator--57737aa0-cb88-4d36-a07d-c9c802de0b81",
|
|
|
|
|
"indicator--57737aa0-a6ac-4927-b127-c9c802de0b81",
|
|
|
|
|
"observed-data--57737aa0-e268-43fd-948c-c9c802de0b81",
|
|
|
|
|
"url--57737aa0-e268-43fd-948c-c9c802de0b81",
|
|
|
|
|
"indicator--57737aa1-9390-44ff-9087-c9c802de0b81",
|
|
|
|
|
"indicator--57737aa1-71f4-4601-bd7c-c9c802de0b81",
|
|
|
|
|
"observed-data--57737aa1-3630-45ca-a423-c9c802de0b81",
|
|
|
|
|
"url--57737aa1-3630-45ca-a423-c9c802de0b81",
|
|
|
|
|
"indicator--57737aa1-4d28-4e16-983b-c9c802de0b81",
|
|
|
|
|
"indicator--57737aa1-984c-4d43-a115-c9c802de0b81",
|
|
|
|
|
"observed-data--57737aa2-9534-4039-849f-c9c802de0b81",
|
|
|
|
|
"url--57737aa2-9534-4039-849f-c9c802de0b81",
|
|
|
|
|
"indicator--57737aa2-c0a0-4e5b-a392-c9c802de0b81",
|
|
|
|
|
"indicator--57737aa2-2458-4b3d-8a87-c9c802de0b81",
|
|
|
|
|
"observed-data--57737aa2-f83c-485b-aa23-c9c802de0b81",
|
|
|
|
|
"url--57737aa2-f83c-485b-aa23-c9c802de0b81",
|
|
|
|
|
"indicator--57737aa3-afd0-4eb9-9566-c9c802de0b81",
|
|
|
|
|
"indicator--57737aa3-b670-408f-94fc-c9c802de0b81",
|
|
|
|
|
"observed-data--57737aa3-7158-4fd5-9f74-c9c802de0b81",
|
|
|
|
|
"url--57737aa3-7158-4fd5-9f74-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"Threat-Report",
|
|
|
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
|
|
|
"type:OSINT",
|
|
|
|
|
"ecsirt:malicious-code=\"malware\"",
|
|
|
|
|
"circl:incident-classification=\"malware\""
|
|
|
|
|
],
|
|
|
|
|
"object_marking_refs": [
|
|
|
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737649-75a0-48f3-a649-a3c6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:18:33.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:18:33.000Z",
|
|
|
|
|
"description": "Sample",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '2c055d7b5199604cd5cf3441073b36b3']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:18:33Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737649-8d18-4dd3-aea7-a3c6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:18:33.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:18:33.000Z",
|
|
|
|
|
"description": "Sample",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'a72aa534973eeaf0782a246d502107a3']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:18:33Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5773764a-de28-400b-8b3a-a3c6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:18:34.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:18:34.000Z",
|
|
|
|
|
"description": "Sample",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'f1c8a3337cbd56e01e478774f5d55278']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:18:34Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5773764a-d8b8-4fa9-ba08-a3c6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:18:34.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:18:34.000Z",
|
|
|
|
|
"description": "Sample",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'da222d4b7993a62665b9eaef10c1846f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:18:34Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5773764a-4b84-4fcf-9435-a3c6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:18:34.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:18:34.000Z",
|
|
|
|
|
"description": "Sample",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '152f626eb92676f940ada4b7077acf16']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:18:34Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5773764a-d3d0-43e9-8822-a3c6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:18:34.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:18:34.000Z",
|
|
|
|
|
"description": "Sample",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '7a99b60349703aed3ab28f498320f247']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:18:34Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5773764a-a43c-4915-ad05-a3c6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:18:34.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:18:34.000Z",
|
|
|
|
|
"description": "Sample",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '1b9e1cd2c7f8e227b2ae5fb5bc735536']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:18:34Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5773764b-06ec-4910-a581-a3c6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:18:35.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:18:35.000Z",
|
|
|
|
|
"description": "Sample",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'd84ff5a7e7c0c33dcfa237299869bc34']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:18:35Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5773764b-2714-4857-b257-a3c6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:18:35.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:18:35.000Z",
|
|
|
|
|
"description": "Sample",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'd70296d3dc4937dedd44f93bb3b74034']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:18:35Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5773764b-c514-4c40-9332-a3c6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:18:35.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:18:35.000Z",
|
|
|
|
|
"description": "Sample",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '88b23b6a5c1b72aeff2fc42e05c173a7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:18:35Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5773764b-9e6c-4efc-b541-a3c6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:18:35.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:18:35.000Z",
|
|
|
|
|
"description": "Sample",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '036258e2c51e21c140b5838ce9bfb4f8']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:18:35Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--577378b8-37b0-4cb3-8d5f-dbf8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:28:56.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:28:56.000Z",
|
|
|
|
|
"description": "via OCR",
|
|
|
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '85.93.5.108']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:28:56Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--577378b8-dbf4-4121-aa38-dbf8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:28:56.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:28:56.000Z",
|
|
|
|
|
"description": "via OCR",
|
|
|
|
|
"pattern": "[url:value = 'http://85.93.5.108//?action=command']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:28:56Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--577378b9-ba14-4812-837c-dbf8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:28:57.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:28:57.000Z",
|
|
|
|
|
"description": "via OCR",
|
|
|
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '85.93.5.109']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:28:57Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--577378b9-be44-466c-8bf5-dbf8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:28:57.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:28:57.000Z",
|
|
|
|
|
"description": "via OCR",
|
|
|
|
|
"pattern": "[url:value = 'http://85.93.5.109/?action=command']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:28:57Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--577378b9-2e18-4f6a-9466-dbf8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:28:57.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:28:57.000Z",
|
|
|
|
|
"description": "via OCR",
|
|
|
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '85.93.5.139']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:28:57Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--577378b9-6fa4-4935-b8f5-dbf8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:28:57.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:28:57.000Z",
|
|
|
|
|
"description": "via OCR",
|
|
|
|
|
"pattern": "[url:value = 'http://85.93.5.139/?action=command']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:28:57Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--577378ba-361c-4b68-8c33-dbf8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:28:58.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:28:58.000Z",
|
|
|
|
|
"description": "via OCR",
|
|
|
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '85.93.5.83']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:28:58Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--577378ba-3a44-4c54-abae-dbf8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:28:58.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:28:58.000Z",
|
|
|
|
|
"description": "via OCR",
|
|
|
|
|
"pattern": "[url:value = 'http://85.93.5.83/?action=command']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:28:58Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--577378ba-2264-4fe3-9825-dbf8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:28:58.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:28:58.000Z",
|
|
|
|
|
"description": "via OCR",
|
|
|
|
|
"pattern": "[url:value = 'http://62.138.0.117/?action=command']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:28:58Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--577378ba-1568-4129-8de3-dbf8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:28:58.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:28:58.000Z",
|
|
|
|
|
"description": "via OCR",
|
|
|
|
|
"pattern": "[file:name = '54.93.1015']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:28:58Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"filename\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--577378ba-55c8-4f23-aba9-dbf8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:28:58.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:28:58.000Z",
|
|
|
|
|
"description": "via OCR",
|
|
|
|
|
"pattern": "[url:value = 'http://54.93.101.5/?action=command']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:28:58Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--577378ba-f2b4-4201-8d60-dbf8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:28:58.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:28:58.000Z",
|
|
|
|
|
"description": "via OCR",
|
|
|
|
|
"pattern": "[url:value = 'http://5.61.39.3/?action=command']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:28:58Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--577378bb-dc68-417e-ab84-dbf8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:28:59.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:28:59.000Z",
|
|
|
|
|
"description": "via OCR",
|
|
|
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '193.105.240.158']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:28:59Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--577378bb-edfc-4f10-a82c-dbf8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:28:59.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:28:59.000Z",
|
|
|
|
|
"description": "via OCR",
|
|
|
|
|
"pattern": "[url:value = 'http://193.105.240.158/?action=command']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:28:59Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--577378bb-c77c-4c0a-989e-dbf8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:28:59.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:28:59.000Z",
|
|
|
|
|
"description": "via OCR",
|
|
|
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '102.220.240.24']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:28:59Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--577378bb-61ac-487c-ab87-dbf8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:28:59.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:28:59.000Z",
|
|
|
|
|
"description": "via OCR",
|
|
|
|
|
"pattern": "[url:value = 'http://162.220.246.24/?action=command']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:28:59Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--577378bc-4a2c-4bf5-bab2-dbf8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:29:00.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:29:00.000Z",
|
|
|
|
|
"description": "via OCR",
|
|
|
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '91.224.101.102']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:29:00Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--577378bc-080c-4efd-86a3-dbf8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:29:00.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:29:00.000Z",
|
|
|
|
|
"description": "via OCR",
|
|
|
|
|
"pattern": "[url:value = 'http://91.224.161.102/?action=command']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:29:00Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--577378bc-da74-47a1-8275-dbf8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:29:00.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:29:00.000Z",
|
|
|
|
|
"description": "via OCR",
|
|
|
|
|
"pattern": "[url:value = 'http://37.1.205.193/?action=command']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:29:00Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--577379fd-1820-434b-8073-c9c8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:34:21.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:34:21.000Z",
|
|
|
|
|
"description": "via OCR",
|
|
|
|
|
"pattern": "[file:name = 'postdanmark.menu']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:34:21Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"filename\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--577379fd-5464-4cf6-b543-c9c8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:34:21.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:34:21.000Z",
|
|
|
|
|
"description": "via OCR",
|
|
|
|
|
"pattern": "[domain-name:value = 'postdanmark.org']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:34:21Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"domain\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--577379fd-4010-4468-a240-c9c8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:34:21.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:34:21.000Z",
|
|
|
|
|
"description": "via OCR",
|
|
|
|
|
"pattern": "[domain-name:value = 'mmstildig.info']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:34:21Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"domain\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--577379fe-f1c8-40c5-8403-c9c8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:34:22.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:34:22.000Z",
|
|
|
|
|
"description": "via OCR",
|
|
|
|
|
"pattern": "[domain-name:value = 'mmstildig.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:34:22Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"domain\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--577379fe-a8fc-44bd-9641-c9c8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:34:22.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:34:22.000Z",
|
|
|
|
|
"description": "via OCR",
|
|
|
|
|
"pattern": "[domain-name:value = 'mmstildig.net']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:34:22Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"domain\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a80-fc90-482e-b261-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:32.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:32.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 036258e2c51e21c140b5838ce9bfb4f8",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'cffebdbb1ab9c1c7be4349973cd530a14776a2952a0c28badf71a0ca83dae940']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:32Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a80-0898-42cb-b207-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:32.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:32.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 036258e2c51e21c140b5838ce9bfb4f8",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'a38be5578df9884074ff6bdb4d3a8ac62151fd33']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:32Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a81-4940-40c9-95df-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:33.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:33.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:33Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:33Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a81-4940-40c9-95df-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a81-4940-40c9-95df-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/cffebdbb1ab9c1c7be4349973cd530a14776a2952a0c28badf71a0ca83dae940/analysis/1457596730/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a81-e3a4-4103-bc3f-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:33.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:33.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 88b23b6a5c1b72aeff2fc42e05c173a7",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'baa3494170b4a1d7278612c71732940f62d308f81ce0d351c3d4adae197b9c74']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:33Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a81-e1f8-417a-9412-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:33.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:33.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 88b23b6a5c1b72aeff2fc42e05c173a7",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'ce648a16531eae5d219899c3671b9bc209365780']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:33Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a81-bd50-43d6-9a25-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:33.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:33.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:33Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:33Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a81-bd50-43d6-9a25-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a81-bd50-43d6-9a25-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/baa3494170b4a1d7278612c71732940f62d308f81ce0d351c3d4adae197b9c74/analysis/1460374921/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a81-5e98-4973-a00a-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:33.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:33.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: d70296d3dc4937dedd44f93bb3b74034",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '54ede44bce62ad415ce71a3a801785b94e0d70dcc7b7c44916d2bfec17e6d8bd']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:33Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a82-0da0-4a16-bf24-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:34.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:34.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: d70296d3dc4937dedd44f93bb3b74034",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '256640a3063def39da25cd07023302dea14a521a']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:34Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a82-b620-4646-af16-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:34.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:34.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:34Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:34Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a82-b620-4646-af16-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a82-b620-4646-af16-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/54ede44bce62ad415ce71a3a801785b94e0d70dcc7b7c44916d2bfec17e6d8bd/analysis/1463816049/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a82-b9d8-474f-abc7-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:34.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:34.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: d84ff5a7e7c0c33dcfa237299869bc34",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'd292c26681deb23da220754e232823a2026af4ac48e12f4b9645ea0fb23c6c97']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:34Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a82-b288-493a-a940-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:34.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:34.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: d84ff5a7e7c0c33dcfa237299869bc34",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'e3ad45d301f6dd25b8c81d5c1777625bcdce245c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:34Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a83-8cc4-4cc0-9be1-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:35.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:35.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:35Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:35Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a83-8cc4-4cc0-9be1-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a83-8cc4-4cc0-9be1-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/d292c26681deb23da220754e232823a2026af4ac48e12f4b9645ea0fb23c6c97/analysis/1465486660/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a83-6ac4-4b9b-876b-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:35.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:35.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 1b9e1cd2c7f8e227b2ae5fb5bc735536",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '4e6551c9c0a9a700dac39f1cecf122204bfae3fbeb1d68186878d0cab3f91697']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:35Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a83-010c-4a02-88f5-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:35.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:35.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 1b9e1cd2c7f8e227b2ae5fb5bc735536",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'ccc7f61f50be1391dfca059ccf1a99287e6fcdc1']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:35Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a83-18c4-4a99-a65b-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:35.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:35.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:35Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:35Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a83-18c4-4a99-a65b-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a83-18c4-4a99-a65b-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/4e6551c9c0a9a700dac39f1cecf122204bfae3fbeb1d68186878d0cab3f91697/analysis/1465486580/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a83-8fdc-4e03-8451-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:35.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:35.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 7a99b60349703aed3ab28f498320f247",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '7120f34239154aa6d8a97be592b2cc070539ccf6d1e7ea3ac0a4c191b673e79f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:35Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a84-cc0c-436b-9a0b-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:36.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:36.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 7a99b60349703aed3ab28f498320f247",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'b6f44a464a15b77c08fa89587a79699b031724df']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:36Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a84-f5a0-4d6d-9ac7-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:36.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:36.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:36Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:36Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a84-f5a0-4d6d-9ac7-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a84-f5a0-4d6d-9ac7-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/7120f34239154aa6d8a97be592b2cc070539ccf6d1e7ea3ac0a4c191b673e79f/analysis/1465486247/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a84-3580-4c33-823a-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:36.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:36.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 152f626eb92676f940ada4b7077acf16",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '2920c474d26e0685114b43e29d8be62b49759f57a97c114e640054d044e15a7c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:36Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a84-d10c-49e2-9a96-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:36.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:36.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 152f626eb92676f940ada4b7077acf16",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'f6c97896d01178c3aec3aedda2178bbf1205f3d2']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:36Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a84-7db0-4141-8d82-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:36.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:36.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:36Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:36Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a84-7db0-4141-8d82-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a84-7db0-4141-8d82-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/2920c474d26e0685114b43e29d8be62b49759f57a97c114e640054d044e15a7c/analysis/1465475861/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a85-b13c-4651-a701-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:37.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:37.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: da222d4b7993a62665b9eaef10c1846f",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'b9529627aa3fb0c1d0327f68ef58edc0f2c087dd746ea123ca9883e2935084af']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:37Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a85-7b3c-4519-8e01-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:37.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:37.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: da222d4b7993a62665b9eaef10c1846f",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '597381cbe514491df5be864c8e13e9a587f84199']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:37Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a85-8368-4366-9165-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:37.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:37.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:37Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:37Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a85-8368-4366-9165-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a85-8368-4366-9165-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/b9529627aa3fb0c1d0327f68ef58edc0f2c087dd746ea123ca9883e2935084af/analysis/1465475263/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a85-b3b0-4ded-b0c2-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:37.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:37.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: f1c8a3337cbd56e01e478774f5d55278",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'bf672f11feb48c91cb528f4bed4706e3b2bf70a6d3014ccfc6532014da64f22c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:37Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a85-e738-459d-bbbb-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:37.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:37.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: f1c8a3337cbd56e01e478774f5d55278",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '800868ade63d3fe53d44fed443c77c0c6ed459eb']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:37Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a86-e5c8-42ad-ad70-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:38.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:38.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:38Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:38Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a86-e5c8-42ad-ad70-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a86-e5c8-42ad-ad70-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/bf672f11feb48c91cb528f4bed4706e3b2bf70a6d3014ccfc6532014da64f22c/analysis/1465475263/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a86-da1c-48f4-a93e-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:38.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:38.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: a72aa534973eeaf0782a246d502107a3",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '5536c2990fae0aebf2a874c5a8e7f93a07701de2b76c0d8d94aa62b04268d9d8']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a86-5260-4e75-a398-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:38.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:38.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: a72aa534973eeaf0782a246d502107a3",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'bf0616570884c30da0148785479ded4d098829e4']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a86-b818-4960-b519-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:38.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:38.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:38Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:38Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a86-b818-4960-b519-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a86-b818-4960-b519-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/5536c2990fae0aebf2a874c5a8e7f93a07701de2b76c0d8d94aa62b04268d9d8/analysis/1465475258/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a86-5f10-40cf-9224-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:38.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:38.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 2c055d7b5199604cd5cf3441073b36b3",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '683521e7750406bdefbec00a50127212a03637beec3cc18ffb95acb4ae452b8f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a86-d368-4376-a09e-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:38.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:38.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 2c055d7b5199604cd5cf3441073b36b3",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'd4ea8481a85b1e1866beadbf905a8b7017d3bd5e']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a87-c668-4835-9fb2-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:39.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:39.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:39Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:39Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a87-c668-4835-9fb2-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a87-c668-4835-9fb2-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/683521e7750406bdefbec00a50127212a03637beec3cc18ffb95acb4ae452b8f/analysis/1465630858/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a87-2ab4-41f9-991c-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:39.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:39.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 23988abad7c7b2ecdda23ae7194b7a0d",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '6903dbe4c7e603cc5ce6cd5584ad59a8cd80a7351e173fa5f238345012095218']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:39Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a87-a698-482e-aa32-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:39.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:39.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 23988abad7c7b2ecdda23ae7194b7a0d",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '53d5c1e545593d679173d6e218710cdca4ac9880']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:39Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a87-c068-48fb-a489-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:39.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:39.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:39Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:39Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a87-c068-48fb-a489-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a87-c068-48fb-a489-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/6903dbe4c7e603cc5ce6cd5584ad59a8cd80a7351e173fa5f238345012095218/analysis/1465889886/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a87-153c-4463-935d-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:39.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:39.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: d0a6ba40e05047dc2cff12935c4cf4fb",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'cc2324892b8d7f677edc7e04a17d94021579063f64adc1a29f4c63eac3330417']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:39Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a88-190c-4784-9db4-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:40.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:40.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: d0a6ba40e05047dc2cff12935c4cf4fb",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '96e75c272e3c41dce9aa4bfee123d22a5cc29a86']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a88-4998-4a8f-8b92-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:40.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:40.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:40Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:40Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a88-4998-4a8f-8b92-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a88-4998-4a8f-8b92-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/cc2324892b8d7f677edc7e04a17d94021579063f64adc1a29f4c63eac3330417/analysis/1465249035/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a88-7d0c-42d6-9bf0-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:40.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:40.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 542f8f77e101d4e8e5d1ef34a3f0df1c",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '314f5dbfe6623d0b84029fedfed6c619ad5ffb0a4546a6f664202045636f0a1b']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a88-adec-426c-909f-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:40.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:40.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 542f8f77e101d4e8e5d1ef34a3f0df1c",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '6d73f440ba8fe6f50c57991ec1ddc0b178de05e7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a88-268c-4f19-b5e8-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:40.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:40.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:40Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:40Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a88-268c-4f19-b5e8-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a88-268c-4f19-b5e8-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/314f5dbfe6623d0b84029fedfed6c619ad5ffb0a4546a6f664202045636f0a1b/analysis/1465577453/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a89-c8ac-4671-abef-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:41.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:41.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 6e93a7f7911b3e9b522be4b8f950cca4",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'bdc537e298c63bac343b802d81a9faa4a51f320211b60529ea04fa672971c455']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:41Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a89-15dc-42c8-b040-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:41.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:41.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 6e93a7f7911b3e9b522be4b8f950cca4",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'b1525c809a0db123e021ad1f97eb4c05ea2a27fd']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:41Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a89-7020-4f9c-ad6f-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:41.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:41.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:41Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:41Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a89-7020-4f9c-ad6f-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a89-7020-4f9c-ad6f-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/bdc537e298c63bac343b802d81a9faa4a51f320211b60529ea04fa672971c455/analysis/1462431939/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a89-b75c-458f-9e83-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:41.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:41.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 05131969af2ae6cbfddf789512f02aa2",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'f53eb311de2534d898db983433b7cae1c7b682cedd4d958aeaf49234b275c0b4']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:41Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a89-28c0-4173-a97f-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:41.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:41.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 05131969af2ae6cbfddf789512f02aa2",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '75f01cc323eda4586780d12b716f8fe1c4156b45']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:41Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a8a-a13c-46db-a6ee-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:42.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:42.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:42Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:42Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a8a-a13c-46db-a6ee-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a8a-a13c-46db-a6ee-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/f53eb311de2534d898db983433b7cae1c7b682cedd4d958aeaf49234b275c0b4/analysis/1462442702/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a8a-58a4-45fa-b7b3-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:42.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:42.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: fcb4ef63f1d8a3a044ac6f8a7c262546",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'b1100f3dbe48fb4e7f570b6b1380456bc79b14e2de30f8ac41fbb80e1d080ded']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:42Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a8a-7aa0-41e9-bfa3-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:42.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:42.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: fcb4ef63f1d8a3a044ac6f8a7c262546",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '658d59e73fefc0f8be3886f3d2b165a6104d6210']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:42Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a8a-2478-4b67-88e7-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:42.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:42.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:42Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:42Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a8a-2478-4b67-88e7-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a8a-2478-4b67-88e7-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/b1100f3dbe48fb4e7f570b6b1380456bc79b14e2de30f8ac41fbb80e1d080ded/analysis/1460378326/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a8a-ad00-44f8-bdc9-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:42.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:42.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 701d57504444344b8d5e79bcabcd3dca",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '9fd36c59d6861ce284f4a2be86e211f530d43d995bb36567d550dcef35e5b40c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:42Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a8b-7034-4178-9f84-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:43.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:43.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 701d57504444344b8d5e79bcabcd3dca",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '82bb113323787b339add2e420c31d9d5de90be55']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:43Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a8b-d0a4-4742-b61b-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:43.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:43.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:43Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:43Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a8b-d0a4-4742-b61b-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a8b-d0a4-4742-b61b-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/9fd36c59d6861ce284f4a2be86e211f530d43d995bb36567d550dcef35e5b40c/analysis/1462401158/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a8b-5ad8-40af-8d3e-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:43.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:43.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 2f4d81ef1b10bf72d0dba0fdf354527f",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '4120829a12eaa425de54e4170d0248ac62865303e2816f5ec6001b459bc4b3a2']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:43Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a8b-7630-4580-bd81-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:43.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:43.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 2f4d81ef1b10bf72d0dba0fdf354527f",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'ced88b9caf8e944132afdca8513569d49cc7118a']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:43Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a8c-ddbc-48ec-8c6e-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:44.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:44.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:44Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:44Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a8c-ddbc-48ec-8c6e-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a8c-ddbc-48ec-8c6e-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/4120829a12eaa425de54e4170d0248ac62865303e2816f5ec6001b459bc4b3a2/analysis/1460123023/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a8c-6450-448d-ad8d-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:44.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:44.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: d73d54f6f86c58030477cc9a96eedb85",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '67a1ace7dd27138065614b9c9f29d80d2b8561bb76fe91ee04a699aab301e114']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:44Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a8c-4f38-4218-b73f-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:44.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:44.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: d73d54f6f86c58030477cc9a96eedb85",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '1a2737ed07989b8a71c86307de733db71fab8e1c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:44Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a8c-4900-486a-b9c2-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:44.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:44.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:44Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:44Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a8c-4900-486a-b9c2-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a8c-4900-486a-b9c2-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/67a1ace7dd27138065614b9c9f29d80d2b8561bb76fe91ee04a699aab301e114/analysis/1464359426/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a8c-89a8-4e82-81c2-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:44.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:44.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: cfa92cbcb0674429cc9ce216cc008902",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '15497dd6c50ae82273d4a3c8891cf9fc4ff1a8a0d6652ddc34e450e56ed99492']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:44Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a8d-2aa8-4f6e-a52f-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:45.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:45.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: cfa92cbcb0674429cc9ce216cc008902",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '401ce322d99a4513ed757cc70b44dfcde845f4d3']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:45Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a8d-42a0-409d-a7d5-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:45.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:45.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:45Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:45Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a8d-42a0-409d-a7d5-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a8d-42a0-409d-a7d5-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/15497dd6c50ae82273d4a3c8891cf9fc4ff1a8a0d6652ddc34e450e56ed99492/analysis/1465484560/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a8d-4f0c-4ca4-91de-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:45.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:45.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 8959513f65bcca6f16faef59ad2d152f",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'c20564a00f4e79dd2bcc59e3beda52be042fade33e27981f357358d9298679eb']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:45Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a8d-34a0-4471-8d62-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:45.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:45.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 8959513f65bcca6f16faef59ad2d152f",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '9f5dd3cbaa5404cb31a1b8e115b8e6aacc03eee2']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:45Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a8e-a578-44a5-9f6d-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:46.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:46.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:46Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:46Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a8e-a578-44a5-9f6d-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a8e-a578-44a5-9f6d-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/c20564a00f4e79dd2bcc59e3beda52be042fade33e27981f357358d9298679eb/analysis/1465484656/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a8e-6470-49f4-a8be-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:46.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:46.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: bee3746684b072867a5b202bfc5527dd",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '6be081eaf8f84069725f91a14b01289a3ecd352db97d22436a4183069913eece']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:46Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a8e-0ea4-42c0-8802-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:46.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:46.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: bee3746684b072867a5b202bfc5527dd",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '56ebf63431b4168387d4d93293c1590d9defdd80']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:46Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a8e-6a00-4827-bbc6-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:46.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:46.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:46Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:46Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a8e-6a00-4827-bbc6-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a8e-6a00-4827-bbc6-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/6be081eaf8f84069725f91a14b01289a3ecd352db97d22436a4183069913eece/analysis/1460757741/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a8e-1b30-4395-b960-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:46.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:46.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: af7a8d32865e8caf51a99c52834d4422",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'f08dc533c59d78ba29877d8d4cf633ab513b8a75e11861dc5fac477ef3003396']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:46Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a8f-d180-4f76-9c7b-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:47.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:47.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: af7a8d32865e8caf51a99c52834d4422",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '70703e7b88be2f1fbeb366ce7a7c284dd957e2c2']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:47Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a8f-4d5c-41dc-bf98-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:47.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:47.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:47Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:47Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a8f-4d5c-41dc-bf98-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a8f-4d5c-41dc-bf98-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/f08dc533c59d78ba29877d8d4cf633ab513b8a75e11861dc5fac477ef3003396/analysis/1465247680/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a8f-9e48-461f-b576-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:47.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:47.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 20f4cd2baa09e0bd5e12dab50c0898cd",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '05531cfe90b5c17eefd4d3cc32660d482643b3705db3f005e7265e00151e897e']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:47Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a8f-0918-499a-a954-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:47.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:47.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 20f4cd2baa09e0bd5e12dab50c0898cd",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '05ba445e24e70e082eb55c2d2f99179500acb139']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:47Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a8f-7788-4d28-88da-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:47.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:47.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:47Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:47Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a8f-7788-4d28-88da-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a8f-7788-4d28-88da-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/05531cfe90b5c17eefd4d3cc32660d482643b3705db3f005e7265e00151e897e/analysis/1464888452/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a90-b034-429d-ad5e-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:48.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:48.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 06e74df867e9cb5c1bafc98165c6c248",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '8bbba09bb465f7d1d0f1666e5fa4d5155e9e1055180bc61b445340c81997709b']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:48Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a90-2330-42c0-919d-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:48.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:48.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 06e74df867e9cb5c1bafc98165c6c248",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '55434693f774b134d1033b53d4c43f8c9903c9e1']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:48Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a90-4ad8-4cae-bcf2-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:48.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:48.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:48Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:48Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a90-4ad8-4cae-bcf2-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a90-4ad8-4cae-bcf2-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/8bbba09bb465f7d1d0f1666e5fa4d5155e9e1055180bc61b445340c81997709b/analysis/1466051543/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a90-bff4-4bd6-92f7-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:48.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:48.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 3f2017a5acb3e57801e2771341287001",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'a2f24f44a8438c1868a90a65d81ec813886fe3bfc73d82a6c0838f95d17d177c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:48Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a91-c378-4ba4-8c79-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:49.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:49.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 3f2017a5acb3e57801e2771341287001",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '2eb3966f6dfff37dd0671212579c51ac47b4d74a']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:49Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a91-58f8-4667-9019-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:49.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:49.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:49Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:49Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a91-58f8-4667-9019-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a91-58f8-4667-9019-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/a2f24f44a8438c1868a90a65d81ec813886fe3bfc73d82a6c0838f95d17d177c/analysis/1464797811/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a91-441c-4cac-ba79-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:49.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:49.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 035d1f3b7fb532a33de7a8445f9fa325",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '3714fa05d89e70c8d7695e6d9909a6b9515fcfce0313a140ae1888866f586a9d']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:49Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a91-1edc-490f-9153-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:49.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:49.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 035d1f3b7fb532a33de7a8445f9fa325",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '4e47466d123acd7865bef4daebd93e7b24c3105e']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:49Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a91-bd68-4b5b-97dd-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:49.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:49.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:49Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:49Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a91-bd68-4b5b-97dd-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a91-bd68-4b5b-97dd-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/3714fa05d89e70c8d7695e6d9909a6b9515fcfce0313a140ae1888866f586a9d/analysis/1465119784/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a92-ea2c-4a87-a2cf-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:50.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:50.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 93922ee5fbd149f31b0161deca76df77",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '61391116ffeefd0c90d29eedd5bc999d622c1badc19b68ae1cdbec30dbbfd2ef']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:50Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a92-37cc-476a-b5aa-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:50.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:50.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 93922ee5fbd149f31b0161deca76df77",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'e466cf45047abeeb360762d5124a800ea385d3c1']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:50Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a92-85fc-4817-9c8a-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:50.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:50.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:50Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:50Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a92-85fc-4817-9c8a-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a92-85fc-4817-9c8a-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/61391116ffeefd0c90d29eedd5bc999d622c1badc19b68ae1cdbec30dbbfd2ef/analysis/1465479724/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a92-2440-4839-931d-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:50.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:50.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: dba6b4bbf61e054fb978acaf70c3d849",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '9a14dc793c2b23a08f5983597f3332549f020f7546d383d874f0fcca0d9a2676']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:50Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a92-5f84-4fdc-aa0f-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:50.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:50.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: dba6b4bbf61e054fb978acaf70c3d849",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '2f34f24f57e965542543352c75a658a1bcb8b388']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:50Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a93-a708-4f47-a0e0-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:51.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:51.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:51Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a93-a708-4f47-a0e0-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a93-a708-4f47-a0e0-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/9a14dc793c2b23a08f5983597f3332549f020f7546d383d874f0fcca0d9a2676/analysis/1465486557/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a93-13e8-4b4b-984d-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:51.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:51.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 9762441d52bdec725eff6f2f65e721e9",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '57fcf0ce4fec05b2c3a77570effbe78ee04ee1fbc26641a92d1030e5e81f2cb5']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:51Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a93-02b8-49a9-b18c-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:51.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:51.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 9762441d52bdec725eff6f2f65e721e9",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '5d86cf09d0d07bb0a47f86ef3d454131f6e5652b']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:51Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a93-f4a8-48db-bc65-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:51.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:51.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:51Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a93-f4a8-48db-bc65-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a93-f4a8-48db-bc65-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/57fcf0ce4fec05b2c3a77570effbe78ee04ee1fbc26641a92d1030e5e81f2cb5/analysis/1462688150/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a94-8978-406c-bdcb-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:52.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:52.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: bf7b72dbb2a9155dabc4eda31d273b92",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '2b43b05726f07ee56e09a550b712320cfdaf6d39b80c8d620452e9c23dcb9f49']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:52Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a94-7888-4600-bcc5-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:52.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:52.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: bf7b72dbb2a9155dabc4eda31d273b92",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '3e8c2d1600000483bfc6cd1bba687b2c3d125614']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:52Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a94-ff14-4a47-b7a6-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:52.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:52.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:52Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:52Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a94-ff14-4a47-b7a6-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a94-ff14-4a47-b7a6-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/2b43b05726f07ee56e09a550b712320cfdaf6d39b80c8d620452e9c23dcb9f49/analysis/1465486439/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a94-8998-47e1-86aa-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:52.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:52.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: a18818cb3fb6f189560991cef6d1f929",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '6d536d4d724f79345e6088e58639b173118506739448481c7fd9a43f426f3a18']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:52Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a94-ed34-4402-bce4-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:52.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:52.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: a18818cb3fb6f189560991cef6d1f929",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'e38ae15deee0aa7f3869270e6951846db7be89eb']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:52Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a95-e7f0-44a9-ab2e-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:53.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:53.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:53Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:53Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a95-e7f0-44a9-ab2e-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a95-e7f0-44a9-ab2e-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/6d536d4d724f79345e6088e58639b173118506739448481c7fd9a43f426f3a18/analysis/1460658177/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a95-135c-41f7-b505-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:53.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:53.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: fbdde37d41d12f21c049c570c9bda3de",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '0278fcf9fabd9a78cca5204b181aaefd4635b5eee070d5bf64276e9718db33e9']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:53Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a95-6a80-427f-9959-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:53.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:53.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: fbdde37d41d12f21c049c570c9bda3de",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'b388a7a6b0e3b5209ec5a167c41871ff9505fd1f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:53Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a95-e9fc-4029-8a8e-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:53.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:53.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:53Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:53Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a95-e9fc-4029-8a8e-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a95-e9fc-4029-8a8e-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/0278fcf9fabd9a78cca5204b181aaefd4635b5eee070d5bf64276e9718db33e9/analysis/1465486301/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a96-34cc-4915-8c44-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:54.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:54.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 8d0a03981daa93210e184e7fff02883c",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '5ad87e2f737d75168688fee2accc50edbcc3800640cdb6476b6debb31e58352a']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:54Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a96-5470-47b1-9bc4-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:54.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:54.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 8d0a03981daa93210e184e7fff02883c",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'c23bd6402a71cc5c501cc51c6646d2b10eddf93c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:54Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a96-ddf8-430a-9757-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:54.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:54.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:54Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:54Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a96-ddf8-430a-9757-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a96-ddf8-430a-9757-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/5ad87e2f737d75168688fee2accc50edbcc3800640cdb6476b6debb31e58352a/analysis/1465486237/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a96-10d0-49d8-bca3-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:54.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:54.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 40449a2ec48c3e630b2eb8c8089828cf",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'b51567440068be05db737306c31c3837b8459efe0dabd45d93e780aad8f0447a']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:54Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a96-846c-4aed-8148-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:54.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:54.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 40449a2ec48c3e630b2eb8c8089828cf",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '1ddab3d24e8719da9d271446683a627cb5f7ec80']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:54Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a97-e5b0-44d2-9b9c-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:55.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:55.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:55Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:55Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a97-e5b0-44d2-9b9c-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a97-e5b0-44d2-9b9c-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/b51567440068be05db737306c31c3837b8459efe0dabd45d93e780aad8f0447a/analysis/1465485386/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a97-b704-4835-a2b8-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:55.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:55.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 2b90fca41272bec8b8ffefbb2456c001",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'eb2ce0c84cdd45f5b0c5dbc80efe24d3fe465e88d9254cba2796a595d9eb47a2']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:55Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a97-9930-4620-8288-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:55.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:55.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 2b90fca41272bec8b8ffefbb2456c001",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '5dfdb47d5bb10e94d6adf8c5279961e1c44c810e']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:55Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a97-9954-4952-8088-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:55.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:55.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:55Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:55Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a97-9954-4952-8088-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a97-9954-4952-8088-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/eb2ce0c84cdd45f5b0c5dbc80efe24d3fe465e88d9254cba2796a595d9eb47a2/analysis/1465485004/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a97-581c-497f-a0eb-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:55.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:55.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: e911df33f1d156b3309a4ac220c52070",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'b76c66a9718ae15989624f37f62aa24c6f1b99d6ad82adb052e339aacfb2e17b']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:55Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a98-5908-4648-b83e-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:56.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:56.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: e911df33f1d156b3309a4ac220c52070",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '10a00815d8ff9f83a25127175688228ed67aea7a']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:56Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a98-0680-4c77-82b3-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:56.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:56.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:56Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:56Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a98-0680-4c77-82b3-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a98-0680-4c77-82b3-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/b76c66a9718ae15989624f37f62aa24c6f1b99d6ad82adb052e339aacfb2e17b/analysis/1463027478/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a98-dbb4-4aee-9550-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:56.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:56.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 228a4b723bf3d8adc53a69dd0f36c746",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'c6723070bf66c1342ff51cd1c6d4a29b1c3f49256701703ed730a1b701b8038a']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:56Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a98-a4e8-437f-921a-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:56.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:56.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 228a4b723bf3d8adc53a69dd0f36c746",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '3ca233c7de6dcc9ed12495c8b41b13c2ecb4e355']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:56Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a99-4878-415f-ae44-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:57.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:57.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:57Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:57Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a99-4878-415f-ae44-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a99-4878-415f-ae44-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/c6723070bf66c1342ff51cd1c6d4a29b1c3f49256701703ed730a1b701b8038a/analysis/1466146202/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a99-c7a8-4cc3-befa-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:57.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:57.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 82d89319fabd998328cc6d4efc4db863",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '2171cf18581e1eab92b454e5e9f9c7dc33505785879358b5886bc59786585eca']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:57Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a99-9c78-4dc1-a827-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:57.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:57.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 82d89319fabd998328cc6d4efc4db863",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '9857af3969632dd3c582c9d58cb4510749e0a8f2']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:57Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a99-e070-4142-bb77-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:57.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:57.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:57Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:57Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a99-e070-4142-bb77-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a99-e070-4142-bb77-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/2171cf18581e1eab92b454e5e9f9c7dc33505785879358b5886bc59786585eca/analysis/1464701375/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a99-fe24-47f2-b4d0-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:57.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:57.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 9e9d9a3717eed4d558a3f5eddb260901",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'e544b04c5faea553e46766397add3aa7d02ed6a8479409cba4c54ad897b90f3c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:57Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a9a-4434-4a02-abe3-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:58.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:58.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 9e9d9a3717eed4d558a3f5eddb260901",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '076ee439a13f1e5afb4bab4dbc8770422dcff0db']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:58Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a9a-cac8-4718-b5c7-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:58.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:58.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:58Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:58Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a9a-cac8-4718-b5c7-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a9a-cac8-4718-b5c7-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/e544b04c5faea553e46766397add3aa7d02ed6a8479409cba4c54ad897b90f3c/analysis/1458202877/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a9a-b7b4-4d69-b90f-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:58.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:58.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 82b1006a5f45a6d2baf69544414ada81",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'b2d6531eba8b3139f0591ff6bd34b393f16f02881523dbba6102e2d9f5daacd3']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:58Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a9a-c560-4b0b-ab6a-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:58.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:58.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 82b1006a5f45a6d2baf69544414ada81",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '7bc09a101fa6254e1fc67fccd23505889b6d6aaf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:58Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a9a-5138-4565-9563-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:58.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:58.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:58Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:58Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a9a-5138-4565-9563-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a9a-5138-4565-9563-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/b2d6531eba8b3139f0591ff6bd34b393f16f02881523dbba6102e2d9f5daacd3/analysis/1464609254/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a9b-3cc0-437d-afb9-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:59.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:59.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 97c2d04aa0f3c3b446fc228c1dbc4837",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '5a04a50d339e0e530dd640813f96488278e5b3cc29c69437c7529464c44f2947']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:59Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a9b-a7c8-4625-99c7-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:59.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:59.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 97c2d04aa0f3c3b446fc228c1dbc4837",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '2d3ff0582fa8b3419b38e0d070b997da8962ee56']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:59Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a9b-350c-44f2-b85a-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:59.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:59.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:36:59Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:36:59Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a9b-350c-44f2-b85a-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a9b-350c-44f2-b85a-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/5a04a50d339e0e530dd640813f96488278e5b3cc29c69437c7529464c44f2947/analysis/1460341223/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a9b-8594-4dcd-859b-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:36:59.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:36:59.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: d83d833092a4fa5ecc436d4246c2f7ce",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '0d00c8028fd2b3ea15bff1d41f5c0c9e0bad8ced36721ac96e6c06786651e691']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:36:59Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a9c-e084-4c89-a220-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:00.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:00.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: d83d833092a4fa5ecc436d4246c2f7ce",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'f69ae871ffe84ad2ae761ece645088c1048d2d03']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:37:00Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a9c-cecc-4252-b348-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:00.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:00.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:37:00Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:37:00Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a9c-cecc-4252-b348-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a9c-cecc-4252-b348-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/0d00c8028fd2b3ea15bff1d41f5c0c9e0bad8ced36721ac96e6c06786651e691/analysis/1462533408/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a9c-da4c-427a-b2ce-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:00.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:00.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: d33b718737de5aa685672a2004e0fa3c",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'bc64e4adeda4a2333e2a33897f651f664ddacf0bf6cb3c945dbbdaa70dbdcbf2']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:37:00Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a9c-1558-4981-8804-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:00.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:00.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: d33b718737de5aa685672a2004e0fa3c",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '39926bd0fe2106b13e669aa251388987a5e4004d']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:37:00Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a9c-a53c-424f-9635-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:00.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:00.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:37:00Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:37:00Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a9c-a53c-424f-9635-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a9c-a53c-424f-9635-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/bc64e4adeda4a2333e2a33897f651f664ddacf0bf6cb3c945dbbdaa70dbdcbf2/analysis/1457193546/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a9d-c494-4225-b313-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:01.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:01.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 6a300ded487671ef39388b8d28927a83",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'c9c7bbb89f93fb6474d6c7e1ff1900531341a69ec8dd016af114ed6e806b2233']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:37:01Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a9d-980c-4b96-8368-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:01.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:01.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 6a300ded487671ef39388b8d28927a83",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '25ae75548a011b3ac5098359a02f380cceb5794c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:37:01Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a9d-e5c4-4f24-a0f9-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:01.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:01.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:37:01Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:37:01Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a9d-e5c4-4f24-a0f9-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a9d-e5c4-4f24-a0f9-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/c9c7bbb89f93fb6474d6c7e1ff1900531341a69ec8dd016af114ed6e806b2233/analysis/1465486354/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a9d-9d48-4b37-ac8b-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:01.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:01.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: ef5c9b15755719597481c501f6b603ce",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '8e07510ac0eed8e3534ff485cdb0381970ba2de4bec9f6adca06ec181542d9a0']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:37:01Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a9e-8138-4b5f-8ff9-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:02.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:02.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: ef5c9b15755719597481c501f6b603ce",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '0507827a7452681ace6d3c2f96c3403f9b124a7f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:37:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a9e-2e28-474c-9e5e-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:02.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:02.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:37:02Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:37:02Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a9e-2e28-474c-9e5e-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a9e-2e28-474c-9e5e-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/8e07510ac0eed8e3534ff485cdb0381970ba2de4bec9f6adca06ec181542d9a0/analysis/1461588305/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a9e-2900-4aa9-98d2-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:02.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:02.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: e1d79608b649c22004ad7cc1cd049528",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '0432a460b1af4a31c0b0ab12106886ff9e5fd1b7a109c1a9e5ab29b4fafd6719']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:37:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a9e-d960-4085-be05-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:02.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:02.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: e1d79608b649c22004ad7cc1cd049528",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '66b44ab4c85c9d55344a5d65933b06e13711b1ab']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:37:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a9e-8cac-45f5-90bc-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:02.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:02.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:37:02Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:37:02Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a9e-8cac-45f5-90bc-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a9e-8cac-45f5-90bc-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/0432a460b1af4a31c0b0ab12106886ff9e5fd1b7a109c1a9e5ab29b4fafd6719/analysis/1458108637/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a9f-933c-412b-be33-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:03.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:03.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: f4b8d64af0a53472901b50621f19d6bf",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'c9344b6dd87cd58540a580020d1e175943d0e2966e55235d20a40f1a007fd715']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:37:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a9f-5e1c-4a29-8cff-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:03.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:03.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: f4b8d64af0a53472901b50621f19d6bf",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '5839a88e7705752925cbb7e4b0aa19642488789f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:37:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737a9f-2fe0-4838-954f-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:03.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:03.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:37:03Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:37:03Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737a9f-2fe0-4838-954f-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737a9f-2fe0-4838-954f-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/c9344b6dd87cd58540a580020d1e175943d0e2966e55235d20a40f1a007fd715/analysis/1456690294/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a9f-3a98-41e9-9d03-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:03.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:03.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: ffe98d97e7d827aa19abb968a528f3fe",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '4b425799100ea3fb4f10dbcedf0a01e2d8b82fc3c7457066a6cccb84d9065b5b']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:37:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737a9f-2ee0-45af-b662-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:03.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:03.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: ffe98d97e7d827aa19abb968a528f3fe",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '0dccf76c5de2e8aa2c1dcc83db9ffded57b17816']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:37:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737aa0-85e8-4584-aa23-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:04.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:04.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:37:04Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:37:04Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737aa0-85e8-4584-aa23-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737aa0-85e8-4584-aa23-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/4b425799100ea3fb4f10dbcedf0a01e2d8b82fc3c7457066a6cccb84d9065b5b/analysis/1458108653/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737aa0-cb88-4d36-a07d-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:04.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:04.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 49dac3b35afb2e8d3605c72d0d83f631",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '0a5d2765414520d695567cdd4fe4f8db8e577d88c76e0daa362d7dcbc2bf6c1d']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:37:04Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737aa0-a6ac-4927-b127-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:04.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:04.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 49dac3b35afb2e8d3605c72d0d83f631",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'a64e86418fc97af5baedc5a1ea03e44318454380']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:37:04Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737aa0-e268-43fd-948c-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:04.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:04.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:37:04Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:37:04Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737aa0-e268-43fd-948c-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737aa0-e268-43fd-948c-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/0a5d2765414520d695567cdd4fe4f8db8e577d88c76e0daa362d7dcbc2bf6c1d/analysis/1464612523/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737aa1-9390-44ff-9087-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:05.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:05.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 265d37013e1ea39b868515cce157dfeb",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '47d993c704f06cfba8b7de1908ab828f5c33109bde484a57df8114746cbdf087']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:37:05Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737aa1-71f4-4601-bd7c-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:05.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:05.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 265d37013e1ea39b868515cce157dfeb",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'aac042d7bd1180e2ab964d9014ea9148968680fc']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:37:05Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737aa1-3630-45ca-a423-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:05.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:05.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:37:05Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:37:05Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737aa1-3630-45ca-a423-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737aa1-3630-45ca-a423-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/47d993c704f06cfba8b7de1908ab828f5c33109bde484a57df8114746cbdf087/analysis/1460120735/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737aa1-4d28-4e16-983b-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:05.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:05.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 3841abcef2b1b37aa7e2d47c535ca80e",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '9efa16125de476183f9fc8fc06f84896dee8f0bcc920e31288f3add6e91c4ea7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:37:05Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737aa1-984c-4d43-a115-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:05.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:05.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 3841abcef2b1b37aa7e2d47c535ca80e",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '93a5ecdbdd538d7ebf1b6b4573c1f41eedc261da']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:37:05Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737aa2-9534-4039-849f-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:06.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:06.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:37:06Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:37:06Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737aa2-9534-4039-849f-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737aa2-9534-4039-849f-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/9efa16125de476183f9fc8fc06f84896dee8f0bcc920e31288f3add6e91c4ea7/analysis/1459660451/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737aa2-c0a0-4e5b-a392-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:06.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:06.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 6eb92667ebbbcb2c7ddf6230462222fd",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'c063827848141ce5149aa44ddd9794249b1eb63833ec684c1e0ee9ae18a65439']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:37:06Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737aa2-2458-4b3d-8a87-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:06.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:06.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: 6eb92667ebbbcb2c7ddf6230462222fd",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '4d2aa3299047e773d83dc0a98e3c4c5766608724']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:37:06Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737aa2-f83c-485b-aa23-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:06.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:06.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:37:06Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:37:06Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737aa2-f83c-485b-aa23-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737aa2-f83c-485b-aa23-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/c063827848141ce5149aa44ddd9794249b1eb63833ec684c1e0ee9ae18a65439/analysis/1464826665/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737aa3-afd0-4eb9-9566-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:07.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:07.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: df53b59e354462cd0e704b7b21a750f7",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '124675ce63027ceea0a52bf89a813ad2a6b0cc3e6ca55329831d0099af2307d9']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:37:07Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57737aa3-b670-408f-94fc-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:07.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:07.000Z",
|
|
|
|
|
"description": "Sample - Xchecked via VT: df53b59e354462cd0e704b7b21a750f7",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '2652d520ac04bfd7c5dd027cafe9ae05da41fbe3']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-06-29T07:37:07Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57737aa3-7158-4fd5-9f74-c9c802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2016-06-29T07:37:07.000Z",
|
|
|
|
|
"modified": "2016-06-29T07:37:07.000Z",
|
|
|
|
|
"first_observed": "2016-06-29T07:37:07Z",
|
|
|
|
|
"last_observed": "2016-06-29T07:37:07Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57737aa3-7158-4fd5-9f74-c9c802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57737aa3-7158-4fd5-9f74-c9c802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/124675ce63027ceea0a52bf89a813ad2a6b0cc3e6ca55329831d0099af2307d9/analysis/1461234079/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "marking-definition",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
|
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
|
|
|
"definition_type": "tlp",
|
|
|
|
|
"name": "TLP:WHITE",
|
|
|
|
|
"definition": {
|
|
|
|
|
"tlp": "white"
|
|
|
|
|
}
|
|
|
|
|
}
|
2023-04-21 13:25:09 +00:00
|
|
|
]
|
|
|
|
|
}
|
