misp-circl-feed/feeds/circl/misp/57b5a864-be78-4eba-af85-4608950d210f.json

{
    "type": "bundle",
    "id": "bundle--57b5a864-be78-4eba-af85-4608950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T12:32:42.000Z",
            "modified": "2016-08-18T12:32:42.000Z",
            "name": "CthulhuSPRL.be",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--57b5a864-be78-4eba-af85-4608950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T12:32:42.000Z",
            "modified": "2016-08-18T12:32:42.000Z",
            "name": "OSINT Shakti Trojan: Document Thief  by Malwarebytes",
            "published": "2016-08-18T12:37:57Z",
            "object_refs": [
                "observed-data--57b5a877-9d20-49f7-aa38-4c16950d210f",
                "url--57b5a877-9d20-49f7-aa38-4c16950d210f",
                "observed-data--57b5a877-9be4-4767-b8e5-436a950d210f",
                "url--57b5a877-9be4-4767-b8e5-436a950d210f",
                "observed-data--57b5a877-a95c-48cf-be90-4981950d210f",
                "url--57b5a877-a95c-48cf-be90-4981950d210f",
                "observed-data--57b5a8aa-4290-4175-9509-478d950d210f",
                "url--57b5a8aa-4290-4175-9509-478d950d210f",
                "indicator--57b5a8c8-1a70-4ec3-9746-44dc950d210f",
                "indicator--57b5a8c8-a87c-44bf-9aec-46e8950d210f",
                "indicator--57b5a8c9-3110-4536-8e93-4baa950d210f",
                "indicator--57b5a8c9-31ec-442a-9e77-4819950d210f",
                "indicator--57b5a8c9-6830-4de5-a4b0-4b00950d210f",
                "indicator--57b5a8ff-4aa4-4baf-a764-49ad950d210f",
                "indicator--57b5a8ff-c074-4601-92b7-4dbc950d210f",
                "indicator--57b5a8ff-8974-40f4-b6bd-44b6950d210f",
                "indicator--57b5a8ff-1dd0-413f-8ede-46ab950d210f",
                "indicator--57b5a900-db74-4f77-8cff-4754950d210f",
                "indicator--57b5a919-cad0-42ff-9825-4d5a950d210f",
                "x-misp-attribute--57b5a93e-f604-442f-8443-49d2950d210f",
                "x-misp-attribute--57b5a93f-9fb4-4436-a220-4a41950d210f",
                "observed-data--57b5a9d1-46d0-4515-8152-429a950d210f",
                "url--57b5a9d1-46d0-4515-8152-429a950d210f",
                "indicator--57b5aa1a-cd14-4bd9-b994-4e4f950d210f",
                "x-misp-attribute--57b5aaea-41e8-41ee-9a00-499c950d210f"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "OSINT"
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57b5a877-9d20-49f7-aa38-4c16950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T12:22:15.000Z",
            "modified": "2016-08-18T12:22:15.000Z",
            "first_observed": "2016-08-18T12:22:15Z",
            "last_observed": "2016-08-18T12:22:15Z",
            "number_observed": 1,
            "object_refs": [
                "url--57b5a877-9d20-49f7-aa38-4c16950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--57b5a877-9d20-49f7-aa38-4c16950d210f",
            "value": "https://blog.malwarebytes.com/threat-analysis/2016/08/shakti-trojan-stealing-documents/"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57b5a877-9be4-4767-b8e5-436a950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T12:22:15.000Z",
            "modified": "2016-08-18T12:22:15.000Z",
            "first_observed": "2016-08-18T12:22:15Z",
            "last_observed": "2016-08-18T12:22:15Z",
            "number_observed": 1,
            "object_refs": [
                "url--57b5a877-9be4-4767-b8e5-436a950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--57b5a877-9be4-4767-b8e5-436a950d210f",
            "value": "https://malwr.com/analysis/NjA0OGVmMDdlMzg5NDJjOGI1OTA3YTJkMDllZTk5Y2U/"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57b5a877-a95c-48cf-be90-4981950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T12:22:15.000Z",
            "modified": "2016-08-18T12:22:15.000Z",
            "first_observed": "2016-08-18T12:22:15Z",
            "last_observed": "2016-08-18T12:22:15Z",
            "number_observed": 1,
            "object_refs": [
                "url--57b5a877-a95c-48cf-be90-4981950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--57b5a877-a95c-48cf-be90-4981950d210f",
            "value": "http://www.bleepingcomputer.com/news/security/new-information-stealing-trojan-steals-and-uploads-corporate-files/"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57b5a8aa-4290-4175-9509-478d950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T12:23:05.000Z",
            "modified": "2016-08-18T12:23:05.000Z",
            "first_observed": "2016-08-18T12:23:05Z",
            "last_observed": "2016-08-18T12:23:05Z",
            "number_observed": 1,
            "object_refs": [
                "url--57b5a8aa-4290-4175-9509-478d950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--57b5a8aa-4290-4175-9509-478d950d210f",
            "value": "https://blog.malwarebytes.com/threat-analysis/2016/08/shakti-trojan-technical-analysis/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57b5a8c8-1a70-4ec3-9746-44dc950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T12:23:36.000Z",
            "modified": "2016-08-18T12:23:36.000Z",
            "description": "Imported via the Freetext Import Tool",
            "pattern": "[file:name = 'Carrier.dll']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-18T12:23:36Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"filename\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57b5a8c8-a87c-44bf-9aec-46e8950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T12:23:36.000Z",
            "modified": "2016-08-18T12:23:36.000Z",
            "description": "Imported via the Freetext Import Tool",
            "pattern": "[file:name = 'Payload.dll']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-18T12:23:36Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"filename\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57b5a8c9-3110-4536-8e93-4baa950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T12:23:37.000Z",
            "modified": "2016-08-18T12:23:37.000Z",
            "description": "Imported via the Freetext Import Tool",
            "pattern": "[domain-name:value = 'web4solution.net']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-18T12:23:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57b5a8c9-31ec-442a-9e77-4819950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T12:23:37.000Z",
            "modified": "2016-08-18T12:23:37.000Z",
            "description": "Imported via the Freetext Import Tool",
            "pattern": "[domain-name:value = 'securedesignus.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-18T12:23:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57b5a8c9-6830-4de5-a4b0-4b00950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T12:23:37.000Z",
            "modified": "2016-08-18T12:23:37.000Z",
            "description": "Imported via the Freetext Import Tool",
            "pattern": "[domain-name:value = 'securedesignuk.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-18T12:23:37Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"domain\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57b5a8ff-4aa4-4baf-a764-49ad950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T12:24:31.000Z",
            "modified": "2016-08-18T12:24:31.000Z",
            "description": "Imported via the Freetext Import Tool",
            "pattern": "[file:name = 'Carrier.dll']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-18T12:24:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57b5a8ff-c074-4601-92b7-4dbc950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T12:24:31.000Z",
            "modified": "2016-08-18T12:24:31.000Z",
            "description": "Imported via the Freetext Import Tool",
            "pattern": "[file:name = 'Payload.dll']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-18T12:24:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"filename\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57b5a8ff-8974-40f4-b6bd-44b6950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T12:24:31.000Z",
            "modified": "2016-08-18T12:24:31.000Z",
            "description": "Imported via the Freetext Import Tool",
            "pattern": "[file:hashes.MD5 = '8ea35293cbb0712a520c7b89059d5a2a']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-18T12:24:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57b5a8ff-1dd0-413f-8ede-46ab950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T12:24:31.000Z",
            "modified": "2016-08-18T12:24:31.000Z",
            "description": "Imported via the Freetext Import Tool",
            "pattern": "[file:hashes.MD5 = '6992370821f8fbeea4a96f7be8015967']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-18T12:24:31Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57b5a900-db74-4f77-8cff-4754950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T12:24:32.000Z",
            "modified": "2016-08-18T12:24:32.000Z",
            "description": "Imported via the Freetext Import Tool",
            "pattern": "[file:hashes.MD5 = 'd9181d69c40fc95d7d27448f5ece1878']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-18T12:24:32Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"md5\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57b5a919-cad0-42ff-9825-4d5a950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T12:24:57.000Z",
            "modified": "2016-08-18T12:24:57.000Z",
            "pattern": "[url:value = '/external/update']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-18T12:24:57Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Network activity"
                }
            ],
            "labels": [
                "misp:type=\"uri\"",
                "misp:category=\"Network activity\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--57b5a93e-f604-442f-8443-49d2950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T12:25:34.000Z",
            "modified": "2016-08-18T12:25:34.000Z",
            "labels": [
                "misp:type=\"pdb\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ],
            "x_misp_category": "Artifacts dropped",
            "x_misp_type": "pdb",
            "x_misp_value": "E:\\Projects\\ComplexStatement\\Shakti\\Code\\Carrier\\Release\\Carrier.pdb"
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--57b5a93f-9fb4-4436-a220-4a41950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T12:25:35.000Z",
            "modified": "2016-08-18T12:25:35.000Z",
            "labels": [
                "misp:type=\"pdb\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ],
            "x_misp_category": "Artifacts dropped",
            "x_misp_type": "pdb",
            "x_misp_value": "E:\\Projects\\ComplexStatement\\Shakti\\Code\\Payload\\Release\\Payload.pdb"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--57b5a9d1-46d0-4515-8152-429a950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T12:28:01.000Z",
            "modified": "2016-08-18T12:28:01.000Z",
            "first_observed": "2016-08-18T12:28:01Z",
            "last_observed": "2016-08-18T12:28:01Z",
            "number_observed": 1,
            "object_refs": [
                "url--57b5a9d1-46d0-4515-8152-429a950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--57b5a9d1-46d0-4515-8152-429a950d210f",
            "value": "http://vms.drweb.ru/virus/?i=3793941&virus_name=Trojan.DownLoader11.5634"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--57b5aa1a-cd14-4bd9-b994-4e4f950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T12:29:14.000Z",
            "modified": "2016-08-18T12:29:14.000Z",
            "pattern": "[file:name = '\\\\%UserProfile\\\\%\\\\uninst.dll']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2016-08-18T12:29:14Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"filename\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--57b5aaea-41e8-41ee-9a00-499c950d210f",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-08-18T12:32:42.000Z",
            "modified": "2016-08-18T12:32:42.000Z",
            "labels": [
                "misp:type=\"whois-registrant-email\"",
                "misp:category=\"Attribution\""
            ],
            "x_misp_category": "Attribution",
            "x_misp_type": "whois-registrant-email",
            "x_misp_value": "ashrafahmed2882@yahoo.com"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}