adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/584fabab-b03c-404c-8ff8-4433950d210f.json

859 lines
37 KiB
JSON
Raw Normal View History

chg: [feed] added
2023-04-21 13:25:09 +00:00
{
chg: [feed] feed updated
2023-06-14 17:31:25 +00:00
"type": "bundle",
"id": "bundle--584fabab-b03c-404c-8ff8-4433950d210f",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:08:32.000Z",
"modified": "2016-12-13T08:08:32.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--584fabab-b03c-404c-8ff8-4433950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:08:32.000Z",
"modified": "2016-12-13T08:08:32.000Z",
"name": "OSINT - Windows 10: protection, detection, and response against recent Depriz malware attacks",
"published": "2016-12-13T08:16:11Z",
"object_refs": [
"observed-data--584fabb7-4028-4bf3-b6b1-4963950d210f",
"url--584fabb7-4028-4bf3-b6b1-4963950d210f",
"x-misp-attribute--584fabcb-d218-44f6-ab11-40ab950d210f",
"indicator--584fabe5-1424-464d-9330-46ef950d210f",
"indicator--584fabe6-f5a8-4ecf-b0a1-4bd5950d210f",
"indicator--584fabe6-5698-4cb8-93e8-4920950d210f",
"indicator--584fabe6-3374-42f0-9f85-4b16950d210f",
"indicator--584fabe6-1e18-4ab7-bea7-42b7950d210f",
"indicator--584fac16-f83c-400f-9397-41dc950d210f",
"indicator--584fac16-42c0-4af5-8c8d-4910950d210f",
"x-misp-attribute--584fac33-c3c0-414a-92fb-464a950d210f",
"x-misp-attribute--584fac33-7be4-4f0b-b5ec-4a30950d210f",
"x-misp-attribute--584fac33-da00-4a71-92d7-4a09950d210f",
"x-misp-attribute--584fac33-885c-41cd-84f8-4eee950d210f",
"indicator--584fac80-e698-4685-8173-48f702de0b81",
"indicator--584fac80-fa70-4953-a8a3-46f802de0b81",
"observed-data--584fac81-86d8-44f1-be73-459502de0b81",
"url--584fac81-86d8-44f1-be73-459502de0b81",
"indicator--584fac81-38f0-460c-84b9-48d502de0b81",
"indicator--584fac81-8a88-4819-8385-454302de0b81",
"observed-data--584fac81-05fc-42e5-ba7d-4dbd02de0b81",
"url--584fac81-05fc-42e5-ba7d-4dbd02de0b81",
"indicator--584fac82-d864-4f8b-a64e-46ff02de0b81",
"indicator--584fac82-2588-445b-a0d1-4d1502de0b81",
"observed-data--584fac82-d674-48f2-ba3a-40d902de0b81",
"url--584fac82-d674-48f2-ba3a-40d902de0b81",
"indicator--584fac82-0bb4-4614-a42a-445b02de0b81",
"indicator--584fac83-0cd0-4fb9-979e-4e7502de0b81",
"observed-data--584fac83-e384-44ab-8511-432d02de0b81",
"url--584fac83-e384-44ab-8511-432d02de0b81",
"indicator--584fac83-5ef8-402e-ba66-4e0d02de0b81",
"indicator--584fac83-3544-4270-9883-4ea502de0b81",
"observed-data--584fac84-3308-4c86-b2e5-40e602de0b81",
"url--584fac84-3308-4c86-b2e5-40e602de0b81",
"indicator--584fac84-4a9c-442c-8fe1-4b8402de0b81",
"indicator--584fac84-4b0c-4ffc-8888-4a8a02de0b81",
"observed-data--584fac84-032c-4ca0-924d-450602de0b81",
"url--584fac84-032c-4ca0-924d-450602de0b81",
"indicator--584fac85-ad2c-42d1-890e-4f6202de0b81",
"indicator--584fac85-01f4-4220-887d-438f02de0b81",
"observed-data--584fac85-5e84-4d1b-b431-4f6902de0b81",
"url--584fac85-5e84-4d1b-b431-4f6902de0b81"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"misp-galaxy:threat-actor=\"TERBIUM\""
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--584fabb7-4028-4bf3-b6b1-4963950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:05:11.000Z",
"modified": "2016-12-13T08:05:11.000Z",
"first_observed": "2016-12-13T08:05:11Z",
"last_observed": "2016-12-13T08:05:11Z",
"number_observed": 1,
"object_refs": [
"url--584fabb7-4028-4bf3-b6b1-4963950d210f"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--584fabb7-4028-4bf3-b6b1-4963950d210f",
"value": "https://blogs.technet.microsoft.com/mmpc/2016/12/09/windows-10-protection-detection-and-response-against-recent-attacks/"
},
{
"type": "x-misp-attribute",
"spec_version": "2.1",
"id": "x-misp-attribute--584fabcb-d218-44f6-ab11-40ab950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:05:31.000Z",
"modified": "2016-12-13T08:05:31.000Z",
"labels": [
"misp:type=\"comment\"",
"misp:category=\"External analysis\""
],
"x_misp_category": "External analysis",
"x_misp_type": "comment",
"x_misp_value": "A few weeks ago, multiple organizations in the Middle East fell victim to targeted and destructive attacks that wiped data from computers, and in many cases rendering them unstable and unbootable. Destructive attacks like these have been observed repeatedly over the years and the Windows Defender and Windows Defender Advanced Threat Protection Threat Intelligence teams are working on protection, detection, and response to these threats.\r\n\r\nMicrosoft Threat Intelligence identified similarities between this recent attack and previous 2012 attacks against tens of thousands of computers belonging to organizations in the energy sector. Microsoft Threat Intelligence refers to the activity group behind these attacks as TERBIUM, following our internal practice of assigning rogue actors chemical element names."
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--584fabe5-1424-464d-9330-46ef950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:05:57.000Z",
"modified": "2016-12-13T08:05:57.000Z",
"description": "malicious files",
"pattern": "[file:hashes.SHA1 = '5c52253b0a2741c4c2e3f1f9a2f82114a254c8d6']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-12-13T08:05:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--584fabe6-f5a8-4ecf-b0a1-4bd5950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:05:58.000Z",
"modified": "2016-12-13T08:05:58.000Z",
"description": "malicious files",
"pattern": "[file:hashes.SHA1 = 'e7c7f41babdb279c099526ece03ede9076edca4e']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-12-13T08:05:58Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--584fabe6-5698-4cb8-93e8-4920950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:05:58.000Z",
"modified": "2016-12-13T08:05:58.000Z",
"description": "malicious files",
"pattern": "[file:hashes.SHA1 = 'a2669df6f7615d317f610f731b6a2129fbed4203']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-12-13T08:05:58Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--584fabe6-3374-42f0-9f85-4b16950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:05:58.000Z",
"modified": "2016-12-13T08:05:58.000Z",
"description": "malicious files",
"pattern": "[file:hashes.SHA1 = '425f02028dcc4e89a07d2892fef9346dac6c140a']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-12-13T08:05:58Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--584fabe6-1e18-4ab7-bea7-42b7950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:05:58.000Z",
"modified": "2016-12-13T08:05:58.000Z",
"description": "malicious files",
"pattern": "[file:hashes.SHA1 = 'ad6744c7ea5fee854261efa403ca06b68761e290']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-12-13T08:05:58Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--584fac16-f83c-400f-9397-41dc950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:06:46.000Z",
"modified": "2016-12-13T08:06:46.000Z",
"description": "legitimate RawDisk drivers",
"pattern": "[file:hashes.SHA1 = '1292c7dd60214d96a71e7705e519006b9de7968f']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-12-13T08:06:46Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--584fac16-42c0-4af5-8c8d-4910950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:06:46.000Z",
"modified": "2016-12-13T08:06:46.000Z",
"description": "legitimate RawDisk drivers",
"pattern": "[file:hashes.SHA1 = 'ce549714a11bd43b52be709581c6e144957136ec']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-12-13T08:06:46Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "x-misp-attribute",
"spec_version": "2.1",
"id": "x-misp-attribute--584fac33-c3c0-414a-92fb-464a950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:07:15.000Z",
"modified": "2016-12-13T08:07:15.000Z",
"labels": [
"misp:type=\"text\"",
"misp:category=\"Antivirus detection\""
],
"x_misp_category": "Antivirus detection",
"x_misp_type": "text",
"x_misp_value": "Trojan:Win32/Depriz.A!dha"
},
{
"type": "x-misp-attribute",
"spec_version": "2.1",
"id": "x-misp-attribute--584fac33-7be4-4f0b-b5ec-4a30950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:07:15.000Z",
"modified": "2016-12-13T08:07:15.000Z",
"labels": [
"misp:type=\"text\"",
"misp:category=\"Antivirus detection\""
],
"x_misp_category": "Antivirus detection",
"x_misp_type": "text",
"x_misp_value": "Trojan:Win32/Depriz.B!dha"
},
{
"type": "x-misp-attribute",
"spec_version": "2.1",
"id": "x-misp-attribute--584fac33-da00-4a71-92d7-4a09950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:07:15.000Z",
"modified": "2016-12-13T08:07:15.000Z",
"labels": [
"misp:type=\"text\"",
"misp:category=\"Antivirus detection\""
],
"x_misp_category": "Antivirus detection",
"x_misp_type": "text",
"x_misp_value": "Trojan:Win32/Depriz.C!dha"
},
{
"type": "x-misp-attribute",
"spec_version": "2.1",
"id": "x-misp-attribute--584fac33-885c-41cd-84f8-4eee950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:07:15.000Z",
"modified": "2016-12-13T08:07:15.000Z",
"labels": [
"misp:type=\"text\"",
"misp:category=\"Antivirus detection\""
],
"x_misp_category": "Antivirus detection",
"x_misp_type": "text",
"x_misp_value": "Trojan:Win32/Depriz.D!dha"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--584fac80-e698-4685-8173-48f702de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:08:32.000Z",
"modified": "2016-12-13T08:08:32.000Z",
"description": "legitimate RawDisk drivers - Xchecked via VT: ce549714a11bd43b52be709581c6e144957136ec",
"pattern": "[file:hashes.SHA256 = '4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-12-13T08:08:32Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--584fac80-fa70-4953-a8a3-46f802de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:08:32.000Z",
"modified": "2016-12-13T08:08:32.000Z",
"description": "legitimate RawDisk drivers - Xchecked via VT: ce549714a11bd43b52be709581c6e144957136ec",
"pattern": "[file:hashes.MD5 = '1493d342e7a36553c56b2adea150949e']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-12-13T08:08:32Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--584fac81-86d8-44f1-be73-459502de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:08:33.000Z",
"modified": "2016-12-13T08:08:33.000Z",
"first_observed": "2016-12-13T08:08:33Z",
"last_observed": "2016-12-13T08:08:33Z",
"number_observed": 1,
"object_refs": [
"url--584fac81-86d8-44f1-be73-459502de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--584fac81-86d8-44f1-be73-459502de0b81",
"value": "https://www.virustotal.com/file/4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6/analysis/1481093448/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--584fac81-38f0-460c-84b9-48d502de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:08:33.000Z",
"modified": "2016-12-13T08:08:33.000Z",
"description": "legitimate RawDisk drivers - Xchecked via VT: 1292c7dd60214d96a71e7705e519006b9de7968f",
"pattern": "[file:hashes.SHA256 = '5a826b4fa10891cf63aae832fc645ce680a483b915c608ca26cedbb173b1b80a']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-12-13T08:08:33Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--584fac81-8a88-4819-8385-454302de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:08:33.000Z",
"modified": "2016-12-13T08:08:33.000Z",
"description": "legitimate RawDisk drivers - Xchecked via VT: 1292c7dd60214d96a71e7705e519006b9de7968f",
"pattern": "[file:hashes.MD5 = '76c643ab29d497317085e5db8c799960']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-12-13T08:08:33Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--584fac81-05fc-42e5-ba7d-4dbd02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:08:33.000Z",
"modified": "2016-12-13T08:08:33.000Z",
"first_observed": "2016-12-13T08:08:33Z",
"last_observed": "2016-12-13T08:08:33Z",
"number_observed": 1,
"object_refs": [
"url--584fac81-05fc-42e5-ba7d-4dbd02de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--584fac81-05fc-42e5-ba7d-4dbd02de0b81",
"value": "https://www.virustotal.com/file/5a826b4fa10891cf63aae832fc645ce680a483b915c608ca26cedbb173b1b80a/analysis/1480997926/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--584fac82-d864-4f8b-a64e-46ff02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:08:34.000Z",
"modified": "2016-12-13T08:08:34.000Z",
"description": "malicious files - Xchecked via VT: ad6744c7ea5fee854261efa403ca06b68761e290",
"pattern": "[file:hashes.SHA256 = '128fa5815c6fee68463b18051c1a1ccdf28c599ce321691686b1efa4838a2acd']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-12-13T08:08:34Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--584fac82-2588-445b-a0d1-4d1502de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:08:34.000Z",
"modified": "2016-12-13T08:08:34.000Z",
"description": "malicious files - Xchecked via VT: ad6744c7ea5fee854261efa403ca06b68761e290",
"pattern": "[file:hashes.MD5 = '2cd0a5f1e9bcce6807e57ec8477d222a']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-12-13T08:08:34Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--584fac82-d674-48f2-ba3a-40d902de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:08:34.000Z",
"modified": "2016-12-13T08:08:34.000Z",
"first_observed": "2016-12-13T08:08:34Z",
"last_observed": "2016-12-13T08:08:34Z",
"number_observed": 1,
"object_refs": [
"url--584fac82-d674-48f2-ba3a-40d902de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--584fac82-d674-48f2-ba3a-40d902de0b81",
"value": "https://www.virustotal.com/file/128fa5815c6fee68463b18051c1a1ccdf28c599ce321691686b1efa4838a2acd/analysis/1481237179/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--584fac82-0bb4-4614-a42a-445b02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:08:34.000Z",
"modified": "2016-12-13T08:08:34.000Z",
"description": "malicious files - Xchecked via VT: 425f02028dcc4e89a07d2892fef9346dac6c140a",
"pattern": "[file:hashes.SHA256 = 'c7fc1f9c2bed748b50a599ee2fa609eb7c9ddaeb9cd16633ba0d10cf66891d8a']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-12-13T08:08:34Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--584fac83-0cd0-4fb9-979e-4e7502de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:08:35.000Z",
"modified": "2016-12-13T08:08:35.000Z",
"description": "malicious files - Xchecked via VT: 425f02028dcc4e89a07d2892fef9346dac6c140a",
"pattern": "[file:hashes.MD5 = 'c843046e54b755ec63ccb09d0a689674']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-12-13T08:08:35Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--584fac83-e384-44ab-8511-432d02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:08:35.000Z",
"modified": "2016-12-13T08:08:35.000Z",
"first_observed": "2016-12-13T08:08:35Z",
"last_observed": "2016-12-13T08:08:35Z",
"number_observed": 1,
"object_refs": [
"url--584fac83-e384-44ab-8511-432d02de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--584fac83-e384-44ab-8511-432d02de0b81",
"value": "https://www.virustotal.com/file/c7fc1f9c2bed748b50a599ee2fa609eb7c9ddaeb9cd16633ba0d10cf66891d8a/analysis/1480864286/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--584fac83-5ef8-402e-ba66-4e0d02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:08:35.000Z",
"modified": "2016-12-13T08:08:35.000Z",
"description": "malicious files - Xchecked via VT: a2669df6f7615d317f610f731b6a2129fbed4203",
"pattern": "[file:hashes.SHA256 = '448ad1bc06ea26f4709159f72ed70ca199ff2176182619afa03435d38cd53237']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-12-13T08:08:35Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--584fac83-3544-4270-9883-4ea502de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:08:35.000Z",
"modified": "2016-12-13T08:08:35.000Z",
"description": "malicious files - Xchecked via VT: a2669df6f7615d317f610f731b6a2129fbed4203",
"pattern": "[file:hashes.MD5 = '5289f4b806bbd7893fbda3ce4025683e']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-12-13T08:08:35Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--584fac84-3308-4c86-b2e5-40e602de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:08:36.000Z",
"modified": "2016-12-13T08:08:36.000Z",
"first_observed": "2016-12-13T08:08:36Z",
"last_observed": "2016-12-13T08:08:36Z",
"number_observed": 1,
"object_refs": [
"url--584fac84-3308-4c86-b2e5-40e602de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--584fac84-3308-4c86-b2e5-40e602de0b81",
"value": "https://www.virustotal.com/file/448ad1bc06ea26f4709159f72ed70ca199ff2176182619afa03435d38cd53237/analysis/1481042001/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--584fac84-4a9c-442c-8fe1-4b8402de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:08:36.000Z",
"modified": "2016-12-13T08:08:36.000Z",
"description": "malicious files - Xchecked via VT: e7c7f41babdb279c099526ece03ede9076edca4e",
"pattern": "[file:hashes.SHA256 = '394a7ebad5dfc13d6c75945a61063470dc3b68f7a207613b79ef000e1990909b']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-12-13T08:08:36Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--584fac84-4b0c-4ffc-8888-4a8a02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:08:36.000Z",
"modified": "2016-12-13T08:08:36.000Z",
"description": "malicious files - Xchecked via VT: e7c7f41babdb279c099526ece03ede9076edca4e",
"pattern": "[file:hashes.MD5 = '5446f46d89124462ae7aca4fce420423']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-12-13T08:08:36Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--584fac84-032c-4ca0-924d-450602de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:08:36.000Z",
"modified": "2016-12-13T08:08:36.000Z",
"first_observed": "2016-12-13T08:08:36Z",
"last_observed": "2016-12-13T08:08:36Z",
"number_observed": 1,
"object_refs": [
"url--584fac84-032c-4ca0-924d-450602de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--584fac84-032c-4ca0-924d-450602de0b81",
"value": "https://www.virustotal.com/file/394a7ebad5dfc13d6c75945a61063470dc3b68f7a207613b79ef000e1990909b/analysis/1481303798/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--584fac85-ad2c-42d1-890e-4f6202de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:08:37.000Z",
"modified": "2016-12-13T08:08:37.000Z",
"description": "malicious files - Xchecked via VT: 5c52253b0a2741c4c2e3f1f9a2f82114a254c8d6",
"pattern": "[file:hashes.SHA256 = '47bb36cd2832a18b5ae951cf5a7d44fba6d8f5dca0a372392d40f51d1fe1ac34']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-12-13T08:08:37Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--584fac85-01f4-4220-887d-438f02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:08:37.000Z",
"modified": "2016-12-13T08:08:37.000Z",
"description": "malicious files - Xchecked via VT: 5c52253b0a2741c4c2e3f1f9a2f82114a254c8d6",
"pattern": "[file:hashes.MD5 = '8fbe990c2d493f58a2afa2b746e49c86']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-12-13T08:08:37Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--584fac85-5e84-4d1b-b431-4f6902de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-12-13T08:08:37.000Z",
"modified": "2016-12-13T08:08:37.000Z",
"first_observed": "2016-12-13T08:08:37Z",
"last_observed": "2016-12-13T08:08:37Z",
"number_observed": 1,
"object_refs": [
"url--584fac85-5e84-4d1b-b431-4f6902de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--584fac85-5e84-4d1b-b431-4f6902de0b81",
"value": "https://www.virustotal.com/file/47bb36cd2832a18b5ae951cf5a7d44fba6d8f5dca0a372392d40f51d1fe1ac34/analysis/1481303775/"
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
chg: [feed] added
2023-04-21 13:25:09 +00:00
]
}
Reference in a new issue Copy permalink