2023-04-21 13:25:09 +00:00
|
|
|
{
|
2023-06-14 17:31:25 +00:00
|
|
|
"type": "bundle",
|
|
|
|
|
"id": "bundle--593a42a0-7298-4e35-9443-4ed0950d210f",
|
|
|
|
|
"objects": [
|
|
|
|
|
{
|
|
|
|
|
"type": "identity",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T07:04:06.000Z",
|
|
|
|
|
"modified": "2017-06-09T07:04:06.000Z",
|
|
|
|
|
"name": "CIRCL",
|
|
|
|
|
"identity_class": "organization"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "report",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "report--593a42a0-7298-4e35-9443-4ed0950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T07:04:06.000Z",
|
|
|
|
|
"modified": "2017-06-09T07:04:06.000Z",
|
|
|
|
|
"name": "M2M - Dridex 2017-06-05 : botnet 7200 - \"Invoice\" - \"A4 Inv_Crd 12345.pdf\"",
|
|
|
|
|
"published": "2017-06-09T07:04:34Z",
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"indicator--593a42a1-507c-4a57-9491-4ebe950d210f",
|
|
|
|
|
"indicator--593a42a1-ce54-4512-92b5-4d23950d210f",
|
|
|
|
|
"indicator--593a42a2-c190-40bb-b002-4f00950d210f",
|
|
|
|
|
"indicator--593a42a3-9860-4b2a-a1e5-8a4b950d210f",
|
|
|
|
|
"observed-data--593a42a4-7ee0-45c5-8373-48e4950d210f",
|
|
|
|
|
"network-traffic--593a42a4-7ee0-45c5-8373-48e4950d210f",
|
|
|
|
|
"ipv4-addr--593a42a4-7ee0-45c5-8373-48e4950d210f",
|
|
|
|
|
"indicator--593a42a4-6d78-4b2e-8760-493c950d210f",
|
|
|
|
|
"indicator--593a42a5-1294-49a6-a8a4-8bcc950d210f",
|
|
|
|
|
"observed-data--593a42a6-cd84-4fe4-82f2-4728950d210f",
|
|
|
|
|
"network-traffic--593a42a6-cd84-4fe4-82f2-4728950d210f",
|
|
|
|
|
"ipv4-addr--593a42a6-cd84-4fe4-82f2-4728950d210f",
|
|
|
|
|
"indicator--593a42a7-0b08-47bc-a9b0-4c12950d210f",
|
|
|
|
|
"indicator--593a42a7-2418-4736-a767-46f4950d210f",
|
|
|
|
|
"observed-data--593a42a8-0694-49dd-b05b-499d950d210f",
|
|
|
|
|
"network-traffic--593a42a8-0694-49dd-b05b-499d950d210f",
|
|
|
|
|
"ipv4-addr--593a42a8-0694-49dd-b05b-499d950d210f",
|
|
|
|
|
"indicator--593a42a8-b750-44ed-b0a0-471a950d210f",
|
|
|
|
|
"indicator--593a42a9-0b74-488f-9659-4f92950d210f",
|
|
|
|
|
"observed-data--593a42aa-12ec-44cd-b39e-4728950d210f",
|
|
|
|
|
"network-traffic--593a42aa-12ec-44cd-b39e-4728950d210f",
|
|
|
|
|
"ipv4-addr--593a42aa-12ec-44cd-b39e-4728950d210f",
|
|
|
|
|
"indicator--593a42ab-0d28-4bfa-86c1-4435950d210f",
|
|
|
|
|
"indicator--593a42ac-3164-450d-ada3-46f4950d210f",
|
|
|
|
|
"observed-data--593a42ac-6678-48e7-b890-8a4b950d210f",
|
|
|
|
|
"network-traffic--593a42ac-6678-48e7-b890-8a4b950d210f",
|
|
|
|
|
"ipv4-addr--593a42ac-6678-48e7-b890-8a4b950d210f",
|
|
|
|
|
"indicator--593a42ad-2580-412d-8992-440d950d210f",
|
|
|
|
|
"indicator--593a42ad-67f0-4d0c-9099-4476950d210f",
|
|
|
|
|
"observed-data--593a42ae-e1b0-4878-b864-4c5b950d210f",
|
|
|
|
|
"network-traffic--593a42ae-e1b0-4878-b864-4c5b950d210f",
|
|
|
|
|
"ipv4-addr--593a42ae-e1b0-4878-b864-4c5b950d210f",
|
|
|
|
|
"indicator--593a42af-4908-4a6e-af81-4288950d210f",
|
|
|
|
|
"indicator--593a42af-f9a8-4d32-997a-46e6950d210f",
|
|
|
|
|
"observed-data--593a42b0-0d3c-4375-9a5d-486e950d210f",
|
|
|
|
|
"network-traffic--593a42b0-0d3c-4375-9a5d-486e950d210f",
|
|
|
|
|
"ipv4-addr--593a42b0-0d3c-4375-9a5d-486e950d210f",
|
|
|
|
|
"indicator--593a42b1-0880-4369-a7ce-46f4950d210f",
|
|
|
|
|
"indicator--593a42b1-573c-4a1b-99e0-8a4b950d210f",
|
|
|
|
|
"observed-data--593a42b2-4f84-449c-9ea7-4280950d210f",
|
|
|
|
|
"network-traffic--593a42b2-4f84-449c-9ea7-4280950d210f",
|
|
|
|
|
"ipv4-addr--593a42b2-4f84-449c-9ea7-4280950d210f",
|
|
|
|
|
"indicator--593a42b2-8908-4719-bb05-4756950d210f",
|
|
|
|
|
"indicator--593a42b3-f0bc-4094-8ee4-8bcc950d210f",
|
|
|
|
|
"observed-data--593a42b4-7a9c-4037-bea2-4402950d210f",
|
|
|
|
|
"network-traffic--593a42b4-7a9c-4037-bea2-4402950d210f",
|
|
|
|
|
"ipv4-addr--593a42b4-7a9c-4037-bea2-4402950d210f",
|
|
|
|
|
"indicator--593a42b5-6d9c-4032-b0b7-44c6950d210f",
|
|
|
|
|
"indicator--593a42b6-c40c-48d3-a957-46f4950d210f",
|
|
|
|
|
"observed-data--593a42b6-9798-4891-a546-461a950d210f",
|
|
|
|
|
"network-traffic--593a42b6-9798-4891-a546-461a950d210f",
|
|
|
|
|
"ipv4-addr--593a42b6-9798-4891-a546-461a950d210f",
|
|
|
|
|
"indicator--593a42b7-34c4-428c-9bc4-41f8950d210f",
|
|
|
|
|
"indicator--593a42b8-ca4c-404e-b8d3-4ae6950d210f",
|
|
|
|
|
"observed-data--593a42b9-062c-4cfb-afee-4066950d210f",
|
|
|
|
|
"network-traffic--593a42b9-062c-4cfb-afee-4066950d210f",
|
|
|
|
|
"ipv4-addr--593a42b9-062c-4cfb-afee-4066950d210f",
|
|
|
|
|
"indicator--593a42b9-1268-4357-a920-8bcc950d210f",
|
|
|
|
|
"indicator--593a42ba-4300-483e-aec8-4306950d210f",
|
|
|
|
|
"observed-data--593a42ba-ec68-4eee-ad6f-46e6950d210f",
|
|
|
|
|
"network-traffic--593a42ba-ec68-4eee-ad6f-46e6950d210f",
|
|
|
|
|
"ipv4-addr--593a42ba-ec68-4eee-ad6f-46e6950d210f",
|
|
|
|
|
"observed-data--593a42bb-0378-4e0c-84bb-4728950d210f",
|
|
|
|
|
"network-traffic--593a42bb-0378-4e0c-84bb-4728950d210f",
|
|
|
|
|
"ipv4-addr--593a42bb-0378-4e0c-84bb-4728950d210f",
|
|
|
|
|
"indicator--593a42bb-bc44-4180-92e8-4187950d210f",
|
|
|
|
|
"indicator--593a42bc-3978-45ec-b4b6-4c0a950d210f",
|
|
|
|
|
"observed-data--593a42bd-eca8-4b29-bc57-45ed950d210f",
|
|
|
|
|
"network-traffic--593a42bd-eca8-4b29-bc57-45ed950d210f",
|
|
|
|
|
"ipv4-addr--593a42bd-eca8-4b29-bc57-45ed950d210f",
|
|
|
|
|
"indicator--593a42be-cee8-4767-bfd7-46f4950d210f",
|
|
|
|
|
"indicator--593a42bf-4528-484b-bbf4-4e18950d210f",
|
|
|
|
|
"observed-data--593a42c0-1e4c-4c15-9b64-4e0d950d210f",
|
|
|
|
|
"network-traffic--593a42c0-1e4c-4c15-9b64-4e0d950d210f",
|
|
|
|
|
"ipv4-addr--593a42c0-1e4c-4c15-9b64-4e0d950d210f",
|
|
|
|
|
"indicator--593a42c0-bae8-43c0-baa0-4f72950d210f",
|
|
|
|
|
"indicator--593a42c1-176c-42de-a1d9-4ea8950d210f",
|
|
|
|
|
"observed-data--593a42c1-4e4c-45cb-91af-40f4950d210f",
|
|
|
|
|
"network-traffic--593a42c1-4e4c-45cb-91af-40f4950d210f",
|
|
|
|
|
"ipv4-addr--593a42c1-4e4c-45cb-91af-40f4950d210f",
|
|
|
|
|
"indicator--593a42c2-77a4-4c14-bf00-4bdf950d210f",
|
|
|
|
|
"indicator--593a42c3-306c-43b8-80e6-4401950d210f",
|
|
|
|
|
"indicator--593a42c4-0f70-45eb-ab81-47b7950d210f",
|
|
|
|
|
"indicator--593a42c5-b14c-438b-92b3-4fa3950d210f",
|
|
|
|
|
"observed-data--593a42c6-e05c-4871-861a-4792950d210f",
|
|
|
|
|
"network-traffic--593a42c6-e05c-4871-861a-4792950d210f",
|
|
|
|
|
"ipv4-addr--593a42c6-e05c-4871-861a-4792950d210f",
|
|
|
|
|
"indicator--593a42c7-b368-4708-a25c-49df950d210f",
|
|
|
|
|
"indicator--593a42c8-d6b4-42ab-af75-46e6950d210f",
|
|
|
|
|
"observed-data--593a42ca-4e68-4448-9c38-4a25950d210f",
|
|
|
|
|
"network-traffic--593a42ca-4e68-4448-9c38-4a25950d210f",
|
|
|
|
|
"ipv4-addr--593a42ca-4e68-4448-9c38-4a25950d210f",
|
|
|
|
|
"indicator--593a42ca-42ac-4da1-a377-8a4b950d210f",
|
|
|
|
|
"indicator--593a42cb-bb4c-481b-930a-46f4950d210f",
|
|
|
|
|
"observed-data--593a42cc-4f5c-4e13-a349-4201950d210f",
|
|
|
|
|
"network-traffic--593a42cc-4f5c-4e13-a349-4201950d210f",
|
|
|
|
|
"ipv4-addr--593a42cc-4f5c-4e13-a349-4201950d210f",
|
|
|
|
|
"indicator--593a42cd-69d8-4a52-87d7-46e6950d210f",
|
|
|
|
|
"indicator--593a42cd-d64c-480c-a0e5-460b950d210f",
|
|
|
|
|
"observed-data--593a42ce-b26c-480b-b87b-49cd950d210f",
|
|
|
|
|
"network-traffic--593a42ce-b26c-480b-b87b-49cd950d210f",
|
|
|
|
|
"ipv4-addr--593a42ce-b26c-480b-b87b-49cd950d210f",
|
|
|
|
|
"indicator--593a42cf-c18c-402e-80c1-4a6e950d210f",
|
|
|
|
|
"indicator--593a42cf-edec-4331-9371-46e6950d210f",
|
|
|
|
|
"observed-data--593a42d0-87b4-4487-b5d4-4a41950d210f",
|
|
|
|
|
"network-traffic--593a42d0-87b4-4487-b5d4-4a41950d210f",
|
|
|
|
|
"ipv4-addr--593a42d0-87b4-4487-b5d4-4a41950d210f",
|
|
|
|
|
"indicator--593a42d1-f1d4-4681-9b22-42a4950d210f",
|
|
|
|
|
"indicator--593a42d2-5c98-4bed-afcc-433d950d210f",
|
|
|
|
|
"observed-data--593a42d3-770c-48a3-a42c-46e6950d210f",
|
|
|
|
|
"network-traffic--593a42d3-770c-48a3-a42c-46e6950d210f",
|
|
|
|
|
"ipv4-addr--593a42d3-770c-48a3-a42c-46e6950d210f",
|
|
|
|
|
"indicator--593a42d3-7c90-4421-b027-48b6950d210f",
|
|
|
|
|
"indicator--593a42d4-af68-4235-8512-46f4950d210f",
|
|
|
|
|
"observed-data--593a42d5-e078-455c-8951-4c6f950d210f",
|
|
|
|
|
"network-traffic--593a42d5-e078-455c-8951-4c6f950d210f",
|
|
|
|
|
"ipv4-addr--593a42d5-e078-455c-8951-4c6f950d210f",
|
|
|
|
|
"indicator--593a42d6-0f38-4016-84ee-43aa950d210f",
|
|
|
|
|
"indicator--593a42d7-ed9c-4701-9d42-4a8a950d210f",
|
|
|
|
|
"observed-data--593a42d8-b8fc-4262-88f3-40ed950d210f",
|
|
|
|
|
"network-traffic--593a42d8-b8fc-4262-88f3-40ed950d210f",
|
|
|
|
|
"ipv4-addr--593a42d8-b8fc-4262-88f3-40ed950d210f",
|
|
|
|
|
"indicator--593a42d9-af3c-4093-b77f-8a4b950d210f",
|
|
|
|
|
"indicator--593a42da-1f58-42bc-9744-4d83950d210f",
|
|
|
|
|
"observed-data--593a42db-e4a8-4071-adcd-464b950d210f",
|
|
|
|
|
"network-traffic--593a42db-e4a8-4071-adcd-464b950d210f",
|
|
|
|
|
"ipv4-addr--593a42db-e4a8-4071-adcd-464b950d210f",
|
|
|
|
|
"indicator--593a42dc-a670-4845-ada7-4411950d210f",
|
|
|
|
|
"indicator--593a42dd-6130-45b4-bd7f-471e950d210f",
|
|
|
|
|
"observed-data--593a42de-4fbc-48e1-bf56-8bcc950d210f",
|
|
|
|
|
"network-traffic--593a42de-4fbc-48e1-bf56-8bcc950d210f",
|
|
|
|
|
"ipv4-addr--593a42de-4fbc-48e1-bf56-8bcc950d210f",
|
|
|
|
|
"indicator--593a42de-dd4c-4347-a957-4728950d210f",
|
|
|
|
|
"indicator--593a42df-d544-4f1b-bfff-49f1950d210f",
|
|
|
|
|
"observed-data--593a42df-4104-425b-b41f-44be950d210f",
|
|
|
|
|
"network-traffic--593a42df-4104-425b-b41f-44be950d210f",
|
|
|
|
|
"ipv4-addr--593a42df-4104-425b-b41f-44be950d210f",
|
|
|
|
|
"indicator--593a42e0-7cc8-47e7-beca-46e6950d210f",
|
|
|
|
|
"indicator--593a42e0-fdf4-4c02-a29a-418c950d210f",
|
|
|
|
|
"observed-data--593a42e1-3834-49b3-9e89-4f17950d210f",
|
|
|
|
|
"network-traffic--593a42e1-3834-49b3-9e89-4f17950d210f",
|
|
|
|
|
"ipv4-addr--593a42e1-3834-49b3-9e89-4f17950d210f",
|
|
|
|
|
"indicator--593a42e2-960c-432b-ae0d-4d47950d210f",
|
|
|
|
|
"indicator--593a42e2-e118-4527-ae31-4728950d210f",
|
|
|
|
|
"observed-data--593a42e4-9070-4ee0-a184-4ca6950d210f",
|
|
|
|
|
"network-traffic--593a42e4-9070-4ee0-a184-4ca6950d210f",
|
|
|
|
|
"ipv4-addr--593a42e4-9070-4ee0-a184-4ca6950d210f",
|
|
|
|
|
"observed-data--593a42ed-f968-492b-bd34-46e6950d210f",
|
|
|
|
|
"url--593a42ed-f968-492b-bd34-46e6950d210f",
|
|
|
|
|
"observed-data--593a42ee-1324-435f-a3a8-4f87950d210f",
|
|
|
|
|
"network-traffic--593a42ee-1324-435f-a3a8-4f87950d210f",
|
|
|
|
|
"ipv4-addr--593a42ee-1324-435f-a3a8-4f87950d210f",
|
|
|
|
|
"observed-data--593a42ee-3ad0-4788-8444-8a4b950d210f",
|
|
|
|
|
"url--593a42ee-3ad0-4788-8444-8a4b950d210f",
|
|
|
|
|
"observed-data--593a42ef-a590-4e9e-ae81-8bcc950d210f",
|
|
|
|
|
"network-traffic--593a42ef-a590-4e9e-ae81-8bcc950d210f",
|
|
|
|
|
"ipv4-addr--593a42ef-a590-4e9e-ae81-8bcc950d210f",
|
|
|
|
|
"observed-data--593a42f0-f684-46c7-891d-4728950d210f",
|
|
|
|
|
"url--593a42f0-f684-46c7-891d-4728950d210f",
|
|
|
|
|
"observed-data--593a42f1-79d0-450f-ba79-4a48950d210f",
|
|
|
|
|
"network-traffic--593a42f1-79d0-450f-ba79-4a48950d210f",
|
|
|
|
|
"ipv4-addr--593a42f1-79d0-450f-ba79-4a48950d210f",
|
|
|
|
|
"observed-data--593a42f2-1c78-4daf-8fe2-4aba950d210f",
|
|
|
|
|
"url--593a42f2-1c78-4daf-8fe2-4aba950d210f",
|
|
|
|
|
"observed-data--593a42f2-94f0-40c3-8386-48a0950d210f",
|
|
|
|
|
"network-traffic--593a42f2-94f0-40c3-8386-48a0950d210f",
|
|
|
|
|
"ipv4-addr--593a42f2-94f0-40c3-8386-48a0950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"Threat-Report",
|
|
|
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
|
|
|
"misp-galaxy:tool=\"Dridex\""
|
|
|
|
|
],
|
|
|
|
|
"object_marking_refs": [
|
|
|
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42a1-507c-4a57-9491-4ebe950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:29.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:29.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '8f527b08eb39578d18a3690980baf2c0']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:39:29Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42a1-ce54-4512-92b5-4d23950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:29.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:29.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '1a18e844222a43381839d2fa95493ee3']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:39:29Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42a2-c190-40bb-b002-4f00950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:30.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:30.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://91menjin.com/8yfh4gfff']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:39:30Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42a3-9860-4b2a-a1e5-8a4b950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:31.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:31.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = '91menjin.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:39:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42a4-7ee0-45c5-8373-48e4950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:32.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:32.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:39:32Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:39:32Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--593a42a4-7ee0-45c5-8373-48e4950d210f",
|
|
|
|
|
"ipv4-addr--593a42a4-7ee0-45c5-8373-48e4950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--593a42a4-7ee0-45c5-8373-48e4950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--593a42a4-7ee0-45c5-8373-48e4950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--593a42a4-7ee0-45c5-8373-48e4950d210f",
|
|
|
|
|
"value": "122.114.94.28"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42a4-6d78-4b2e-8760-493c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:32.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:32.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://almahaconsultants.com/8yfh4gfff']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:39:32Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42a5-1294-49a6-a8a4-8bcc950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:33.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:33.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'almahaconsultants.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:39:33Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42a6-cd84-4fe4-82f2-4728950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:34.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:34.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:39:34Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:39:34Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--593a42a6-cd84-4fe4-82f2-4728950d210f",
|
|
|
|
|
"ipv4-addr--593a42a6-cd84-4fe4-82f2-4728950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--593a42a6-cd84-4fe4-82f2-4728950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--593a42a6-cd84-4fe4-82f2-4728950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--593a42a6-cd84-4fe4-82f2-4728950d210f",
|
|
|
|
|
"value": "213.158.187.37"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42a7-0b08-47bc-a9b0-4c12950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:35.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:35.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://cabanaionela.ro/8yfh4gfff']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:39:35Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42a7-2418-4736-a767-46f4950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:35.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:35.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'cabanaionela.ro']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:39:35Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42a8-0694-49dd-b05b-499d950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:36.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:36.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:39:36Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:39:36Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--593a42a8-0694-49dd-b05b-499d950d210f",
|
|
|
|
|
"ipv4-addr--593a42a8-0694-49dd-b05b-499d950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--593a42a8-0694-49dd-b05b-499d950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--593a42a8-0694-49dd-b05b-499d950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--593a42a8-0694-49dd-b05b-499d950d210f",
|
|
|
|
|
"value": "188.240.2.174"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42a8-b750-44ed-b0a0-471a950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:36.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:36.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://cardaffairs.com/8yfh4gfff']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:39:36Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42a9-0b74-488f-9659-4f92950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:37.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:37.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'cardaffairs.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:39:37Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42aa-12ec-44cd-b39e-4728950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:38.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:38.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:39:38Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:39:38Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--593a42aa-12ec-44cd-b39e-4728950d210f",
|
|
|
|
|
"ipv4-addr--593a42aa-12ec-44cd-b39e-4728950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--593a42aa-12ec-44cd-b39e-4728950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--593a42aa-12ec-44cd-b39e-4728950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--593a42aa-12ec-44cd-b39e-4728950d210f",
|
|
|
|
|
"value": "23.229.205.226"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42ab-0d28-4bfa-86c1-4435950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:39.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:39.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://cartus-imprimanta.ro/8yfh4gfff']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:39:39Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42ac-3164-450d-ada3-46f4950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:40.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:40.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'cartus-imprimanta.ro']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:39:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42ac-6678-48e7-b890-8a4b950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:40.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:40.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:39:40Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:39:40Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--593a42ac-6678-48e7-b890-8a4b950d210f",
|
|
|
|
|
"ipv4-addr--593a42ac-6678-48e7-b890-8a4b950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--593a42ac-6678-48e7-b890-8a4b950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--593a42ac-6678-48e7-b890-8a4b950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--593a42ac-6678-48e7-b890-8a4b950d210f",
|
|
|
|
|
"value": "176.126.200.56"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42ad-2580-412d-8992-440d950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:41.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:41.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://clicburkina.com/8yfh4gfff']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:39:41Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42ad-67f0-4d0c-9099-4476950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:41.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:41.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'clicburkina.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:39:41Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42ae-e1b0-4878-b864-4c5b950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:42.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:42.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:39:42Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:39:42Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--593a42ae-e1b0-4878-b864-4c5b950d210f",
|
|
|
|
|
"ipv4-addr--593a42ae-e1b0-4878-b864-4c5b950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--593a42ae-e1b0-4878-b864-4c5b950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--593a42ae-e1b0-4878-b864-4c5b950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--593a42ae-e1b0-4878-b864-4c5b950d210f",
|
|
|
|
|
"value": "69.28.199.50"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42af-4908-4a6e-af81-4288950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:43.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:43.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://cqyssj.com/8yfh4gfff']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:39:43Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42af-f9a8-4d32-997a-46e6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:43.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:43.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'cqyssj.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:39:43Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42b0-0d3c-4375-9a5d-486e950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:44.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:44.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:39:44Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:39:44Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--593a42b0-0d3c-4375-9a5d-486e950d210f",
|
|
|
|
|
"ipv4-addr--593a42b0-0d3c-4375-9a5d-486e950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--593a42b0-0d3c-4375-9a5d-486e950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--593a42b0-0d3c-4375-9a5d-486e950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--593a42b0-0d3c-4375-9a5d-486e950d210f",
|
|
|
|
|
"value": "69.10.62.204"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42b1-0880-4369-a7ce-46f4950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:45.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:45.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://luczko.pl/8yfh4gfff']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:39:45Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42b1-573c-4a1b-99e0-8a4b950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:45.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:45.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'luczko.pl']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:39:45Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42b2-4f84-449c-9ea7-4280950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:46.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:46.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:39:46Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:39:46Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--593a42b2-4f84-449c-9ea7-4280950d210f",
|
|
|
|
|
"ipv4-addr--593a42b2-4f84-449c-9ea7-4280950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--593a42b2-4f84-449c-9ea7-4280950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--593a42b2-4f84-449c-9ea7-4280950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--593a42b2-4f84-449c-9ea7-4280950d210f",
|
|
|
|
|
"value": "195.78.66.207"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42b2-8908-4719-bb05-4756950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:46.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:46.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://mainlinecarriers.co.tz/8yfh4gfff']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:39:46Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42b3-f0bc-4094-8ee4-8bcc950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:47.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:47.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'mainlinecarriers.co.tz']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:39:47Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42b4-7a9c-4037-bea2-4402950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:48.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:48.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:39:48Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:39:48Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--593a42b4-7a9c-4037-bea2-4402950d210f",
|
|
|
|
|
"ipv4-addr--593a42b4-7a9c-4037-bea2-4402950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--593a42b4-7a9c-4037-bea2-4402950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--593a42b4-7a9c-4037-bea2-4402950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--593a42b4-7a9c-4037-bea2-4402950d210f",
|
|
|
|
|
"value": "75.102.24.241"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42b5-6d9c-4032-b0b7-44c6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:49.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:49.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://mbmedia.ca/8yfh4gfff']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:39:49Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42b6-c40c-48d3-a957-46f4950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:50.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:50.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'mbmedia.ca']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:39:50Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42b6-9798-4891-a546-461a950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:50.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:50.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:39:50Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:39:50Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--593a42b6-9798-4891-a546-461a950d210f",
|
|
|
|
|
"ipv4-addr--593a42b6-9798-4891-a546-461a950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--593a42b6-9798-4891-a546-461a950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--593a42b6-9798-4891-a546-461a950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--593a42b6-9798-4891-a546-461a950d210f",
|
|
|
|
|
"value": "199.166.6.15"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42b7-34c4-428c-9bc4-41f8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:51.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:51.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://minhatv.6te.net/8yfh4gfff']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:39:51Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42b8-ca4c-404e-b8d3-4ae6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:52.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:52.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'minhatv.6te.net']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:39:52Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42b9-062c-4cfb-afee-4066950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:53.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:53.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:39:53Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:39:53Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--593a42b9-062c-4cfb-afee-4066950d210f",
|
|
|
|
|
"ipv4-addr--593a42b9-062c-4cfb-afee-4066950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--593a42b9-062c-4cfb-afee-4066950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--593a42b9-062c-4cfb-afee-4066950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--593a42b9-062c-4cfb-afee-4066950d210f",
|
|
|
|
|
"value": "173.208.215.124"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42b9-1268-4357-a920-8bcc950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:53.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:53.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://minigal.cz/8yfh4gfff']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:39:53Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42ba-4300-483e-aec8-4306950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:54.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:54.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'minigal.cz']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:39:54Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42ba-ec68-4eee-ad6f-46e6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:54.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:54.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:39:54Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:39:54Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--593a42ba-ec68-4eee-ad6f-46e6950d210f",
|
|
|
|
|
"ipv4-addr--593a42ba-ec68-4eee-ad6f-46e6950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--593a42ba-ec68-4eee-ad6f-46e6950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--593a42ba-ec68-4eee-ad6f-46e6950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--593a42ba-ec68-4eee-ad6f-46e6950d210f",
|
|
|
|
|
"value": "83.167.244.201"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42bb-0378-4e0c-84bb-4728950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:55.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:55.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:39:55Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:39:55Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--593a42bb-0378-4e0c-84bb-4728950d210f",
|
|
|
|
|
"ipv4-addr--593a42bb-0378-4e0c-84bb-4728950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--593a42bb-0378-4e0c-84bb-4728950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--593a42bb-0378-4e0c-84bb-4728950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--593a42bb-0378-4e0c-84bb-4728950d210f",
|
|
|
|
|
"value": "83.167.244.202"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42bb-bc44-4180-92e8-4187950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:55.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:55.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://multielectricos.com/8yfh4gfff']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:39:55Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42bc-3978-45ec-b4b6-4c0a950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:56.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:56.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'multielectricos.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:39:56Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42bd-eca8-4b29-bc57-45ed950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:57.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:57.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:39:57Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:39:57Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--593a42bd-eca8-4b29-bc57-45ed950d210f",
|
|
|
|
|
"ipv4-addr--593a42bd-eca8-4b29-bc57-45ed950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--593a42bd-eca8-4b29-bc57-45ed950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--593a42bd-eca8-4b29-bc57-45ed950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--593a42bd-eca8-4b29-bc57-45ed950d210f",
|
|
|
|
|
"value": "96.127.190.130"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42be-cee8-4767-bfd7-46f4950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:58.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:58.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://newserniggrofg.net/af/8yfh4gfff']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:39:58Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42bf-4528-484b-bbf4-4e18950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:39:59.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:39:59.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'newserniggrofg.net']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:39:59Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42c0-1e4c-4c15-9b64-4e0d950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:00.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:00.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:40:00Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:40:00Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--593a42c0-1e4c-4c15-9b64-4e0d950d210f",
|
|
|
|
|
"ipv4-addr--593a42c0-1e4c-4c15-9b64-4e0d950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--593a42c0-1e4c-4c15-9b64-4e0d950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--593a42c0-1e4c-4c15-9b64-4e0d950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--593a42c0-1e4c-4c15-9b64-4e0d950d210f",
|
|
|
|
|
"value": "119.28.85.128"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42c0-bae8-43c0-baa0-4f72950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:00.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:00.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://quitecross.com/8yfh4gfff']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:40:00Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42c1-176c-42de-a1d9-4ea8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:01.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:01.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'quitecross.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:40:01Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42c1-4e4c-45cb-91af-40f4950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:01.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:01.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:40:01Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:40:01Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--593a42c1-4e4c-45cb-91af-40f4950d210f",
|
|
|
|
|
"ipv4-addr--593a42c1-4e4c-45cb-91af-40f4950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--593a42c1-4e4c-45cb-91af-40f4950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--593a42c1-4e4c-45cb-91af-40f4950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--593a42c1-4e4c-45cb-91af-40f4950d210f",
|
|
|
|
|
"value": "192.124.249.102"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42c2-77a4-4c14-bf00-4bdf950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:02.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:02.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://resevesssetornument.com/af/8yfh4gfff']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:40:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42c3-306c-43b8-80e6-4401950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:03.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:03.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'resevesssetornument.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:40:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42c4-0f70-45eb-ab81-47b7950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:04.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:04.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://salonpalmareal.com/8yfh4gfff']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:40:04Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42c5-b14c-438b-92b3-4fa3950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:05.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:05.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'salonpalmareal.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:40:05Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42c6-e05c-4871-861a-4792950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:06.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:06.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:40:06Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:40:06Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--593a42c6-e05c-4871-861a-4792950d210f",
|
|
|
|
|
"ipv4-addr--593a42c6-e05c-4871-861a-4792950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--593a42c6-e05c-4871-861a-4792950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--593a42c6-e05c-4871-861a-4792950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--593a42c6-e05c-4871-861a-4792950d210f",
|
|
|
|
|
"value": "199.79.62.206"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42c7-b368-4708-a25c-49df950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:07.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:07.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://saybella.com.au/8yfh4gfff']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:40:07Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42c8-d6b4-42ab-af75-46e6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:08.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:08.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'saybella.com.au']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:40:08Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42ca-4e68-4448-9c38-4a25950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:10.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:10.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:40:10Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:40:10Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--593a42ca-4e68-4448-9c38-4a25950d210f",
|
|
|
|
|
"ipv4-addr--593a42ca-4e68-4448-9c38-4a25950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--593a42ca-4e68-4448-9c38-4a25950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--593a42ca-4e68-4448-9c38-4a25950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--593a42ca-4e68-4448-9c38-4a25950d210f",
|
|
|
|
|
"value": "202.191.62.89"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42ca-42ac-4da1-a377-8a4b950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:10.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:10.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://select-hire.com/8yfh4gfff']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:40:10Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42cb-bb4c-481b-930a-46f4950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:11.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:11.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'select-hire.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:40:11Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42cc-4f5c-4e13-a349-4201950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:12.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:12.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:40:12Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:40:12Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--593a42cc-4f5c-4e13-a349-4201950d210f",
|
|
|
|
|
"ipv4-addr--593a42cc-4f5c-4e13-a349-4201950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--593a42cc-4f5c-4e13-a349-4201950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--593a42cc-4f5c-4e13-a349-4201950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--593a42cc-4f5c-4e13-a349-4201950d210f",
|
|
|
|
|
"value": "103.44.161.194"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42cd-69d8-4a52-87d7-46e6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:13.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:13.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://servisanchez.com/8yfh4gfff']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:40:13Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42cd-d64c-480c-a0e5-460b950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:13.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:13.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'servisanchez.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:40:13Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42ce-b26c-480b-b87b-49cd950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:14.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:14.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:40:14Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:40:14Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--593a42ce-b26c-480b-b87b-49cd950d210f",
|
|
|
|
|
"ipv4-addr--593a42ce-b26c-480b-b87b-49cd950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--593a42ce-b26c-480b-b87b-49cd950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--593a42ce-b26c-480b-b87b-49cd950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--593a42ce-b26c-480b-b87b-49cd950d210f",
|
|
|
|
|
"value": "104.37.35.95"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42cf-c18c-402e-80c1-4a6e950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:15.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:15.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://sethiwriting.com/8yfh4gfff']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:40:15Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42cf-edec-4331-9371-46e6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:15.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:15.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'sethiwriting.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:40:15Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42d0-87b4-4487-b5d4-4a41950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:16.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:16.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:40:16Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:40:16Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--593a42d0-87b4-4487-b5d4-4a41950d210f",
|
|
|
|
|
"ipv4-addr--593a42d0-87b4-4487-b5d4-4a41950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--593a42d0-87b4-4487-b5d4-4a41950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--593a42d0-87b4-4487-b5d4-4a41950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--593a42d0-87b4-4487-b5d4-4a41950d210f",
|
|
|
|
|
"value": "199.79.62.9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42d1-f1d4-4681-9b22-42a4950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:17.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:17.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://sonder-bar.net/8yfh4gfff']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:40:17Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42d2-5c98-4bed-afcc-433d950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:18.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:18.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'sonder-bar.net']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:40:18Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42d3-770c-48a3-a42c-46e6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:19.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:19.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:40:19Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:40:19Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--593a42d3-770c-48a3-a42c-46e6950d210f",
|
|
|
|
|
"ipv4-addr--593a42d3-770c-48a3-a42c-46e6950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--593a42d3-770c-48a3-a42c-46e6950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--593a42d3-770c-48a3-a42c-46e6950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--593a42d3-770c-48a3-a42c-46e6950d210f",
|
|
|
|
|
"value": "81.169.145.88"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42d3-7c90-4421-b027-48b6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:19.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:19.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://spaceonline.in/8yfh4gfff']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:40:19Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42d4-af68-4235-8512-46f4950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:20.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:20.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'spaceonline.in']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:40:20Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42d5-e078-455c-8951-4c6f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:21.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:21.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:40:21Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:40:21Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--593a42d5-e078-455c-8951-4c6f950d210f",
|
|
|
|
|
"ipv4-addr--593a42d5-e078-455c-8951-4c6f950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--593a42d5-e078-455c-8951-4c6f950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--593a42d5-e078-455c-8951-4c6f950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--593a42d5-e078-455c-8951-4c6f950d210f",
|
|
|
|
|
"value": "111.118.212.86"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42d6-0f38-4016-84ee-43aa950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:22.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:22.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://studyineurope.in/8yfh4gfff']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:40:22Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42d7-ed9c-4701-9d42-4a8a950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:23.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:23.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'studyineurope.in']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:40:23Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42d8-b8fc-4262-88f3-40ed950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:24.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:24.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:40:24Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:40:24Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--593a42d8-b8fc-4262-88f3-40ed950d210f",
|
|
|
|
|
"ipv4-addr--593a42d8-b8fc-4262-88f3-40ed950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--593a42d8-b8fc-4262-88f3-40ed950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--593a42d8-b8fc-4262-88f3-40ed950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--593a42d8-b8fc-4262-88f3-40ed950d210f",
|
|
|
|
|
"value": "111.118.215.210"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42d9-af3c-4093-b77f-8a4b950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:25.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://sukko-diona.ru/8yfh4gfff']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:40:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42da-1f58-42bc-9744-4d83950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:26.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:26.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'sukko-diona.ru']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:40:26Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42db-e4a8-4071-adcd-464b950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:27.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:27.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:40:27Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:40:27Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--593a42db-e4a8-4071-adcd-464b950d210f",
|
|
|
|
|
"ipv4-addr--593a42db-e4a8-4071-adcd-464b950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--593a42db-e4a8-4071-adcd-464b950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--593a42db-e4a8-4071-adcd-464b950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--593a42db-e4a8-4071-adcd-464b950d210f",
|
|
|
|
|
"value": "81.177.135.193"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42dc-a670-4845-ada7-4411950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:28.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:28.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://weddingphotolook.es/8yfh4gfff']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:40:28Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42dd-6130-45b4-bd7f-471e950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:29.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:29.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'weddingphotolook.es']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:40:29Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42de-4fbc-48e1-bf56-8bcc950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:30.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:30.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:40:30Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:40:30Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--593a42de-4fbc-48e1-bf56-8bcc950d210f",
|
|
|
|
|
"ipv4-addr--593a42de-4fbc-48e1-bf56-8bcc950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--593a42de-4fbc-48e1-bf56-8bcc950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--593a42de-4fbc-48e1-bf56-8bcc950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--593a42de-4fbc-48e1-bf56-8bcc950d210f",
|
|
|
|
|
"value": "46.249.205.45"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42de-dd4c-4347-a957-4728950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:30.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:30.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://xtramax.de/8yfh4gfff']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:40:30Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42df-d544-4f1b-bfff-49f1950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:31.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:31.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'xtramax.de']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:40:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42df-4104-425b-b41f-44be950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:31.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:31.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:40:31Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:40:31Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--593a42df-4104-425b-b41f-44be950d210f",
|
|
|
|
|
"ipv4-addr--593a42df-4104-425b-b41f-44be950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--593a42df-4104-425b-b41f-44be950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--593a42df-4104-425b-b41f-44be950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--593a42df-4104-425b-b41f-44be950d210f",
|
|
|
|
|
"value": "81.169.145.169"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42e0-7cc8-47e7-beca-46e6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:32.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:32.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://ymcaonline.net/8yfh4gfff']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:40:32Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42e0-fdf4-4c02-a29a-418c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:32.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:32.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'ymcaonline.net']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:40:32Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42e1-3834-49b3-9e89-4f17950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:33.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:33.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:40:33Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:40:33Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--593a42e1-3834-49b3-9e89-4f17950d210f",
|
|
|
|
|
"ipv4-addr--593a42e1-3834-49b3-9e89-4f17950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--593a42e1-3834-49b3-9e89-4f17950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--593a42e1-3834-49b3-9e89-4f17950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--593a42e1-3834-49b3-9e89-4f17950d210f",
|
|
|
|
|
"value": "212.57.234.30"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42e2-960c-432b-ae0d-4d47950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:34.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:34.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://zhongjianbao.com/8yfh4gfff']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:40:34Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--593a42e2-e118-4527-ae31-4728950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:34.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:34.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'zhongjianbao.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-06-09T06:40:34Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42e4-9070-4ee0-a184-4ca6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:36.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:36.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:40:36Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:40:36Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--593a42e4-9070-4ee0-a184-4ca6950d210f",
|
|
|
|
|
"ipv4-addr--593a42e4-9070-4ee0-a184-4ca6950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--593a42e4-9070-4ee0-a184-4ca6950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--593a42e4-9070-4ee0-a184-4ca6950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--593a42e4-9070-4ee0-a184-4ca6950d210f",
|
|
|
|
|
"value": "118.244.196.9"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42ed-f968-492b-bd34-46e6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:45.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:45.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:40:45Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:40:45Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--593a42ed-f968-492b-bd34-46e6950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--593a42ed-f968-492b-bd34-46e6950d210f",
|
|
|
|
|
"value": "192.48.88.167"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42ee-1324-435f-a3a8-4f87950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:46.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:46.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:40:46Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:40:46Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--593a42ee-1324-435f-a3a8-4f87950d210f",
|
|
|
|
|
"ipv4-addr--593a42ee-1324-435f-a3a8-4f87950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--593a42ee-1324-435f-a3a8-4f87950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--593a42ee-1324-435f-a3a8-4f87950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--593a42ee-1324-435f-a3a8-4f87950d210f",
|
|
|
|
|
"value": "192.48.88.167"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42ee-3ad0-4788-8444-8a4b950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:46.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:46.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:40:46Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:40:46Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--593a42ee-3ad0-4788-8444-8a4b950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--593a42ee-3ad0-4788-8444-8a4b950d210f",
|
|
|
|
|
"value": "89.110.157.78"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42ef-a590-4e9e-ae81-8bcc950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:47.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:47.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:40:47Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:40:47Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--593a42ef-a590-4e9e-ae81-8bcc950d210f",
|
|
|
|
|
"ipv4-addr--593a42ef-a590-4e9e-ae81-8bcc950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--593a42ef-a590-4e9e-ae81-8bcc950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--593a42ef-a590-4e9e-ae81-8bcc950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--593a42ef-a590-4e9e-ae81-8bcc950d210f",
|
|
|
|
|
"value": "89.110.157.78"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42f0-f684-46c7-891d-4728950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:48.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:48.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:40:48Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:40:48Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--593a42f0-f684-46c7-891d-4728950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--593a42f0-f684-46c7-891d-4728950d210f",
|
|
|
|
|
"value": "85.214.126.182"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42f1-79d0-450f-ba79-4a48950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:49.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:49.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:40:49Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:40:49Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--593a42f1-79d0-450f-ba79-4a48950d210f",
|
|
|
|
|
"ipv4-addr--593a42f1-79d0-450f-ba79-4a48950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--593a42f1-79d0-450f-ba79-4a48950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--593a42f1-79d0-450f-ba79-4a48950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--593a42f1-79d0-450f-ba79-4a48950d210f",
|
|
|
|
|
"value": "85.214.126.182"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42f2-1c78-4daf-8fe2-4aba950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:50.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:50.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:40:50Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:40:50Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--593a42f2-1c78-4daf-8fe2-4aba950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--593a42f2-1c78-4daf-8fe2-4aba950d210f",
|
|
|
|
|
"value": "46.101.154.177"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--593a42f2-94f0-40c3-8386-48a0950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-06-09T06:40:50.000Z",
|
|
|
|
|
"modified": "2017-06-09T06:40:50.000Z",
|
|
|
|
|
"first_observed": "2017-06-09T06:40:50Z",
|
|
|
|
|
"last_observed": "2017-06-09T06:40:50Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--593a42f2-94f0-40c3-8386-48a0950d210f",
|
|
|
|
|
"ipv4-addr--593a42f2-94f0-40c3-8386-48a0950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--593a42f2-94f0-40c3-8386-48a0950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--593a42f2-94f0-40c3-8386-48a0950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--593a42f2-94f0-40c3-8386-48a0950d210f",
|
|
|
|
|
"value": "46.101.154.177"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "marking-definition",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
|
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
|
|
|
"definition_type": "tlp",
|
|
|
|
|
"name": "TLP:WHITE",
|
|
|
|
|
"definition": {
|
|
|
|
|
"tlp": "white"
|
|
|
|
|
}
|
|
|
|
|
}
|
2023-04-21 13:25:09 +00:00
|
|
|
]
|
|
|
|
|
}
|
