2023-04-21 13:25:09 +00:00
|
|
|
{
|
2023-06-14 17:31:25 +00:00
|
|
|
"type": "bundle",
|
|
|
|
|
"id": "bundle--59525a0f-4584-40a8-82c7-420f950d210f",
|
|
|
|
|
"objects": [
|
|
|
|
|
{
|
|
|
|
|
"type": "identity",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:11:00.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:11:00.000Z",
|
|
|
|
|
"name": "CIRCL",
|
|
|
|
|
"identity_class": "organization"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "report",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "report--59525a0f-4584-40a8-82c7-420f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:11:00.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:11:00.000Z",
|
|
|
|
|
"name": "M2M - Trickbot 2017-06-27 : mac1 : \"facture 654321\" - \"abonneau_654321.docm\"",
|
|
|
|
|
"published": "2017-07-05T09:11:09Z",
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"indicator--59525a0f-1e00-49dc-92cb-672f950d210f",
|
|
|
|
|
"indicator--59525a10-a940-4414-9763-6731950d210f",
|
|
|
|
|
"indicator--59525a10-4260-4372-ad2d-4147950d210f",
|
|
|
|
|
"indicator--59525a10-6494-44b9-bfba-43b8950d210f",
|
|
|
|
|
"observed-data--59525a10-5e5c-400e-a42d-1844950d210f",
|
|
|
|
|
"network-traffic--59525a10-5e5c-400e-a42d-1844950d210f",
|
|
|
|
|
"ipv4-addr--59525a10-5e5c-400e-a42d-1844950d210f",
|
|
|
|
|
"indicator--59525a10-b05c-4299-8ee1-673b950d210f",
|
|
|
|
|
"indicator--59525a11-3f98-4ed8-aef2-4d72950d210f",
|
|
|
|
|
"observed-data--59525a11-2084-43eb-93c3-4052950d210f",
|
|
|
|
|
"network-traffic--59525a11-2084-43eb-93c3-4052950d210f",
|
|
|
|
|
"ipv4-addr--59525a11-2084-43eb-93c3-4052950d210f",
|
|
|
|
|
"indicator--59525a11-5544-4704-ad9f-672c950d210f",
|
|
|
|
|
"indicator--59525a12-a434-4abc-b78a-4679950d210f",
|
|
|
|
|
"observed-data--59525a12-0680-4bca-9af6-6401950d210f",
|
|
|
|
|
"network-traffic--59525a12-0680-4bca-9af6-6401950d210f",
|
|
|
|
|
"ipv4-addr--59525a12-0680-4bca-9af6-6401950d210f",
|
|
|
|
|
"indicator--59525a12-b624-4c9d-ab20-19ec950d210f",
|
|
|
|
|
"indicator--59525a12-eb24-49db-a96e-64a3950d210f",
|
|
|
|
|
"observed-data--59525a15-95e4-419c-9637-1844950d210f",
|
|
|
|
|
"network-traffic--59525a15-95e4-419c-9637-1844950d210f",
|
|
|
|
|
"ipv4-addr--59525a15-95e4-419c-9637-1844950d210f",
|
|
|
|
|
"observed-data--59525a15-df78-4786-b6fe-673b950d210f",
|
|
|
|
|
"network-traffic--59525a15-df78-4786-b6fe-673b950d210f",
|
|
|
|
|
"ipv4-addr--59525a15-df78-4786-b6fe-673b950d210f",
|
|
|
|
|
"indicator--59525a15-9c84-4cb9-a3c7-4b32950d210f",
|
|
|
|
|
"indicator--59525a16-3b08-4886-86d5-4d57950d210f",
|
|
|
|
|
"observed-data--59525a16-6378-48ba-9100-4f40950d210f",
|
|
|
|
|
"network-traffic--59525a16-6378-48ba-9100-4f40950d210f",
|
|
|
|
|
"ipv4-addr--59525a16-6378-48ba-9100-4f40950d210f",
|
|
|
|
|
"indicator--59525a16-80a8-4469-8b98-44ef950d210f",
|
|
|
|
|
"indicator--59525a16-ef48-42bf-a589-672c950d210f",
|
|
|
|
|
"observed-data--59525a17-6bd8-4f2d-86e9-480d950d210f",
|
|
|
|
|
"network-traffic--59525a17-6bd8-4f2d-86e9-480d950d210f",
|
|
|
|
|
"ipv4-addr--59525a17-6bd8-4f2d-86e9-480d950d210f",
|
|
|
|
|
"indicator--59525a17-7000-4324-9e15-43ec950d210f",
|
|
|
|
|
"indicator--59525a17-5d3c-4dff-b6d5-6401950d210f",
|
|
|
|
|
"observed-data--59525a17-904c-4bfc-9ff2-42df950d210f",
|
|
|
|
|
"network-traffic--59525a17-904c-4bfc-9ff2-42df950d210f",
|
|
|
|
|
"ipv4-addr--59525a17-904c-4bfc-9ff2-42df950d210f",
|
|
|
|
|
"indicator--59525a17-4908-4b74-ad3a-19ec950d210f",
|
|
|
|
|
"indicator--59525a18-b09c-4248-b07e-64a3950d210f",
|
|
|
|
|
"observed-data--59525a18-29b8-48f7-a1a2-672f950d210f",
|
|
|
|
|
"network-traffic--59525a18-29b8-48f7-a1a2-672f950d210f",
|
|
|
|
|
"ipv4-addr--59525a18-29b8-48f7-a1a2-672f950d210f",
|
|
|
|
|
"indicator--59525a18-d150-4892-a472-6731950d210f",
|
|
|
|
|
"indicator--59525a18-94dc-4c93-befc-4256950d210f",
|
|
|
|
|
"observed-data--59525a18-5b14-4212-8702-4da7950d210f",
|
|
|
|
|
"network-traffic--59525a18-5b14-4212-8702-4da7950d210f",
|
|
|
|
|
"ipv4-addr--59525a18-5b14-4212-8702-4da7950d210f",
|
|
|
|
|
"indicator--59525a18-ebb8-4c91-a379-6736950d210f",
|
|
|
|
|
"indicator--59525a18-4258-4882-a46c-673b950d210f",
|
|
|
|
|
"observed-data--59525a19-ebfc-4d56-9690-46bc950d210f",
|
|
|
|
|
"network-traffic--59525a19-ebfc-4d56-9690-46bc950d210f",
|
|
|
|
|
"ipv4-addr--59525a19-ebfc-4d56-9690-46bc950d210f",
|
|
|
|
|
"indicator--59525a19-e018-4049-a698-493d950d210f",
|
|
|
|
|
"indicator--59525a19-a024-4fc1-b552-4f44950d210f",
|
|
|
|
|
"observed-data--59525a19-3028-4c83-bb3e-4eb5950d210f",
|
|
|
|
|
"network-traffic--59525a19-3028-4c83-bb3e-4eb5950d210f",
|
|
|
|
|
"ipv4-addr--59525a19-3028-4c83-bb3e-4eb5950d210f",
|
|
|
|
|
"indicator--59525a1a-7394-4483-9d70-6401950d210f",
|
|
|
|
|
"indicator--59525a1a-9454-44a1-a98f-47e1950d210f",
|
|
|
|
|
"observed-data--59525a1a-2944-4f0b-812e-672f950d210f",
|
|
|
|
|
"network-traffic--59525a1a-2944-4f0b-812e-672f950d210f",
|
|
|
|
|
"ipv4-addr--59525a1a-2944-4f0b-812e-672f950d210f",
|
|
|
|
|
"indicator--59525a1b-2588-4336-8333-6738950d210f",
|
|
|
|
|
"indicator--59525a1b-5940-40ae-a73d-481a950d210f",
|
|
|
|
|
"observed-data--59525a1b-2888-4480-be11-4ed0950d210f",
|
|
|
|
|
"network-traffic--59525a1b-2888-4480-be11-4ed0950d210f",
|
|
|
|
|
"ipv4-addr--59525a1b-2888-4480-be11-4ed0950d210f",
|
|
|
|
|
"indicator--59525a1b-98e4-4eba-b1bd-6736950d210f",
|
|
|
|
|
"indicator--59525a1b-a234-47f0-b367-673b950d210f",
|
|
|
|
|
"observed-data--59525a1e-9190-4019-a89e-6401950d210f",
|
|
|
|
|
"network-traffic--59525a1e-9190-4019-a89e-6401950d210f",
|
|
|
|
|
"ipv4-addr--59525a1e-9190-4019-a89e-6401950d210f",
|
|
|
|
|
"indicator--59525a1e-0f54-4043-8f3e-4bce950d210f",
|
|
|
|
|
"indicator--59525a1e-6ad8-4e76-a949-19ec950d210f",
|
|
|
|
|
"observed-data--59525a1f-f0a8-42c2-a563-672f950d210f",
|
|
|
|
|
"network-traffic--59525a1f-f0a8-42c2-a563-672f950d210f",
|
|
|
|
|
"ipv4-addr--59525a1f-f0a8-42c2-a563-672f950d210f",
|
|
|
|
|
"indicator--59525a1f-7d28-4e10-9cac-64a3950d210f",
|
|
|
|
|
"indicator--59525a1f-1218-4630-8fbd-6738950d210f",
|
|
|
|
|
"observed-data--59525a1f-eb9c-44c7-9490-41f6950d210f",
|
|
|
|
|
"network-traffic--59525a1f-eb9c-44c7-9490-41f6950d210f",
|
|
|
|
|
"ipv4-addr--59525a1f-eb9c-44c7-9490-41f6950d210f",
|
|
|
|
|
"indicator--59525a1f-7d18-42fe-ad82-6731950d210f",
|
|
|
|
|
"indicator--59525a20-d818-4c77-83b1-649f950d210f",
|
|
|
|
|
"observed-data--59525a20-b4bc-4149-8269-6736950d210f",
|
|
|
|
|
"network-traffic--59525a20-b4bc-4149-8269-6736950d210f",
|
|
|
|
|
"ipv4-addr--59525a20-b4bc-4149-8269-6736950d210f",
|
|
|
|
|
"indicator--59525a20-07cc-4dd0-b738-673b950d210f",
|
|
|
|
|
"indicator--59525a20-16a8-4f97-b483-1844950d210f",
|
|
|
|
|
"observed-data--59525a21-d47c-4f35-97f5-4535950d210f",
|
|
|
|
|
"network-traffic--59525a21-d47c-4f35-97f5-4535950d210f",
|
|
|
|
|
"ipv4-addr--59525a21-d47c-4f35-97f5-4535950d210f",
|
|
|
|
|
"indicator--59525a21-a928-4d9a-b0c2-408f950d210f",
|
|
|
|
|
"indicator--59525a21-37ac-454b-9353-672c950d210f",
|
|
|
|
|
"observed-data--59525a22-94c8-477d-9321-4724950d210f",
|
|
|
|
|
"network-traffic--59525a22-94c8-477d-9321-4724950d210f",
|
|
|
|
|
"ipv4-addr--59525a22-94c8-477d-9321-4724950d210f",
|
|
|
|
|
"indicator--59525a22-9b80-44c2-8f97-19ec950d210f",
|
|
|
|
|
"indicator--59525a22-9670-4ad7-a975-4ee4950d210f",
|
|
|
|
|
"observed-data--59525a22-a800-4d61-be26-672f950d210f",
|
|
|
|
|
"network-traffic--59525a22-a800-4d61-be26-672f950d210f",
|
|
|
|
|
"ipv4-addr--59525a22-a800-4d61-be26-672f950d210f",
|
|
|
|
|
"indicator--59525a22-72b8-471e-a106-6738950d210f",
|
|
|
|
|
"indicator--59525a23-64e4-46ab-aeea-49e3950d210f",
|
|
|
|
|
"observed-data--59525a23-651c-42b0-b167-6731950d210f",
|
|
|
|
|
"network-traffic--59525a23-651c-42b0-b167-6731950d210f",
|
|
|
|
|
"ipv4-addr--59525a23-651c-42b0-b167-6731950d210f",
|
|
|
|
|
"indicator--59525a23-73f4-4a47-9996-4d41950d210f",
|
|
|
|
|
"indicator--59525a23-6a6c-4a33-abeb-6736950d210f",
|
|
|
|
|
"observed-data--59525a24-dde4-4964-88e8-673b950d210f",
|
|
|
|
|
"network-traffic--59525a24-dde4-4964-88e8-673b950d210f",
|
|
|
|
|
"ipv4-addr--59525a24-dde4-4964-88e8-673b950d210f",
|
|
|
|
|
"indicator--59525a24-674c-4b2d-a459-1844950d210f",
|
|
|
|
|
"indicator--59525a25-f1c8-4d81-b53e-4db5950d210f",
|
|
|
|
|
"observed-data--59525a25-ed1c-415f-9d71-4a9a950d210f",
|
|
|
|
|
"network-traffic--59525a25-ed1c-415f-9d71-4a9a950d210f",
|
|
|
|
|
"ipv4-addr--59525a25-ed1c-415f-9d71-4a9a950d210f",
|
|
|
|
|
"indicator--59525a25-24c8-4400-bdb8-4c71950d210f",
|
|
|
|
|
"indicator--59525a25-9c34-42c9-a7c5-43ba950d210f",
|
|
|
|
|
"indicator--59525a27-dca0-4bd9-a9dd-6401950d210f",
|
|
|
|
|
"indicator--59525a27-44b8-4586-a181-490b950d210f",
|
|
|
|
|
"observed-data--59525a27-5a20-4d78-8ea3-19ec950d210f",
|
|
|
|
|
"network-traffic--59525a27-5a20-4d78-8ea3-19ec950d210f",
|
|
|
|
|
"ipv4-addr--59525a27-5a20-4d78-8ea3-19ec950d210f",
|
|
|
|
|
"indicator--59525a28-b89c-4534-80ba-4cba950d210f",
|
|
|
|
|
"indicator--59525a28-ad40-42f0-8f33-4bf6950d210f",
|
|
|
|
|
"observed-data--59525a28-8c4c-4f09-81b4-672f950d210f",
|
|
|
|
|
"network-traffic--59525a28-8c4c-4f09-81b4-672f950d210f",
|
|
|
|
|
"ipv4-addr--59525a28-8c4c-4f09-81b4-672f950d210f",
|
|
|
|
|
"indicator--59525a28-0744-4f39-9995-6738950d210f",
|
|
|
|
|
"indicator--59525a28-6958-4d36-9d19-4d64950d210f",
|
|
|
|
|
"observed-data--59525a29-521c-41ee-bf24-64a3950d210f",
|
|
|
|
|
"network-traffic--59525a29-521c-41ee-bf24-64a3950d210f",
|
|
|
|
|
"ipv4-addr--59525a29-521c-41ee-bf24-64a3950d210f",
|
|
|
|
|
"indicator--59525a29-b7d0-4cff-b890-6731950d210f",
|
|
|
|
|
"indicator--59525a29-d850-4982-9c8e-499b950d210f",
|
|
|
|
|
"observed-data--59525a2a-fa44-4d9f-a58e-6736950d210f",
|
|
|
|
|
"network-traffic--59525a2a-fa44-4d9f-a58e-6736950d210f",
|
|
|
|
|
"ipv4-addr--59525a2a-fa44-4d9f-a58e-6736950d210f",
|
|
|
|
|
"indicator--59525a2a-89d8-4e13-bc19-649f950d210f",
|
|
|
|
|
"indicator--59525a2a-3038-4b1c-946f-673b950d210f",
|
|
|
|
|
"observed-data--59525a2a-656c-474e-9c1b-1844950d210f",
|
|
|
|
|
"network-traffic--59525a2a-656c-474e-9c1b-1844950d210f",
|
|
|
|
|
"ipv4-addr--59525a2a-656c-474e-9c1b-1844950d210f",
|
|
|
|
|
"indicator--59525a2a-f45c-45e5-b4e0-4a12950d210f",
|
|
|
|
|
"indicator--59525a2a-2ed0-4204-879c-43ee950d210f",
|
|
|
|
|
"observed-data--59525a2b-f648-465b-a533-448e950d210f",
|
|
|
|
|
"network-traffic--59525a2b-f648-465b-a533-448e950d210f",
|
|
|
|
|
"ipv4-addr--59525a2b-f648-465b-a533-448e950d210f",
|
|
|
|
|
"indicator--59525a2b-7db8-4ce3-b468-4fff950d210f",
|
|
|
|
|
"indicator--59525a2b-c2ac-45bf-9d57-672c950d210f",
|
|
|
|
|
"observed-data--59525a2b-13e0-4d9b-9ff5-6401950d210f",
|
|
|
|
|
"network-traffic--59525a2b-13e0-4d9b-9ff5-6401950d210f",
|
|
|
|
|
"ipv4-addr--59525a2b-13e0-4d9b-9ff5-6401950d210f",
|
|
|
|
|
"observed-data--59525a2c-f610-42bc-ac08-49a0950d210f",
|
|
|
|
|
"network-traffic--59525a2c-f610-42bc-ac08-49a0950d210f",
|
|
|
|
|
"ipv4-addr--59525a2c-f610-42bc-ac08-49a0950d210f",
|
|
|
|
|
"indicator--59525a2c-fde8-4488-85ae-19ec950d210f",
|
|
|
|
|
"indicator--59525a2c-6860-48f6-851e-4f00950d210f",
|
|
|
|
|
"observed-data--59525a2c-539c-4674-a7e9-4f77950d210f",
|
|
|
|
|
"network-traffic--59525a2c-539c-4674-a7e9-4f77950d210f",
|
|
|
|
|
"ipv4-addr--59525a2c-539c-4674-a7e9-4f77950d210f",
|
|
|
|
|
"indicator--59525a2c-4174-48a3-9469-672f950d210f",
|
|
|
|
|
"indicator--59525a2c-4c2c-4303-96ae-6738950d210f",
|
|
|
|
|
"observed-data--59525a2d-24c0-4b51-96b8-47d3950d210f",
|
|
|
|
|
"network-traffic--59525a2d-24c0-4b51-96b8-47d3950d210f",
|
|
|
|
|
"ipv4-addr--59525a2d-24c0-4b51-96b8-47d3950d210f",
|
|
|
|
|
"observed-data--59525a35-3ebc-47db-9460-19ec950d210f",
|
|
|
|
|
"network-traffic--59525a35-3ebc-47db-9460-19ec950d210f",
|
|
|
|
|
"ipv4-addr--59525a35-3ebc-47db-9460-19ec950d210f",
|
|
|
|
|
"observed-data--59525a35-2968-4b01-9867-4553950d210f",
|
|
|
|
|
"network-traffic--59525a35-2968-4b01-9867-4553950d210f",
|
|
|
|
|
"ipv4-addr--59525a35-2968-4b01-9867-4553950d210f",
|
|
|
|
|
"observed-data--59525a35-dd40-4cb9-bd9f-672f950d210f",
|
|
|
|
|
"network-traffic--59525a35-dd40-4cb9-bd9f-672f950d210f",
|
|
|
|
|
"ipv4-addr--59525a35-dd40-4cb9-bd9f-672f950d210f",
|
|
|
|
|
"observed-data--59525a36-7bf4-4f8a-9c14-4433950d210f",
|
|
|
|
|
"network-traffic--59525a36-7bf4-4f8a-9c14-4433950d210f",
|
|
|
|
|
"ipv4-addr--59525a36-7bf4-4f8a-9c14-4433950d210f",
|
|
|
|
|
"observed-data--59525a36-1174-4c5c-a6b3-6731950d210f",
|
|
|
|
|
"network-traffic--59525a36-1174-4c5c-a6b3-6731950d210f",
|
|
|
|
|
"ipv4-addr--59525a36-1174-4c5c-a6b3-6731950d210f",
|
|
|
|
|
"observed-data--59525a36-3398-4ec3-bb83-6736950d210f",
|
|
|
|
|
"network-traffic--59525a36-3398-4ec3-bb83-6736950d210f",
|
|
|
|
|
"ipv4-addr--59525a36-3398-4ec3-bb83-6736950d210f",
|
|
|
|
|
"observed-data--59525a37-5aa4-4bed-a64f-449f950d210f",
|
|
|
|
|
"network-traffic--59525a37-5aa4-4bed-a64f-449f950d210f",
|
|
|
|
|
"ipv4-addr--59525a37-5aa4-4bed-a64f-449f950d210f",
|
|
|
|
|
"observed-data--59525a37-f2f4-4fac-9547-673b950d210f",
|
|
|
|
|
"network-traffic--59525a37-f2f4-4fac-9547-673b950d210f",
|
|
|
|
|
"ipv4-addr--59525a37-f2f4-4fac-9547-673b950d210f",
|
|
|
|
|
"observed-data--59525a37-6304-4b2a-832e-43b5950d210f",
|
|
|
|
|
"network-traffic--59525a37-6304-4b2a-832e-43b5950d210f",
|
|
|
|
|
"ipv4-addr--59525a37-6304-4b2a-832e-43b5950d210f",
|
|
|
|
|
"observed-data--59525a37-bb98-4b7c-b064-41c6950d210f",
|
|
|
|
|
"network-traffic--59525a37-bb98-4b7c-b064-41c6950d210f",
|
|
|
|
|
"ipv4-addr--59525a37-bb98-4b7c-b064-41c6950d210f",
|
|
|
|
|
"observed-data--59525a37-2b3c-4819-a07c-42ca950d210f",
|
|
|
|
|
"network-traffic--59525a37-2b3c-4819-a07c-42ca950d210f",
|
|
|
|
|
"ipv4-addr--59525a37-2b3c-4819-a07c-42ca950d210f",
|
|
|
|
|
"observed-data--59525a38-8334-45f6-8973-4b80950d210f",
|
|
|
|
|
"network-traffic--59525a38-8334-45f6-8973-4b80950d210f",
|
|
|
|
|
"ipv4-addr--59525a38-8334-45f6-8973-4b80950d210f",
|
|
|
|
|
"observed-data--59525a38-e784-472a-a2f3-672c950d210f",
|
|
|
|
|
"network-traffic--59525a38-e784-472a-a2f3-672c950d210f",
|
|
|
|
|
"ipv4-addr--59525a38-e784-472a-a2f3-672c950d210f",
|
|
|
|
|
"observed-data--59525a38-48cc-41c8-9c0c-19ec950d210f",
|
|
|
|
|
"network-traffic--59525a38-48cc-41c8-9c0c-19ec950d210f",
|
|
|
|
|
"ipv4-addr--59525a38-48cc-41c8-9c0c-19ec950d210f",
|
|
|
|
|
"observed-data--59525a38-f47c-497e-87db-6401950d210f",
|
|
|
|
|
"network-traffic--59525a38-f47c-497e-87db-6401950d210f",
|
|
|
|
|
"ipv4-addr--59525a38-f47c-497e-87db-6401950d210f",
|
|
|
|
|
"observed-data--59525a38-9b30-42f8-b7bf-43e5950d210f",
|
|
|
|
|
"network-traffic--59525a38-9b30-42f8-b7bf-43e5950d210f",
|
|
|
|
|
"ipv4-addr--59525a38-9b30-42f8-b7bf-43e5950d210f",
|
|
|
|
|
"observed-data--59525a39-04f0-4c64-bccc-6731950d210f",
|
|
|
|
|
"network-traffic--59525a39-04f0-4c64-bccc-6731950d210f",
|
|
|
|
|
"ipv4-addr--59525a39-04f0-4c64-bccc-6731950d210f",
|
|
|
|
|
"observed-data--59525a39-1508-4567-a98d-6736950d210f",
|
|
|
|
|
"network-traffic--59525a39-1508-4567-a98d-6736950d210f",
|
|
|
|
|
"ipv4-addr--59525a39-1508-4567-a98d-6736950d210f",
|
|
|
|
|
"observed-data--59525a39-f7b4-48fd-9189-47b9950d210f",
|
|
|
|
|
"network-traffic--59525a39-f7b4-48fd-9189-47b9950d210f",
|
|
|
|
|
"ipv4-addr--59525a39-f7b4-48fd-9189-47b9950d210f",
|
|
|
|
|
"observed-data--59525a3a-6cf4-48ed-a8e6-649f950d210f",
|
|
|
|
|
"network-traffic--59525a3a-6cf4-48ed-a8e6-649f950d210f",
|
|
|
|
|
"ipv4-addr--59525a3a-6cf4-48ed-a8e6-649f950d210f",
|
|
|
|
|
"observed-data--59525a3a-4210-40a8-a9f9-4e8c950d210f",
|
|
|
|
|
"network-traffic--59525a3a-4210-40a8-a9f9-4e8c950d210f",
|
|
|
|
|
"ipv4-addr--59525a3a-4210-40a8-a9f9-4e8c950d210f",
|
|
|
|
|
"observed-data--59525a3a-a424-4562-878e-4cf6950d210f",
|
|
|
|
|
"network-traffic--59525a3a-a424-4562-878e-4cf6950d210f",
|
|
|
|
|
"ipv4-addr--59525a3a-a424-4562-878e-4cf6950d210f",
|
|
|
|
|
"observed-data--59525a3a-b670-4ec9-b032-4ccd950d210f",
|
|
|
|
|
"network-traffic--59525a3a-b670-4ec9-b032-4ccd950d210f",
|
|
|
|
|
"ipv4-addr--59525a3a-b670-4ec9-b032-4ccd950d210f",
|
|
|
|
|
"observed-data--59525a3b-df88-459c-adae-672c950d210f",
|
|
|
|
|
"network-traffic--59525a3b-df88-459c-adae-672c950d210f",
|
|
|
|
|
"ipv4-addr--59525a3b-df88-459c-adae-672c950d210f",
|
|
|
|
|
"observed-data--59525a3b-f4f0-4ab8-88c9-19ec950d210f",
|
|
|
|
|
"network-traffic--59525a3b-f4f0-4ab8-88c9-19ec950d210f",
|
|
|
|
|
"ipv4-addr--59525a3b-f4f0-4ab8-88c9-19ec950d210f",
|
|
|
|
|
"observed-data--59525a3b-6d6c-446f-bd7c-6401950d210f",
|
|
|
|
|
"network-traffic--59525a3b-6d6c-446f-bd7c-6401950d210f",
|
|
|
|
|
"ipv4-addr--59525a3b-6d6c-446f-bd7c-6401950d210f",
|
|
|
|
|
"indicator--595cacc8-6fc0-4464-925a-429602de0b81",
|
|
|
|
|
"indicator--595cacc8-4ec4-4601-885b-4f6f02de0b81",
|
|
|
|
|
"observed-data--595cacc8-5af8-48cb-8abe-460302de0b81",
|
|
|
|
|
"url--595cacc8-5af8-48cb-8abe-460302de0b81",
|
|
|
|
|
"indicator--595cacc8-caac-468a-9c47-49a602de0b81",
|
|
|
|
|
"indicator--595cacc8-d3b0-4609-9232-42af02de0b81",
|
|
|
|
|
"observed-data--595cacc8-5848-4517-aef5-468d02de0b81",
|
|
|
|
|
"url--595cacc8-5848-4517-aef5-468d02de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"Threat-Report",
|
|
|
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
|
|
|
"misp-galaxy:tool=\"Trick Bot\""
|
|
|
|
|
],
|
|
|
|
|
"object_marking_refs": [
|
|
|
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a0f-1e00-49dc-92cb-672f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '51c3a67bc5045ce6dde016cdffbfd158']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a10-a940-4414-9763-6731950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '745d9e02af75fcfba39dd20ed9f8d806']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a10-4260-4372-ad2d-4147950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://alexrice.co.uk/jYGUFye7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a10-6494-44b9-bfba-43b8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'alexrice.co.uk']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a10-5e5c-400e-a42d-1844950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a10-5e5c-400e-a42d-1844950d210f",
|
|
|
|
|
"ipv4-addr--59525a10-5e5c-400e-a42d-1844950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a10-5e5c-400e-a42d-1844950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a10-5e5c-400e-a42d-1844950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a10-5e5c-400e-a42d-1844950d210f",
|
|
|
|
|
"value": "109.203.122.184"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a10-b05c-4299-8ee1-673b950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://aristei.com.ar/jYGUFye7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a11-3f98-4ed8-aef2-4d72950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'aristei.com.ar']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a11-2084-43eb-93c3-4052950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a11-2084-43eb-93c3-4052950d210f",
|
|
|
|
|
"ipv4-addr--59525a11-2084-43eb-93c3-4052950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a11-2084-43eb-93c3-4052950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a11-2084-43eb-93c3-4052950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a11-2084-43eb-93c3-4052950d210f",
|
|
|
|
|
"value": "190.105.227.224"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a11-5544-4704-ad9f-672c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://bloomasia.net/jYGUFye7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a12-a434-4abc-b78a-4679950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'bloomasia.net']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a12-0680-4bca-9af6-6401950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a12-0680-4bca-9af6-6401950d210f",
|
|
|
|
|
"ipv4-addr--59525a12-0680-4bca-9af6-6401950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a12-0680-4bca-9af6-6401950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a12-0680-4bca-9af6-6401950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a12-0680-4bca-9af6-6401950d210f",
|
|
|
|
|
"value": "162.251.85.205"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a12-b624-4c9d-ab20-19ec950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://brontorittoozzo.com/af/jYGUFye7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a12-eb24-49db-a96e-64a3950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'brontorittoozzo.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a15-95e4-419c-9637-1844950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a15-95e4-419c-9637-1844950d210f",
|
|
|
|
|
"ipv4-addr--59525a15-95e4-419c-9637-1844950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a15-95e4-419c-9637-1844950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a15-95e4-419c-9637-1844950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a15-95e4-419c-9637-1844950d210f",
|
|
|
|
|
"value": "46.173.218.214"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a15-df78-4786-b6fe-673b950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a15-df78-4786-b6fe-673b950d210f",
|
|
|
|
|
"ipv4-addr--59525a15-df78-4786-b6fe-673b950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a15-df78-4786-b6fe-673b950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a15-df78-4786-b6fe-673b950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a15-df78-4786-b6fe-673b950d210f",
|
|
|
|
|
"value": "46.173.218.249"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a15-9c84-4cb9-a3c7-4b32950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://chulkyu.com/jYGUFye7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a16-3b08-4886-86d5-4d57950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'chulkyu.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a16-6378-48ba-9100-4f40950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a16-6378-48ba-9100-4f40950d210f",
|
|
|
|
|
"ipv4-addr--59525a16-6378-48ba-9100-4f40950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a16-6378-48ba-9100-4f40950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a16-6378-48ba-9100-4f40950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a16-6378-48ba-9100-4f40950d210f",
|
|
|
|
|
"value": "175.126.195.54"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a16-80a8-4469-8b98-44ef950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://dextron.de/jYGUFye7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a16-ef48-42bf-a589-672c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'dextron.de']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a17-6bd8-4f2d-86e9-480d950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a17-6bd8-4f2d-86e9-480d950d210f",
|
|
|
|
|
"ipv4-addr--59525a17-6bd8-4f2d-86e9-480d950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a17-6bd8-4f2d-86e9-480d950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a17-6bd8-4f2d-86e9-480d950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a17-6bd8-4f2d-86e9-480d950d210f",
|
|
|
|
|
"value": "81.169.145.163"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a17-7000-4324-9e15-43ec950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://earsay.com/jYGUFye7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a17-5d3c-4dff-b6d5-6401950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'earsay.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a17-904c-4bfc-9ff2-42df950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a17-904c-4bfc-9ff2-42df950d210f",
|
|
|
|
|
"ipv4-addr--59525a17-904c-4bfc-9ff2-42df950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a17-904c-4bfc-9ff2-42df950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a17-904c-4bfc-9ff2-42df950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a17-904c-4bfc-9ff2-42df950d210f",
|
|
|
|
|
"value": "69.90.161.220"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a17-4908-4b74-ad3a-19ec950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://flachpass.net/jYGUFye7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a18-b09c-4248-b07e-64a3950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'flachpass.net']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a18-29b8-48f7-a1a2-672f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a18-29b8-48f7-a1a2-672f950d210f",
|
|
|
|
|
"ipv4-addr--59525a18-29b8-48f7-a1a2-672f950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a18-29b8-48f7-a1a2-672f950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a18-29b8-48f7-a1a2-672f950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a18-29b8-48f7-a1a2-672f950d210f",
|
|
|
|
|
"value": "81.169.145.150"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a18-d150-4892-a472-6731950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://freelapaustralia.com.au/jYGUFye7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a18-94dc-4c93-befc-4256950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'freelapaustralia.com.au']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a18-5b14-4212-8702-4da7950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a18-5b14-4212-8702-4da7950d210f",
|
|
|
|
|
"ipv4-addr--59525a18-5b14-4212-8702-4da7950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a18-5b14-4212-8702-4da7950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a18-5b14-4212-8702-4da7950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a18-5b14-4212-8702-4da7950d210f",
|
|
|
|
|
"value": "43.243.119.253"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a18-ebb8-4c91-a379-6736950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://gbdco.com/jYGUFye7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a18-4258-4882-a46c-673b950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'gbdco.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a19-ebfc-4d56-9690-46bc950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a19-ebfc-4d56-9690-46bc950d210f",
|
|
|
|
|
"ipv4-addr--59525a19-ebfc-4d56-9690-46bc950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a19-ebfc-4d56-9690-46bc950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a19-ebfc-4d56-9690-46bc950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a19-ebfc-4d56-9690-46bc950d210f",
|
|
|
|
|
"value": "43.225.55.90"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a19-e018-4049-a698-493d950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://germania2.bravepages.com/jYGUFye7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a19-a024-4fc1-b552-4f44950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'germania2.bravepages.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a19-3028-4c83-bb3e-4eb5950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a19-3028-4c83-bb3e-4eb5950d210f",
|
|
|
|
|
"ipv4-addr--59525a19-3028-4c83-bb3e-4eb5950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a19-3028-4c83-bb3e-4eb5950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a19-3028-4c83-bb3e-4eb5950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a19-3028-4c83-bb3e-4eb5950d210f",
|
|
|
|
|
"value": "66.219.202.10"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a1a-7394-4483-9d70-6401950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://hrlpk.com/jYGUFye7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a1a-9454-44a1-a98f-47e1950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'hrlpk.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a1a-2944-4f0b-812e-672f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a1a-2944-4f0b-812e-672f950d210f",
|
|
|
|
|
"ipv4-addr--59525a1a-2944-4f0b-812e-672f950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a1a-2944-4f0b-812e-672f950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a1a-2944-4f0b-812e-672f950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a1a-2944-4f0b-812e-672f950d210f",
|
|
|
|
|
"value": "203.124.43.229"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a1b-2588-4336-8333-6738950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://i2iapp.com/jYGUFye7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a1b-5940-40ae-a73d-481a950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'i2iapp.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a1b-2888-4480-be11-4ed0950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a1b-2888-4480-be11-4ed0950d210f",
|
|
|
|
|
"ipv4-addr--59525a1b-2888-4480-be11-4ed0950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a1b-2888-4480-be11-4ed0950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a1b-2888-4480-be11-4ed0950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a1b-2888-4480-be11-4ed0950d210f",
|
|
|
|
|
"value": "160.153.131.152"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a1b-98e4-4eba-b1bd-6736950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://ibudian.com/jYGUFye7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a1b-a234-47f0-b367-673b950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'ibudian.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a1e-9190-4019-a89e-6401950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a1e-9190-4019-a89e-6401950d210f",
|
|
|
|
|
"ipv4-addr--59525a1e-9190-4019-a89e-6401950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a1e-9190-4019-a89e-6401950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a1e-9190-4019-a89e-6401950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a1e-9190-4019-a89e-6401950d210f",
|
|
|
|
|
"value": "122.9.52.203"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a1e-0f54-4043-8f3e-4bce950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://itbouquet.com/jYGUFye7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a1e-6ad8-4e76-a949-19ec950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'itbouquet.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a1f-f0a8-42c2-a563-672f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a1f-f0a8-42c2-a563-672f950d210f",
|
|
|
|
|
"ipv4-addr--59525a1f-f0a8-42c2-a563-672f950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a1f-f0a8-42c2-a563-672f950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a1f-f0a8-42c2-a563-672f950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a1f-f0a8-42c2-a563-672f950d210f",
|
|
|
|
|
"value": "115.186.148.123"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a1f-7d28-4e10-9cac-64a3950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://jointpainsrelief.com/jYGUFye7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a1f-1218-4630-8fbd-6738950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'jointpainsrelief.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a1f-eb9c-44c7-9490-41f6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a1f-eb9c-44c7-9490-41f6950d210f",
|
|
|
|
|
"ipv4-addr--59525a1f-eb9c-44c7-9490-41f6950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a1f-eb9c-44c7-9490-41f6950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a1f-eb9c-44c7-9490-41f6950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a1f-eb9c-44c7-9490-41f6950d210f",
|
|
|
|
|
"value": "43.225.55.204"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a1f-7d18-42fe-ad82-6731950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://kitchenandgifts.com/jYGUFye7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a20-d818-4c77-83b1-649f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'kitchenandgifts.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a20-b4bc-4149-8269-6736950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a20-b4bc-4149-8269-6736950d210f",
|
|
|
|
|
"ipv4-addr--59525a20-b4bc-4149-8269-6736950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a20-b4bc-4149-8269-6736950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a20-b4bc-4149-8269-6736950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a20-b4bc-4149-8269-6736950d210f",
|
|
|
|
|
"value": "192.185.224.197"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a20-07cc-4dd0-b738-673b950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://lamweb123.net/jYGUFye7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a20-16a8-4f97-b483-1844950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'lamweb123.net']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a21-d47c-4f35-97f5-4535950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a21-d47c-4f35-97f5-4535950d210f",
|
|
|
|
|
"ipv4-addr--59525a21-d47c-4f35-97f5-4535950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a21-d47c-4f35-97f5-4535950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a21-d47c-4f35-97f5-4535950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a21-d47c-4f35-97f5-4535950d210f",
|
|
|
|
|
"value": "125.212.224.157"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a21-a928-4d9a-b0c2-408f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://malamalamak9.net/jYGUFye7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a21-37ac-454b-9353-672c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'malamalamak9.net']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a22-94c8-477d-9321-4724950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a22-94c8-477d-9321-4724950d210f",
|
|
|
|
|
"ipv4-addr--59525a22-94c8-477d-9321-4724950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a22-94c8-477d-9321-4724950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a22-94c8-477d-9321-4724950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a22-94c8-477d-9321-4724950d210f",
|
|
|
|
|
"value": "74.122.121.8"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a22-9b80-44c2-8f97-19ec950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://mediawax.be/jYGUFye7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a22-9670-4ad7-a975-4ee4950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'mediawax.be']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a22-a800-4d61-be26-672f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a22-a800-4d61-be26-672f950d210f",
|
|
|
|
|
"ipv4-addr--59525a22-a800-4d61-be26-672f950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a22-a800-4d61-be26-672f950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a22-a800-4d61-be26-672f950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a22-a800-4d61-be26-672f950d210f",
|
|
|
|
|
"value": "5.61.252.24"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a22-72b8-471e-a106-6738950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://napset.net/jYGUFye7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a23-64e4-46ab-aeea-49e3950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'napset.net']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a23-651c-42b0-b167-6731950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a23-651c-42b0-b167-6731950d210f",
|
|
|
|
|
"ipv4-addr--59525a23-651c-42b0-b167-6731950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a23-651c-42b0-b167-6731950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a23-651c-42b0-b167-6731950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a23-651c-42b0-b167-6731950d210f",
|
|
|
|
|
"value": "107.180.2.98"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a23-73f4-4a47-9996-4d41950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://oscarbenson.com/jYGUFye7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a23-6a6c-4a33-abeb-6736950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'oscarbenson.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a24-dde4-4964-88e8-673b950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a24-dde4-4964-88e8-673b950d210f",
|
|
|
|
|
"ipv4-addr--59525a24-dde4-4964-88e8-673b950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a24-dde4-4964-88e8-673b950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a24-dde4-4964-88e8-673b950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a24-dde4-4964-88e8-673b950d210f",
|
|
|
|
|
"value": "202.181.132.161"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a24-674c-4b2d-a459-1844950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://polistar.net/jYGUFye7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a25-f1c8-4d81-b53e-4db5950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'polistar.net']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a25-ed1c-415f-9d71-4a9a950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a25-ed1c-415f-9d71-4a9a950d210f",
|
|
|
|
|
"ipv4-addr--59525a25-ed1c-415f-9d71-4a9a950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a25-ed1c-415f-9d71-4a9a950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a25-ed1c-415f-9d71-4a9a950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a25-ed1c-415f-9d71-4a9a950d210f",
|
|
|
|
|
"value": "89.111.176.93"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a25-24c8-4400-bdb8-4c71950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://randomessstioprottoy.net/af/jYGUFye7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a25-9c34-42c9-a7c5-43ba950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'randomessstioprottoy.net']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a27-dca0-4bd9-a9dd-6401950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://rotarychieti.it/jYGUFye7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a27-44b8-4586-a181-490b950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'rotarychieti.it']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a27-5a20-4d78-8ea3-19ec950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a27-5a20-4d78-8ea3-19ec950d210f",
|
|
|
|
|
"ipv4-addr--59525a27-5a20-4d78-8ea3-19ec950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a27-5a20-4d78-8ea3-19ec950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a27-5a20-4d78-8ea3-19ec950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a27-5a20-4d78-8ea3-19ec950d210f",
|
|
|
|
|
"value": "151.1.182.14"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a28-b89c-4534-80ba-4cba950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://skyfling.com/jYGUFye7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a28-ad40-42f0-8f33-4bf6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'skyfling.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a28-8c4c-4f09-81b4-672f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a28-8c4c-4f09-81b4-672f950d210f",
|
|
|
|
|
"ipv4-addr--59525a28-8c4c-4f09-81b4-672f950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a28-8c4c-4f09-81b4-672f950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a28-8c4c-4f09-81b4-672f950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a28-8c4c-4f09-81b4-672f950d210f",
|
|
|
|
|
"value": "103.53.42.51"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a28-0744-4f39-9995-6738950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://stalaktit-indonesia.com/jYGUFye7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a28-6958-4d36-9d19-4d64950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'stalaktit-indonesia.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a29-521c-41ee-bf24-64a3950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a29-521c-41ee-bf24-64a3950d210f",
|
|
|
|
|
"ipv4-addr--59525a29-521c-41ee-bf24-64a3950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a29-521c-41ee-bf24-64a3950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a29-521c-41ee-bf24-64a3950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a29-521c-41ee-bf24-64a3950d210f",
|
|
|
|
|
"value": "202.52.146.56"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a29-b7d0-4cff-b890-6731950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://teekayu.com/jYGUFye7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a29-d850-4982-9c8e-499b950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'teekayu.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a2a-fa44-4d9f-a58e-6736950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a2a-fa44-4d9f-a58e-6736950d210f",
|
|
|
|
|
"ipv4-addr--59525a2a-fa44-4d9f-a58e-6736950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a2a-fa44-4d9f-a58e-6736950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a2a-fa44-4d9f-a58e-6736950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a2a-fa44-4d9f-a58e-6736950d210f",
|
|
|
|
|
"value": "203.146.127.133"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a2a-89d8-4e13-bc19-649f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://thephonks.de/jYGUFye7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a2a-3038-4b1c-946f-673b950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'thephonks.de']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a2a-656c-474e-9c1b-1844950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a2a-656c-474e-9c1b-1844950d210f",
|
|
|
|
|
"ipv4-addr--59525a2a-656c-474e-9c1b-1844950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a2a-656c-474e-9c1b-1844950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a2a-656c-474e-9c1b-1844950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a2a-656c-474e-9c1b-1844950d210f",
|
|
|
|
|
"value": "81.169.145.164"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a2a-f45c-45e5-b4e0-4a12950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://thepickintool.com/jYGUFye7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a2a-2ed0-4204-879c-43ee950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'thepickintool.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a2b-f648-465b-a533-448e950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a2b-f648-465b-a533-448e950d210f",
|
|
|
|
|
"ipv4-addr--59525a2b-f648-465b-a533-448e950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a2b-f648-465b-a533-448e950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a2b-f648-465b-a533-448e950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a2b-f648-465b-a533-448e950d210f",
|
|
|
|
|
"value": "192.254.234.175"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a2b-7db8-4ce3-b468-4fff950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://videodb.in/jYGUFye7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a2b-c2ac-45bf-9d57-672c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'videodb.in']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a2b-13e0-4d9b-9ff5-6401950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a2b-13e0-4d9b-9ff5-6401950d210f",
|
|
|
|
|
"ipv4-addr--59525a2b-13e0-4d9b-9ff5-6401950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a2b-13e0-4d9b-9ff5-6401950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a2b-13e0-4d9b-9ff5-6401950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a2b-13e0-4d9b-9ff5-6401950d210f",
|
|
|
|
|
"value": "104.28.18.121"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a2c-f610-42bc-ac08-49a0950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a2c-f610-42bc-ac08-49a0950d210f",
|
|
|
|
|
"ipv4-addr--59525a2c-f610-42bc-ac08-49a0950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a2c-f610-42bc-ac08-49a0950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a2c-f610-42bc-ac08-49a0950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a2c-f610-42bc-ac08-49a0950d210f",
|
|
|
|
|
"value": "104.28.19.121"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a2c-fde8-4488-85ae-19ec950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://wesser24.de/jYGUFye7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a2c-6860-48f6-851e-4f00950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'wesser24.de']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a2c-539c-4674-a7e9-4f77950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a2c-539c-4674-a7e9-4f77950d210f",
|
|
|
|
|
"ipv4-addr--59525a2c-539c-4674-a7e9-4f77950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a2c-539c-4674-a7e9-4f77950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a2c-539c-4674-a7e9-4f77950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a2c-539c-4674-a7e9-4f77950d210f",
|
|
|
|
|
"value": "81.169.145.82"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a2c-4174-48a3-9469-672f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://xn----8sb4abph0af.com/jYGUFye7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59525a2c-4c2c-4303-96ae-6738950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'xn----8sb4abph0af.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a2d-24c0-4b51-96b8-47d3950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a2d-24c0-4b51-96b8-47d3950d210f",
|
|
|
|
|
"ipv4-addr--59525a2d-24c0-4b51-96b8-47d3950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a2d-24c0-4b51-96b8-47d3950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a2d-24c0-4b51-96b8-47d3950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a2d-24c0-4b51-96b8-47d3950d210f",
|
|
|
|
|
"value": "51.255.157.19"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a35-3ebc-47db-9460-19ec950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a35-3ebc-47db-9460-19ec950d210f",
|
|
|
|
|
"ipv4-addr--59525a35-3ebc-47db-9460-19ec950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a35-3ebc-47db-9460-19ec950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a35-3ebc-47db-9460-19ec950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a35-3ebc-47db-9460-19ec950d210f",
|
|
|
|
|
"value": "194.87.237.19"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a35-2968-4b01-9867-4553950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a35-2968-4b01-9867-4553950d210f",
|
|
|
|
|
"ipv4-addr--59525a35-2968-4b01-9867-4553950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a35-2968-4b01-9867-4553950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a35-2968-4b01-9867-4553950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a35-2968-4b01-9867-4553950d210f",
|
|
|
|
|
"value": "194.87.238.82"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a35-dd40-4cb9-bd9f-672f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a35-dd40-4cb9-bd9f-672f950d210f",
|
|
|
|
|
"ipv4-addr--59525a35-dd40-4cb9-bd9f-672f950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a35-dd40-4cb9-bd9f-672f950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a35-dd40-4cb9-bd9f-672f950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a35-dd40-4cb9-bd9f-672f950d210f",
|
|
|
|
|
"value": "195.2.252.252"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a36-7bf4-4f8a-9c14-4433950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a36-7bf4-4f8a-9c14-4433950d210f",
|
|
|
|
|
"ipv4-addr--59525a36-7bf4-4f8a-9c14-4433950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a36-7bf4-4f8a-9c14-4433950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a36-7bf4-4f8a-9c14-4433950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a36-7bf4-4f8a-9c14-4433950d210f",
|
|
|
|
|
"value": "94.140.121.180"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a36-1174-4c5c-a6b3-6731950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a36-1174-4c5c-a6b3-6731950d210f",
|
|
|
|
|
"ipv4-addr--59525a36-1174-4c5c-a6b3-6731950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a36-1174-4c5c-a6b3-6731950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a36-1174-4c5c-a6b3-6731950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a36-1174-4c5c-a6b3-6731950d210f",
|
|
|
|
|
"value": "195.28.183.87"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a36-3398-4ec3-bb83-6736950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a36-3398-4ec3-bb83-6736950d210f",
|
|
|
|
|
"ipv4-addr--59525a36-3398-4ec3-bb83-6736950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a36-3398-4ec3-bb83-6736950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a36-3398-4ec3-bb83-6736950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a36-3398-4ec3-bb83-6736950d210f",
|
|
|
|
|
"value": "195.62.53.213"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a37-5aa4-4bed-a64f-449f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a37-5aa4-4bed-a64f-449f950d210f",
|
|
|
|
|
"ipv4-addr--59525a37-5aa4-4bed-a64f-449f950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a37-5aa4-4bed-a64f-449f950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a37-5aa4-4bed-a64f-449f950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a37-5aa4-4bed-a64f-449f950d210f",
|
|
|
|
|
"value": "194.87.98.158"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a37-f2f4-4fac-9547-673b950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a37-f2f4-4fac-9547-673b950d210f",
|
|
|
|
|
"ipv4-addr--59525a37-f2f4-4fac-9547-673b950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a37-f2f4-4fac-9547-673b950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a37-f2f4-4fac-9547-673b950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a37-f2f4-4fac-9547-673b950d210f",
|
|
|
|
|
"value": "195.2.252.178"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a37-6304-4b2a-832e-43b5950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a37-6304-4b2a-832e-43b5950d210f",
|
|
|
|
|
"ipv4-addr--59525a37-6304-4b2a-832e-43b5950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a37-6304-4b2a-832e-43b5950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a37-6304-4b2a-832e-43b5950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a37-6304-4b2a-832e-43b5950d210f",
|
|
|
|
|
"value": "94.140.121.181"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a37-bb98-4b7c-b064-41c6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a37-bb98-4b7c-b064-41c6950d210f",
|
|
|
|
|
"ipv4-addr--59525a37-bb98-4b7c-b064-41c6950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a37-bb98-4b7c-b064-41c6950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a37-bb98-4b7c-b064-41c6950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a37-bb98-4b7c-b064-41c6950d210f",
|
|
|
|
|
"value": "194.87.99.155"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a37-2b3c-4819-a07c-42ca950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a37-2b3c-4819-a07c-42ca950d210f",
|
|
|
|
|
"ipv4-addr--59525a37-2b3c-4819-a07c-42ca950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a37-2b3c-4819-a07c-42ca950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a37-2b3c-4819-a07c-42ca950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a37-2b3c-4819-a07c-42ca950d210f",
|
|
|
|
|
"value": "89.231.13.18"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a38-8334-45f6-8973-4b80950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a38-8334-45f6-8973-4b80950d210f",
|
|
|
|
|
"ipv4-addr--59525a38-8334-45f6-8973-4b80950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a38-8334-45f6-8973-4b80950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a38-8334-45f6-8973-4b80950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a38-8334-45f6-8973-4b80950d210f",
|
|
|
|
|
"value": "89.231.13.27"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a38-e784-472a-a2f3-672c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a38-e784-472a-a2f3-672c950d210f",
|
|
|
|
|
"ipv4-addr--59525a38-e784-472a-a2f3-672c950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a38-e784-472a-a2f3-672c950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a38-e784-472a-a2f3-672c950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a38-e784-472a-a2f3-672c950d210f",
|
|
|
|
|
"value": "89.231.13.33"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a38-48cc-41c8-9c0c-19ec950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a38-48cc-41c8-9c0c-19ec950d210f",
|
|
|
|
|
"ipv4-addr--59525a38-48cc-41c8-9c0c-19ec950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a38-48cc-41c8-9c0c-19ec950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a38-48cc-41c8-9c0c-19ec950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a38-48cc-41c8-9c0c-19ec950d210f",
|
|
|
|
|
"value": "190.228.169.106"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a38-f47c-497e-87db-6401950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a38-f47c-497e-87db-6401950d210f",
|
|
|
|
|
"ipv4-addr--59525a38-f47c-497e-87db-6401950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a38-f47c-497e-87db-6401950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a38-f47c-497e-87db-6401950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a38-f47c-497e-87db-6401950d210f",
|
|
|
|
|
"value": "94.42.91.27"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a38-9b30-42f8-b7bf-43e5950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a38-9b30-42f8-b7bf-43e5950d210f",
|
|
|
|
|
"ipv4-addr--59525a38-9b30-42f8-b7bf-43e5950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a38-9b30-42f8-b7bf-43e5950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a38-9b30-42f8-b7bf-43e5950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a38-9b30-42f8-b7bf-43e5950d210f",
|
|
|
|
|
"value": "118.91.178.121"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a39-04f0-4c64-bccc-6731950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a39-04f0-4c64-bccc-6731950d210f",
|
|
|
|
|
"ipv4-addr--59525a39-04f0-4c64-bccc-6731950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a39-04f0-4c64-bccc-6731950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a39-04f0-4c64-bccc-6731950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a39-04f0-4c64-bccc-6731950d210f",
|
|
|
|
|
"value": "118.91.178.114"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a39-1508-4567-a98d-6736950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a39-1508-4567-a98d-6736950d210f",
|
|
|
|
|
"ipv4-addr--59525a39-1508-4567-a98d-6736950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a39-1508-4567-a98d-6736950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a39-1508-4567-a98d-6736950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a39-1508-4567-a98d-6736950d210f",
|
|
|
|
|
"value": "186.103.161.204"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a39-f7b4-48fd-9189-47b9950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a39-f7b4-48fd-9189-47b9950d210f",
|
|
|
|
|
"ipv4-addr--59525a39-f7b4-48fd-9189-47b9950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a39-f7b4-48fd-9189-47b9950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a39-f7b4-48fd-9189-47b9950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a39-f7b4-48fd-9189-47b9950d210f",
|
|
|
|
|
"value": "163.53.206.187"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a3a-6cf4-48ed-a8e6-649f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a3a-6cf4-48ed-a8e6-649f950d210f",
|
|
|
|
|
"ipv4-addr--59525a3a-6cf4-48ed-a8e6-649f950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a3a-6cf4-48ed-a8e6-649f950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a3a-6cf4-48ed-a8e6-649f950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a3a-6cf4-48ed-a8e6-649f950d210f",
|
|
|
|
|
"value": "46.160.165.16"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a3a-4210-40a8-a9f9-4e8c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a3a-4210-40a8-a9f9-4e8c950d210f",
|
|
|
|
|
"ipv4-addr--59525a3a-4210-40a8-a9f9-4e8c950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a3a-4210-40a8-a9f9-4e8c950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a3a-4210-40a8-a9f9-4e8c950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a3a-4210-40a8-a9f9-4e8c950d210f",
|
|
|
|
|
"value": "191.7.30.30"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a3a-a424-4562-878e-4cf6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a3a-a424-4562-878e-4cf6950d210f",
|
|
|
|
|
"ipv4-addr--59525a3a-a424-4562-878e-4cf6950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a3a-a424-4562-878e-4cf6950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a3a-a424-4562-878e-4cf6950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a3a-a424-4562-878e-4cf6950d210f",
|
|
|
|
|
"value": "118.91.178.134"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a3a-b670-4ec9-b032-4ccd950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a3a-b670-4ec9-b032-4ccd950d210f",
|
|
|
|
|
"ipv4-addr--59525a3a-b670-4ec9-b032-4ccd950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a3a-b670-4ec9-b032-4ccd950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a3a-b670-4ec9-b032-4ccd950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a3a-b670-4ec9-b032-4ccd950d210f",
|
|
|
|
|
"value": "46.160.165.31"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a3b-df88-459c-adae-672c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a3b-df88-459c-adae-672c950d210f",
|
|
|
|
|
"ipv4-addr--59525a3b-df88-459c-adae-672c950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a3b-df88-459c-adae-672c950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a3b-df88-459c-adae-672c950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a3b-df88-459c-adae-672c950d210f",
|
|
|
|
|
"value": "197.248.210.150"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a3b-f4f0-4ab8-88c9-19ec950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a3b-f4f0-4ab8-88c9-19ec950d210f",
|
|
|
|
|
"ipv4-addr--59525a3b-f4f0-4ab8-88c9-19ec950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a3b-f4f0-4ab8-88c9-19ec950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a3b-f4f0-4ab8-88c9-19ec950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a3b-f4f0-4ab8-88c9-19ec950d210f",
|
|
|
|
|
"value": "118.91.178.143"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59525a3b-6d6c-446f-bd7c-6401950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:25.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:25Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59525a3b-6d6c-446f-bd7c-6401950d210f",
|
|
|
|
|
"ipv4-addr--59525a3b-6d6c-446f-bd7c-6401950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59525a3b-6d6c-446f-bd7c-6401950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59525a3b-6d6c-446f-bd7c-6401950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59525a3b-6d6c-446f-bd7c-6401950d210f",
|
|
|
|
|
"value": "190.228.169.73"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--595cacc8-6fc0-4464-925a-429602de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:28.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:28.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 745d9e02af75fcfba39dd20ed9f8d806",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'edf609ac4f18c0340570170fbc7a6d27505fdb79add69d5916038a36bfa4bbf4']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:28Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--595cacc8-4ec4-4601-885b-4f6f02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:28.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:28.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 745d9e02af75fcfba39dd20ed9f8d806",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '851736d63efff15ef670433de8340e35d2a64767']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:28Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--595cacc8-5af8-48cb-8abe-460302de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:28.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:28.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:28Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:28Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--595cacc8-5af8-48cb-8abe-460302de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--595cacc8-5af8-48cb-8abe-460302de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/edf609ac4f18c0340570170fbc7a6d27505fdb79add69d5916038a36bfa4bbf4/analysis/1499239288/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--595cacc8-caac-468a-9c47-49a602de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:28.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:28.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 51c3a67bc5045ce6dde016cdffbfd158",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'bff8f75d4984bfc5c3077e2321858a4ab9925b767ad4239af35e84072e37dc4a']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:28Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--595cacc8-d3b0-4609-9232-42af02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:28.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:28.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 51c3a67bc5045ce6dde016cdffbfd158",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '53322f619c4d9b71ee080fa2ae2dd8e86f7c817e']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-07-05T09:09:28Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--595cacc8-5848-4517-aef5-468d02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-07-05T09:09:28.000Z",
|
|
|
|
|
"modified": "2017-07-05T09:09:28.000Z",
|
|
|
|
|
"first_observed": "2017-07-05T09:09:28Z",
|
|
|
|
|
"last_observed": "2017-07-05T09:09:28Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--595cacc8-5848-4517-aef5-468d02de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--595cacc8-5848-4517-aef5-468d02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/bff8f75d4984bfc5c3077e2321858a4ab9925b767ad4239af35e84072e37dc4a/analysis/1499094503/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "marking-definition",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
|
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
|
|
|
"definition_type": "tlp",
|
|
|
|
|
"name": "TLP:WHITE",
|
|
|
|
|
"definition": {
|
|
|
|
|
"tlp": "white"
|
|
|
|
|
}
|
|
|
|
|
}
|
2023-04-21 13:25:09 +00:00
|
|
|
]
|
|
|
|
|
}
|
