2023-04-21 13:25:09 +00:00
|
|
|
{
|
2023-06-14 17:31:25 +00:00
|
|
|
"type": "bundle",
|
|
|
|
|
"id": "bundle--59c56149-8ec4-4490-996e-df79950d210f",
|
|
|
|
|
"objects": [
|
|
|
|
|
{
|
|
|
|
|
"type": "identity",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-25T11:40:45.000Z",
|
|
|
|
|
"modified": "2017-09-25T11:40:45.000Z",
|
|
|
|
|
"name": "CIRCL",
|
|
|
|
|
"identity_class": "organization"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "report",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "report--59c56149-8ec4-4490-996e-df79950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-25T11:40:45.000Z",
|
|
|
|
|
"modified": "2017-09-25T11:40:45.000Z",
|
|
|
|
|
"name": "M2M - Locky 2017-09-20 : Affid=3, offline, \".ykcol\" : \"New voice message...\" - \"msg0321.7z\"",
|
|
|
|
|
"published": "2017-09-25T11:43:00Z",
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"indicator--59c5614a-bfa4-49df-8383-4082950d210f",
|
|
|
|
|
"indicator--59c5614a-1d60-4e3c-ad98-454c950d210f",
|
|
|
|
|
"indicator--59c5614a-eea8-49d3-85a8-4eca950d210f",
|
|
|
|
|
"observed-data--59c5614b-44a4-4d33-8c04-4782950d210f",
|
|
|
|
|
"network-traffic--59c5614b-44a4-4d33-8c04-4782950d210f",
|
|
|
|
|
"ipv4-addr--59c5614b-44a4-4d33-8c04-4782950d210f",
|
|
|
|
|
"indicator--59c5614b-f5d4-4442-a6ff-df79950d210f",
|
|
|
|
|
"indicator--59c5614b-02f8-4282-bfaa-4c2a950d210f",
|
|
|
|
|
"observed-data--59c5614c-361c-4727-821a-403f950d210f",
|
|
|
|
|
"network-traffic--59c5614c-361c-4727-821a-403f950d210f",
|
|
|
|
|
"ipv4-addr--59c5614c-361c-4727-821a-403f950d210f",
|
|
|
|
|
"indicator--59c5614c-d9a8-4394-ad71-4933950d210f",
|
|
|
|
|
"indicator--59c5614c-0a14-43f5-8bd0-49a5950d210f",
|
|
|
|
|
"observed-data--59c5614d-ba5c-43c3-91c7-4424950d210f",
|
|
|
|
|
"network-traffic--59c5614d-ba5c-43c3-91c7-4424950d210f",
|
|
|
|
|
"ipv4-addr--59c5614d-ba5c-43c3-91c7-4424950d210f",
|
|
|
|
|
"indicator--59c5614d-9c30-4074-af56-46f8950d210f",
|
|
|
|
|
"indicator--59c5614d-2fb0-4714-9d76-e0d9950d210f",
|
|
|
|
|
"observed-data--59c5614d-a3c0-4a21-b96e-4a90950d210f",
|
|
|
|
|
"network-traffic--59c5614d-a3c0-4a21-b96e-4a90950d210f",
|
|
|
|
|
"ipv4-addr--59c5614d-a3c0-4a21-b96e-4a90950d210f",
|
|
|
|
|
"indicator--59c5614e-6458-4bb4-91be-e0c7950d210f",
|
|
|
|
|
"indicator--59c5614e-c800-47aa-a30e-477e950d210f",
|
|
|
|
|
"observed-data--59c5614e-7c70-45b8-acaf-45fc950d210f",
|
|
|
|
|
"network-traffic--59c5614e-7c70-45b8-acaf-45fc950d210f",
|
|
|
|
|
"ipv4-addr--59c5614e-7c70-45b8-acaf-45fc950d210f",
|
|
|
|
|
"indicator--59c5614e-dd40-46ab-bdc2-4359950d210f",
|
|
|
|
|
"indicator--59c5614f-20e8-4bc5-925b-4a82950d210f",
|
|
|
|
|
"observed-data--59c5614f-1c60-4165-924e-4723950d210f",
|
|
|
|
|
"network-traffic--59c5614f-1c60-4165-924e-4723950d210f",
|
|
|
|
|
"ipv4-addr--59c5614f-1c60-4165-924e-4723950d210f",
|
|
|
|
|
"indicator--59c5614f-0c14-4b0e-b6fa-4602950d210f",
|
|
|
|
|
"indicator--59c5614f-7bfc-4b83-8407-e0d9950d210f",
|
|
|
|
|
"observed-data--59c56150-1a00-4af1-98c1-df79950d210f",
|
|
|
|
|
"network-traffic--59c56150-1a00-4af1-98c1-df79950d210f",
|
|
|
|
|
"ipv4-addr--59c56150-1a00-4af1-98c1-df79950d210f",
|
|
|
|
|
"indicator--59c56150-b14c-44a6-be4e-4305950d210f",
|
|
|
|
|
"indicator--59c56150-5c1c-4a31-be36-4aca950d210f",
|
|
|
|
|
"observed-data--59c56151-7f1c-44f1-9fbb-4de6950d210f",
|
|
|
|
|
"network-traffic--59c56151-7f1c-44f1-9fbb-4de6950d210f",
|
|
|
|
|
"ipv4-addr--59c56151-7f1c-44f1-9fbb-4de6950d210f",
|
|
|
|
|
"indicator--59c56151-fc54-4f31-9f4d-4f3a950d210f",
|
|
|
|
|
"indicator--59c56151-9774-4902-a88a-41fb950d210f",
|
|
|
|
|
"observed-data--59c56151-01e8-43fd-af78-4877950d210f",
|
|
|
|
|
"network-traffic--59c56151-01e8-43fd-af78-4877950d210f",
|
|
|
|
|
"ipv4-addr--59c56151-01e8-43fd-af78-4877950d210f",
|
|
|
|
|
"indicator--59c56152-372c-494d-892b-df79950d210f",
|
|
|
|
|
"indicator--59c56152-707c-4ad9-8a1e-4631950d210f",
|
|
|
|
|
"observed-data--59c56152-9410-494e-918b-4cba950d210f",
|
|
|
|
|
"network-traffic--59c56152-9410-494e-918b-4cba950d210f",
|
|
|
|
|
"ipv4-addr--59c56152-9410-494e-918b-4cba950d210f",
|
|
|
|
|
"indicator--59c56152-c7cc-4bf7-a6aa-4a72950d210f",
|
|
|
|
|
"indicator--59c56152-a71c-4c47-8d14-1330950d210f",
|
|
|
|
|
"indicator--59c56153-0618-45a8-bcb6-4ff8950d210f",
|
|
|
|
|
"indicator--59c56153-0384-4e01-b5ab-e0d9950d210f",
|
|
|
|
|
"observed-data--59c56153-92ec-4684-b6c6-44df950d210f",
|
|
|
|
|
"network-traffic--59c56153-92ec-4684-b6c6-44df950d210f",
|
|
|
|
|
"ipv4-addr--59c56153-92ec-4684-b6c6-44df950d210f",
|
|
|
|
|
"indicator--59c56153-5aac-4f2e-81a9-4d81950d210f",
|
|
|
|
|
"indicator--59c56154-2150-40d7-b3c8-4ede950d210f",
|
|
|
|
|
"indicator--59c56263-8fbc-410d-91e8-133002de0b81",
|
|
|
|
|
"indicator--59c56263-2664-4d91-bf06-133002de0b81",
|
|
|
|
|
"observed-data--59c56263-1640-4219-aec2-133002de0b81",
|
|
|
|
|
"url--59c56263-1640-4219-aec2-133002de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"Threat-Report",
|
|
|
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
|
|
|
"ecsirt:malicious-code=\"ransomware\"",
|
|
|
|
|
"misp-galaxy:ransomware=\"Locky\""
|
|
|
|
|
],
|
|
|
|
|
"object_marking_refs": [
|
|
|
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59c5614a-bfa4-49df-8383-4082950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '5dd7d5899168ac90325b350293c49ee2']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-09-22T19:20:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59c5614a-1d60-4e3c-ad98-454c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://121-psychic-reading.co.uk/slehGTexc']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-09-22T19:20:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59c5614a-eea8-49d3-85a8-4eca950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = '121-psychic-reading.co.uk']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-09-22T19:20:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59c5614b-44a4-4d33-8c04-4782950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"first_observed": "2017-09-22T19:20:03Z",
|
|
|
|
|
"last_observed": "2017-09-22T19:20:03Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59c5614b-44a4-4d33-8c04-4782950d210f",
|
|
|
|
|
"ipv4-addr--59c5614b-44a4-4d33-8c04-4782950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59c5614b-44a4-4d33-8c04-4782950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59c5614b-44a4-4d33-8c04-4782950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59c5614b-44a4-4d33-8c04-4782950d210f",
|
|
|
|
|
"value": "217.168.155.63"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59c5614b-f5d4-4442-a6ff-df79950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://2-wave.com/slehGTexc']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-09-22T19:20:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59c5614b-02f8-4282-bfaa-4c2a950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = '2-wave.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-09-22T19:20:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59c5614c-361c-4727-821a-403f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"first_observed": "2017-09-22T19:20:03Z",
|
|
|
|
|
"last_observed": "2017-09-22T19:20:03Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59c5614c-361c-4727-821a-403f950d210f",
|
|
|
|
|
"ipv4-addr--59c5614c-361c-4727-821a-403f950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59c5614c-361c-4727-821a-403f950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59c5614c-361c-4727-821a-403f950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59c5614c-361c-4727-821a-403f950d210f",
|
|
|
|
|
"value": "209.54.62.81"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59c5614c-d9a8-4394-ad71-4933950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://3e.com.pt/slehGTexc']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-09-22T19:20:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59c5614c-0a14-43f5-8bd0-49a5950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = '3e.com.pt']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-09-22T19:20:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59c5614d-ba5c-43c3-91c7-4424950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"first_observed": "2017-09-22T19:20:03Z",
|
|
|
|
|
"last_observed": "2017-09-22T19:20:03Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59c5614d-ba5c-43c3-91c7-4424950d210f",
|
|
|
|
|
"ipv4-addr--59c5614d-ba5c-43c3-91c7-4424950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59c5614d-ba5c-43c3-91c7-4424950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59c5614d-ba5c-43c3-91c7-4424950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59c5614d-ba5c-43c3-91c7-4424950d210f",
|
|
|
|
|
"value": "174.141.224.179"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59c5614d-9c30-4074-af56-46f8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://4advice-interactive.be/slehGTexc']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-09-22T19:20:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59c5614d-2fb0-4714-9d76-e0d9950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = '4advice-interactive.be']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-09-22T19:20:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59c5614d-a3c0-4a21-b96e-4a90950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"first_observed": "2017-09-22T19:20:03Z",
|
|
|
|
|
"last_observed": "2017-09-22T19:20:03Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59c5614d-a3c0-4a21-b96e-4a90950d210f",
|
|
|
|
|
"ipv4-addr--59c5614d-a3c0-4a21-b96e-4a90950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59c5614d-a3c0-4a21-b96e-4a90950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59c5614d-a3c0-4a21-b96e-4a90950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59c5614d-a3c0-4a21-b96e-4a90950d210f",
|
|
|
|
|
"value": "91.121.20.89"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59c5614e-6458-4bb4-91be-e0c7950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://9ninewright.net/slehGTexc']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-09-22T19:20:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59c5614e-c800-47aa-a30e-477e950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = '9ninewright.net']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-09-22T19:20:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59c5614e-7c70-45b8-acaf-45fc950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"first_observed": "2017-09-22T19:20:03Z",
|
|
|
|
|
"last_observed": "2017-09-22T19:20:03Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59c5614e-7c70-45b8-acaf-45fc950d210f",
|
|
|
|
|
"ipv4-addr--59c5614e-7c70-45b8-acaf-45fc950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59c5614e-7c70-45b8-acaf-45fc950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59c5614e-7c70-45b8-acaf-45fc950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59c5614e-7c70-45b8-acaf-45fc950d210f",
|
|
|
|
|
"value": "98.124.251.65"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59c5614e-dd40-46ab-bdc2-4359950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://adaliyapi.com/slehGTexc']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-09-22T19:20:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59c5614f-20e8-4bc5-925b-4a82950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'adaliyapi.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-09-22T19:20:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59c5614f-1c60-4165-924e-4723950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"first_observed": "2017-09-22T19:20:03Z",
|
|
|
|
|
"last_observed": "2017-09-22T19:20:03Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59c5614f-1c60-4165-924e-4723950d210f",
|
|
|
|
|
"ipv4-addr--59c5614f-1c60-4165-924e-4723950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59c5614f-1c60-4165-924e-4723950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59c5614f-1c60-4165-924e-4723950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59c5614f-1c60-4165-924e-4723950d210f",
|
|
|
|
|
"value": "77.92.99.5"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59c5614f-0c14-4b0e-b6fa-4602950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://ahtwindowcleaning.co.uk/slehGTexc']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-09-22T19:20:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59c5614f-7bfc-4b83-8407-e0d9950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'ahtwindowcleaning.co.uk']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-09-22T19:20:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59c56150-1a00-4af1-98c1-df79950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"first_observed": "2017-09-22T19:20:03Z",
|
|
|
|
|
"last_observed": "2017-09-22T19:20:03Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59c56150-1a00-4af1-98c1-df79950d210f",
|
|
|
|
|
"ipv4-addr--59c56150-1a00-4af1-98c1-df79950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59c56150-1a00-4af1-98c1-df79950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59c56150-1a00-4af1-98c1-df79950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59c56150-1a00-4af1-98c1-df79950d210f",
|
|
|
|
|
"value": "81.27.85.25"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59c56150-b14c-44a6-be4e-4305950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://PamelaSparrowChilds.com/slehGTexc']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-09-22T19:20:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59c56150-5c1c-4a31-be36-4aca950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'pamelasparrowchilds.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-09-22T19:20:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59c56151-7f1c-44f1-9fbb-4de6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"first_observed": "2017-09-22T19:20:03Z",
|
|
|
|
|
"last_observed": "2017-09-22T19:20:03Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59c56151-7f1c-44f1-9fbb-4de6950d210f",
|
|
|
|
|
"ipv4-addr--59c56151-7f1c-44f1-9fbb-4de6950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59c56151-7f1c-44f1-9fbb-4de6950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59c56151-7f1c-44f1-9fbb-4de6950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59c56151-7f1c-44f1-9fbb-4de6950d210f",
|
|
|
|
|
"value": "23.229.153.66"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59c56151-fc54-4f31-9f4d-4f3a950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://rasbery.co.uk/slehGTexc']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-09-22T19:20:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59c56151-9774-4902-a88a-41fb950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'rasbery.co.uk']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-09-22T19:20:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59c56151-01e8-43fd-af78-4877950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"first_observed": "2017-09-22T19:20:03Z",
|
|
|
|
|
"last_observed": "2017-09-22T19:20:03Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59c56151-01e8-43fd-af78-4877950d210f",
|
|
|
|
|
"ipv4-addr--59c56151-01e8-43fd-af78-4877950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59c56151-01e8-43fd-af78-4877950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59c56151-01e8-43fd-af78-4877950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59c56151-01e8-43fd-af78-4877950d210f",
|
|
|
|
|
"value": "193.189.74.89"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59c56152-372c-494d-892b-df79950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://robinsonfun.pl/slehGTexc']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-09-22T19:20:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59c56152-707c-4ad9-8a1e-4631950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'robinsonfun.pl']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-09-22T19:20:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59c56152-9410-494e-918b-4cba950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"first_observed": "2017-09-22T19:20:03Z",
|
|
|
|
|
"last_observed": "2017-09-22T19:20:03Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59c56152-9410-494e-918b-4cba950d210f",
|
|
|
|
|
"ipv4-addr--59c56152-9410-494e-918b-4cba950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59c56152-9410-494e-918b-4cba950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59c56152-9410-494e-918b-4cba950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59c56152-9410-494e-918b-4cba950d210f",
|
|
|
|
|
"value": "87.98.239.48"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59c56152-c7cc-4bf7-a6aa-4a72950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://ryterorrephat.info/af/slehGTexc']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-09-22T19:20:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59c56152-a71c-4c47-8d14-1330950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'ryterorrephat.info']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-09-22T19:20:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59c56153-0618-45a8-bcb6-4ff8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://weddingcarsbury.co.uk/slehGTexc']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-09-22T19:20:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59c56153-0384-4e01-b5ab-e0d9950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'weddingcarsbury.co.uk']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-09-22T19:20:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59c56153-92ec-4684-b6c6-44df950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"first_observed": "2017-09-22T19:20:03Z",
|
|
|
|
|
"last_observed": "2017-09-22T19:20:03Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59c56153-92ec-4684-b6c6-44df950d210f",
|
|
|
|
|
"ipv4-addr--59c56153-92ec-4684-b6c6-44df950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59c56153-92ec-4684-b6c6-44df950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59c56153-92ec-4684-b6c6-44df950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59c56153-92ec-4684-b6c6-44df950d210f",
|
|
|
|
|
"value": "193.189.74.92"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59c56153-5aac-4f2e-81a9-4d81950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://weddingcarsrochdale.co.uk/slehGTexc']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-09-22T19:20:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59c56154-2150-40d7-b3c8-4ede950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'weddingcarsrochdale.co.uk']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-09-22T19:20:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59c56263-8fbc-410d-91e8-133002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 5dd7d5899168ac90325b350293c49ee2",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '302aabfec6b1696e3019699d6367e4ac9e57037aec6237d9b263ba9a8fbe3418']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-09-22T19:20:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59c56263-2664-4d91-bf06-133002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 5dd7d5899168ac90325b350293c49ee2",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '6ea25cddbe0957d20d7ddea9efe84d2ba13a84e0']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-09-22T19:20:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59c56263-1640-4219-aec2-133002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"modified": "2017-09-22T19:20:03.000Z",
|
|
|
|
|
"first_observed": "2017-09-22T19:20:03Z",
|
|
|
|
|
"last_observed": "2017-09-22T19:20:03Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--59c56263-1640-4219-aec2-133002de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--59c56263-1640-4219-aec2-133002de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/302aabfec6b1696e3019699d6367e4ac9e57037aec6237d9b263ba9a8fbe3418/analysis/1506053356/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "marking-definition",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
|
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
|
|
|
"definition_type": "tlp",
|
|
|
|
|
"name": "TLP:WHITE",
|
|
|
|
|
"definition": {
|
|
|
|
|
"tlp": "white"
|
|
|
|
|
}
|
|
|
|
|
}
|
2023-04-21 13:25:09 +00:00
|
|
|
]
|
|
|
|
|
}
|
