2023-04-21 13:25:09 +00:00
|
|
|
{
|
2023-06-14 17:31:25 +00:00
|
|
|
"type": "bundle",
|
|
|
|
|
"id": "bundle--59d25f8b-1a64-43b0-ab71-4ba1950d210f",
|
|
|
|
|
"objects": [
|
|
|
|
|
{
|
|
|
|
|
"type": "identity",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:55:48.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:55:48.000Z",
|
|
|
|
|
"name": "CIRCL",
|
|
|
|
|
"identity_class": "organization"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "report",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "report--59d25f8b-1a64-43b0-ab71-4ba1950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:55:48.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:55:48.000Z",
|
|
|
|
|
"name": "M2M - Locky 2017-10-02 : Affid=3, offline, \".ykcol\" : \"Emailed Invoice - 123456\" - \"I_123456.7z\"",
|
|
|
|
|
"published": "2017-10-04T08:55:58Z",
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"indicator--59d25f8c-ba58-40a4-b8a3-46cc950d210f",
|
|
|
|
|
"indicator--59d25f8c-6c24-44e9-b636-bdbb950d210f",
|
|
|
|
|
"indicator--59d25f8c-80e8-4fc7-b1a5-bd79950d210f",
|
|
|
|
|
"observed-data--59d25f8d-5df8-4fc7-b666-47d5950d210f",
|
|
|
|
|
"network-traffic--59d25f8d-5df8-4fc7-b666-47d5950d210f",
|
|
|
|
|
"ipv4-addr--59d25f8d-5df8-4fc7-b666-47d5950d210f",
|
|
|
|
|
"indicator--59d25f8d-61c8-4033-81b0-4955950d210f",
|
|
|
|
|
"indicator--59d25f8e-d788-400c-b3ec-5d9f950d210f",
|
|
|
|
|
"observed-data--59d25f8e-1abc-42bd-a599-43ce950d210f",
|
|
|
|
|
"network-traffic--59d25f8e-1abc-42bd-a599-43ce950d210f",
|
|
|
|
|
"ipv4-addr--59d25f8e-1abc-42bd-a599-43ce950d210f",
|
|
|
|
|
"indicator--59d25f8f-895c-4518-8a72-4769950d210f",
|
|
|
|
|
"indicator--59d25f8f-8854-4f9a-8676-60c9950d210f",
|
|
|
|
|
"observed-data--59d25f90-beb0-4341-b99f-5e45950d210f",
|
|
|
|
|
"network-traffic--59d25f90-beb0-4341-b99f-5e45950d210f",
|
|
|
|
|
"ipv4-addr--59d25f90-beb0-4341-b99f-5e45950d210f",
|
|
|
|
|
"indicator--59d25f90-efb4-4646-99b0-5e44950d210f",
|
|
|
|
|
"indicator--59d25f90-ca84-49b1-81ab-bdbb950d210f",
|
|
|
|
|
"observed-data--59d25f91-be58-477c-8b4b-bd79950d210f",
|
|
|
|
|
"network-traffic--59d25f91-be58-477c-8b4b-bd79950d210f",
|
|
|
|
|
"ipv4-addr--59d25f91-be58-477c-8b4b-bd79950d210f",
|
|
|
|
|
"indicator--59d25f91-fd78-4e02-bdc3-4ef0950d210f",
|
|
|
|
|
"indicator--59d25f92-8b58-4ef5-9561-47e8950d210f",
|
|
|
|
|
"observed-data--59d25f92-038c-4078-9926-5d9f950d210f",
|
|
|
|
|
"network-traffic--59d25f92-038c-4078-9926-5d9f950d210f",
|
|
|
|
|
"ipv4-addr--59d25f92-038c-4078-9926-5d9f950d210f",
|
|
|
|
|
"indicator--59d25f93-e7dc-41d5-b3a8-4f3c950d210f",
|
|
|
|
|
"indicator--59d25f93-33fc-474a-be12-4b51950d210f",
|
|
|
|
|
"observed-data--59d25f93-dd28-4ea2-ba65-60c9950d210f",
|
|
|
|
|
"network-traffic--59d25f93-dd28-4ea2-ba65-60c9950d210f",
|
|
|
|
|
"ipv4-addr--59d25f93-dd28-4ea2-ba65-60c9950d210f",
|
|
|
|
|
"indicator--59d25f94-1efc-4819-a551-47e1950d210f",
|
|
|
|
|
"indicator--59d25f94-cca0-418b-a677-5e44950d210f",
|
|
|
|
|
"observed-data--59d25f95-80dc-4e15-9703-bdbb950d210f",
|
|
|
|
|
"network-traffic--59d25f95-80dc-4e15-9703-bdbb950d210f",
|
|
|
|
|
"ipv4-addr--59d25f95-80dc-4e15-9703-bdbb950d210f",
|
|
|
|
|
"indicator--59d25f95-13a8-414e-b64a-4583950d210f",
|
|
|
|
|
"indicator--59d25f95-1ecc-4c33-8802-4daf950d210f",
|
|
|
|
|
"observed-data--59d25f96-148c-43a6-af6c-46c1950d210f",
|
|
|
|
|
"network-traffic--59d25f96-148c-43a6-af6c-46c1950d210f",
|
|
|
|
|
"ipv4-addr--59d25f96-148c-43a6-af6c-46c1950d210f",
|
|
|
|
|
"indicator--59d25f96-08e0-4132-9fdb-5d9f950d210f",
|
|
|
|
|
"indicator--59d25f96-daac-4921-bd18-4ff8950d210f",
|
|
|
|
|
"observed-data--59d25f97-8694-4b18-b341-43ef950d210f",
|
|
|
|
|
"network-traffic--59d25f97-8694-4b18-b341-43ef950d210f",
|
|
|
|
|
"ipv4-addr--59d25f97-8694-4b18-b341-43ef950d210f",
|
|
|
|
|
"indicator--59d25f97-3b54-480c-badd-49e4950d210f",
|
|
|
|
|
"indicator--59d25f97-d110-4329-9ea9-4c20950d210f",
|
|
|
|
|
"observed-data--59d25f98-6e60-401e-80d7-4e43950d210f",
|
|
|
|
|
"network-traffic--59d25f98-6e60-401e-80d7-4e43950d210f",
|
|
|
|
|
"ipv4-addr--59d25f98-6e60-401e-80d7-4e43950d210f",
|
|
|
|
|
"indicator--59d25f98-2554-497a-8c19-60c9950d210f",
|
|
|
|
|
"indicator--59d25f98-522c-4d53-abd5-5e45950d210f",
|
|
|
|
|
"observed-data--59d25f98-c030-4dbf-aa63-4b8d950d210f",
|
|
|
|
|
"network-traffic--59d25f98-c030-4dbf-aa63-4b8d950d210f",
|
|
|
|
|
"ipv4-addr--59d25f98-c030-4dbf-aa63-4b8d950d210f",
|
|
|
|
|
"indicator--59d25f99-f4c0-4b1f-a696-4f62950d210f",
|
|
|
|
|
"indicator--59d25f99-3d58-4588-871e-4cf3950d210f",
|
|
|
|
|
"indicator--59d25fb7-6e4c-4072-9b61-bdbb950d210f",
|
|
|
|
|
"indicator--59d25fb7-2080-472e-8865-bd79950d210f",
|
|
|
|
|
"observed-data--59d25fb8-1040-40a3-bc12-431c950d210f",
|
|
|
|
|
"network-traffic--59d25fb8-1040-40a3-bc12-431c950d210f",
|
|
|
|
|
"ipv4-addr--59d25fb8-1040-40a3-bc12-431c950d210f",
|
|
|
|
|
"indicator--59d25fb8-e450-4728-a265-6062950d210f",
|
|
|
|
|
"indicator--59d25fb8-6004-4606-b716-4c22950d210f",
|
|
|
|
|
"observed-data--59d25fb8-a16c-478c-8850-42c1950d210f",
|
|
|
|
|
"network-traffic--59d25fb8-a16c-478c-8850-42c1950d210f",
|
|
|
|
|
"ipv4-addr--59d25fb8-a16c-478c-8850-42c1950d210f",
|
|
|
|
|
"indicator--59d25fb9-1028-4c09-be94-472b950d210f",
|
|
|
|
|
"indicator--59d25fb9-8c24-44a2-8330-5d9f950d210f",
|
|
|
|
|
"observed-data--59d25fb9-ede4-487e-a460-4ccd950d210f",
|
|
|
|
|
"network-traffic--59d25fb9-ede4-487e-a460-4ccd950d210f",
|
|
|
|
|
"ipv4-addr--59d25fb9-ede4-487e-a460-4ccd950d210f",
|
|
|
|
|
"indicator--59d4a11d-e4fc-4272-8049-472602de0b81",
|
|
|
|
|
"indicator--59d4a11d-fd90-43ff-a75d-48f802de0b81",
|
|
|
|
|
"observed-data--59d4a11d-eeac-4480-a8e7-4d8802de0b81",
|
|
|
|
|
"url--59d4a11d-eeac-4480-a8e7-4d8802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"Threat-Report",
|
|
|
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
|
|
|
"ecsirt:malicious-code=\"ransomware\"",
|
|
|
|
|
"misp-galaxy:ransomware=\"Locky\""
|
|
|
|
|
],
|
|
|
|
|
"object_marking_refs": [
|
|
|
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d25f8c-ba58-40a4-b8a3-46cc950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '94f3b5dbf38a74664e85e8bca6ac6ede']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-04T08:51:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d25f8c-6c24-44e9-b636-bdbb950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://alexandradickman.com/873gfhi3f3r']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-04T08:51:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d25f8c-80e8-4fc7-b1a5-bd79950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'alexandradickman.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-04T08:51:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59d25f8d-5df8-4fc7-b666-47d5950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"first_observed": "2017-10-04T08:51:40Z",
|
|
|
|
|
"last_observed": "2017-10-04T08:51:40Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59d25f8d-5df8-4fc7-b666-47d5950d210f",
|
|
|
|
|
"ipv4-addr--59d25f8d-5df8-4fc7-b666-47d5950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59d25f8d-5df8-4fc7-b666-47d5950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59d25f8d-5df8-4fc7-b666-47d5950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59d25f8d-5df8-4fc7-b666-47d5950d210f",
|
|
|
|
|
"value": "98.124.251.65"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d25f8d-61c8-4033-81b0-4955950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://goliathstoneindustries.com/873gfhi3f3r']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-04T08:51:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d25f8e-d788-400c-b3ec-5d9f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'goliathstoneindustries.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-04T08:51:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59d25f8e-1abc-42bd-a599-43ce950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"first_observed": "2017-10-04T08:51:40Z",
|
|
|
|
|
"last_observed": "2017-10-04T08:51:40Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59d25f8e-1abc-42bd-a599-43ce950d210f",
|
|
|
|
|
"ipv4-addr--59d25f8e-1abc-42bd-a599-43ce950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59d25f8e-1abc-42bd-a599-43ce950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59d25f8e-1abc-42bd-a599-43ce950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59d25f8e-1abc-42bd-a599-43ce950d210f",
|
|
|
|
|
"value": "103.53.172.3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d25f8f-895c-4518-8a72-4769950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://honeypot.egdevcenter.com/873gfhi3f3r']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-04T08:51:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d25f8f-8854-4f9a-8676-60c9950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'honeypot.egdevcenter.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-04T08:51:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59d25f90-beb0-4341-b99f-5e45950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"first_observed": "2017-10-04T08:51:40Z",
|
|
|
|
|
"last_observed": "2017-10-04T08:51:40Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59d25f90-beb0-4341-b99f-5e45950d210f",
|
|
|
|
|
"ipv4-addr--59d25f90-beb0-4341-b99f-5e45950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59d25f90-beb0-4341-b99f-5e45950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59d25f90-beb0-4341-b99f-5e45950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59d25f90-beb0-4341-b99f-5e45950d210f",
|
|
|
|
|
"value": "37.48.73.139"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d25f90-efb4-4646-99b0-5e44950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://ichinose.de/873gfhi3f3r']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-04T08:51:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d25f90-ca84-49b1-81ab-bdbb950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'ichinose.de']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-04T08:51:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59d25f91-be58-477c-8b4b-bd79950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"first_observed": "2017-10-04T08:51:40Z",
|
|
|
|
|
"last_observed": "2017-10-04T08:51:40Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59d25f91-be58-477c-8b4b-bd79950d210f",
|
|
|
|
|
"ipv4-addr--59d25f91-be58-477c-8b4b-bd79950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59d25f91-be58-477c-8b4b-bd79950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59d25f91-be58-477c-8b4b-bd79950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59d25f91-be58-477c-8b4b-bd79950d210f",
|
|
|
|
|
"value": "87.106.222.105"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d25f91-fd78-4e02-bdc3-4ef0950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://kartprinterleri.com/873gfhi3f3r']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-04T08:51:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d25f92-8b58-4ef5-9561-47e8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'kartprinterleri.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-04T08:51:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59d25f92-038c-4078-9926-5d9f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"first_observed": "2017-10-04T08:51:40Z",
|
|
|
|
|
"last_observed": "2017-10-04T08:51:40Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59d25f92-038c-4078-9926-5d9f950d210f",
|
|
|
|
|
"ipv4-addr--59d25f92-038c-4078-9926-5d9f950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59d25f92-038c-4078-9926-5d9f950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59d25f92-038c-4078-9926-5d9f950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59d25f92-038c-4078-9926-5d9f950d210f",
|
|
|
|
|
"value": "77.245.149.46"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d25f93-e7dc-41d5-b3a8-4f3c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://leightonbrothers.co.uk/873gfhi3f3r']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-04T08:51:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d25f93-33fc-474a-be12-4b51950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'leightonbrothers.co.uk']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-04T08:51:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59d25f93-dd28-4ea2-ba65-60c9950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"first_observed": "2017-10-04T08:51:40Z",
|
|
|
|
|
"last_observed": "2017-10-04T08:51:40Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59d25f93-dd28-4ea2-ba65-60c9950d210f",
|
|
|
|
|
"ipv4-addr--59d25f93-dd28-4ea2-ba65-60c9950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59d25f93-dd28-4ea2-ba65-60c9950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59d25f93-dd28-4ea2-ba65-60c9950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59d25f93-dd28-4ea2-ba65-60c9950d210f",
|
|
|
|
|
"value": "87.106.150.83"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d25f94-1efc-4819-a551-47e1950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://motifahsap.com/873gfhi3f3r']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-04T08:51:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d25f94-cca0-418b-a677-5e44950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'motifahsap.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-04T08:51:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59d25f95-80dc-4e15-9703-bdbb950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"first_observed": "2017-10-04T08:51:40Z",
|
|
|
|
|
"last_observed": "2017-10-04T08:51:40Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59d25f95-80dc-4e15-9703-bdbb950d210f",
|
|
|
|
|
"ipv4-addr--59d25f95-80dc-4e15-9703-bdbb950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59d25f95-80dc-4e15-9703-bdbb950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59d25f95-80dc-4e15-9703-bdbb950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59d25f95-80dc-4e15-9703-bdbb950d210f",
|
|
|
|
|
"value": "188.132.180.113"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d25f95-13a8-414e-b64a-4583950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://pacalik.net/873gfhi3f3r']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-04T08:51:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d25f95-1ecc-4c33-8802-4daf950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'pacalik.net']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-04T08:51:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59d25f96-148c-43a6-af6c-46c1950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"first_observed": "2017-10-04T08:51:40Z",
|
|
|
|
|
"last_observed": "2017-10-04T08:51:40Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59d25f96-148c-43a6-af6c-46c1950d210f",
|
|
|
|
|
"ipv4-addr--59d25f96-148c-43a6-af6c-46c1950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59d25f96-148c-43a6-af6c-46c1950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59d25f96-148c-43a6-af6c-46c1950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59d25f96-148c-43a6-af6c-46c1950d210f",
|
|
|
|
|
"value": "93.187.200.105"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d25f96-08e0-4132-9fdb-5d9f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://petrochemus.com/873gfhi3f3r']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-04T08:51:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d25f96-daac-4921-bd18-4ff8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'petrochemus.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-04T08:51:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59d25f97-8694-4b18-b341-43ef950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"first_observed": "2017-10-04T08:51:40Z",
|
|
|
|
|
"last_observed": "2017-10-04T08:51:40Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59d25f97-8694-4b18-b341-43ef950d210f",
|
|
|
|
|
"ipv4-addr--59d25f97-8694-4b18-b341-43ef950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59d25f97-8694-4b18-b341-43ef950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59d25f97-8694-4b18-b341-43ef950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59d25f97-8694-4b18-b341-43ef950d210f",
|
|
|
|
|
"value": "98.124.251.72"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d25f97-3b54-480c-badd-49e4950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://robsacks.com/873gfhi3f3r']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-04T08:51:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d25f97-d110-4329-9ea9-4c20950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'robsacks.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-04T08:51:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59d25f98-6e60-401e-80d7-4e43950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"first_observed": "2017-10-04T08:51:40Z",
|
|
|
|
|
"last_observed": "2017-10-04T08:51:40Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59d25f98-6e60-401e-80d7-4e43950d210f",
|
|
|
|
|
"ipv4-addr--59d25f98-6e60-401e-80d7-4e43950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59d25f98-6e60-401e-80d7-4e43950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59d25f98-6e60-401e-80d7-4e43950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59d25f98-6e60-401e-80d7-4e43950d210f",
|
|
|
|
|
"value": "184.168.92.220"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d25f98-2554-497a-8c19-60c9950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://schwellenwertdaten.de/873gfhi3f3r']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-04T08:51:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d25f98-522c-4d53-abd5-5e45950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'schwellenwertdaten.de']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-04T08:51:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59d25f98-c030-4dbf-aa63-4b8d950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"first_observed": "2017-10-04T08:51:40Z",
|
|
|
|
|
"last_observed": "2017-10-04T08:51:40Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59d25f98-c030-4dbf-aa63-4b8d950d210f",
|
|
|
|
|
"ipv4-addr--59d25f98-c030-4dbf-aa63-4b8d950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59d25f98-c030-4dbf-aa63-4b8d950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59d25f98-c030-4dbf-aa63-4b8d950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59d25f98-c030-4dbf-aa63-4b8d950d210f",
|
|
|
|
|
"value": "178.77.75.77"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d25f99-f4c0-4b1f-a696-4f62950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://sherylbro.net/p66/873gfhi3f3r']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-04T08:51:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d25f99-3d58-4588-871e-4cf3950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'sherylbro.net']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-04T08:51:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d25fb7-6e4c-4072-9b61-bdbb950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://skyehoppus.com/873gfhi3f3r']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-04T08:51:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d25fb7-2080-472e-8865-bd79950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'skyehoppus.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-04T08:51:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59d25fb8-1040-40a3-bc12-431c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"first_observed": "2017-10-04T08:51:40Z",
|
|
|
|
|
"last_observed": "2017-10-04T08:51:40Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59d25fb8-1040-40a3-bc12-431c950d210f",
|
|
|
|
|
"ipv4-addr--59d25fb8-1040-40a3-bc12-431c950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59d25fb8-1040-40a3-bc12-431c950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59d25fb8-1040-40a3-bc12-431c950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59d25fb8-1040-40a3-bc12-431c950d210f",
|
|
|
|
|
"value": "98.124.252.131"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d25fb8-e450-4728-a265-6062950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://theceocforeporter.com/873gfhi3f3r']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-04T08:51:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d25fb8-6004-4606-b716-4c22950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:40.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'theceocforeporter.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-04T08:51:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59d25fb8-a16c-478c-8850-42c1950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:41.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:41.000Z",
|
|
|
|
|
"first_observed": "2017-10-04T08:51:41Z",
|
|
|
|
|
"last_observed": "2017-10-04T08:51:41Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59d25fb8-a16c-478c-8850-42c1950d210f",
|
|
|
|
|
"ipv4-addr--59d25fb8-a16c-478c-8850-42c1950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59d25fb8-a16c-478c-8850-42c1950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59d25fb8-a16c-478c-8850-42c1950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59d25fb8-a16c-478c-8850-42c1950d210f",
|
|
|
|
|
"value": "98.124.251.69"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d25fb9-1028-4c09-be94-472b950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:41.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:41.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://wallstproperties.com/873gfhi3f3r']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-04T08:51:41Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d25fb9-8c24-44a2-8330-5d9f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:41.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:41.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'wallstproperties.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-04T08:51:41Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59d25fb9-ede4-487e-a460-4ccd950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:41.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:41.000Z",
|
|
|
|
|
"first_observed": "2017-10-04T08:51:41Z",
|
|
|
|
|
"last_observed": "2017-10-04T08:51:41Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59d25fb9-ede4-487e-a460-4ccd950d210f",
|
|
|
|
|
"ipv4-addr--59d25fb9-ede4-487e-a460-4ccd950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59d25fb9-ede4-487e-a460-4ccd950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59d25fb9-ede4-487e-a460-4ccd950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59d25fb9-ede4-487e-a460-4ccd950d210f",
|
|
|
|
|
"value": "98.124.251.204"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d4a11d-e4fc-4272-8049-472602de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:41.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:41.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 94f3b5dbf38a74664e85e8bca6ac6ede",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '5998290a28026732d73b1144dd67e4dcd3b0cbdc1b9d61a8a9286c3a35fcfdfb']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-04T08:51:41Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d4a11d-fd90-43ff-a75d-48f802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:41.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:41.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 94f3b5dbf38a74664e85e8bca6ac6ede",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '2d3c8d31b97de4ac412aa36ae9ae5b672a934167']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-04T08:51:41Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59d4a11d-eeac-4480-a8e7-4d8802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-04T08:51:41.000Z",
|
|
|
|
|
"modified": "2017-10-04T08:51:41.000Z",
|
|
|
|
|
"first_observed": "2017-10-04T08:51:41Z",
|
|
|
|
|
"last_observed": "2017-10-04T08:51:41Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--59d4a11d-eeac-4480-a8e7-4d8802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--59d4a11d-eeac-4480-a8e7-4d8802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/5998290a28026732d73b1144dd67e4dcd3b0cbdc1b9d61a8a9286c3a35fcfdfb/analysis/1506967292/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "marking-definition",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
|
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
|
|
|
"definition_type": "tlp",
|
|
|
|
|
"name": "TLP:WHITE",
|
|
|
|
|
"definition": {
|
|
|
|
|
"tlp": "white"
|
|
|
|
|
}
|
|
|
|
|
}
|
2023-04-21 13:25:09 +00:00
|
|
|
]
|
|
|
|
|
}
|
