2023-04-21 13:25:09 +00:00
{
2023-06-14 17:31:25 +00:00
"type" : "bundle" ,
"id" : "bundle--59d68cfe-723c-4b5e-b737-fbfd02de0b81" ,
"objects" : [
{
"type" : "identity" ,
"spec_version" : "2.1" ,
"id" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-06T09:52:59.000Z" ,
"modified" : "2017-10-06T09:52:59.000Z" ,
"name" : "CIRCL" ,
"identity_class" : "organization"
} ,
{
"type" : "report" ,
"spec_version" : "2.1" ,
"id" : "report--59d68cfe-723c-4b5e-b737-fbfd02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-06T09:52:59.000Z" ,
"modified" : "2017-10-06T09:52:59.000Z" ,
"name" : "OSINT - FreeMilk: A Highly Targeted Spear Phishing Campaign" ,
"published" : "2017-10-06T09:53:07Z" ,
"object_refs" : [
"observed-data--59d68d30-fef8-46e2-8299-4c2b02de0b81" ,
"url--59d68d30-fef8-46e2-8299-4c2b02de0b81" ,
"x-misp-attribute--59d68d50-3d28-4831-8b96-fbfd02de0b81" ,
"indicator--59d68def-93ac-417a-95dd-400802de0b81" ,
"indicator--59d68def-76dc-4ac8-8b0b-444802de0b81" ,
"indicator--59d68def-e5ec-416b-8650-45e502de0b81" ,
"indicator--59d68def-89dc-4632-8c84-4dfc02de0b81" ,
"indicator--59d68def-84a8-4265-94ec-49dd02de0b81" ,
"indicator--59d68def-6160-4073-8635-4de102de0b81" ,
"indicator--59d68def-3968-412f-82f1-4f8602de0b81" ,
"vulnerability--59d68e21-a364-43f8-b09e-421402de0b81" ,
"indicator--59d68ea6-7d58-426b-8637-403a02de0b81" ,
"indicator--59d68ea6-6038-4f14-b78f-42c102de0b81" ,
"indicator--59d68ecc-8668-4775-8992-fbfd02de0b81" ,
"indicator--59d68ef1-2558-4156-a0b7-7ed002de0b81" ,
"indicator--59d68ef1-ba78-4aec-8fd4-7ed002de0b81" ,
"indicator--59d68ef1-5fe8-475f-a18e-7ed002de0b81" ,
"indicator--59d68ef1-8a9c-40fa-96f0-7ed002de0b81" ,
"indicator--59d68ef1-cd70-4af0-81f9-7ed002de0b81" ,
"indicator--59d68ef1-a150-4d30-a712-7ed002de0b81" ,
"indicator--59d68ef1-0b54-4ac7-a770-7ed002de0b81" ,
"indicator--59d68ef1-053c-4ed0-962d-7ed002de0b81" ,
"indicator--59d68ef1-3c14-42eb-bad5-7ed002de0b81" ,
"indicator--59d68f38-6028-4934-8183-4cf702de0b81" ,
"indicator--59d68f38-2850-481e-8d9c-43bf02de0b81" ,
"observed-data--59d68f38-0658-420d-954b-4adf02de0b81" ,
"url--59d68f38-0658-420d-954b-4adf02de0b81" ,
"indicator--59d68f38-2664-4f17-a556-455502de0b81" ,
"indicator--59d68f38-2e9c-4f28-9978-4ee302de0b81" ,
"observed-data--59d68f38-ffc0-4f55-a249-475b02de0b81" ,
"url--59d68f38-ffc0-4f55-a249-475b02de0b81" ,
"indicator--59d68f38-00f0-49aa-8d6f-4f0102de0b81" ,
"indicator--59d68f38-0f68-4dcb-a9f9-478d02de0b81" ,
"observed-data--59d68f38-1868-461e-bcf3-4e7502de0b81" ,
"url--59d68f38-1868-461e-bcf3-4e7502de0b81" ,
"indicator--59d68f38-4238-455f-9053-4ffb02de0b81" ,
"indicator--59d68f38-b6c8-4ecd-85ab-4d5e02de0b81" ,
"observed-data--59d68f38-a048-4780-96ff-4d9302de0b81" ,
"url--59d68f38-a048-4780-96ff-4d9302de0b81" ,
"indicator--59d68f38-83c8-41c6-8060-4ba402de0b81" ,
"indicator--59d68f38-9ec0-4be5-995a-4d2d02de0b81" ,
"observed-data--59d68f38-9c6c-46b1-80d4-45ff02de0b81" ,
"url--59d68f38-9c6c-46b1-80d4-45ff02de0b81" ,
"indicator--59d68f38-a88c-4685-9964-43cd02de0b81" ,
"indicator--59d68f38-c834-4724-8322-4b4b02de0b81" ,
"observed-data--59d68f38-a574-409c-979d-4d0402de0b81" ,
"url--59d68f38-a574-409c-979d-4d0402de0b81" ,
"indicator--59d68f38-ec2c-4ac1-bacb-489e02de0b81" ,
"indicator--59d68f38-a5e0-43e2-a403-4b1a02de0b81" ,
"observed-data--59d68f38-d1a4-4ab2-a2cb-473c02de0b81" ,
"url--59d68f38-d1a4-4ab2-a2cb-473c02de0b81" ,
"indicator--59d68f38-9710-4f62-95af-44b002de0b81" ,
"indicator--59d68f38-c400-4825-bc49-456702de0b81" ,
"observed-data--59d68f38-0d10-4f4f-859c-470a02de0b81" ,
"url--59d68f38-0d10-4f4f-859c-470a02de0b81" ,
"indicator--59d68f38-5044-4612-a378-484802de0b81" ,
"indicator--59d68f38-4eb8-4a29-8339-40b802de0b81" ,
"observed-data--59d68f38-630c-481b-b4fb-4cdc02de0b81" ,
"url--59d68f38-630c-481b-b4fb-4cdc02de0b81" ,
"indicator--59d68f38-c38c-4a45-98f7-462b02de0b81" ,
"indicator--59d68f38-ed5c-4691-a55d-489802de0b81" ,
"observed-data--59d68f38-bcf0-4ab9-8041-447502de0b81" ,
"url--59d68f38-bcf0-4ab9-8041-447502de0b81" ,
"indicator--59d68f38-f18c-4d90-8c81-462102de0b81" ,
"indicator--59d68f38-5da0-4303-ae0c-408a02de0b81" ,
"observed-data--59d68f38-f7b0-4bcf-bf68-414702de0b81" ,
"url--59d68f38-f7b0-4bcf-bf68-414702de0b81"
] ,
"labels" : [
"Threat-Report" ,
"misp:tool=\"MISP-STIX-Converter\""
] ,
"object_marking_refs" : [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--59d68d30-fef8-46e2-8299-4c2b02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"first_observed" : "2017-10-05T19:59:52Z" ,
"last_observed" : "2017-10-05T19:59:52Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--59d68d30-fef8-46e2-8299-4c2b02de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\"" ,
"osint:source-type=\"blog-post\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--59d68d30-fef8-46e2-8299-4c2b02de0b81" ,
"value" : "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
} ,
{
"type" : "x-misp-attribute" ,
"spec_version" : "2.1" ,
"id" : "x-misp-attribute--59d68d50-3d28-4831-8b96-fbfd02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"labels" : [
"misp:type=\"text\"" ,
"misp:category=\"External analysis\"" ,
"osint:source-type=\"blog-post\""
] ,
"x_misp_category" : "External analysis" ,
"x_misp_type" : "text" ,
"x_misp_value" : "In May 2017, Palo Alto Networks Unit 42 identified a limited spear phishing campaign targeting various individuals across the world. The threat actor leveraged the CVE-2017-0199 Microsoft Word Office/WordPad Remote Code Execution Vulnerability with carefully crafted decoy content customized for each target recipient. Our research showed that the spear phishing emails came from multiple compromised email accounts tied to a legitimate domain in North East Asia. We believe that the threat actor hijacked an existing, legitimate in-progress conversation and posed as the legitimate senders to send malicious spear phishing emails to the recipients"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68def-93ac-417a-95dd-400802de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"description" : "JavaScript to extract and run the payload" ,
"pattern" : "[file:hashes.SHA256 = '1893af524edea4541c317df288adbf17ae4fcc3a30d403331eae541281c71a3c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68def-76dc-4ac8-8b0b-444802de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"pattern" : "[url:value = 'http://old.jrchina.com/btob_asiana/udel_ok.ipp']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"url\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68def-e5ec-416b-8650-45e502de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"description" : "Fake image extracts to Freenki downloader" ,
"pattern" : "[file:hashes.SHA256 = '64ef80e7639c8c5dddf239883617e6740c6b3589f995d11314d36ab64fcfc54c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68def-89dc-4632-8c84-4dfc02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"pattern" : "[url:value = 'http://old.jrchina.com/btob_asiana/appach01.jpg']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"url\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68def-84a8-4265-94ec-49dd02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"pattern" : "[file:hashes.SHA256 = '7f35521cdbaa4e86143656ff9c52cef8d1e5e5f8245860c205364138f82c54df']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68def-6160-4073-8635-4de102de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"description" : "PoohMilk loader" ,
"pattern" : "[file:hashes.SHA256 = '40572e1fc37f4376fdb2a33a6c376631ff7bc00b1e64538a0385bc1e09a85574']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68def-3968-412f-82f1-4f8602de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"pattern" : "[file:hashes.SHA256 = '35273d6c25665a19ac14d469e1436223202be655ee19b5b247cb1afef626c9f2']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "vulnerability" ,
"spec_version" : "2.1" ,
"id" : "vulnerability--59d68e21-a364-43f8-b09e-421402de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"name" : "CVE-2017-0199" ,
"labels" : [
"misp:type=\"vulnerability\"" ,
"misp:category=\"Payload delivery\""
] ,
"external_references" : [
{
"source_name" : "cve" ,
"external_id" : "CVE-2017-0199"
}
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68ea6-7d58-426b-8637-403a02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"description" : "Windows-KB276133-x86.exe" ,
"pattern" : "[file:hashes.SHA256 = '1163da8c37ad9ba98d59b921ba8cf8e54bfc1282712cf754f4ff82b63f8e6027']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68ea6-6038-4f14-b78f-42c102de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-06T09:52:59.000Z" ,
"modified" : "2017-10-06T09:52:59.000Z" ,
"description" : "Windows-KB251952-x86.exe" ,
"pattern" : "[file:hashes.SHA256 = 'ba5905c2fe46bd6734973139e759ba405fd193c2342dfcac396e9d529b57821b']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-06T09:52:59Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\"" ,
"circl:incident-classification=\"malware\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68ecc-8668-4775-8992-fbfd02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"description" : "http://www.ethanpublishing.com/ethanpublishing/phpcms/templates/default/member/pub/jquery_min_2.2.6.js" ,
"pattern" : "[file:hashes.SHA256 = '99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68ef1-2558-4156-a0b7-7ed002de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"pattern" : "[file:hashes.SHA256 = 'a50543919c52ccaea40155ce35aa791bc86bd634240fb51922827223aca5c88a']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68ef1-ba78-4aec-8fd4-7ed002de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"pattern" : "[file:hashes.SHA256 = '201b876bcb97f6c8972cc677bdf1e3e2b2f069ae2ec4653db8af4797884efa30']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68ef1-5fe8-475f-a18e-7ed002de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"pattern" : "[file:hashes.SHA256 = '0f82ea2f92c7e906ee9ffbbd8212be6a8545b9bb0200eda09cce0ba9d7cb1313']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68ef1-8a9c-40fa-96f0-7ed002de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"pattern" : "[file:hashes.SHA256 = '34478d6692f8c28332751b31fd695b799d4ab36a8c12f7b728e2cb99ae2efcd9']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68ef1-cd70-4af0-81f9-7ed002de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"pattern" : "[file:hashes.SHA256 = 'ef40f7ddff404d1193e025081780e32f88883fa4dd496f4189084d772a435cb2']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68ef1-a150-4d30-a712-7ed002de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"pattern" : "[domain-name:value = 'old.jrchina.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"hostname\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68ef1-0b54-4ac7-a770-7ed002de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"pattern" : "[domain-name:value = 'foodforu.heliohost.org']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"hostname\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68ef1-053c-4ed0-962d-7ed002de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"pattern" : "[domain-name:value = 'www.ethanpublishing.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"hostname\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68ef1-3c14-42eb-bad5-7ed002de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"pattern" : "[domain-name:value = 'discgolfglow.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68f38-6028-4934-8183-4cf702de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"description" : "- Xchecked via VT: ef40f7ddff404d1193e025081780e32f88883fa4dd496f4189084d772a435cb2" ,
"pattern" : "[file:hashes.SHA1 = '67cd2e35fd6e06afe80724f53effabbfdf80349b']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68f38-2850-481e-8d9c-43bf02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"description" : "- Xchecked via VT: ef40f7ddff404d1193e025081780e32f88883fa4dd496f4189084d772a435cb2" ,
"pattern" : "[file:hashes.MD5 = '9f022df0bcfded9377baf4da1fbe7b8c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--59d68f38-0658-420d-954b-4adf02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"first_observed" : "2017-10-05T19:59:52Z" ,
"last_observed" : "2017-10-05T19:59:52Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--59d68f38-0658-420d-954b-4adf02de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--59d68f38-0658-420d-954b-4adf02de0b81" ,
"value" : "https://www.virustotal.com/file/ef40f7ddff404d1193e025081780e32f88883fa4dd496f4189084d772a435cb2/analysis/1507220836/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68f38-2664-4f17-a556-455502de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"description" : "- Xchecked via VT: 34478d6692f8c28332751b31fd695b799d4ab36a8c12f7b728e2cb99ae2efcd9" ,
"pattern" : "[file:hashes.SHA1 = 'f374436ec085e8bb254c3bf42d0dc84536cc4a90']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68f38-2e9c-4f28-9978-4ee302de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"description" : "- Xchecked via VT: 34478d6692f8c28332751b31fd695b799d4ab36a8c12f7b728e2cb99ae2efcd9" ,
"pattern" : "[file:hashes.MD5 = '36ab73294dbbcdfe2554c5e29544de24']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--59d68f38-ffc0-4f55-a249-475b02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"first_observed" : "2017-10-05T19:59:52Z" ,
"last_observed" : "2017-10-05T19:59:52Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--59d68f38-ffc0-4f55-a249-475b02de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--59d68f38-ffc0-4f55-a249-475b02de0b81" ,
"value" : "https://www.virustotal.com/file/34478d6692f8c28332751b31fd695b799d4ab36a8c12f7b728e2cb99ae2efcd9/analysis/1507217555/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68f38-00f0-49aa-8d6f-4f0102de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"description" : "- Xchecked via VT: 0f82ea2f92c7e906ee9ffbbd8212be6a8545b9bb0200eda09cce0ba9d7cb1313" ,
"pattern" : "[file:hashes.SHA1 = '419a86472fa374a333fd616152a4e1c2e94e8c8d']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68f38-0f68-4dcb-a9f9-478d02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"description" : "- Xchecked via VT: 0f82ea2f92c7e906ee9ffbbd8212be6a8545b9bb0200eda09cce0ba9d7cb1313" ,
"pattern" : "[file:hashes.MD5 = 'fed4b7096553965a07e0f340494889fe']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--59d68f38-1868-461e-bcf3-4e7502de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"first_observed" : "2017-10-05T19:59:52Z" ,
"last_observed" : "2017-10-05T19:59:52Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--59d68f38-1868-461e-bcf3-4e7502de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--59d68f38-1868-461e-bcf3-4e7502de0b81" ,
"value" : "https://www.virustotal.com/file/0f82ea2f92c7e906ee9ffbbd8212be6a8545b9bb0200eda09cce0ba9d7cb1313/analysis/1507217556/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68f38-4238-455f-9053-4ffb02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"description" : "- Xchecked via VT: 201b876bcb97f6c8972cc677bdf1e3e2b2f069ae2ec4653db8af4797884efa30" ,
"pattern" : "[file:hashes.SHA1 = 'ad6fb28bd1eb1b992982648f0e78874e14e7b4ba']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68f38-b6c8-4ecd-85ab-4d5e02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"description" : "- Xchecked via VT: 201b876bcb97f6c8972cc677bdf1e3e2b2f069ae2ec4653db8af4797884efa30" ,
"pattern" : "[file:hashes.MD5 = '53fb994908b72067bc3d2f6f93c0de7d']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--59d68f38-a048-4780-96ff-4d9302de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"first_observed" : "2017-10-05T19:59:52Z" ,
"last_observed" : "2017-10-05T19:59:52Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--59d68f38-a048-4780-96ff-4d9302de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--59d68f38-a048-4780-96ff-4d9302de0b81" ,
"value" : "https://www.virustotal.com/file/201b876bcb97f6c8972cc677bdf1e3e2b2f069ae2ec4653db8af4797884efa30/analysis/1506334002/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68f38-83c8-41c6-8060-4ba402de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"description" : "- Xchecked via VT: a50543919c52ccaea40155ce35aa791bc86bd634240fb51922827223aca5c88a" ,
"pattern" : "[file:hashes.SHA1 = 'abe2753ea8c2c54163703c4a3ca86ae25a0ce780']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68f38-9ec0-4be5-995a-4d2d02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"description" : "- Xchecked via VT: a50543919c52ccaea40155ce35aa791bc86bd634240fb51922827223aca5c88a" ,
"pattern" : "[file:hashes.MD5 = '321461c22c742328af1feb27a7c1c8e0']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--59d68f38-9c6c-46b1-80d4-45ff02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"first_observed" : "2017-10-05T19:59:52Z" ,
"last_observed" : "2017-10-05T19:59:52Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--59d68f38-9c6c-46b1-80d4-45ff02de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--59d68f38-9c6c-46b1-80d4-45ff02de0b81" ,
"value" : "https://www.virustotal.com/file/a50543919c52ccaea40155ce35aa791bc86bd634240fb51922827223aca5c88a/analysis/1507233005/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68f38-a88c-4685-9964-43cd02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"description" : "http://www.ethanpublishing.com/ethanpublishing/phpcms/templates/default/member/pub/jquery_min_2.2.6.js - Xchecked via VT: 99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5" ,
"pattern" : "[file:hashes.SHA1 = 'f7fcadc8c71752ce5d47af1e8069069cc70e6e27']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68f38-c834-4724-8322-4b4b02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"description" : "http://www.ethanpublishing.com/ethanpublishing/phpcms/templates/default/member/pub/jquery_min_2.2.6.js - Xchecked via VT: 99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5" ,
"pattern" : "[file:hashes.MD5 = '6c668fd6a98f0659abc54d88c1db209e']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--59d68f38-a574-409c-979d-4d0402de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"first_observed" : "2017-10-05T19:59:52Z" ,
"last_observed" : "2017-10-05T19:59:52Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--59d68f38-a574-409c-979d-4d0402de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--59d68f38-a574-409c-979d-4d0402de0b81" ,
"value" : "https://www.virustotal.com/file/99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5/analysis/1507217555/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68f38-ec2c-4ac1-bacb-489e02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"description" : "- Xchecked via VT: 35273d6c25665a19ac14d469e1436223202be655ee19b5b247cb1afef626c9f2" ,
"pattern" : "[file:hashes.SHA1 = '011604ce0e46229ece8d9266d69d0e68d5931e72']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68f38-a5e0-43e2-a403-4b1a02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"description" : "- Xchecked via VT: 35273d6c25665a19ac14d469e1436223202be655ee19b5b247cb1afef626c9f2" ,
"pattern" : "[file:hashes.MD5 = '237ff78e9d8c9407f89563cb696c2539']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--59d68f38-d1a4-4ab2-a2cb-473c02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"first_observed" : "2017-10-05T19:59:52Z" ,
"last_observed" : "2017-10-05T19:59:52Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--59d68f38-d1a4-4ab2-a2cb-473c02de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--59d68f38-d1a4-4ab2-a2cb-473c02de0b81" ,
"value" : "https://www.virustotal.com/file/35273d6c25665a19ac14d469e1436223202be655ee19b5b247cb1afef626c9f2/analysis/1496397207/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68f38-9710-4f62-95af-44b002de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"description" : "PoohMilk loader - Xchecked via VT: 40572e1fc37f4376fdb2a33a6c376631ff7bc00b1e64538a0385bc1e09a85574" ,
"pattern" : "[file:hashes.SHA1 = 'aa84276ca9a6ad2f644f927cc14c9bff09595d92']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68f38-c400-4825-bc49-456702de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"description" : "PoohMilk loader - Xchecked via VT: 40572e1fc37f4376fdb2a33a6c376631ff7bc00b1e64538a0385bc1e09a85574" ,
"pattern" : "[file:hashes.MD5 = 'f5cae9fcc8bad42b3dddb71ce68dbd92']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--59d68f38-0d10-4f4f-859c-470a02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"first_observed" : "2017-10-05T19:59:52Z" ,
"last_observed" : "2017-10-05T19:59:52Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--59d68f38-0d10-4f4f-859c-470a02de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--59d68f38-0d10-4f4f-859c-470a02de0b81" ,
"value" : "https://www.virustotal.com/file/40572e1fc37f4376fdb2a33a6c376631ff7bc00b1e64538a0385bc1e09a85574/analysis/1503367656/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68f38-5044-4612-a378-484802de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"description" : "- Xchecked via VT: 7f35521cdbaa4e86143656ff9c52cef8d1e5e5f8245860c205364138f82c54df" ,
"pattern" : "[file:hashes.SHA1 = '0f97d50ca513c6899204b59d594a0537a14aa81f']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68f38-4eb8-4a29-8339-40b802de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"description" : "- Xchecked via VT: 7f35521cdbaa4e86143656ff9c52cef8d1e5e5f8245860c205364138f82c54df" ,
"pattern" : "[file:hashes.MD5 = 'f5463cd95632706cd7823bfea8fc118c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--59d68f38-630c-481b-b4fb-4cdc02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"first_observed" : "2017-10-05T19:59:52Z" ,
"last_observed" : "2017-10-05T19:59:52Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--59d68f38-630c-481b-b4fb-4cdc02de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--59d68f38-630c-481b-b4fb-4cdc02de0b81" ,
"value" : "https://www.virustotal.com/file/7f35521cdbaa4e86143656ff9c52cef8d1e5e5f8245860c205364138f82c54df/analysis/1502302846/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68f38-c38c-4a45-98f7-462b02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"description" : "Fake image extracts to Freenki downloader - Xchecked via VT: 64ef80e7639c8c5dddf239883617e6740c6b3589f995d11314d36ab64fcfc54c" ,
"pattern" : "[file:hashes.SHA1 = '5bb865a0518862c9b47e678446e9968b8e2d0bed']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68f38-ed5c-4691-a55d-489802de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"description" : "Fake image extracts to Freenki downloader - Xchecked via VT: 64ef80e7639c8c5dddf239883617e6740c6b3589f995d11314d36ab64fcfc54c" ,
"pattern" : "[file:hashes.MD5 = '7c2ebfc7960aac6f8d58b37e3f092a9c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--59d68f38-bcf0-4ab9-8041-447502de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"first_observed" : "2017-10-05T19:59:52Z" ,
"last_observed" : "2017-10-05T19:59:52Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--59d68f38-bcf0-4ab9-8041-447502de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--59d68f38-bcf0-4ab9-8041-447502de0b81" ,
"value" : "https://www.virustotal.com/file/64ef80e7639c8c5dddf239883617e6740c6b3589f995d11314d36ab64fcfc54c/analysis/1502714265/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68f38-f18c-4d90-8c81-462102de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"description" : "JavaScript to extract and run the payload - Xchecked via VT: 1893af524edea4541c317df288adbf17ae4fcc3a30d403331eae541281c71a3c" ,
"pattern" : "[file:hashes.SHA1 = '73f84a1bfb63c06c43d570dd6fd0f08b14c2b7c6']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59d68f38-5da0-4303-ae0c-408a02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"description" : "JavaScript to extract and run the payload - Xchecked via VT: 1893af524edea4541c317df288adbf17ae4fcc3a30d403331eae541281c71a3c" ,
"pattern" : "[file:hashes.MD5 = 'ab4596f26b25730fbc9dc41e629980f1']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-10-05T19:59:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--59d68f38-f7b0-4bcf-bf68-414702de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-10-05T19:59:52.000Z" ,
"modified" : "2017-10-05T19:59:52.000Z" ,
"first_observed" : "2017-10-05T19:59:52Z" ,
"last_observed" : "2017-10-05T19:59:52Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--59d68f38-f7b0-4bcf-bf68-414702de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--59d68f38-f7b0-4bcf-bf68-414702de0b81" ,
"value" : "https://www.virustotal.com/file/1893af524edea4541c317df288adbf17ae4fcc3a30d403331eae541281c71a3c/analysis/1502714265/"
} ,
{
"type" : "marking-definition" ,
"spec_version" : "2.1" ,
"id" : "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ,
"created" : "2017-01-20T00:00:00.000Z" ,
"definition_type" : "tlp" ,
"name" : "TLP:WHITE" ,
"definition" : {
"tlp" : "white"
}
}
2023-04-21 13:25:09 +00:00
]
}
