2023-04-21 13:25:09 +00:00
|
|
|
{
|
2023-06-14 17:31:25 +00:00
|
|
|
"type": "bundle",
|
|
|
|
|
"id": "bundle--59db9d5b-e49c-455a-8a95-409c950d210f",
|
|
|
|
|
"objects": [
|
|
|
|
|
{
|
|
|
|
|
"type": "identity",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:47.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:47.000Z",
|
|
|
|
|
"name": "CIRCL",
|
|
|
|
|
"identity_class": "organization"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "report",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "report--59db9d5b-e49c-455a-8a95-409c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:47.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:47.000Z",
|
|
|
|
|
"name": "M2M - Locky 2017-10-09 : Affid=3, offline, \".ykcol\" : \"Invoice IP1234567\" - \"Invoice-IP1234567.7z\"",
|
|
|
|
|
"published": "2017-10-12T18:19:00Z",
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"indicator--59db9d5c-2b14-40eb-98f7-48c2950d210f",
|
|
|
|
|
"indicator--59db9d5c-520c-4c2a-8c08-4a3f950d210f",
|
|
|
|
|
"observed-data--59db9d5d-48e0-4ac8-8e90-47fd950d210f",
|
|
|
|
|
"network-traffic--59db9d5d-48e0-4ac8-8e90-47fd950d210f",
|
|
|
|
|
"ipv4-addr--59db9d5d-48e0-4ac8-8e90-47fd950d210f",
|
|
|
|
|
"indicator--59db9d5d-ba60-4133-9603-4370950d210f",
|
|
|
|
|
"indicator--59db9d7b-9c24-4bda-8762-4a47950d210f",
|
|
|
|
|
"observed-data--59db9d7d-2a48-4c7b-aa72-4d9d950d210f",
|
|
|
|
|
"network-traffic--59db9d7d-2a48-4c7b-aa72-4d9d950d210f",
|
|
|
|
|
"ipv4-addr--59db9d7d-2a48-4c7b-aa72-4d9d950d210f",
|
|
|
|
|
"indicator--59db9d7d-7820-4796-8224-4c66950d210f",
|
|
|
|
|
"indicator--59db9d7d-7a84-4eb3-bf75-433c950d210f",
|
|
|
|
|
"observed-data--59db9d7d-725c-4cdf-8788-4eaf950d210f",
|
|
|
|
|
"network-traffic--59db9d7d-725c-4cdf-8788-4eaf950d210f",
|
|
|
|
|
"ipv4-addr--59db9d7d-725c-4cdf-8788-4eaf950d210f",
|
|
|
|
|
"indicator--59db9d7e-5584-42e8-a96f-4871950d210f",
|
|
|
|
|
"indicator--59db9d7e-7f14-4d00-8cec-4fc9950d210f",
|
|
|
|
|
"observed-data--59db9d7f-ae0c-49dd-ad8b-49b3950d210f",
|
|
|
|
|
"network-traffic--59db9d7f-ae0c-49dd-ad8b-49b3950d210f",
|
|
|
|
|
"ipv4-addr--59db9d7f-ae0c-49dd-ad8b-49b3950d210f",
|
|
|
|
|
"indicator--59db9d7f-f344-47e2-b9e0-4037950d210f",
|
|
|
|
|
"indicator--59db9d7f-7b48-455d-849d-4d3f950d210f",
|
|
|
|
|
"observed-data--59db9d7f-4518-44ac-9fe8-4d30950d210f",
|
|
|
|
|
"network-traffic--59db9d7f-4518-44ac-9fe8-4d30950d210f",
|
|
|
|
|
"ipv4-addr--59db9d7f-4518-44ac-9fe8-4d30950d210f",
|
|
|
|
|
"indicator--59db9d80-b1ac-4230-a87d-4eb3950d210f",
|
|
|
|
|
"indicator--59db9d80-49e8-4c87-924c-47e7950d210f",
|
|
|
|
|
"observed-data--59db9d80-57e0-4069-b822-468c950d210f",
|
|
|
|
|
"network-traffic--59db9d80-57e0-4069-b822-468c950d210f",
|
|
|
|
|
"ipv4-addr--59db9d80-57e0-4069-b822-468c950d210f",
|
|
|
|
|
"indicator--59db9d80-ef58-47c1-b2b5-4003950d210f",
|
|
|
|
|
"indicator--59db9d81-2bf0-422e-a21e-44a3950d210f",
|
|
|
|
|
"observed-data--59db9d81-5388-4ff0-bfd2-4660950d210f",
|
|
|
|
|
"network-traffic--59db9d81-5388-4ff0-bfd2-4660950d210f",
|
|
|
|
|
"ipv4-addr--59db9d81-5388-4ff0-bfd2-4660950d210f",
|
|
|
|
|
"indicator--59db9d81-fbac-4650-929b-46d4950d210f",
|
|
|
|
|
"indicator--59db9d82-ad64-41b4-bd80-4d40950d210f",
|
|
|
|
|
"observed-data--59db9d82-3874-4e0a-b6df-46f9950d210f",
|
|
|
|
|
"network-traffic--59db9d82-3874-4e0a-b6df-46f9950d210f",
|
|
|
|
|
"ipv4-addr--59db9d82-3874-4e0a-b6df-46f9950d210f",
|
|
|
|
|
"indicator--59db9d82-3928-4d1e-8190-4f74950d210f",
|
|
|
|
|
"indicator--59db9d82-d3d0-4b4f-8deb-4a09950d210f",
|
|
|
|
|
"observed-data--59db9d83-df20-4a3f-b834-4009950d210f",
|
|
|
|
|
"network-traffic--59db9d83-df20-4a3f-b834-4009950d210f",
|
|
|
|
|
"ipv4-addr--59db9d83-df20-4a3f-b834-4009950d210f",
|
|
|
|
|
"indicator--59db9d83-9660-44c4-a5eb-475f950d210f",
|
|
|
|
|
"indicator--59db9d83-af84-4437-a220-4089950d210f",
|
|
|
|
|
"observed-data--59db9d84-987c-4a74-949d-47a1950d210f",
|
|
|
|
|
"network-traffic--59db9d84-987c-4a74-949d-47a1950d210f",
|
|
|
|
|
"ipv4-addr--59db9d84-987c-4a74-949d-47a1950d210f",
|
|
|
|
|
"indicator--59db9d84-a5d0-4145-b1a1-47a8950d210f",
|
|
|
|
|
"indicator--59db9d84-0cb0-4886-bc4d-4232950d210f",
|
|
|
|
|
"observed-data--59db9d84-5cd4-4831-ae61-4f7a950d210f",
|
|
|
|
|
"network-traffic--59db9d84-5cd4-4831-ae61-4f7a950d210f",
|
|
|
|
|
"ipv4-addr--59db9d84-5cd4-4831-ae61-4f7a950d210f",
|
|
|
|
|
"indicator--59db9d85-9c8c-4ca1-a5dd-43c7950d210f",
|
|
|
|
|
"indicator--59db9d85-2c80-48f7-8d71-4e64950d210f",
|
|
|
|
|
"observed-data--59db9d85-cc1c-4821-9041-48ce950d210f",
|
|
|
|
|
"network-traffic--59db9d85-cc1c-4821-9041-48ce950d210f",
|
|
|
|
|
"ipv4-addr--59db9d85-cc1c-4821-9041-48ce950d210f",
|
|
|
|
|
"indicator--59db9d85-3da0-44d3-b1de-442c950d210f",
|
|
|
|
|
"indicator--59db9d85-0980-4dd6-9a4c-47e3950d210f",
|
|
|
|
|
"observed-data--59db9d86-ccb0-45b7-8767-40e1950d210f",
|
|
|
|
|
"network-traffic--59db9d86-ccb0-45b7-8767-40e1950d210f",
|
|
|
|
|
"ipv4-addr--59db9d86-ccb0-45b7-8767-40e1950d210f",
|
|
|
|
|
"indicator--59db9d86-bebc-46fa-bdc3-4f45950d210f",
|
|
|
|
|
"indicator--59db9d86-7fc8-4869-805e-4d91950d210f",
|
|
|
|
|
"observed-data--59db9d87-838c-4401-b045-425f950d210f",
|
|
|
|
|
"network-traffic--59db9d87-838c-4401-b045-425f950d210f",
|
|
|
|
|
"ipv4-addr--59db9d87-838c-4401-b045-425f950d210f",
|
|
|
|
|
"indicator--59db9d87-51f4-48ca-bd67-48ee950d210f",
|
|
|
|
|
"indicator--59db9d87-c4c8-41a5-8098-4828950d210f",
|
|
|
|
|
"observed-data--59db9d88-dc04-4ce8-8595-4ba6950d210f",
|
|
|
|
|
"network-traffic--59db9d88-dc04-4ce8-8595-4ba6950d210f",
|
|
|
|
|
"ipv4-addr--59db9d88-dc04-4ce8-8595-4ba6950d210f",
|
|
|
|
|
"indicator--59db9d88-2c68-447b-85d2-4b7a950d210f",
|
|
|
|
|
"indicator--59db9d88-af3c-414f-b15c-45e4950d210f",
|
|
|
|
|
"observed-data--59db9d88-e754-4d1d-9b2f-481c950d210f",
|
|
|
|
|
"network-traffic--59db9d88-e754-4d1d-9b2f-481c950d210f",
|
|
|
|
|
"ipv4-addr--59db9d88-e754-4d1d-9b2f-481c950d210f",
|
|
|
|
|
"indicator--59db9d89-8d5c-44ed-9f02-4e1d950d210f",
|
|
|
|
|
"indicator--59db9d89-6ae0-480f-9ba2-4be4950d210f",
|
|
|
|
|
"observed-data--59db9d89-0e0c-4599-8045-402e950d210f",
|
|
|
|
|
"network-traffic--59db9d89-0e0c-4599-8045-402e950d210f",
|
|
|
|
|
"ipv4-addr--59db9d89-0e0c-4599-8045-402e950d210f",
|
|
|
|
|
"indicator--59db9d8a-6720-45ba-8c82-4465950d210f",
|
|
|
|
|
"indicator--59db9d8a-6c58-47b5-86f4-4cb5950d210f",
|
|
|
|
|
"observed-data--59db9d8a-c4fc-4ce7-aadc-42ad950d210f",
|
|
|
|
|
"network-traffic--59db9d8a-c4fc-4ce7-aadc-42ad950d210f",
|
|
|
|
|
"ipv4-addr--59db9d8a-c4fc-4ce7-aadc-42ad950d210f",
|
|
|
|
|
"indicator--59db9d8a-a474-4386-9530-4a2a950d210f",
|
|
|
|
|
"indicator--59db9d8b-a250-408e-bc24-4c9c950d210f",
|
|
|
|
|
"observed-data--59db9d8b-eee8-43db-99cb-4d43950d210f",
|
|
|
|
|
"network-traffic--59db9d8b-eee8-43db-99cb-4d43950d210f",
|
|
|
|
|
"ipv4-addr--59db9d8b-eee8-43db-99cb-4d43950d210f",
|
|
|
|
|
"indicator--59db9d8b-0ab4-4315-b0b8-475e950d210f",
|
|
|
|
|
"indicator--59db9d8b-fae8-4dee-b698-4831950d210f",
|
|
|
|
|
"observed-data--59db9d8c-4968-46ad-b5a5-42eb950d210f",
|
|
|
|
|
"network-traffic--59db9d8c-4968-46ad-b5a5-42eb950d210f",
|
|
|
|
|
"ipv4-addr--59db9d8c-4968-46ad-b5a5-42eb950d210f",
|
|
|
|
|
"indicator--59db9d8c-b070-4a61-9216-471a950d210f",
|
|
|
|
|
"indicator--59db9d8c-2ae8-4c15-8796-436c950d210f",
|
|
|
|
|
"observed-data--59db9d8d-d3a8-4313-a775-4abf950d210f",
|
|
|
|
|
"network-traffic--59db9d8d-d3a8-4313-a775-4abf950d210f",
|
|
|
|
|
"ipv4-addr--59db9d8d-d3a8-4313-a775-4abf950d210f",
|
|
|
|
|
"indicator--59db9d8d-efd0-47d3-886f-4f62950d210f",
|
|
|
|
|
"indicator--59db9d8d-7884-410e-9e8b-4706950d210f",
|
|
|
|
|
"observed-data--59db9d8d-a970-47e4-bf54-49ec950d210f",
|
|
|
|
|
"network-traffic--59db9d8d-a970-47e4-bf54-49ec950d210f",
|
|
|
|
|
"ipv4-addr--59db9d8d-a970-47e4-bf54-49ec950d210f",
|
|
|
|
|
"indicator--59db9d8e-13f8-4d72-997a-4ca7950d210f",
|
|
|
|
|
"indicator--59dfb16f-79d4-4108-a8de-48a402de0b81",
|
|
|
|
|
"indicator--59dfb16f-d15c-4a16-8a9d-418202de0b81",
|
|
|
|
|
"observed-data--59dfb16f-043c-4b3d-8724-428c02de0b81",
|
|
|
|
|
"url--59dfb16f-043c-4b3d-8724-428c02de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"Threat-Report",
|
|
|
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
|
|
|
"ecsirt:malicious-code=\"ransomware\"",
|
|
|
|
|
"misp-galaxy:ransomware=\"Locky\""
|
|
|
|
|
],
|
|
|
|
|
"object_marking_refs": [
|
|
|
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d5c-2b14-40eb-98f7-48c2950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '3aeeb55f8239b731603f5c907113a34f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d5c-520c-4c2a-8c08-4a3f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'mail.estudiorrbp.com.uy']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db9d5d-48e0-4ac8-8e90-47fd950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:16:14Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:16:14Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db9d5d-48e0-4ac8-8e90-47fd950d210f",
|
|
|
|
|
"ipv4-addr--59db9d5d-48e0-4ac8-8e90-47fd950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db9d5d-48e0-4ac8-8e90-47fd950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db9d5d-48e0-4ac8-8e90-47fd950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db9d5d-48e0-4ac8-8e90-47fd950d210f",
|
|
|
|
|
"value": "50.63.177.206"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d5d-ba60-4133-9603-4370950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'scottfranch.org']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d7b-9c24-4bda-8762-4a47950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'essenza.co.id']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db9d7d-2a48-4c7b-aa72-4d9d950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:16:14Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:16:14Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db9d7d-2a48-4c7b-aa72-4d9d950d210f",
|
|
|
|
|
"ipv4-addr--59db9d7d-2a48-4c7b-aa72-4d9d950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db9d7d-2a48-4c7b-aa72-4d9d950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db9d7d-2a48-4c7b-aa72-4d9d950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db9d7d-2a48-4c7b-aa72-4d9d950d210f",
|
|
|
|
|
"value": "202.169.44.141"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d7d-7820-4796-8224-4c66950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://121-psychic-reading.co.uk/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d7d-7a84-4eb3-bf75-433c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = '121-psychic-reading.co.uk']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db9d7d-725c-4cdf-8788-4eaf950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:16:14Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:16:14Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db9d7d-725c-4cdf-8788-4eaf950d210f",
|
|
|
|
|
"ipv4-addr--59db9d7d-725c-4cdf-8788-4eaf950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db9d7d-725c-4cdf-8788-4eaf950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db9d7d-725c-4cdf-8788-4eaf950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db9d7d-725c-4cdf-8788-4eaf950d210f",
|
|
|
|
|
"value": "217.168.155.63"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d7e-5584-42e8-a96f-4871950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://amatuermatch.org/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d7e-7f14-4d00-8cec-4fc9950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'amatuermatch.org']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db9d7f-ae0c-49dd-ad8b-49b3950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:16:14Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:16:14Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db9d7f-ae0c-49dd-ad8b-49b3950d210f",
|
|
|
|
|
"ipv4-addr--59db9d7f-ae0c-49dd-ad8b-49b3950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db9d7f-ae0c-49dd-ad8b-49b3950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db9d7f-ae0c-49dd-ad8b-49b3950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db9d7f-ae0c-49dd-ad8b-49b3950d210f",
|
|
|
|
|
"value": "64.50.172.171"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d7f-f344-47e2-b9e0-4037950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://anderlaw.com/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d7f-7b48-455d-849d-4d3f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'anderlaw.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db9d7f-4518-44ac-9fe8-4d30950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:16:14Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:16:14Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db9d7f-4518-44ac-9fe8-4d30950d210f",
|
|
|
|
|
"ipv4-addr--59db9d7f-4518-44ac-9fe8-4d30950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db9d7f-4518-44ac-9fe8-4d30950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db9d7f-4518-44ac-9fe8-4d30950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db9d7f-4518-44ac-9fe8-4d30950d210f",
|
|
|
|
|
"value": "98.124.251.69"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d80-b1ac-4230-a87d-4eb3950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://asesoreszapico.com/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d80-49e8-4c87-924c-47e7950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'asesoreszapico.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db9d80-57e0-4069-b822-468c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:16:14Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:16:14Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db9d80-57e0-4069-b822-468c950d210f",
|
|
|
|
|
"ipv4-addr--59db9d80-57e0-4069-b822-468c950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db9d80-57e0-4069-b822-468c950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db9d80-57e0-4069-b822-468c950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db9d80-57e0-4069-b822-468c950d210f",
|
|
|
|
|
"value": "212.89.16.142"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d80-ef58-47c1-b2b5-4003950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://cagliaricity.it/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d81-2bf0-422e-a21e-44a3950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'cagliaricity.it']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db9d81-5388-4ff0-bfd2-4660950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:16:14Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:16:14Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db9d81-5388-4ff0-bfd2-4660950d210f",
|
|
|
|
|
"ipv4-addr--59db9d81-5388-4ff0-bfd2-4660950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db9d81-5388-4ff0-bfd2-4660950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db9d81-5388-4ff0-bfd2-4660950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db9d81-5388-4ff0-bfd2-4660950d210f",
|
|
|
|
|
"value": "95.110.196.214"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d81-fbac-4650-929b-46d4950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://cfai66.fr/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d82-ad64-41b4-bd80-4d40950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'cfai66.fr']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db9d82-3874-4e0a-b6df-46f9950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:16:14Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:16:14Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db9d82-3874-4e0a-b6df-46f9950d210f",
|
|
|
|
|
"ipv4-addr--59db9d82-3874-4e0a-b6df-46f9950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db9d82-3874-4e0a-b6df-46f9950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db9d82-3874-4e0a-b6df-46f9950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db9d82-3874-4e0a-b6df-46f9950d210f",
|
|
|
|
|
"value": "87.252.5.144"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d82-3928-4d1e-8190-4f74950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://depomedikal.com/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d82-d3d0-4b4f-8deb-4a09950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'depomedikal.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db9d83-df20-4a3f-b834-4009950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:16:14Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:16:14Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db9d83-df20-4a3f-b834-4009950d210f",
|
|
|
|
|
"ipv4-addr--59db9d83-df20-4a3f-b834-4009950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db9d83-df20-4a3f-b834-4009950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db9d83-df20-4a3f-b834-4009950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db9d83-df20-4a3f-b834-4009950d210f",
|
|
|
|
|
"value": "82.151.131.234"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d83-9660-44c4-a5eb-475f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://designordie.ca/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d83-af84-4437-a220-4089950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'designordie.ca']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db9d84-987c-4a74-949d-47a1950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:16:14Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:16:14Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db9d84-987c-4a74-949d-47a1950d210f",
|
|
|
|
|
"ipv4-addr--59db9d84-987c-4a74-949d-47a1950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db9d84-987c-4a74-949d-47a1950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db9d84-987c-4a74-949d-47a1950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db9d84-987c-4a74-949d-47a1950d210f",
|
|
|
|
|
"value": "204.244.185.219"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d84-a5d0-4145-b1a1-47a8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://dewekker.nl/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d84-0cb0-4886-bc4d-4232950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'dewekker.nl']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db9d84-5cd4-4831-ae61-4f7a950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:16:14Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:16:14Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db9d84-5cd4-4831-ae61-4f7a950d210f",
|
|
|
|
|
"ipv4-addr--59db9d84-5cd4-4831-ae61-4f7a950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db9d84-5cd4-4831-ae61-4f7a950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db9d84-5cd4-4831-ae61-4f7a950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db9d84-5cd4-4831-ae61-4f7a950d210f",
|
|
|
|
|
"value": "94.126.70.12"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d85-9c8c-4ca1-a5dd-43c7950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://domke-engineering.de/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d85-2c80-48f7-8d71-4e64950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'domke-engineering.de']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db9d85-cc1c-4821-9041-48ce950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:16:14Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:16:14Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db9d85-cc1c-4821-9041-48ce950d210f",
|
|
|
|
|
"ipv4-addr--59db9d85-cc1c-4821-9041-48ce950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db9d85-cc1c-4821-9041-48ce950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db9d85-cc1c-4821-9041-48ce950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db9d85-cc1c-4821-9041-48ce950d210f",
|
|
|
|
|
"value": "213.185.128.116"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d85-3da0-44d3-b1de-442c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://drspay.com/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d85-0980-4dd6-9a4c-47e3950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'drspay.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db9d86-ccb0-45b7-8767-40e1950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:16:14Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:16:14Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db9d86-ccb0-45b7-8767-40e1950d210f",
|
|
|
|
|
"ipv4-addr--59db9d86-ccb0-45b7-8767-40e1950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db9d86-ccb0-45b7-8767-40e1950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db9d86-ccb0-45b7-8767-40e1950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db9d86-ccb0-45b7-8767-40e1950d210f",
|
|
|
|
|
"value": "68.178.159.168"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d86-bebc-46fa-bdc3-4f45950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://easyhousedev.gr/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d86-7fc8-4869-805e-4d91950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'easyhousedev.gr']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db9d87-838c-4401-b045-425f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:16:14Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:16:14Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db9d87-838c-4401-b045-425f950d210f",
|
|
|
|
|
"ipv4-addr--59db9d87-838c-4401-b045-425f950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db9d87-838c-4401-b045-425f950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db9d87-838c-4401-b045-425f950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db9d87-838c-4401-b045-425f950d210f",
|
|
|
|
|
"value": "149.56.223.252"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d87-51f4-48ca-bd67-48ee950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://ecotek.me/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d87-c4c8-41a5-8098-4828950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'ecotek.me']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db9d88-dc04-4ce8-8595-4ba6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:16:14Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:16:14Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db9d88-dc04-4ce8-8595-4ba6950d210f",
|
|
|
|
|
"ipv4-addr--59db9d88-dc04-4ce8-8595-4ba6950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db9d88-dc04-4ce8-8595-4ba6950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db9d88-dc04-4ce8-8595-4ba6950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db9d88-dc04-4ce8-8595-4ba6950d210f",
|
|
|
|
|
"value": "45.40.135.32"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d88-2c68-447b-85d2-4b7a950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:14.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://edeldestillerie-mair.at/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d88-af3c-414f-b15c-45e4950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'edeldestillerie-mair.at']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:15Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db9d88-e754-4d1d-9b2f-481c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:16:15Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:16:15Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db9d88-e754-4d1d-9b2f-481c950d210f",
|
|
|
|
|
"ipv4-addr--59db9d88-e754-4d1d-9b2f-481c950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db9d88-e754-4d1d-9b2f-481c950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db9d88-e754-4d1d-9b2f-481c950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db9d88-e754-4d1d-9b2f-481c950d210f",
|
|
|
|
|
"value": "193.19.92.233"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d89-8d5c-44ed-9f02-4e1d950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://hard-grooves.com/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:15Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d89-6ae0-480f-9ba2-4be4950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'hard-grooves.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:15Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db9d89-0e0c-4599-8045-402e950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:16:15Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:16:15Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db9d89-0e0c-4599-8045-402e950d210f",
|
|
|
|
|
"ipv4-addr--59db9d89-0e0c-4599-8045-402e950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db9d89-0e0c-4599-8045-402e950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db9d89-0e0c-4599-8045-402e950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db9d89-0e0c-4599-8045-402e950d210f",
|
|
|
|
|
"value": "66.36.173.111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d8a-6720-45ba-8c82-4465950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://hellonwheelsthemovie.com/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:15Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d8a-6c58-47b5-86f4-4cb5950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'hellonwheelsthemovie.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:15Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db9d8a-c4fc-4ce7-aadc-42ad950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:16:15Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:16:15Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db9d8a-c4fc-4ce7-aadc-42ad950d210f",
|
|
|
|
|
"ipv4-addr--59db9d8a-c4fc-4ce7-aadc-42ad950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db9d8a-c4fc-4ce7-aadc-42ad950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db9d8a-c4fc-4ce7-aadc-42ad950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db9d8a-c4fc-4ce7-aadc-42ad950d210f",
|
|
|
|
|
"value": "66.36.165.149"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d8a-a474-4386-9530-4a2a950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://intra.cfecgcaquitaine.com/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:15Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d8b-a250-408e-bc24-4c9c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'intra.cfecgcaquitaine.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:15Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db9d8b-eee8-43db-99cb-4d43950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:16:15Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:16:15Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db9d8b-eee8-43db-99cb-4d43950d210f",
|
|
|
|
|
"ipv4-addr--59db9d8b-eee8-43db-99cb-4d43950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db9d8b-eee8-43db-99cb-4d43950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db9d8b-eee8-43db-99cb-4d43950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db9d8b-eee8-43db-99cb-4d43950d210f",
|
|
|
|
|
"value": "94.247.178.77"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d8b-0ab4-4315-b0b8-475e950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://miyatakewind.com/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:15Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d8b-fae8-4dee-b698-4831950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'miyatakewind.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:15Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db9d8c-4968-46ad-b5a5-42eb950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:16:15Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:16:15Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db9d8c-4968-46ad-b5a5-42eb950d210f",
|
|
|
|
|
"ipv4-addr--59db9d8c-4968-46ad-b5a5-42eb950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db9d8c-4968-46ad-b5a5-42eb950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db9d8c-4968-46ad-b5a5-42eb950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db9d8c-4968-46ad-b5a5-42eb950d210f",
|
|
|
|
|
"value": "216.194.66.48"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d8c-b070-4a61-9216-471a950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://prova.eshopavant.it/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:15Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d8c-2ae8-4c15-8796-436c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'prova.eshopavant.it']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:15Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db9d8d-d3a8-4313-a775-4abf950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:16:15Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:16:15Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db9d8d-d3a8-4313-a775-4abf950d210f",
|
|
|
|
|
"ipv4-addr--59db9d8d-d3a8-4313-a775-4abf950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db9d8d-d3a8-4313-a775-4abf950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db9d8d-d3a8-4313-a775-4abf950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db9d8d-d3a8-4313-a775-4abf950d210f",
|
|
|
|
|
"value": "217.73.227.30"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d8d-efd0-47d3-886f-4f62950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://prueba.depaterna.com/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:15Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d8d-7884-410e-9e8b-4706950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'prueba.depaterna.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:15Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db9d8d-a970-47e4-bf54-49ec950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:16:15Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:16:15Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db9d8d-a970-47e4-bf54-49ec950d210f",
|
|
|
|
|
"ipv4-addr--59db9d8d-a970-47e4-bf54-49ec950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db9d8d-a970-47e4-bf54-49ec950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db9d8d-a970-47e4-bf54-49ec950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db9d8d-a970-47e4-bf54-49ec950d210f",
|
|
|
|
|
"value": "62.113.249.12"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db9d8e-13f8-4d72-997a-4ca7950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://scottfranch.org/p66/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:15Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59dfb16f-79d4-4108-a8de-48a402de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 3aeeb55f8239b731603f5c907113a34f",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '203ee7bc02c3d2b01584efc23b5240fdbc37c56a99b17cef8983ff59f564ab18']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:15Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59dfb16f-d15c-4a16-8a9d-418202de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 3aeeb55f8239b731603f5c907113a34f",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '517c3203aed9a4229d6260a796f03e448250e0a3']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:16:15Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59dfb16f-043c-4b3d-8724-428c02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:16:15.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:16:15Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:16:15Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--59dfb16f-043c-4b3d-8724-428c02de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--59dfb16f-043c-4b3d-8724-428c02de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/203ee7bc02c3d2b01584efc23b5240fdbc37c56a99b17cef8983ff59f564ab18/analysis/1507550567/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "marking-definition",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
|
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
|
|
|
"definition_type": "tlp",
|
|
|
|
|
"name": "TLP:WHITE",
|
|
|
|
|
"definition": {
|
|
|
|
|
"tlp": "white"
|
|
|
|
|
}
|
|
|
|
|
}
|
2023-04-21 13:25:09 +00:00
|
|
|
]
|
|
|
|
|
}
|
