2023-04-21 13:25:09 +00:00
{
2023-06-14 17:31:25 +00:00
"type" : "bundle" ,
"id" : "bundle--5a0a9aa9-23a4-4607-b6df-41a9950d210f" ,
"objects" : [
{
"type" : "identity" ,
"spec_version" : "2.1" ,
"id" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:35.000Z" ,
"modified" : "2017-11-17T12:40:35.000Z" ,
"name" : "CIRCL" ,
"identity_class" : "organization"
} ,
{
"type" : "report" ,
"spec_version" : "2.1" ,
"id" : "report--5a0a9aa9-23a4-4607-b6df-41a9950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:35.000Z" ,
"modified" : "2017-11-17T12:40:35.000Z" ,
"name" : "OSINT - New Malware with Ties to SunOrcal Discovered" ,
"published" : "2018-02-12T17:11:34Z" ,
"object_refs" : [
"observed-data--5a0a9ade-3b60-4fbb-87d2-4628950d210f" ,
"url--5a0a9ade-3b60-4fbb-87d2-4628950d210f" ,
"x-misp-attribute--5a0a9af4-0d1c-4ae0-8903-45c4950d210f" ,
"observed-data--5a0a9d47-1c7c-4353-8523-440b950d210f" ,
"windows-registry-key--5a0a9d47-1c7c-4353-8523-440b950d210f" ,
"observed-data--5a0a9d47-808c-4833-b739-43bf950d210f" ,
"windows-registry-key--5a0a9d47-808c-4833-b739-43bf950d210f" ,
"observed-data--5a0a9d47-91e0-4fea-8a8d-48ce950d210f" ,
"windows-registry-key--5a0a9d47-91e0-4fea-8a8d-48ce950d210f" ,
"observed-data--5a0a9d47-0d2c-4f98-9913-4ea3950d210f" ,
"windows-registry-key--5a0a9d47-0d2c-4f98-9913-4ea3950d210f" ,
"indicator--5a0a9d47-a0a4-4f6b-bd53-42b4950d210f" ,
"indicator--5a0a9d96-48d4-4538-b643-4c26950d210f" ,
"observed-data--5a0a9d96-d87c-4b6f-b3a6-4eea950d210f" ,
"windows-registry-key--5a0a9d96-d87c-4b6f-b3a6-4eea950d210f" ,
"indicator--5a0a9d96-83dc-4a40-90fe-46d9950d210f" ,
"indicator--5a0a9d96-cc18-491c-b16b-4ffe950d210f" ,
"indicator--5a0a9e4c-1c14-49c0-bee2-4f7d950d210f" ,
"indicator--5a0a9e4c-ab08-47f8-991f-471c950d210f" ,
"indicator--5a0a9e4c-8ba4-43d7-a8e3-4b52950d210f" ,
"indicator--5a0a9e4c-bcf8-42ac-86dc-48b0950d210f" ,
"indicator--5a0a9e4c-9440-40fa-ac80-4320950d210f" ,
"indicator--5a0a9eae-a23c-4b65-b46b-4683950d210f" ,
"indicator--5a0a9eae-5e1c-411a-b1ba-49ac950d210f" ,
"indicator--5a0a9eae-ccf0-4390-bcde-43bd950d210f" ,
"indicator--5a0a9eae-3ef4-42d5-baca-44c4950d210f" ,
"indicator--5a0a9eae-8cc8-4bbd-adec-4e38950d210f" ,
"indicator--5a0a9eae-486c-4820-b2b3-4bf0950d210f" ,
"indicator--5a0a9eae-bef4-4696-a1ab-4c83950d210f" ,
"indicator--5a0a9eae-7560-4794-90d1-4f4d950d210f" ,
"indicator--5a0a9eae-d3c4-4809-aea5-435c950d210f" ,
"indicator--5a0a9eae-a5dc-43ab-9158-451c950d210f" ,
"indicator--5a0a9eae-1d70-4f14-b316-4ce4950d210f" ,
"indicator--5a0a9eae-7674-4a3f-a595-4006950d210f" ,
"indicator--5a0a9eae-4a58-4535-9998-49b7950d210f" ,
"indicator--5a0a9eae-6ae4-41a1-8402-4328950d210f" ,
"indicator--5a0a9eae-6edc-4177-afd5-4c93950d210f" ,
"indicator--5a0a9eae-8388-4e7f-ab5b-4e95950d210f" ,
"indicator--5a0a9efc-6604-4cd9-acbb-4632950d210f" ,
"indicator--5a0ed8bb-5df0-47a8-9785-44a702de0b81" ,
"indicator--5a0ed8bb-f580-4b51-a866-482602de0b81" ,
"observed-data--5a0ed8bb-8a94-47be-9f1e-463f02de0b81" ,
"url--5a0ed8bb-8a94-47be-9f1e-463f02de0b81" ,
"indicator--5a0ed8bb-3f4c-411b-9507-4d1602de0b81" ,
"indicator--5a0ed8bb-6f34-4e76-ba5b-45ae02de0b81" ,
"observed-data--5a0ed8bb-5b24-48ce-82c4-4e2b02de0b81" ,
"url--5a0ed8bb-5b24-48ce-82c4-4e2b02de0b81" ,
"indicator--5a0ed8bb-830c-472b-9d19-481002de0b81" ,
"indicator--5a0ed8bb-b94c-4e75-a47d-488002de0b81" ,
"observed-data--5a0ed8bb-8d8c-4b7a-a223-498e02de0b81" ,
"url--5a0ed8bb-8d8c-4b7a-a223-498e02de0b81" ,
"indicator--5a0ed8bb-b9b0-40ac-a84f-4b6002de0b81" ,
"indicator--5a0ed8bb-65e8-471f-9a66-4e3102de0b81" ,
"observed-data--5a0ed8bb-d7c0-4ed1-9bdc-497002de0b81" ,
"url--5a0ed8bb-d7c0-4ed1-9bdc-497002de0b81" ,
"indicator--5a0ed8bb-a260-4d97-b3c8-43eb02de0b81" ,
"indicator--5a0ed8bb-61ec-48e1-8327-492b02de0b81" ,
"observed-data--5a0ed8bb-4f20-46d8-b762-4cf702de0b81" ,
"url--5a0ed8bb-4f20-46d8-b762-4cf702de0b81" ,
"indicator--5a0ed8bb-b6ec-4b31-8078-4c9b02de0b81" ,
"indicator--5a0ed8bb-67e0-45e3-86d3-4a9d02de0b81" ,
"observed-data--5a0ed8bb-cfec-48d4-9919-49ab02de0b81" ,
"url--5a0ed8bb-cfec-48d4-9919-49ab02de0b81" ,
"indicator--5a0ed8bb-cb84-4739-a17e-456b02de0b81" ,
"indicator--5a0ed8bb-8bd8-4a20-a99e-498b02de0b81" ,
"observed-data--5a0ed8bb-c264-45c1-acf8-4ece02de0b81" ,
"url--5a0ed8bb-c264-45c1-acf8-4ece02de0b81" ,
"indicator--5a0ed8bb-bc04-47cf-8f7b-49cb02de0b81" ,
"indicator--5a0ed8bb-9340-4443-b23e-4e1902de0b81" ,
"observed-data--5a0ed8bb-b9c8-43aa-8797-462302de0b81" ,
"url--5a0ed8bb-b9c8-43aa-8797-462302de0b81" ,
"indicator--5a0ed8bb-8a68-4f7a-adcb-46c302de0b81" ,
"indicator--5a0ed8bb-dcf8-4fe9-bdee-484502de0b81" ,
"observed-data--5a0ed8bb-23d8-4bbe-b367-4fae02de0b81" ,
"url--5a0ed8bb-23d8-4bbe-b367-4fae02de0b81" ,
"indicator--5a0ed8bb-d850-43f6-aa30-4f5702de0b81" ,
"indicator--5a0ed8bb-3ae4-4f3e-b592-474002de0b81" ,
"observed-data--5a0ed8bb-c9a4-4669-a3ba-47e002de0b81" ,
"url--5a0ed8bb-c9a4-4669-a3ba-47e002de0b81" ,
"indicator--5a0ed8bb-e764-4ad4-8cdb-438902de0b81" ,
"indicator--5a0ed8bb-02e0-4eb5-9e34-41e602de0b81" ,
"observed-data--5a0ed8bb-586c-4a4d-aa3b-4f7c02de0b81" ,
"url--5a0ed8bb-586c-4a4d-aa3b-4f7c02de0b81" ,
"indicator--5a0ed8bc-ba8c-4160-8374-4dba02de0b81" ,
"indicator--5a0ed8bc-eff4-4d36-947a-424c02de0b81" ,
"observed-data--5a0ed8bc-60d8-4f2e-aa79-4d6f02de0b81" ,
"url--5a0ed8bc-60d8-4f2e-aa79-4d6f02de0b81" ,
"indicator--5a0ed8bc-0124-4bd3-9049-4e6b02de0b81" ,
"indicator--5a0ed8bc-c04c-49c4-9d39-464802de0b81" ,
"observed-data--5a0ed8bc-37cc-47c1-bdcd-454e02de0b81" ,
"url--5a0ed8bc-37cc-47c1-bdcd-454e02de0b81" ,
"indicator--5a0ed8bc-4014-447e-8efc-450702de0b81" ,
"indicator--5a0ed8bc-5768-4c26-85a2-47b902de0b81" ,
"observed-data--5a0ed8bc-a7a0-499f-bd08-48bb02de0b81" ,
"url--5a0ed8bc-a7a0-499f-bd08-48bb02de0b81"
] ,
"labels" : [
"Threat-Report" ,
"misp:tool=\"MISP-STIX-Converter\"" ,
"type:OSINT" ,
"circl:incident-classification=\"malware\"" ,
"osint:source-type=\"blog-post\""
] ,
"object_marking_refs" : [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5a0a9ade-3b60-4fbb-87d2-4628950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:26.000Z" ,
"modified" : "2017-11-17T12:40:26.000Z" ,
"first_observed" : "2017-11-17T12:40:26Z" ,
"last_observed" : "2017-11-17T12:40:26Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5a0a9ade-3b60-4fbb-87d2-4628950d210f"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\"" ,
"osint:source-type=\"blog-post\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5a0a9ade-3b60-4fbb-87d2-4628950d210f" ,
"value" : "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
} ,
{
"type" : "x-misp-attribute" ,
"spec_version" : "2.1" ,
"id" : "x-misp-attribute--5a0a9af4-0d1c-4ae0-8903-45c4950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:26.000Z" ,
"modified" : "2017-11-17T12:40:26.000Z" ,
"labels" : [
"misp:type=\"comment\"" ,
"misp:category=\"External analysis\"" ,
"osint:source-type=\"blog-post\""
] ,
"x_misp_category" : "External analysis" ,
"x_misp_type" : "comment" ,
"x_misp_value" : "Unit 42 has discovered a new malware family we\u00e2\u20ac\u2122ve named \u00e2\u20ac\u0153Reaver\u00e2\u20ac\u009d with ties to attackers who use SunOrcal malware. SunOrcal activity has been documented to at least 2013, and based on metadata surrounding some of the C2s, may have been active as early as 2010. The new family appears to have been in the wild since late 2016 and to date we have only identified 10 unique samples, indicating it may be sparingly used. Reaver is also somewhat unique in the fact that its final payload is in the form of a Control panel item, or CPL file. To date, only 0.006% of all malware seen by Palo Alto Networks employs this technique, indicating that it is in fact fairly rare."
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5a0a9d47-1c7c-4353-8523-440b950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:26.000Z" ,
"modified" : "2017-11-17T12:40:26.000Z" ,
"first_observed" : "2017-11-17T12:40:26Z" ,
"last_observed" : "2017-11-17T12:40:26Z" ,
"number_observed" : 1 ,
"object_refs" : [
"windows-registry-key--5a0a9d47-1c7c-4353-8523-440b950d210f"
] ,
"labels" : [
"misp:type=\"regkey\"" ,
"misp:category=\"Persistence mechanism\""
]
} ,
{
"type" : "windows-registry-key" ,
"spec_version" : "2.1" ,
"id" : "windows-registry-key--5a0a9d47-1c7c-4353-8523-440b950d210f" ,
"key" : "%COMMONPROGRAMFILES%\\services\\"
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5a0a9d47-808c-4833-b739-43bf950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:26.000Z" ,
"modified" : "2017-11-17T12:40:26.000Z" ,
"first_observed" : "2017-11-17T12:40:26Z" ,
"last_observed" : "2017-11-17T12:40:26Z" ,
"number_observed" : 1 ,
"object_refs" : [
"windows-registry-key--5a0a9d47-808c-4833-b739-43bf950d210f"
] ,
"labels" : [
"misp:type=\"regkey\"" ,
"misp:category=\"Persistence mechanism\""
]
} ,
{
"type" : "windows-registry-key" ,
"spec_version" : "2.1" ,
"id" : "windows-registry-key--5a0a9d47-808c-4833-b739-43bf950d210f" ,
"key" : "%APPDATA%\\microsoft\\mmc\\"
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5a0a9d47-91e0-4fea-8a8d-48ce950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:26.000Z" ,
"modified" : "2017-11-17T12:40:26.000Z" ,
"first_observed" : "2017-11-17T12:40:26Z" ,
"last_observed" : "2017-11-17T12:40:26Z" ,
"number_observed" : 1 ,
"object_refs" : [
"windows-registry-key--5a0a9d47-91e0-4fea-8a8d-48ce950d210f"
] ,
"labels" : [
"misp:type=\"regkey\"" ,
"misp:category=\"Persistence mechanism\""
]
} ,
{
"type" : "windows-registry-key" ,
"spec_version" : "2.1" ,
"id" : "windows-registry-key--5a0a9d47-91e0-4fea-8a8d-48ce950d210f" ,
"key" : "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Common Startup"
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5a0a9d47-0d2c-4f98-9913-4ea3950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:26.000Z" ,
"modified" : "2017-11-17T12:40:26.000Z" ,
"first_observed" : "2017-11-17T12:40:26Z" ,
"last_observed" : "2017-11-17T12:40:26Z" ,
"number_observed" : 1 ,
"object_refs" : [
"windows-registry-key--5a0a9d47-0d2c-4f98-9913-4ea3950d210f"
] ,
"labels" : [
"misp:type=\"regkey\"" ,
"misp:category=\"Persistence mechanism\""
]
} ,
{
"type" : "windows-registry-key" ,
"spec_version" : "2.1" ,
"id" : "windows-registry-key--5a0a9d47-0d2c-4f98-9913-4ea3950d210f" ,
"key" : "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Startup"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0a9d47-a0a4-4f6b-bd53-42b4950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:26.000Z" ,
"modified" : "2017-11-17T12:40:26.000Z" ,
"pattern" : "[file:name = '\u00e2\u20ac\u02dc\\\\%TEMP\\\\%\\\\~WUpdate.lnk']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:26Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0a9d96-48d4-4538-b643-4c26950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:26.000Z" ,
"modified" : "2017-11-17T12:40:26.000Z" ,
"pattern" : "[file:name = '\\\\%TEMP\\\\%\\\\~Update.lnk']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:26Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5a0a9d96-d87c-4b6f-b3a6-4eea950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:26.000Z" ,
"modified" : "2017-11-17T12:40:26.000Z" ,
"first_observed" : "2017-11-17T12:40:26Z" ,
"last_observed" : "2017-11-17T12:40:26Z" ,
"number_observed" : 1 ,
"object_refs" : [
"windows-registry-key--5a0a9d96-d87c-4b6f-b3a6-4eea950d210f"
] ,
"labels" : [
"misp:type=\"regkey\"" ,
"misp:category=\"Persistence mechanism\""
]
} ,
{
"type" : "windows-registry-key" ,
"spec_version" : "2.1" ,
"id" : "windows-registry-key--5a0a9d96-d87c-4b6f-b3a6-4eea950d210f" ,
"key" : "%APPDATA%\\microsoft\\credentials\\"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0a9d96-83dc-4a40-90fe-46d9950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:26.000Z" ,
"modified" : "2017-11-17T12:40:26.000Z" ,
"pattern" : "[file:name = '\\\\%TEMP\\\\%\\\\winhelp.dat']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:26Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0a9d96-cc18-491c-b16b-4ffe950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:26.000Z" ,
"modified" : "2017-11-17T12:40:26.000Z" ,
"pattern" : "[file:name = '[path_previously_identified]\\\\winhelp.cpl']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:26Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0a9e4c-1c14-49c0-bee2-4f7d950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:26.000Z" ,
"modified" : "2017-11-17T12:40:26.000Z" ,
"description" : "C2" ,
"pattern" : "[domain-name:value = 'www.fyoutside.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:26Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"hostname\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0a9e4c-ab08-47f8-991f-471c950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:26.000Z" ,
"modified" : "2017-11-17T12:40:26.000Z" ,
"description" : "C2" ,
"pattern" : "[domain-name:value = 'www.tashdqdxp.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:26Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"hostname\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0a9e4c-8ba4-43d7-a8e3-4b52950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:26.000Z" ,
"modified" : "2017-11-17T12:40:26.000Z" ,
"description" : "C2" ,
"pattern" : "[domain-name:value = 'www.weryhstui.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:26Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"hostname\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0a9e4c-bcf8-42ac-86dc-48b0950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:26.000Z" ,
"modified" : "2017-11-17T12:40:26.000Z" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '98.126.156.210']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:26Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0a9e4c-9440-40fa-ac80-4320950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:26.000Z" ,
"modified" : "2017-11-17T12:40:26.000Z" ,
"description" : "C2" ,
"pattern" : "[domain-name:value = 'www.olinaodi.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:26Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"hostname\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0a9eae-a23c-4b65-b46b-4683950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "Reaver.v1" ,
"pattern" : "[file:hashes.SHA256 = 'd560f44188fb56d3abb11d9508e1167329470de19b811163eb1167534722e666']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0a9eae-5e1c-411a-b1ba-49ac950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "Reaver.v2" ,
"pattern" : "[file:hashes.SHA256 = '98eb5465c6330b9b49df2e7c9ad0b1164aa5b35423d9e80495a178eb510cdc1c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0a9eae-ccf0-4390-bcde-43bd950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "Reaver.v2" ,
"pattern" : "[file:hashes.SHA256 = '05ddbd0506ec95fb460b3994e5b21cdb0418ba4aa406374ca1b91249349b7640']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0a9eae-3ef4-42d5-baca-44c4950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "Reaver.v3" ,
"pattern" : "[file:hashes.SHA256 = '18ac3b14300ecfeed4b64a844c16dccb06b0e3513d0954d6c6182f2ea14e4c92']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0a9eae-8cc8-4bbd-adec-4e38950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "Reaver.v3" ,
"pattern" : "[file:hashes.SHA256 = 'c0f8bb77284b96e07cab1c3fab8800b1bbd030720c74628c4ee5666694ef903d']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0a9eae-486c-4820-b2b3-4bf0950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "Reaver.v3" ,
"pattern" : "[file:hashes.SHA256 = '9213f70bce491991c4cbbbd7dc3e67d3a3d535b965d7064973b35c50f265e59b']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0a9eae-bef4-4696-a1ab-4c83950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "Reaver.v3" ,
"pattern" : "[file:hashes.SHA256 = '26c234c73e2c3448589c7d4a0cf17f615ad3666541a4e611e2d8b77637205bcf']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0a9eae-7560-4794-90d1-4f4d950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "Reaver.v3" ,
"pattern" : "[file:hashes.SHA256 = 'ae9f158e4886cfdbfb4f1b3b25707d05f6fd873d0be9d8e7334a2c28741228ee']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0a9eae-d3c4-4809-aea5-435c950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "Reaver.v3" ,
"pattern" : "[file:hashes.SHA256 = '1fcda755e8fa23d27329e4bc0443a82e1c1e9a6c1691639db256a187365e4db1']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0a9eae-a5dc-43ab-9158-451c950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "Reaver.v3" ,
"pattern" : "[file:hashes.SHA256 = 'c906250e0a4c457663e37119ebe1efa1e4b97eef1d975f383ac3243f9f09908c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0a9eae-1d70-4f14-b316-4ce4950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "Reaver.v3" ,
"pattern" : "[file:hashes.SHA256 = '1813f10bcf74beb582c824c64fff63cb150d178bef93af81d875ca84214307a1']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0a9eae-7674-4a3f-a595-4006950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "SunOrcal" ,
"pattern" : "[file:hashes.SHA256 = '799139b5278dc2ac24279cc6c3db44f4ef0ea78ee7b721b0ace38fd8018c51ac']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0a9eae-4a58-4535-9998-49b7950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "SunOrcal" ,
"pattern" : "[file:hashes.SHA256 = '81d887fefdbb0219647991c2b7bddf45c2fede4dc6fc18408f1706e0279615b2']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0a9eae-6ae4-41a1-8402-4328950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "SunOrcal" ,
"pattern" : "[file:hashes.SHA256 = '58312fb742ce881e040e1b5b8555f00a402b8dd4fc886acaae2f862040b3bfc5']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0a9eae-6edc-4177-afd5-4c93950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "SunOrcal" ,
"pattern" : "[file:hashes.SHA256 = '38ea33dab0ba2edd16ecd98cba161c550d1036b253c8666c4110d198948329fb']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0a9eae-8388-4e7f-ab5b-4e95950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "SunOrcal" ,
"pattern" : "[file:hashes.SHA256 = 'cb7c0cf1750baaa11783e93369230ee666b9f3da7298e4d1bb9a07af6a439f2f']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0a9efc-6604-4cd9-acbb-4632950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "C2" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '104.148.70.217']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0ed8bb-5df0-47a8-9785-44a702de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "SunOrcal - Xchecked via VT: cb7c0cf1750baaa11783e93369230ee666b9f3da7298e4d1bb9a07af6a439f2f" ,
"pattern" : "[file:hashes.SHA1 = 'da7a5e54d1d45462bda65807c1ef03ee34b7e777']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0ed8bb-f580-4b51-a866-482602de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "SunOrcal - Xchecked via VT: cb7c0cf1750baaa11783e93369230ee666b9f3da7298e4d1bb9a07af6a439f2f" ,
"pattern" : "[file:hashes.MD5 = '7dcf79a66192e88b92ccc12810e61329']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5a0ed8bb-8a94-47be-9f1e-463f02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"first_observed" : "2017-11-17T12:40:27Z" ,
"last_observed" : "2017-11-17T12:40:27Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5a0ed8bb-8a94-47be-9f1e-463f02de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5a0ed8bb-8a94-47be-9f1e-463f02de0b81" ,
"value" : "https://www.virustotal.com/file/cb7c0cf1750baaa11783e93369230ee666b9f3da7298e4d1bb9a07af6a439f2f/analysis/1510574305/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0ed8bb-3f4c-411b-9507-4d1602de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "SunOrcal - Xchecked via VT: 38ea33dab0ba2edd16ecd98cba161c550d1036b253c8666c4110d198948329fb" ,
"pattern" : "[file:hashes.SHA1 = '704886d56ded5817e39d7442b0203c2f76207f92']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0ed8bb-6f34-4e76-ba5b-45ae02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "SunOrcal - Xchecked via VT: 38ea33dab0ba2edd16ecd98cba161c550d1036b253c8666c4110d198948329fb" ,
"pattern" : "[file:hashes.MD5 = 'af6a25fc28e0560860c01d74854a2cba']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5a0ed8bb-5b24-48ce-82c4-4e2b02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"first_observed" : "2017-11-17T12:40:27Z" ,
"last_observed" : "2017-11-17T12:40:27Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5a0ed8bb-5b24-48ce-82c4-4e2b02de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5a0ed8bb-5b24-48ce-82c4-4e2b02de0b81" ,
"value" : "https://www.virustotal.com/file/38ea33dab0ba2edd16ecd98cba161c550d1036b253c8666c4110d198948329fb/analysis/1510574322/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0ed8bb-830c-472b-9d19-481002de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "SunOrcal - Xchecked via VT: 58312fb742ce881e040e1b5b8555f00a402b8dd4fc886acaae2f862040b3bfc5" ,
"pattern" : "[file:hashes.SHA1 = '9adbe92835ee2cc93e0d99b9d4536eb7727acf47']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0ed8bb-b94c-4e75-a47d-488002de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "SunOrcal - Xchecked via VT: 58312fb742ce881e040e1b5b8555f00a402b8dd4fc886acaae2f862040b3bfc5" ,
"pattern" : "[file:hashes.MD5 = '47cc3592bbf8c3b516ae74c95efb3344']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5a0ed8bb-8d8c-4b7a-a223-498e02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"first_observed" : "2017-11-17T12:40:27Z" ,
"last_observed" : "2017-11-17T12:40:27Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5a0ed8bb-8d8c-4b7a-a223-498e02de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5a0ed8bb-8d8c-4b7a-a223-498e02de0b81" ,
"value" : "https://www.virustotal.com/file/58312fb742ce881e040e1b5b8555f00a402b8dd4fc886acaae2f862040b3bfc5/analysis/1510574347/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0ed8bb-b9b0-40ac-a84f-4b6002de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "SunOrcal - Xchecked via VT: 81d887fefdbb0219647991c2b7bddf45c2fede4dc6fc18408f1706e0279615b2" ,
"pattern" : "[file:hashes.SHA1 = '7fa8bfc051b98698e6b95cbc7163e4aa41880279']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0ed8bb-65e8-471f-9a66-4e3102de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "SunOrcal - Xchecked via VT: 81d887fefdbb0219647991c2b7bddf45c2fede4dc6fc18408f1706e0279615b2" ,
"pattern" : "[file:hashes.MD5 = '5eb3a846092cae378fcd45bdf5453536']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5a0ed8bb-d7c0-4ed1-9bdc-497002de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"first_observed" : "2017-11-17T12:40:27Z" ,
"last_observed" : "2017-11-17T12:40:27Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5a0ed8bb-d7c0-4ed1-9bdc-497002de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5a0ed8bb-d7c0-4ed1-9bdc-497002de0b81" ,
"value" : "https://www.virustotal.com/file/81d887fefdbb0219647991c2b7bddf45c2fede4dc6fc18408f1706e0279615b2/analysis/1510574318/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0ed8bb-a260-4d97-b3c8-43eb02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "SunOrcal - Xchecked via VT: 799139b5278dc2ac24279cc6c3db44f4ef0ea78ee7b721b0ace38fd8018c51ac" ,
"pattern" : "[file:hashes.SHA1 = 'a6e538a01c366580e90e49249251b66dfe39c72f']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0ed8bb-61ec-48e1-8327-492b02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "SunOrcal - Xchecked via VT: 799139b5278dc2ac24279cc6c3db44f4ef0ea78ee7b721b0ace38fd8018c51ac" ,
"pattern" : "[file:hashes.MD5 = '11a5b1901243396984670af7acc6cf72']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5a0ed8bb-4f20-46d8-b762-4cf702de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"first_observed" : "2017-11-17T12:40:27Z" ,
"last_observed" : "2017-11-17T12:40:27Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5a0ed8bb-4f20-46d8-b762-4cf702de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5a0ed8bb-4f20-46d8-b762-4cf702de0b81" ,
"value" : "https://www.virustotal.com/file/799139b5278dc2ac24279cc6c3db44f4ef0ea78ee7b721b0ace38fd8018c51ac/analysis/1510574343/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0ed8bb-b6ec-4b31-8078-4c9b02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "Reaver.v3 - Xchecked via VT: 1813f10bcf74beb582c824c64fff63cb150d178bef93af81d875ca84214307a1" ,
"pattern" : "[file:hashes.SHA1 = '03bc4181fb54af3151cab60406a01a44158e5277']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0ed8bb-67e0-45e3-86d3-4a9d02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "Reaver.v3 - Xchecked via VT: 1813f10bcf74beb582c824c64fff63cb150d178bef93af81d875ca84214307a1" ,
"pattern" : "[file:hashes.MD5 = '17587683361d8458aebd9b8fdd07137a']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5a0ed8bb-cfec-48d4-9919-49ab02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"first_observed" : "2017-11-17T12:40:27Z" ,
"last_observed" : "2017-11-17T12:40:27Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5a0ed8bb-cfec-48d4-9919-49ab02de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5a0ed8bb-cfec-48d4-9919-49ab02de0b81" ,
"value" : "https://www.virustotal.com/file/1813f10bcf74beb582c824c64fff63cb150d178bef93af81d875ca84214307a1/analysis/1510849386/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0ed8bb-cb84-4739-a17e-456b02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "Reaver.v3 - Xchecked via VT: c906250e0a4c457663e37119ebe1efa1e4b97eef1d975f383ac3243f9f09908c" ,
"pattern" : "[file:hashes.SHA1 = 'b31160953ff19e6abf12fc8319420ab2e1c88e77']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0ed8bb-8bd8-4a20-a99e-498b02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "Reaver.v3 - Xchecked via VT: c906250e0a4c457663e37119ebe1efa1e4b97eef1d975f383ac3243f9f09908c" ,
"pattern" : "[file:hashes.MD5 = '2d563bf83bddca1f24e8a0ffb951a7e9']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5a0ed8bb-c264-45c1-acf8-4ece02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"first_observed" : "2017-11-17T12:40:27Z" ,
"last_observed" : "2017-11-17T12:40:27Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5a0ed8bb-c264-45c1-acf8-4ece02de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5a0ed8bb-c264-45c1-acf8-4ece02de0b81" ,
"value" : "https://www.virustotal.com/file/c906250e0a4c457663e37119ebe1efa1e4b97eef1d975f383ac3243f9f09908c/analysis/1510574300/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0ed8bb-bc04-47cf-8f7b-49cb02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "Reaver.v3 - Xchecked via VT: 1fcda755e8fa23d27329e4bc0443a82e1c1e9a6c1691639db256a187365e4db1" ,
"pattern" : "[file:hashes.SHA1 = '172b4578cb50985b08c227360d9c9df2cf32117a']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0ed8bb-9340-4443-b23e-4e1902de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "Reaver.v3 - Xchecked via VT: 1fcda755e8fa23d27329e4bc0443a82e1c1e9a6c1691639db256a187365e4db1" ,
"pattern" : "[file:hashes.MD5 = 'aab319d9715d38a37a10d82e87478dfc']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5a0ed8bb-b9c8-43aa-8797-462302de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"first_observed" : "2017-11-17T12:40:27Z" ,
"last_observed" : "2017-11-17T12:40:27Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5a0ed8bb-b9c8-43aa-8797-462302de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5a0ed8bb-b9c8-43aa-8797-462302de0b81" ,
"value" : "https://www.virustotal.com/file/1fcda755e8fa23d27329e4bc0443a82e1c1e9a6c1691639db256a187365e4db1/analysis/1510574331/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0ed8bb-8a68-4f7a-adcb-46c302de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "Reaver.v3 - Xchecked via VT: ae9f158e4886cfdbfb4f1b3b25707d05f6fd873d0be9d8e7334a2c28741228ee" ,
"pattern" : "[file:hashes.SHA1 = 'd62f1f039d0be1d7b2a8ed122d97ee917dbc9ce8']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0ed8bb-dcf8-4fe9-bdee-484502de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "Reaver.v3 - Xchecked via VT: ae9f158e4886cfdbfb4f1b3b25707d05f6fd873d0be9d8e7334a2c28741228ee" ,
"pattern" : "[file:hashes.MD5 = '892350b2a44efd9fa1e7c88aec013818']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5a0ed8bb-23d8-4bbe-b367-4fae02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"first_observed" : "2017-11-17T12:40:27Z" ,
"last_observed" : "2017-11-17T12:40:27Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5a0ed8bb-23d8-4bbe-b367-4fae02de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5a0ed8bb-23d8-4bbe-b367-4fae02de0b81" ,
"value" : "https://www.virustotal.com/file/ae9f158e4886cfdbfb4f1b3b25707d05f6fd873d0be9d8e7334a2c28741228ee/analysis/1510574327/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0ed8bb-d850-43f6-aa30-4f5702de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "Reaver.v3 - Xchecked via VT: 9213f70bce491991c4cbbbd7dc3e67d3a3d535b965d7064973b35c50f265e59b" ,
"pattern" : "[file:hashes.SHA1 = 'e96be5b542d100913a5bca0f02fb094d6f3ad85b']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0ed8bb-3ae4-4f3e-b592-474002de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "Reaver.v3 - Xchecked via VT: 9213f70bce491991c4cbbbd7dc3e67d3a3d535b965d7064973b35c50f265e59b" ,
"pattern" : "[file:hashes.MD5 = 'dd7edadd019bc120978a4dad284fbea6']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5a0ed8bb-c9a4-4669-a3ba-47e002de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"first_observed" : "2017-11-17T12:40:27Z" ,
"last_observed" : "2017-11-17T12:40:27Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5a0ed8bb-c9a4-4669-a3ba-47e002de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5a0ed8bb-c9a4-4669-a3ba-47e002de0b81" ,
"value" : "https://www.virustotal.com/file/9213f70bce491991c4cbbbd7dc3e67d3a3d535b965d7064973b35c50f265e59b/analysis/1510574335/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0ed8bb-e764-4ad4-8cdb-438902de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "Reaver.v3 - Xchecked via VT: c0f8bb77284b96e07cab1c3fab8800b1bbd030720c74628c4ee5666694ef903d" ,
"pattern" : "[file:hashes.SHA1 = 'cbde40a234bff8870f8746eca969c364da7f4aec']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0ed8bb-02e0-4eb5-9e34-41e602de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"description" : "Reaver.v3 - Xchecked via VT: c0f8bb77284b96e07cab1c3fab8800b1bbd030720c74628c4ee5666694ef903d" ,
"pattern" : "[file:hashes.MD5 = 'ae185e9c43bb1498a3c653a0886896e3']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5a0ed8bb-586c-4a4d-aa3b-4f7c02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:27.000Z" ,
"modified" : "2017-11-17T12:40:27.000Z" ,
"first_observed" : "2017-11-17T12:40:27Z" ,
"last_observed" : "2017-11-17T12:40:27Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5a0ed8bb-586c-4a4d-aa3b-4f7c02de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5a0ed8bb-586c-4a4d-aa3b-4f7c02de0b81" ,
"value" : "https://www.virustotal.com/file/c0f8bb77284b96e07cab1c3fab8800b1bbd030720c74628c4ee5666694ef903d/analysis/1510921773/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0ed8bc-ba8c-4160-8374-4dba02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:28.000Z" ,
"modified" : "2017-11-17T12:40:28.000Z" ,
"description" : "Reaver.v3 - Xchecked via VT: 18ac3b14300ecfeed4b64a844c16dccb06b0e3513d0954d6c6182f2ea14e4c92" ,
"pattern" : "[file:hashes.SHA1 = '5c6b231111239c0625dc9ff4359d1b8553159ecc']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:28Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0ed8bc-eff4-4d36-947a-424c02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:28.000Z" ,
"modified" : "2017-11-17T12:40:28.000Z" ,
"description" : "Reaver.v3 - Xchecked via VT: 18ac3b14300ecfeed4b64a844c16dccb06b0e3513d0954d6c6182f2ea14e4c92" ,
"pattern" : "[file:hashes.MD5 = 'c629f8f3206e5a6de83b4c996a2bacfb']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:28Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5a0ed8bc-60d8-4f2e-aa79-4d6f02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:28.000Z" ,
"modified" : "2017-11-17T12:40:28.000Z" ,
"first_observed" : "2017-11-17T12:40:28Z" ,
"last_observed" : "2017-11-17T12:40:28Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5a0ed8bc-60d8-4f2e-aa79-4d6f02de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5a0ed8bc-60d8-4f2e-aa79-4d6f02de0b81" ,
"value" : "https://www.virustotal.com/file/18ac3b14300ecfeed4b64a844c16dccb06b0e3513d0954d6c6182f2ea14e4c92/analysis/1510610402/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0ed8bc-0124-4bd3-9049-4e6b02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:28.000Z" ,
"modified" : "2017-11-17T12:40:28.000Z" ,
"description" : "Reaver.v2 - Xchecked via VT: 98eb5465c6330b9b49df2e7c9ad0b1164aa5b35423d9e80495a178eb510cdc1c" ,
"pattern" : "[file:hashes.SHA1 = 'c05d15fc94d096a821f2c689a29dff7679ce087a']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:28Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0ed8bc-c04c-49c4-9d39-464802de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:28.000Z" ,
"modified" : "2017-11-17T12:40:28.000Z" ,
"description" : "Reaver.v2 - Xchecked via VT: 98eb5465c6330b9b49df2e7c9ad0b1164aa5b35423d9e80495a178eb510cdc1c" ,
"pattern" : "[file:hashes.MD5 = 'dadf3d3dd411bc02d7c05ee3a18259ea']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:28Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5a0ed8bc-37cc-47c1-bdcd-454e02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:28.000Z" ,
"modified" : "2017-11-17T12:40:28.000Z" ,
"first_observed" : "2017-11-17T12:40:28Z" ,
"last_observed" : "2017-11-17T12:40:28Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5a0ed8bc-37cc-47c1-bdcd-454e02de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5a0ed8bc-37cc-47c1-bdcd-454e02de0b81" ,
"value" : "https://www.virustotal.com/file/98eb5465c6330b9b49df2e7c9ad0b1164aa5b35423d9e80495a178eb510cdc1c/analysis/1510823791/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0ed8bc-4014-447e-8efc-450702de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:28.000Z" ,
"modified" : "2017-11-17T12:40:28.000Z" ,
"description" : "Reaver.v1 - Xchecked via VT: d560f44188fb56d3abb11d9508e1167329470de19b811163eb1167534722e666" ,
"pattern" : "[file:hashes.SHA1 = '0cea48067ddbc9227363168013142f6f3a5dea9f']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:28Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a0ed8bc-5768-4c26-85a2-47b902de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:28.000Z" ,
"modified" : "2017-11-17T12:40:28.000Z" ,
"description" : "Reaver.v1 - Xchecked via VT: d560f44188fb56d3abb11d9508e1167329470de19b811163eb1167534722e666" ,
"pattern" : "[file:hashes.MD5 = '9f289cce6f95949450e3f4c96a187f5d']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-11-17T12:40:28Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5a0ed8bc-a7a0-499f-bd08-48bb02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-11-17T12:40:28.000Z" ,
"modified" : "2017-11-17T12:40:28.000Z" ,
"first_observed" : "2017-11-17T12:40:28Z" ,
"last_observed" : "2017-11-17T12:40:28Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5a0ed8bc-a7a0-499f-bd08-48bb02de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5a0ed8bc-a7a0-499f-bd08-48bb02de0b81" ,
"value" : "https://www.virustotal.com/file/d560f44188fb56d3abb11d9508e1167329470de19b811163eb1167534722e666/analysis/1510823685/"
} ,
{
"type" : "marking-definition" ,
"spec_version" : "2.1" ,
"id" : "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ,
"created" : "2017-01-20T00:00:00.000Z" ,
"definition_type" : "tlp" ,
"name" : "TLP:WHITE" ,
"definition" : {
"tlp" : "white"
}
}
2023-04-21 13:25:09 +00:00
]
}