2023-06-14 17:31:25 +00:00
|
|
|
{
|
|
|
|
|
"type": "bundle",
|
|
|
|
|
"id": "bundle--5a0f0f64-4be0-4b9f-b6e3-5e08950d210f",
|
|
|
|
|
"objects": [
|
|
|
|
|
{
|
|
|
|
|
"type": "identity",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:58.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:58.000Z",
|
|
|
|
|
"name": "CIRCL",
|
|
|
|
|
"identity_class": "organization"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "grouping",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "grouping--5a0f0f64-4be0-4b9f-b6e3-5e08950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:58.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:58.000Z",
|
|
|
|
|
"name": "M2M - Trickbot 2017-11-14 : \"mac1\" : \"Invoice\n AXBY1234567\" - \"InvoiceAXBY1234567.doc\"",
|
|
|
|
|
"context": "suspicious-activity",
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"indicator--5a0f0f65-6728-417b-be96-b831950d210f",
|
|
|
|
|
"indicator--5a0f0f65-e4a0-42ca-9876-5911950d210f",
|
|
|
|
|
"indicator--5a0f0f65-96d4-4d8a-8978-4dfd950d210f",
|
|
|
|
|
"observed-data--5a0f0f66-9440-48cd-9f29-5dfc950d210f",
|
|
|
|
|
"network-traffic--5a0f0f66-9440-48cd-9f29-5dfc950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f66-9440-48cd-9f29-5dfc950d210f",
|
|
|
|
|
"indicator--5a0f0f66-2ab8-4fc9-9500-b41d950d210f",
|
|
|
|
|
"indicator--5a0f0f66-69f8-44b9-8975-b59f950d210f",
|
|
|
|
|
"observed-data--5a0f0f66-54f4-4c11-9a39-4bb6950d210f",
|
|
|
|
|
"network-traffic--5a0f0f66-54f4-4c11-9a39-4bb6950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f66-54f4-4c11-9a39-4bb6950d210f",
|
|
|
|
|
"indicator--5a0f0f67-e470-4ef3-9ec9-5e08950d210f",
|
|
|
|
|
"indicator--5a0f0f67-e778-4c79-9bfc-5d86950d210f",
|
|
|
|
|
"observed-data--5a0f0f67-e5a8-4d7e-a2f7-b84a950d210f",
|
|
|
|
|
"network-traffic--5a0f0f67-e5a8-4d7e-a2f7-b84a950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f67-e5a8-4d7e-a2f7-b84a950d210f",
|
|
|
|
|
"indicator--5a0f0f67-d570-4688-b052-5d51950d210f",
|
|
|
|
|
"indicator--5a0f0f67-d120-4b45-bc25-b831950d210f",
|
|
|
|
|
"observed-data--5a0f0f68-9a20-4b25-8e06-5911950d210f",
|
|
|
|
|
"network-traffic--5a0f0f68-9a20-4b25-8e06-5911950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f68-9a20-4b25-8e06-5911950d210f",
|
|
|
|
|
"indicator--5a0f0f68-294c-492e-bb55-41c0950d210f",
|
|
|
|
|
"indicator--5a0f0f68-dba0-41a1-9e33-5d86950d210f",
|
|
|
|
|
"indicator--5a0f0f69-e044-4990-b068-b84a950d210f",
|
|
|
|
|
"indicator--5a0f0f69-3fcc-4b0a-b0d1-5dfc950d210f",
|
|
|
|
|
"observed-data--5a0f0f69-35f0-40cc-a98d-5d51950d210f",
|
|
|
|
|
"network-traffic--5a0f0f69-35f0-40cc-a98d-5d51950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f69-35f0-40cc-a98d-5d51950d210f",
|
|
|
|
|
"observed-data--5a0f0f69-ec94-4d52-9d5c-49f9950d210f",
|
|
|
|
|
"network-traffic--5a0f0f69-ec94-4d52-9d5c-49f9950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f69-ec94-4d52-9d5c-49f9950d210f",
|
|
|
|
|
"observed-data--5a0f0f69-98e0-451d-971a-4f7c950d210f",
|
|
|
|
|
"network-traffic--5a0f0f69-98e0-451d-971a-4f7c950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f69-98e0-451d-971a-4f7c950d210f",
|
|
|
|
|
"observed-data--5a0f0f6a-c1b4-49f9-8981-4c40950d210f",
|
|
|
|
|
"network-traffic--5a0f0f6a-c1b4-49f9-8981-4c40950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6a-c1b4-49f9-8981-4c40950d210f",
|
|
|
|
|
"observed-data--5a0f0f6a-c9e0-493b-9f3b-b664950d210f",
|
|
|
|
|
"network-traffic--5a0f0f6a-c9e0-493b-9f3b-b664950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6a-c9e0-493b-9f3b-b664950d210f",
|
|
|
|
|
"observed-data--5a0f0f6a-7870-49b8-b63c-5e08950d210f",
|
|
|
|
|
"network-traffic--5a0f0f6a-7870-49b8-b63c-5e08950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6a-7870-49b8-b63c-5e08950d210f",
|
|
|
|
|
"observed-data--5a0f0f6b-b2b4-4d2d-910b-478c950d210f",
|
|
|
|
|
"network-traffic--5a0f0f6b-b2b4-4d2d-910b-478c950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6b-b2b4-4d2d-910b-478c950d210f",
|
|
|
|
|
"observed-data--5a0f0f6b-8f14-4ab5-90d7-45e5950d210f",
|
|
|
|
|
"network-traffic--5a0f0f6b-8f14-4ab5-90d7-45e5950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6b-8f14-4ab5-90d7-45e5950d210f",
|
|
|
|
|
"observed-data--5a0f0f6b-9f34-45a8-b704-b84a950d210f",
|
|
|
|
|
"network-traffic--5a0f0f6b-9f34-45a8-b704-b84a950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6b-9f34-45a8-b704-b84a950d210f",
|
|
|
|
|
"observed-data--5a0f0f6b-b088-497e-9567-4af6950d210f",
|
|
|
|
|
"network-traffic--5a0f0f6b-b088-497e-9567-4af6950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6b-b088-497e-9567-4af6950d210f",
|
|
|
|
|
"observed-data--5a0f0f6c-40c8-41f3-b245-b41d950d210f",
|
|
|
|
|
"network-traffic--5a0f0f6c-40c8-41f3-b245-b41d950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6c-40c8-41f3-b245-b41d950d210f",
|
|
|
|
|
"observed-data--5a0f0f6c-d900-4741-8743-b59f950d210f",
|
|
|
|
|
"network-traffic--5a0f0f6c-d900-4741-8743-b59f950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6c-d900-4741-8743-b59f950d210f",
|
|
|
|
|
"observed-data--5a0f0f6c-826c-46e5-92ef-47d0950d210f",
|
|
|
|
|
"network-traffic--5a0f0f6c-826c-46e5-92ef-47d0950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6c-826c-46e5-92ef-47d0950d210f",
|
|
|
|
|
"observed-data--5a0f0f6d-7044-463b-824b-435c950d210f",
|
|
|
|
|
"network-traffic--5a0f0f6d-7044-463b-824b-435c950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6d-7044-463b-824b-435c950d210f",
|
|
|
|
|
"observed-data--5a0f0f6d-42ec-48d3-ba9e-b664950d210f",
|
|
|
|
|
"network-traffic--5a0f0f6d-42ec-48d3-ba9e-b664950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6d-42ec-48d3-ba9e-b664950d210f",
|
|
|
|
|
"observed-data--5a0f0f6d-3ad4-4d30-9a78-5e08950d210f",
|
|
|
|
|
"network-traffic--5a0f0f6d-3ad4-4d30-9a78-5e08950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6d-3ad4-4d30-9a78-5e08950d210f",
|
|
|
|
|
"observed-data--5a0f0f6d-a978-4233-80c2-4be7950d210f",
|
|
|
|
|
"network-traffic--5a0f0f6d-a978-4233-80c2-4be7950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6d-a978-4233-80c2-4be7950d210f",
|
|
|
|
|
"observed-data--5a0f0f6e-f8b0-42f6-9fda-5d86950d210f",
|
|
|
|
|
"network-traffic--5a0f0f6e-f8b0-42f6-9fda-5d86950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6e-f8b0-42f6-9fda-5d86950d210f",
|
|
|
|
|
"observed-data--5a0f0f6e-0e80-49a7-9117-b84a950d210f",
|
|
|
|
|
"network-traffic--5a0f0f6e-0e80-49a7-9117-b84a950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6e-0e80-49a7-9117-b84a950d210f",
|
|
|
|
|
"observed-data--5a0f0f6e-875c-4fd4-bf89-4f23950d210f",
|
|
|
|
|
"network-traffic--5a0f0f6e-875c-4fd4-bf89-4f23950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6e-875c-4fd4-bf89-4f23950d210f",
|
|
|
|
|
"observed-data--5a0f0f6f-a384-474f-8c3b-5dfc950d210f",
|
|
|
|
|
"network-traffic--5a0f0f6f-a384-474f-8c3b-5dfc950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6f-a384-474f-8c3b-5dfc950d210f",
|
|
|
|
|
"observed-data--5a0f0f6f-f3b4-4c03-af17-5d51950d210f",
|
|
|
|
|
"network-traffic--5a0f0f6f-f3b4-4c03-af17-5d51950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6f-f3b4-4c03-af17-5d51950d210f",
|
|
|
|
|
"observed-data--5a0f0f6f-a67c-4df4-9c09-4aa2950d210f",
|
|
|
|
|
"network-traffic--5a0f0f6f-a67c-4df4-9c09-4aa2950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6f-a67c-4df4-9c09-4aa2950d210f",
|
|
|
|
|
"observed-data--5a0f0f6f-49e0-4710-aa7f-b831950d210f",
|
|
|
|
|
"network-traffic--5a0f0f6f-49e0-4710-aa7f-b831950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6f-49e0-4710-aa7f-b831950d210f",
|
|
|
|
|
"observed-data--5a0f0f70-5460-4687-a5af-5911950d210f",
|
|
|
|
|
"network-traffic--5a0f0f70-5460-4687-a5af-5911950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f70-5460-4687-a5af-5911950d210f",
|
|
|
|
|
"observed-data--5a0f0f70-3f68-47ce-b9a7-446a950d210f",
|
|
|
|
|
"network-traffic--5a0f0f70-3f68-47ce-b9a7-446a950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f70-3f68-47ce-b9a7-446a950d210f",
|
|
|
|
|
"observed-data--5a0f0f70-e560-4f6e-b847-5d86950d210f",
|
|
|
|
|
"network-traffic--5a0f0f70-e560-4f6e-b847-5d86950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f70-e560-4f6e-b847-5d86950d210f",
|
|
|
|
|
"observed-data--5a0f0f70-0d10-4e6e-9d1c-b57b950d210f",
|
|
|
|
|
"network-traffic--5a0f0f70-0d10-4e6e-9d1c-b57b950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f70-0d10-4e6e-9d1c-b57b950d210f",
|
|
|
|
|
"observed-data--5a0f0f71-d47c-4892-bd8f-b41d950d210f",
|
|
|
|
|
"network-traffic--5a0f0f71-d47c-4892-bd8f-b41d950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f71-d47c-4892-bd8f-b41d950d210f",
|
|
|
|
|
"observed-data--5a0f0f71-7ac8-4efb-a02b-4143950d210f",
|
|
|
|
|
"network-traffic--5a0f0f71-7ac8-4efb-a02b-4143950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f71-7ac8-4efb-a02b-4143950d210f",
|
|
|
|
|
"observed-data--5a0f0f71-19c0-42be-9da2-b831950d210f",
|
|
|
|
|
"network-traffic--5a0f0f71-19c0-42be-9da2-b831950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f71-19c0-42be-9da2-b831950d210f",
|
|
|
|
|
"indicator--5a0f1203-6b28-4acb-85ab-442602de0b81",
|
|
|
|
|
"indicator--5a0f1203-defc-4085-8173-498a02de0b81",
|
|
|
|
|
"observed-data--5a0f1203-5484-401a-955f-458102de0b81",
|
|
|
|
|
"url--5a0f1203-5484-401a-955f-458102de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"Threat-Report",
|
|
|
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
|
|
|
"misp-galaxy:tool=\"Trick Bot\""
|
|
|
|
|
],
|
|
|
|
|
"object_marking_refs": [
|
|
|
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5a0f0f65-6728-417b-be96-b831950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '37e5976ed01f8bcf6b814e58a847d294']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-11-17T16:44:51Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5a0f0f65-e4a0-42ca-9876-5911950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://hubalon.de/FGdhbr5']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-11-17T16:44:51Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5a0f0f65-96d4-4d8a-8978-4dfd950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'hubalon.de']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-11-17T16:44:51Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f66-9440-48cd-9f29-5dfc950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f66-9440-48cd-9f29-5dfc950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f66-9440-48cd-9f29-5dfc950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f66-9440-48cd-9f29-5dfc950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f66-9440-48cd-9f29-5dfc950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f66-9440-48cd-9f29-5dfc950d210f",
|
|
|
|
|
"value": "212.72.171.130"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5a0f0f66-2ab8-4fc9-9500-b41d950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://infoweb.cfpsdevweb.ch/FGdhbr5']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-11-17T16:44:51Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5a0f0f66-69f8-44b9-8975-b59f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'infoweb.cfpsdevweb.ch']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-11-17T16:44:51Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f66-54f4-4c11-9a39-4bb6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f66-54f4-4c11-9a39-4bb6950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f66-54f4-4c11-9a39-4bb6950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f66-54f4-4c11-9a39-4bb6950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f66-54f4-4c11-9a39-4bb6950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f66-54f4-4c11-9a39-4bb6950d210f",
|
|
|
|
|
"value": "213.221.153.22"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5a0f0f67-e470-4ef3-9ec9-5e08950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://kb.schuttesystems.net/FGdhbr5']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-11-17T16:44:51Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5a0f0f67-e778-4c79-9bfc-5d86950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'kb.schuttesystems.net']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-11-17T16:44:51Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f67-e5a8-4d7e-a2f7-b84a950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f67-e5a8-4d7e-a2f7-b84a950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f67-e5a8-4d7e-a2f7-b84a950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f67-e5a8-4d7e-a2f7-b84a950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f67-e5a8-4d7e-a2f7-b84a950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f67-e5a8-4d7e-a2f7-b84a950d210f",
|
|
|
|
|
"value": "194.151.161.144"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5a0f0f67-d570-4688-b052-5d51950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://kipshagen-ol.de/FGdhbr5']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-11-17T16:44:51Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5a0f0f67-d120-4b45-bc25-b831950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'kipshagen-ol.de']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-11-17T16:44:51Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f68-9a20-4b25-8e06-5911950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f68-9a20-4b25-8e06-5911950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f68-9a20-4b25-8e06-5911950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f68-9a20-4b25-8e06-5911950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f68-9a20-4b25-8e06-5911950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f68-9a20-4b25-8e06-5911950d210f",
|
|
|
|
|
"value": "82.165.155.25"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5a0f0f68-294c-492e-bb55-41c0950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://nc.skyrunner.net/FGdhbr5']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-11-17T16:44:51Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5a0f0f68-dba0-41a1-9e33-5d86950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'nc.skyrunner.net']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-11-17T16:44:51Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5a0f0f69-e044-4990-b068-b84a950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://sport-market.ru/FGdhbr5']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-11-17T16:44:51Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5a0f0f69-3fcc-4b0a-b0d1-5dfc950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'sport-market.ru']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-11-17T16:44:51Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f69-35f0-40cc-a98d-5d51950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f69-35f0-40cc-a98d-5d51950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f69-35f0-40cc-a98d-5d51950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f69-35f0-40cc-a98d-5d51950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f69-35f0-40cc-a98d-5d51950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f69-35f0-40cc-a98d-5d51950d210f",
|
|
|
|
|
"value": "85.10.224.162"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f69-ec94-4d52-9d5c-49f9950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f69-ec94-4d52-9d5c-49f9950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f69-ec94-4d52-9d5c-49f9950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f69-ec94-4d52-9d5c-49f9950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f69-ec94-4d52-9d5c-49f9950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f69-ec94-4d52-9d5c-49f9950d210f",
|
|
|
|
|
"value": "187.188.162.150"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f69-98e0-451d-971a-4f7c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f69-98e0-451d-971a-4f7c950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f69-98e0-451d-971a-4f7c950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f69-98e0-451d-971a-4f7c950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f69-98e0-451d-971a-4f7c950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f69-98e0-451d-971a-4f7c950d210f",
|
|
|
|
|
"value": "185.28.63.109"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f6a-c1b4-49f9-8981-4c40950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f6a-c1b4-49f9-8981-4c40950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6a-c1b4-49f9-8981-4c40950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f6a-c1b4-49f9-8981-4c40950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f6a-c1b4-49f9-8981-4c40950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f6a-c1b4-49f9-8981-4c40950d210f",
|
|
|
|
|
"value": "83.0.245.234"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f6a-c9e0-493b-9f3b-b664950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f6a-c9e0-493b-9f3b-b664950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6a-c9e0-493b-9f3b-b664950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f6a-c9e0-493b-9f3b-b664950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f6a-c9e0-493b-9f3b-b664950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f6a-c9e0-493b-9f3b-b664950d210f",
|
|
|
|
|
"value": "213.241.29.89"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f6a-7870-49b8-b63c-5e08950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f6a-7870-49b8-b63c-5e08950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6a-7870-49b8-b63c-5e08950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f6a-7870-49b8-b63c-5e08950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f6a-7870-49b8-b63c-5e08950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f6a-7870-49b8-b63c-5e08950d210f",
|
|
|
|
|
"value": "62.109.31.123"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f6b-b2b4-4d2d-910b-478c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f6b-b2b4-4d2d-910b-478c950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6b-b2b4-4d2d-910b-478c950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f6b-b2b4-4d2d-910b-478c950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f6b-b2b4-4d2d-910b-478c950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f6b-b2b4-4d2d-910b-478c950d210f",
|
|
|
|
|
"value": "92.63.107.14"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f6b-8f14-4ab5-90d7-45e5950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f6b-8f14-4ab5-90d7-45e5950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6b-8f14-4ab5-90d7-45e5950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f6b-8f14-4ab5-90d7-45e5950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f6b-8f14-4ab5-90d7-45e5950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f6b-8f14-4ab5-90d7-45e5950d210f",
|
|
|
|
|
"value": "92.63.107.222"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f6b-9f34-45a8-b704-b84a950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f6b-9f34-45a8-b704-b84a950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6b-9f34-45a8-b704-b84a950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f6b-9f34-45a8-b704-b84a950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f6b-9f34-45a8-b704-b84a950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f6b-9f34-45a8-b704-b84a950d210f",
|
|
|
|
|
"value": "92.63.104.211"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f6b-b088-497e-9567-4af6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f6b-b088-497e-9567-4af6950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6b-b088-497e-9567-4af6950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f6b-b088-497e-9567-4af6950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f6b-b088-497e-9567-4af6950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f6b-b088-497e-9567-4af6950d210f",
|
|
|
|
|
"value": "62.109.25.3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f6c-40c8-41f3-b245-b41d950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f6c-40c8-41f3-b245-b41d950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6c-40c8-41f3-b245-b41d950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f6c-40c8-41f3-b245-b41d950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f6c-40c8-41f3-b245-b41d950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f6c-40c8-41f3-b245-b41d950d210f",
|
|
|
|
|
"value": "62.109.26.208"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f6c-d900-4741-8743-b59f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f6c-d900-4741-8743-b59f950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6c-d900-4741-8743-b59f950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f6c-d900-4741-8743-b59f950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f6c-d900-4741-8743-b59f950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f6c-d900-4741-8743-b59f950d210f",
|
|
|
|
|
"value": "37.230.113.231"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f6c-826c-46e5-92ef-47d0950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f6c-826c-46e5-92ef-47d0950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6c-826c-46e5-92ef-47d0950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f6c-826c-46e5-92ef-47d0950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f6c-826c-46e5-92ef-47d0950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f6c-826c-46e5-92ef-47d0950d210f",
|
|
|
|
|
"value": "149.154.69.126"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f6d-7044-463b-824b-435c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f6d-7044-463b-824b-435c950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6d-7044-463b-824b-435c950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f6d-7044-463b-824b-435c950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f6d-7044-463b-824b-435c950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f6d-7044-463b-824b-435c950d210f",
|
|
|
|
|
"value": "95.213.191.144"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f6d-42ec-48d3-ba9e-b664950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f6d-42ec-48d3-ba9e-b664950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6d-42ec-48d3-ba9e-b664950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f6d-42ec-48d3-ba9e-b664950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f6d-42ec-48d3-ba9e-b664950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f6d-42ec-48d3-ba9e-b664950d210f",
|
|
|
|
|
"value": "82.202.226.229"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f6d-3ad4-4d30-9a78-5e08950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f6d-3ad4-4d30-9a78-5e08950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6d-3ad4-4d30-9a78-5e08950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f6d-3ad4-4d30-9a78-5e08950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f6d-3ad4-4d30-9a78-5e08950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f6d-3ad4-4d30-9a78-5e08950d210f",
|
|
|
|
|
"value": "37.230.113.249"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f6d-a978-4233-80c2-4be7950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f6d-a978-4233-80c2-4be7950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6d-a978-4233-80c2-4be7950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f6d-a978-4233-80c2-4be7950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f6d-a978-4233-80c2-4be7950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f6d-a978-4233-80c2-4be7950d210f",
|
|
|
|
|
"value": "149.154.69.129"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f6e-f8b0-42f6-9fda-5d86950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f6e-f8b0-42f6-9fda-5d86950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6e-f8b0-42f6-9fda-5d86950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f6e-f8b0-42f6-9fda-5d86950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f6e-f8b0-42f6-9fda-5d86950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f6e-f8b0-42f6-9fda-5d86950d210f",
|
|
|
|
|
"value": "185.158.114.72"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f6e-0e80-49a7-9117-b84a950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f6e-0e80-49a7-9117-b84a950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6e-0e80-49a7-9117-b84a950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f6e-0e80-49a7-9117-b84a950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f6e-0e80-49a7-9117-b84a950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f6e-0e80-49a7-9117-b84a950d210f",
|
|
|
|
|
"value": "179.43.160.50"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f6e-875c-4fd4-bf89-4f23950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f6e-875c-4fd4-bf89-4f23950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6e-875c-4fd4-bf89-4f23950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f6e-875c-4fd4-bf89-4f23950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f6e-875c-4fd4-bf89-4f23950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f6e-875c-4fd4-bf89-4f23950d210f",
|
|
|
|
|
"value": "94.250.254.22"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f6f-a384-474f-8c3b-5dfc950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f6f-a384-474f-8c3b-5dfc950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6f-a384-474f-8c3b-5dfc950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f6f-a384-474f-8c3b-5dfc950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f6f-a384-474f-8c3b-5dfc950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f6f-a384-474f-8c3b-5dfc950d210f",
|
|
|
|
|
"value": "149.154.70.248"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f6f-f3b4-4c03-af17-5d51950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f6f-f3b4-4c03-af17-5d51950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6f-f3b4-4c03-af17-5d51950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f6f-f3b4-4c03-af17-5d51950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f6f-f3b4-4c03-af17-5d51950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f6f-f3b4-4c03-af17-5d51950d210f",
|
|
|
|
|
"value": "95.213.236.81"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f6f-a67c-4df4-9c09-4aa2950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f6f-a67c-4df4-9c09-4aa2950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6f-a67c-4df4-9c09-4aa2950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f6f-a67c-4df4-9c09-4aa2950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f6f-a67c-4df4-9c09-4aa2950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f6f-a67c-4df4-9c09-4aa2950d210f",
|
|
|
|
|
"value": "82.202.226.66"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f6f-49e0-4710-aa7f-b831950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f6f-49e0-4710-aa7f-b831950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f6f-49e0-4710-aa7f-b831950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f6f-49e0-4710-aa7f-b831950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f6f-49e0-4710-aa7f-b831950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f6f-49e0-4710-aa7f-b831950d210f",
|
|
|
|
|
"value": "37.230.113.191"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f70-5460-4687-a5af-5911950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f70-5460-4687-a5af-5911950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f70-5460-4687-a5af-5911950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f70-5460-4687-a5af-5911950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f70-5460-4687-a5af-5911950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f70-5460-4687-a5af-5911950d210f",
|
|
|
|
|
"value": "92.53.67.44"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f70-3f68-47ce-b9a7-446a950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f70-3f68-47ce-b9a7-446a950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f70-3f68-47ce-b9a7-446a950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f70-3f68-47ce-b9a7-446a950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f70-3f68-47ce-b9a7-446a950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f70-3f68-47ce-b9a7-446a950d210f",
|
|
|
|
|
"value": "94.250.254.104"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f70-e560-4f6e-b847-5d86950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f70-e560-4f6e-b847-5d86950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f70-e560-4f6e-b847-5d86950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f70-e560-4f6e-b847-5d86950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f70-e560-4f6e-b847-5d86950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f70-e560-4f6e-b847-5d86950d210f",
|
|
|
|
|
"value": "91.211.247.94"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f70-0d10-4e6e-9d1c-b57b950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f70-0d10-4e6e-9d1c-b57b950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f70-0d10-4e6e-9d1c-b57b950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f70-0d10-4e6e-9d1c-b57b950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f70-0d10-4e6e-9d1c-b57b950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f70-0d10-4e6e-9d1c-b57b950d210f",
|
|
|
|
|
"value": "94.250.254.102"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f71-d47c-4892-bd8f-b41d950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f71-d47c-4892-bd8f-b41d950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f71-d47c-4892-bd8f-b41d950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f71-d47c-4892-bd8f-b41d950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f71-d47c-4892-bd8f-b41d950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f71-d47c-4892-bd8f-b41d950d210f",
|
|
|
|
|
"value": "185.34.52.80"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f71-7ac8-4efb-a02b-4143950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f71-7ac8-4efb-a02b-4143950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f71-7ac8-4efb-a02b-4143950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f71-7ac8-4efb-a02b-4143950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f71-7ac8-4efb-a02b-4143950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f71-7ac8-4efb-a02b-4143950d210f",
|
|
|
|
|
"value": "195.133.146.156"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f0f71-19c0-42be-9da2-b831950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5a0f0f71-19c0-42be-9da2-b831950d210f",
|
|
|
|
|
"ipv4-addr--5a0f0f71-19c0-42be-9da2-b831950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5a0f0f71-19c0-42be-9da2-b831950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--5a0f0f71-19c0-42be-9da2-b831950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5a0f0f71-19c0-42be-9da2-b831950d210f",
|
|
|
|
|
"value": "77.244.215.81"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5a0f1203-6b28-4acb-85ab-442602de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 37e5976ed01f8bcf6b814e58a847d294",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'e1217585c1c357a9cd4f44e54fd18e198f70e337d1e7073963adc270c5c7f526']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-11-17T16:44:51Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5a0f1203-defc-4085-8173-498a02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 37e5976ed01f8bcf6b814e58a847d294",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'd4e18c53779b3900e325eda985f611eb50043703']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-11-17T16:44:51Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5a0f1203-5484-401a-955f-458102de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"modified": "2017-11-17T16:44:51.000Z",
|
|
|
|
|
"first_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"last_observed": "2017-11-17T16:44:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5a0f1203-5484-401a-955f-458102de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5a0f1203-5484-401a-955f-458102de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/e1217585c1c357a9cd4f44e54fd18e198f70e337d1e7073963adc270c5c7f526/analysis/1510816029/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "marking-definition",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
|
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
|
|
|
"definition_type": "tlp",
|
|
|
|
|
"name": "TLP:WHITE",
|
|
|
|
|
"definition": {
|
|
|
|
|
"tlp": "white"
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
