2023-04-21 13:25:09 +00:00
{
2023-06-14 17:31:25 +00:00
"type" : "bundle" ,
"id" : "bundle--5a26b513-1ffc-497b-8cac-c53a950d210f" ,
"objects" : [
{
"type" : "identity" ,
"spec_version" : "2.1" ,
"id" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T09:07:39.000Z" ,
"modified" : "2018-10-26T09:07:39.000Z" ,
"name" : "CIRCL" ,
"identity_class" : "organization"
} ,
{
"type" : "report" ,
"spec_version" : "2.1" ,
"id" : "report--5a26b513-1ffc-497b-8cac-c53a950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T09:07:39.000Z" ,
"modified" : "2018-10-26T09:07:39.000Z" ,
"name" : "OSINT - Multi-stage malware sneaks into Google Play" ,
"published" : "2018-10-26T09:07:52Z" ,
"object_refs" : [
"observed-data--5a26b520-8974-4557-9ecb-4260950d210f" ,
"url--5a26b520-8974-4557-9ecb-4260950d210f" ,
"indicator--5a2e4c0c-e20c-4386-bdc9-c566950d210f" ,
"indicator--5a2e4c0c-5e7c-446d-979f-c566950d210f" ,
"indicator--5a2e4c0d-6ec0-4617-b698-c566950d210f" ,
"indicator--5a2e4c0d-0d90-4608-b0e4-c566950d210f" ,
"indicator--5a2e4c0e-ae14-4d56-81da-c566950d210f" ,
"x-misp-attribute--5a2e4c7f-9ce8-418d-ae08-b401950d210f" ,
"indicator--5a2e4046-8b60-456b-8b75-5467950d210f" ,
"indicator--5a2e4265-81d0-44f3-ba7c-5daf950d210f" ,
"indicator--5a2e42c6-1420-41e4-8580-60de950d210f" ,
"indicator--5a2e4302-df2c-4db4-8bba-71d3950d210f" ,
"indicator--5a2e46e8-f488-40cd-a9ec-878d950d210f" ,
"indicator--5a2e499b-4ccc-4e5c-ae67-bb07950d210f" ,
"indicator--5a2e4a5b-b27c-4c2f-9112-ba38950d210f" ,
"indicator--5a2e4a97-e268-44ea-ada6-bbe1950d210f" ,
"indicator--11c074b2-9ef5-468f-9a71-70ea7abb9d67" ,
"x-misp-object--df8032d7-cbe9-49fd-9747-63d74730df9f" ,
"indicator--475d3bb8-eb86-4c51-a3a3-15ab39d91ddf" ,
"x-misp-object--94031eb7-4ff3-486e-b44f-eb4fa2ab0c1c" ,
"indicator--90b018c5-f3af-4ebf-9bb9-452b205d3038" ,
"x-misp-object--caa22be8-c2c9-465f-8aaa-c20e3eafec9f" ,
"indicator--a62c5ce0-9e21-466e-b317-a0a00fef80ef" ,
"x-misp-object--1263f071-0c4b-4d90-b6ef-81682679e425" ,
"indicator--959b41df-ba0f-4520-a633-f28b0d7e5b21" ,
"x-misp-object--9c3a68e0-2e10-46ad-adda-0237549ebcd1" ,
"indicator--973efe60-da30-4d60-aa15-6a1ee7f82e22" ,
"x-misp-object--6b985af4-f961-4f8d-b2f7-513b6ed1c140" ,
"indicator--ae8d1770-da33-4160-92e5-bc56fe5781d5" ,
"x-misp-object--095999e8-cf65-4068-9aa8-111b4596ae64" ,
"indicator--01689a22-9fef-4b84-bc15-84a951d19e66" ,
"x-misp-object--2f933552-e105-4559-9ba2-4adb53dde71b"
] ,
"labels" : [
"Threat-Report" ,
"misp:tool=\"MISP-STIX-Converter\"" ,
"type:OSINT" ,
"circl:incident-classification=\"malware\"" ,
"osint:source-type=\"blog-post\""
] ,
"object_marking_refs" : [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5a26b520-8974-4557-9ecb-4260950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-05T15:03:03.000Z" ,
"modified" : "2017-12-05T15:03:03.000Z" ,
"first_observed" : "2017-12-05T15:03:03Z" ,
"last_observed" : "2017-12-05T15:03:03Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5a26b520-8974-4557-9ecb-4260950d210f"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\"" ,
"osint:source-type=\"blog-post\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5a26b520-8974-4557-9ecb-4260950d210f" ,
"value" : "https://www.welivesecurity.com/2017/11/15/multi-stage-malware-sneaks-google-play/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a2e4c0c-e20c-4386-bdc9-c566950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-11T09:12:44.000Z" ,
"modified" : "2017-12-11T09:12:44.000Z" ,
"description" : "Hardcoded domains hosting links to the third-stage payloads" ,
"pattern" : "[domain-name:value = 'loaderclientarea24.ru']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-11T09:12:44Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a2e4c0c-5e7c-446d-979f-c566950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-11T09:12:44.000Z" ,
"modified" : "2017-12-11T09:12:44.000Z" ,
"description" : "Hardcoded domains hosting links to the third-stage payloads" ,
"pattern" : "[domain-name:value = 'loaderclientarea22.ru']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-11T09:12:44Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a2e4c0d-6ec0-4617-b698-c566950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-11T09:12:45.000Z" ,
"modified" : "2017-12-11T09:12:45.000Z" ,
"description" : "Hardcoded domains hosting links to the third-stage payloads" ,
"pattern" : "[domain-name:value = 'loaderclientarea20.ru']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-11T09:12:45Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a2e4c0d-0d90-4608-b0e4-c566950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-11T09:12:45.000Z" ,
"modified" : "2017-12-11T09:12:45.000Z" ,
"description" : "Hardcoded domains hosting links to the third-stage payloads" ,
"pattern" : "[domain-name:value = 'loaderclientarea15.ru']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-11T09:12:45Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a2e4c0e-ae14-4d56-81da-c566950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-11T09:12:46.000Z" ,
"modified" : "2017-12-11T09:12:46.000Z" ,
"description" : "Hardcoded domains hosting links to the third-stage payloads" ,
"pattern" : "[domain-name:value = 'loaderclientarea13.ru']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-11T09:12:46Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-attribute" ,
"spec_version" : "2.1" ,
"id" : "x-misp-attribute--5a2e4c7f-9ce8-418d-ae08-b401950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-11T09:14:49.000Z" ,
"modified" : "2017-12-11T09:14:49.000Z" ,
"labels" : [
"misp:type=\"comment\"" ,
"misp:category=\"External analysis\"" ,
"osint:source-type=\"blog-post\""
] ,
"x_misp_category" : "External analysis" ,
"x_misp_type" : "comment" ,
"x_misp_value" : "Anti-detection features\r\n\r\nThese malware samples all employ a multi-stage architecture and encryption to stay under the radar.\r\n\r\nAfter being downloaded and installed, these apps do not request any suspicious permissions and even mimic the activity the user expects them to exhibit.\r\n\r\nAlong with this, the malicious app also decrypts and executes its payload \u00e2\u20ac\u201c that is, the first-stage payload. This payload decrypts and executes the second-stage payload, which is stored in the assets of the initial app downloaded from Google Play. These steps are invisible to the user and serve as obfuscatory measures."
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a2e4046-8b60-456b-8b75-5467950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-11T08:22:30.000Z" ,
"modified" : "2017-12-11T08:22:30.000Z" ,
"pattern" : "[file:hashes.SHA1 = '9ab5a05bc3c8f1931a3a49278e18d2116f529704' AND file:name = 'com.fleeeishei.erabladmounsem']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-11T08:22:30Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a2e4265-81d0-44f3-ba7c-5daf950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-11T08:31:33.000Z" ,
"modified" : "2017-12-11T08:31:33.000Z" ,
"pattern" : "[file:hashes.SHA1 = '2e47c816a517548a0fbf809324d63868708d00d0' AND file:name = 'com.softmuiiurket.cleanerforandroid']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-11T08:31:33Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a2e42c6-1420-41e4-8580-60de950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-11T08:33:10.000Z" ,
"modified" : "2017-12-11T08:33:10.000Z" ,
"pattern" : "[file:hashes.SHA1 = 'de64139e6e91ac0dde755d2ef49d60251984652f' AND file:name = 'com.expjhvjhertsoft.bestrambooster']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-11T08:33:10Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a2e4302-df2c-4db4-8bba-71d3950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-11T08:34:10.000Z" ,
"modified" : "2017-12-11T08:34:10.000Z" ,
"pattern" : "[file:hashes.SHA1 = '6ab844c8fd654aaec29dac095214f4430012ee0e' AND file:name = 'gotov.games.toppro']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-11T08:34:10Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a2e46e8-f488-40cd-a9ec-878d950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-11T08:50:48.000Z" ,
"modified" : "2017-12-11T08:50:48.000Z" ,
"pattern" : "[file:hashes.SHA1 = 'c8dd6815f30367695938a7613c11e029055279a2' AND file:name = 'slots.forgame.vul']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-11T08:50:48Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a2e499b-4ccc-4e5c-ae67-bb07950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-11T09:02:19.000Z" ,
"modified" : "2017-12-11T09:02:19.000Z" ,
"pattern" : "[file:hashes.SHA1 = '47442bfdfbc0fb350b8b30271c310fe44ffb119a' AND file:name = 'com.bucholregaum.hampelpa']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-11T09:02:19Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a2e4a5b-b27c-4c2f-9112-ba38950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-11T09:05:31.000Z" ,
"modified" : "2017-12-11T09:05:31.000Z" ,
"pattern" : "[file:hashes.SHA1 = '604e6dcdf1fa1f7b5a85892ac3761bed81405bf6' AND file:name = 'com.peridesuramant.worldnews']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-11T09:05:31Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a2e4a97-e268-44ea-ada6-bbe1950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-11T09:06:31.000Z" ,
"modified" : "2017-12-11T09:06:31.000Z" ,
"pattern" : "[file:hashes.SHA1 = '532079b31e3acef2d71c75b31d77480304b2f7b9' AND file:name = 'com.peridesurrramant.worldnews']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-11T09:06:31Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--11c074b2-9ef5-468f-9a71-70ea7abb9d67" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T09:05:46.000Z" ,
"modified" : "2018-10-26T09:05:46.000Z" ,
"pattern" : "[file:hashes.MD5 = '4e6183687717cf7d7adc906cf5450729' AND file:hashes.SHA1 = 'c8dd6815f30367695938a7613c11e029055279a2' AND file:hashes.SHA256 = 'd6e48539252c4425bbb8f4b7e60f9ca6cbb703f324bbf1dde025a3d935b74cb9']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T09:05:46Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--df8032d7-cbe9-49fd-9747-63d74730df9f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T09:05:49.000Z" ,
"modified" : "2018-10-26T09:05:49.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-04T21:24:43" ,
"category" : "Other" ,
"uuid" : "72b61313-867c-48fe-afae-33879fda2b33"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/d6e48539252c4425bbb8f4b7e60f9ca6cbb703f324bbf1dde025a3d935b74cb9/analysis/1538688283/" ,
"category" : "External analysis" ,
"uuid" : "4f384fe0-2a17-4c90-81bd-1eea46dcb4dc"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "30/61" ,
"category" : "Other" ,
"uuid" : "2fdf0dd7-f0e3-4a27-b288-fd731165a63b"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--475d3bb8-eb86-4c51-a3a3-15ab39d91ddf" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T09:05:50.000Z" ,
"modified" : "2018-10-26T09:05:50.000Z" ,
"pattern" : "[file:hashes.MD5 = '21af98ec1a99ae37367d2e71d16b85fa' AND file:hashes.SHA1 = 'de64139e6e91ac0dde755d2ef49d60251984652f' AND file:hashes.SHA256 = 'f0c97217377ab0b4dd71baf5529d79e6349e477e69d4043a82f9c768ef46a932']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T09:05:50Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--94031eb7-4ff3-486e-b44f-eb4fa2ab0c1c" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T09:05:58.000Z" ,
"modified" : "2018-10-26T09:05:58.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-04T21:32:29" ,
"category" : "Other" ,
"uuid" : "beace62d-a2d6-42ad-a1ff-0d85f7ccf447"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/f0c97217377ab0b4dd71baf5529d79e6349e477e69d4043a82f9c768ef46a932/analysis/1538688749/" ,
"category" : "External analysis" ,
"uuid" : "f5e4dc71-0ada-47da-9c85-dd7999b9fdb4"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "30/62" ,
"category" : "Other" ,
"uuid" : "69190414-96bf-48ed-8a7c-2e002e4ef9eb"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--90b018c5-f3af-4ebf-9bb9-452b205d3038" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T09:06:12.000Z" ,
"modified" : "2018-10-26T09:06:12.000Z" ,
"pattern" : "[file:hashes.MD5 = 'f9617beec1b56eace79e870cb0925ffd' AND file:hashes.SHA1 = '604e6dcdf1fa1f7b5a85892ac3761bed81405bf6' AND file:hashes.SHA256 = '3fc104c7fb8f6419aa5b45a3abfcc545ddb8e225f1b6dcaf5824075cbdf5dddd']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T09:06:12Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--caa22be8-c2c9-465f-8aaa-c20e3eafec9f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T09:06:14.000Z" ,
"modified" : "2018-10-26T09:06:14.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-04T21:32:21" ,
"category" : "Other" ,
"uuid" : "f3bd1117-6b76-40f4-b890-3ff8c3a11b3a"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/3fc104c7fb8f6419aa5b45a3abfcc545ddb8e225f1b6dcaf5824075cbdf5dddd/analysis/1538688741/" ,
"category" : "External analysis" ,
"uuid" : "081c6e6e-4bcc-4223-9840-923e63ed044c"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "30/62" ,
"category" : "Other" ,
"uuid" : "70e00152-a2f1-46fd-b7c7-55f38c1255a4"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--a62c5ce0-9e21-466e-b317-a0a00fef80ef" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T09:06:16.000Z" ,
"modified" : "2018-10-26T09:06:16.000Z" ,
"pattern" : "[file:hashes.MD5 = 'c4acc83183ac0fabe92fc02ae5ef3ca4' AND file:hashes.SHA1 = '9ab5a05bc3c8f1931a3a49278e18d2116f529704' AND file:hashes.SHA256 = 'dd857e8505cedf84b316eb0f5cdcba1386fb8412bc630e671f474aeedfccb387']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T09:06:16Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--1263f071-0c4b-4d90-b6ef-81682679e425" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T09:06:23.000Z" ,
"modified" : "2018-10-26T09:06:23.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-04T21:32:25" ,
"category" : "Other" ,
"uuid" : "8aa24a31-7fdd-4ed4-a632-705aa09205d3"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/dd857e8505cedf84b316eb0f5cdcba1386fb8412bc630e671f474aeedfccb387/analysis/1538688745/" ,
"category" : "External analysis" ,
"uuid" : "0cc5c304-cd11-41a5-9583-7e971aad4310"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "34/62" ,
"category" : "Other" ,
"uuid" : "5263a8d1-50e1-4f76-8f4b-d73cef90d7ed"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--959b41df-ba0f-4520-a633-f28b0d7e5b21" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T09:06:25.000Z" ,
"modified" : "2018-10-26T09:06:25.000Z" ,
"pattern" : "[file:hashes.MD5 = 'a0dcd9907a3726edfb8e7de48b3aa8f6' AND file:hashes.SHA1 = '6ab844c8fd654aaec29dac095214f4430012ee0e' AND file:hashes.SHA256 = 'e980dc97b0b63158e251e6055d0f4362bf0a105bd999146de048f13a8f4aadb7']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T09:06:25Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--9c3a68e0-2e10-46ad-adda-0237549ebcd1" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T09:06:27.000Z" ,
"modified" : "2018-10-26T09:06:27.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-04T21:24:52" ,
"category" : "Other" ,
"uuid" : "fac591a5-dfe8-45be-994b-d62da1b2a50d"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/e980dc97b0b63158e251e6055d0f4362bf0a105bd999146de048f13a8f4aadb7/analysis/1538688292/" ,
"category" : "External analysis" ,
"uuid" : "58702d62-de2f-4573-b03a-f18fd9513e2e"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "29/62" ,
"category" : "Other" ,
"uuid" : "7a7627ca-a13a-48e8-8fad-142354ccfc99"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--973efe60-da30-4d60-aa15-6a1ee7f82e22" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T09:06:29.000Z" ,
"modified" : "2018-10-26T09:06:29.000Z" ,
"pattern" : "[file:hashes.MD5 = '327d37ad6391c674f2f5a96e08cbc95f' AND file:hashes.SHA1 = '47442bfdfbc0fb350b8b30271c310fe44ffb119a' AND file:hashes.SHA256 = 'ef3dfcd3e1351f46ee3cbfb3f71fe9d06a445d8affe2e679f34d8bf4bb618849']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T09:06:29Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--6b985af4-f961-4f8d-b2f7-513b6ed1c140" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T09:06:43.000Z" ,
"modified" : "2018-10-26T09:06:43.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-04T21:32:08" ,
"category" : "Other" ,
"uuid" : "1b0b2e29-f922-40e2-b9e7-e1138cc8cd16"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/ef3dfcd3e1351f46ee3cbfb3f71fe9d06a445d8affe2e679f34d8bf4bb618849/analysis/1538688728/" ,
"category" : "External analysis" ,
"uuid" : "e48a740f-3a6a-4209-b09f-9ce33ca4d094"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "31/61" ,
"category" : "Other" ,
"uuid" : "6184c6e0-29e2-4165-8e42-ccf5bbb23b19"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--ae8d1770-da33-4160-92e5-bc56fe5781d5" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T09:06:57.000Z" ,
"modified" : "2018-10-26T09:06:57.000Z" ,
"pattern" : "[file:hashes.MD5 = '2d5b8b4a868cbb8947f869f789fef5ff' AND file:hashes.SHA1 = '532079b31e3acef2d71c75b31d77480304b2f7b9' AND file:hashes.SHA256 = 'd2a6cbe9acd4193188f7aa6d922c916999845da82171889526550790f5632b47']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T09:06:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--095999e8-cf65-4068-9aa8-111b4596ae64" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T09:07:06.000Z" ,
"modified" : "2018-10-26T09:07:06.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-04T21:32:13" ,
"category" : "Other" ,
"uuid" : "9f46d30d-be05-4c45-be71-9d342e9a2fa1"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/d2a6cbe9acd4193188f7aa6d922c916999845da82171889526550790f5632b47/analysis/1538688733/" ,
"category" : "External analysis" ,
"uuid" : "5d3c8f72-90a2-466d-82ae-de692d5e9523"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "28/60" ,
"category" : "Other" ,
"uuid" : "4d7c5d08-44bb-456b-8b95-19a3c5f79d4c"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--01689a22-9fef-4b84-bc15-84a951d19e66" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T09:07:15.000Z" ,
"modified" : "2018-10-26T09:07:15.000Z" ,
"pattern" : "[file:hashes.MD5 = '2ed45ea4f3b26adcc5eaa88b5234c997' AND file:hashes.SHA1 = '2e47c816a517548a0fbf809324d63868708d00d0' AND file:hashes.SHA256 = 'ab9f1a59fcae8374282a39f244f164b58dbed4d16c37366bf2272c9509a7502e']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T09:07:15Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--2f933552-e105-4559-9ba2-4adb53dde71b" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T09:07:17.000Z" ,
"modified" : "2018-10-26T09:07:17.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-04T21:31:07" ,
"category" : "Other" ,
"uuid" : "973e093c-1a25-4961-9a70-1047fb6be0e7"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/ab9f1a59fcae8374282a39f244f164b58dbed4d16c37366bf2272c9509a7502e/analysis/1538688667/" ,
"category" : "External analysis" ,
"uuid" : "8f0d0a5f-9323-4973-b32a-adaf4007fe08"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "30/60" ,
"category" : "Other" ,
"uuid" : "2367705e-c040-48af-8d75-755949bfadf7"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "marking-definition" ,
"spec_version" : "2.1" ,
"id" : "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ,
"created" : "2017-01-20T00:00:00.000Z" ,
"definition_type" : "tlp" ,
"name" : "TLP:WHITE" ,
"definition" : {
"tlp" : "white"
}
}
2023-04-21 13:25:09 +00:00
]
}
