2023-06-14 17:31:25 +00:00
{
"type" : "bundle" ,
"id" : "bundle--5a37ccac-13e4-4703-9487-4070950d210f" ,
"objects" : [
{
"type" : "identity" ,
"spec_version" : "2.1" ,
"id" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-18T20:47:36.000Z" ,
"modified" : "2017-12-18T20:47:36.000Z" ,
"name" : "CIRCL" ,
"identity_class" : "organization"
} ,
{
"type" : "grouping" ,
"spec_version" : "2.1" ,
"id" : "grouping--5a37ccac-13e4-4703-9487-4070950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-18T20:47:36.000Z" ,
"modified" : "2017-12-18T20:47:36.000Z" ,
"name" : "OSINT - Graftor - But I Never Asked for This\u2026" ,
"context" : "suspicious-activity" ,
"object_refs" : [
"observed-data--5a37ccc2-b818-4ea8-951f-4e6f950d210f" ,
"url--5a37ccc2-b818-4ea8-951f-4e6f950d210f" ,
"indicator--5a37cf9b-0f4c-41d8-bd86-4fec950d210f" ,
"indicator--5a37cf9b-0ac8-4fb2-aa7d-4f44950d210f" ,
"indicator--5a37cf9c-0980-4f21-b32c-478f950d210f" ,
"indicator--5a37cf9c-57b8-4fda-8d1d-4bf6950d210f" ,
"indicator--5a37cf9c-df28-41b5-b61a-4783950d210f" ,
"indicator--5a37d08d-4b94-4832-a1c2-4e00950d210f" ,
"indicator--5a37d146-e344-482b-9b62-416f950d210f" ,
"indicator--5a37d162-6368-40e2-8542-4c9b950d210f" ,
"observed-data--5a37d162-19a0-412b-b81d-40c3950d210f" ,
"domain-name--5a37d162-19a0-412b-b81d-40c3950d210f" ,
"observed-data--5a37d162-a1fc-4218-8a59-45ac950d210f" ,
"domain-name--5a37d162-a1fc-4218-8a59-45ac950d210f" ,
"indicator--5a37d162-54ac-4906-851c-4110950d210f" ,
"indicator--5a37d162-43cc-45b5-bdda-4ea7950d210f" ,
"indicator--5a37d162-5b44-4686-bbf2-4983950d210f" ,
"indicator--5a37d162-a7dc-4d9f-b7da-477a950d210f" ,
"indicator--5a37d162-e218-417a-85d7-46d2950d210f" ,
"indicator--5a37d162-14a0-49d3-9b41-4453950d210f" ,
"indicator--5a37d162-27a8-44bb-a11d-47b9950d210f" ,
"indicator--5a37d162-18b4-45c1-85f4-449e950d210f" ,
"indicator--5a37d162-c1e8-4a7f-ba5e-4ec6950d210f" ,
"indicator--5a37d162-e460-4ed8-bc65-4369950d210f" ,
"indicator--5a37d162-f288-4ae4-a01c-4ad7950d210f" ,
"indicator--5a37d162-0178-43d0-a643-4b31950d210f" ,
"indicator--5a37cfe7-03a8-43cf-91d9-4b46950d210f" ,
"indicator--5a37d02b-66d0-4d32-a418-4ae4950d210f" ,
"indicator--5a37d070-e818-4ed7-ab3b-4a9c950d210f"
] ,
"labels" : [
"Threat-Report" ,
"misp:tool=\"MISP-STIX-Converter\"" ,
"misp-galaxy:tool=\"Aumlib\"" ,
"type:OSINT" ,
"osint:source-type=\"blog-post\"" ,
"workflow:todo=\"expansion\"" ,
"workflow:todo=\"review-for-false-positive\"" ,
"workflow:todo=\"review-before-publication\""
] ,
"object_marking_refs" : [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5a37ccc2-b818-4ea8-951f-4e6f950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-18T14:16:07.000Z" ,
"modified" : "2017-12-18T14:16:07.000Z" ,
"first_observed" : "2017-12-18T14:16:07Z" ,
"last_observed" : "2017-12-18T14:16:07Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5a37ccc2-b818-4ea8-951f-4e6f950d210f"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\"" ,
"osint:source-type=\"blog-post\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5a37ccc2-b818-4ea8-951f-4e6f950d210f" ,
"value" : "http://blog.talosintelligence.com/2017/09/graftor-but-i-never-asked-for-this.html"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a37cf9b-0f4c-41d8-bd86-4fec950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-18T14:24:27.000Z" ,
"modified" : "2017-12-18T14:24:27.000Z" ,
"description" : "Alternate Data Streams(ADS)" ,
"pattern" : "[file:name = 'C:UsersdexAppDataLocalTemp2263387661.exe:Zone.Identifier']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-18T14:24:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a37cf9b-0ac8-4fb2-aa7d-4f44950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-18T14:24:27.000Z" ,
"modified" : "2017-12-18T14:24:27.000Z" ,
"description" : "Alternate Data Streams(ADS)" ,
"pattern" : "[file:name = 'C:UsersdexAppDataLocalTempQBPO5ppcuhJG.exe']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-18T14:24:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a37cf9c-0980-4f21-b32c-478f950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-18T14:24:28.000Z" ,
"modified" : "2017-12-18T14:24:28.000Z" ,
"description" : "Alternate Data Streams(ADS)" ,
"pattern" : "[file:name = 'C:UsersdexAppDataLocalTemp2263387661.exe']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-18T14:24:28Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a37cf9c-57b8-4fda-8d1d-4bf6950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-18T14:24:28.000Z" ,
"modified" : "2017-12-18T14:24:28.000Z" ,
"description" : "Alternate Data Streams(ADS)" ,
"pattern" : "[file:name = 'C:UsersdexAppDataLocalTempAyWdp7tHPIeU.exe']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-18T14:24:28Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a37cf9c-df28-41b5-b61a-4783950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-18T14:24:28.000Z" ,
"modified" : "2017-12-18T14:24:28.000Z" ,
"description" : "Alternate Data Streams(ADS)" ,
"pattern" : "[file:name = 'C:WindowsSystem32regsvr32.exe:Zone.Identifier']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-18T14:24:28Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a37d08d-4b94-4832-a1c2-4e00950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-18T14:28:29.000Z" ,
"modified" : "2017-12-18T14:28:29.000Z" ,
"description" : "Command and Control Server GET Request" ,
"pattern" : "[url:value = 'http://kskmasdqsjuzom.regularfood.gdn/J/ZGF0YV9maWxlcz0yMyZ0eXBlPXN0YXRpYyZuYW1lPVRlbXAlNUMyMjYzMzg3NjYxLmV4ZSZybmQ9ZTY5NjM5ZjJjYTdlNWNiNDU2ZmYwMDUyN2M2ODBlNDMxMTY0YmFhZGJlZWI3MTI5YjIwZGYzM2M3YzIzNTc1YQ']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-18T14:28:29Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"url\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a37d146-e344-482b-9b62-416f950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-18T14:31:34.000Z" ,
"modified" : "2017-12-18T14:31:34.000Z" ,
"description" : "Command and Control Server POST Request" ,
"pattern" : "[url:value = 'http://kskmasdqsjuzom.regularfood.gdn/J/ZGF0YV9maWxlcz0yMyZ0eXBlPXN0YXRpYyZuYW1lPVRlbXAlNUMyMjYzMzg3NjYxLmV4ZSZybmQ9ZTY5NjM5ZjJjYTdlNWNiNDU2ZmYwMDUyN2M2ODBlNDMxMTY0YmFhZGJlZWI3MTI5YjIwZGYzM2M3YzIzNTc1YSZkZWxheT0zODk']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-18T14:31:34Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"url\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a37d162-6368-40e2-8542-4c9b950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-18T14:32:02.000Z" ,
"modified" : "2017-12-18T14:32:02.000Z" ,
"description" : "Domains from sandbox run" ,
"pattern" : "[domain-name:value = 'arolina.torchpound.gdn']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-18T14:32:02Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"hostname\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5a37d162-19a0-412b-b81d-40c3950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-18T20:47:00.000Z" ,
"modified" : "2017-12-18T20:47:00.000Z" ,
"first_observed" : "2017-12-18T20:47:00Z" ,
"last_observed" : "2017-12-18T20:47:00Z" ,
"number_observed" : 1 ,
"object_refs" : [
"domain-name--5a37d162-19a0-412b-b81d-40c3950d210f"
] ,
"labels" : [
"misp:type=\"hostname\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "domain-name" ,
"spec_version" : "2.1" ,
"id" : "domain-name--5a37d162-19a0-412b-b81d-40c3950d210f" ,
"value" : "binupdate.mail.ru"
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5a37d162-a1fc-4218-8a59-45ac950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-18T20:46:52.000Z" ,
"modified" : "2017-12-18T20:46:52.000Z" ,
"first_observed" : "2017-12-18T20:46:52Z" ,
"last_observed" : "2017-12-18T20:46:52Z" ,
"number_observed" : 1 ,
"object_refs" : [
"domain-name--5a37d162-a1fc-4218-8a59-45ac950d210f"
] ,
"labels" : [
"misp:type=\"hostname\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "domain-name" ,
"spec_version" : "2.1" ,
"id" : "domain-name--5a37d162-a1fc-4218-8a59-45ac950d210f" ,
"value" : "crl.microsoft.com"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a37d162-54ac-4906-851c-4110950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-18T14:32:02.000Z" ,
"modified" : "2017-12-18T14:32:02.000Z" ,
"description" : "Domains from sandbox run" ,
"pattern" : "[domain-name:value = 'dreple.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-18T14:32:02Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a37d162-43cc-45b5-bdda-4ea7950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-18T14:32:02.000Z" ,
"modified" : "2017-12-18T14:32:02.000Z" ,
"description" : "Domains from sandbox run" ,
"pattern" : "[domain-name:value = 'gambling577.xyz']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-18T14:32:02Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a37d162-5b44-4686-bbf2-4983950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-18T14:32:02.000Z" ,
"modified" : "2017-12-18T14:32:02.000Z" ,
"description" : "Domains from sandbox run" ,
"pattern" : "[domain-name:value = 'jvusdtufhlreari.twiceprint.gdn']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-18T14:32:02Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"hostname\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a37d162-a7dc-4d9f-b7da-477a950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-18T14:32:02.000Z" ,
"modified" : "2017-12-18T14:32:02.000Z" ,
"description" : "Domains from sandbox run" ,
"pattern" : "[domain-name:value = 'kskmasdqsjuzom.regularfood.gdn']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-18T14:32:02Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"hostname\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a37d162-e218-417a-85d7-46d2950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-18T14:32:02.000Z" ,
"modified" : "2017-12-18T14:32:02.000Z" ,
"description" : "Domains from sandbox run" ,
"pattern" : "[domain-name:value = 'mentalaware.gdn']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-18T14:32:02Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a37d162-14a0-49d3-9b41-4453950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-18T14:32:02.000Z" ,
"modified" : "2017-12-18T14:32:02.000Z" ,
"description" : "Domains from sandbox run" ,
"pattern" : "[domain-name:value = 'mrds.mail.ru']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-18T14:32:02Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"hostname\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a37d162-27a8-44bb-a11d-47b9950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-18T14:32:02.000Z" ,
"modified" : "2017-12-18T14:32:02.000Z" ,
"description" : "Domains from sandbox run" ,
"pattern" : "[domain-name:value = 'nottotrack.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-18T14:32:02Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a37d162-18b4-45c1-85f4-449e950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-18T14:32:02.000Z" ,
"modified" : "2017-12-18T14:32:02.000Z" ,
"description" : "Domains from sandbox run" ,
"pattern" : "[domain-name:value = 'plugpackdownload.net']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-18T14:32:02Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a37d162-c1e8-4a7f-ba5e-4ec6950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-18T14:32:02.000Z" ,
"modified" : "2017-12-18T14:32:02.000Z" ,
"description" : "Domains from sandbox run" ,
"pattern" : "[domain-name:value = 's2.symcb.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-18T14:32:02Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"hostname\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a37d162-e460-4ed8-bc65-4369950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-18T14:32:02.000Z" ,
"modified" : "2017-12-18T14:32:02.000Z" ,
"description" : "Domains from sandbox run" ,
"pattern" : "[domain-name:value = 'sputnikmailru.cdnmail.ru']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-18T14:32:02Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"hostname\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a37d162-f288-4ae4-a01c-4ad7950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-18T14:32:02.000Z" ,
"modified" : "2017-12-18T14:32:02.000Z" ,
"description" : "Domains from sandbox run" ,
"pattern" : "[domain-name:value = 'ss.symcd.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-18T14:32:02Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"hostname\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a37d162-0178-43d0-a643-4b31950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-18T14:32:02.000Z" ,
"modified" : "2017-12-18T14:32:02.000Z" ,
"description" : "Domains from sandbox run" ,
"pattern" : "[domain-name:value = 'xml.binupdate.mail.ru']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-18T14:32:02Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"hostname\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a37cfe7-03a8-43cf-91d9-4b46950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-18T14:25:43.000Z" ,
"modified" : "2017-12-18T14:25:43.000Z" ,
"description" : "Graftor Dropper" ,
"pattern" : "[file:hashes.MD5 = '9b9ce661a764d84a4636812e1dfcb03b' AND file:hashes.SHA1 = 'fd3ccf65eab21a77d2e440bd23c59d52e96a03a4' AND file:hashes.SHA256 = '41474cd23ff0a861625ec1304f882891826829ed26ed1662aae2e7ebbe3605f2' AND file:name = '2263387661.exe']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-18T14:25:43Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a37d02b-66d0-4d32-a418-4ae4950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-18T14:26:51.000Z" ,
"modified" : "2017-12-18T14:26:51.000Z" ,
"description" : "Dumped 2nd stage" ,
"pattern" : "[file:hashes.MD5 = '40bde09fc059f205f67b181c34de666b' AND file:hashes.SHA1 = '99c7627708c4ab1fca3222738c573e7376ab4070' AND file:hashes.SHA256 = 'eefdbe891e35390b84181eabe0ace6e202f5b2a050e800fb8e82327d5e57336d']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-18T14:26:51Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a37d070-e818-4ed7-ab3b-4a9c950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-18T14:28:00.000Z" ,
"modified" : "2017-12-18T14:28:00.000Z" ,
"description" : "Dumped 3rd stage" ,
"pattern" : "[file:hashes.MD5 = '1e9f40e70ed3ab0ca9a52c216f807eff' AND file:hashes.SHA1 = '7c4cd0ff0e004a62c9ab7f8bd991094226eca842' AND file:hashes.SHA256 = '5eb2333956bebb81da365a26e56fea874797fa003107f95cda21273045d98385']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-18T14:28:00Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "marking-definition" ,
"spec_version" : "2.1" ,
"id" : "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ,
"created" : "2017-01-20T00:00:00.000Z" ,
"definition_type" : "tlp" ,
"name" : "TLP:WHITE" ,
"definition" : {
"tlp" : "white"
}
}
]
}
