2023-06-14 17:31:25 +00:00
{
"type" : "bundle" ,
"id" : "bundle--5a3c2fcd-8328-42bb-a95e-4f4402de0b81" ,
"objects" : [
{
"type" : "identity" ,
"spec_version" : "2.1" ,
"id" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T13:17:25.000Z" ,
"modified" : "2017-12-22T13:17:25.000Z" ,
"name" : "CIRCL" ,
"identity_class" : "organization"
} ,
{
"type" : "grouping" ,
"spec_version" : "2.1" ,
"id" : "grouping--5a3c2fcd-8328-42bb-a95e-4f4402de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T13:17:25.000Z" ,
"modified" : "2017-12-22T13:17:25.000Z" ,
"name" : "OSINT - Sednit update: How Fancy Bear Spent the Year" ,
"context" : "suspicious-activity" ,
"object_refs" : [
"observed-data--5a3c2fda-78f4-44b7-8366-46da02de0b81" ,
"url--5a3c2fda-78f4-44b7-8366-46da02de0b81" ,
"x-misp-attribute--5a3c2fee-7c8c-438a-8f7f-465402de0b81" ,
"indicator--5a3c3045-ab0c-4d38-8efe-459002de0b81" ,
"indicator--5a3c3045-61dc-495c-ae8a-471e02de0b81" ,
"indicator--5a3c3045-e354-4978-a6b4-49ad02de0b81" ,
"indicator--5a3c3045-968c-4572-9f64-491502de0b81" ,
"indicator--5a3c3045-eb44-433f-a13a-44b902de0b81" ,
"indicator--5a3c3045-6a88-479d-b799-4d3d02de0b81" ,
"indicator--5a3c3045-7480-4831-a5c4-48c802de0b81" ,
"indicator--5a3cd5b6-9568-4342-b2ab-4c62950d210f" ,
"indicator--5a3cd604-e11c-4de5-bbbf-c170950d210f" ,
"indicator--5a3cd693-fd9c-4fcf-b69a-439c950d210f" ,
"indicator--5a3cd6c2-d290-4787-910f-4e6d950d210f" ,
"indicator--5a3cd74e-1504-40ff-9a28-4501950d210f" ,
"indicator--5a3cd775-e4cc-44bb-89b6-4c5a950d210f" ,
"indicator--5a3cd82f-2788-4561-bbeb-5165950d210f" ,
"indicator--5a3cd847-b5a0-42f7-ac4b-5165950d210f" ,
"indicator--5a3cd861-65c0-4b69-9429-4f37950d210f" ,
"indicator--5a3cd87d-f514-4071-a5f7-4ec2950d210f" ,
"indicator--5a3cd896-f6cc-4e52-bcb2-442c950d210f" ,
"indicator--5a3cd8ae-54d0-46bb-adbb-4c5a950d210f" ,
"indicator--5a3cd8bb-a704-4f1d-a235-444e950d210f" ,
"indicator--5a3cd8c9-6568-406a-853c-4862950d210f" ,
"indicator--5a3cd8db-2838-4466-a986-4afb950d210f" ,
"indicator--5a3cd8fb-cd14-4b00-9710-430c950d210f" ,
"indicator--5a3cd90e-538c-4b7e-95dc-5276950d210f" ,
"indicator--5a3cd927-e410-489c-abfc-4b63950d210f" ,
"indicator--5a3cd93c-716c-4918-a00f-4671950d210f" ,
"indicator--5a3cda96-85c4-45a1-82ea-c5ed950d210f" ,
"indicator--5a3cdbc7-dbec-4b8c-8ba3-4c5a950d210f" ,
"indicator--5a3cdbf6-f814-491f-9f93-4c59950d210f" ,
"indicator--5a3cdc09-6fbc-4ca1-bfaa-c5ed950d210f" ,
"indicator--5a3cdc21-856c-48bd-a757-4f4b950d210f" ,
"indicator--5a3cdc37-89e8-4a2d-823a-4af8950d210f" ,
"indicator--5a3cdc48-b9a0-4775-a03f-5156950d210f" ,
"indicator--5a3cdc5a-8760-4efa-949a-4c5a950d210f" ,
"indicator--5a3cdc72-1538-4c66-af46-427b950d210f" ,
"indicator--5a3ce3a9-f070-4403-a1f6-4b8c950d210f" ,
"indicator--5a3ce3c3-34b4-4e1f-b238-4399950d210f" ,
"indicator--5a3ce3d4-07bc-4af3-90fc-4798950d210f" ,
"indicator--5a3ce3ea-580c-477c-9b73-4e57950d210f" ,
"indicator--5a3ce404-efc0-4f15-864e-55ea950d210f" ,
"indicator--5a3ce417-7cd4-4c36-8a73-55ea950d210f" ,
"indicator--5a3ce42b-2e0c-4a26-b6c8-47a3950d210f" ,
"indicator--5a3ce43a-5478-4f65-95b2-4e1e950d210f" ,
"indicator--5a3ce44a-ce70-42b7-80b8-c328950d210f" ,
"indicator--5a3ce58a-3198-4cb8-9d51-44e5950d210f" ,
"indicator--5a3ce5f8-3418-4f7b-ae41-4bca950d210f" ,
"indicator--5a3ce60a-6db8-4212-b194-4339950d210f" ,
"indicator--5a3ce61a-c1f0-4c7c-b815-4fa9950d210f" ,
"indicator--5a3ce63e-0240-46f5-b9ed-4759950d210f" ,
"indicator--5a3ce64e-8bf8-4dc6-be49-437f950d210f" ,
"indicator--5a3ce65c-fc40-4585-817e-4ca3950d210f" ,
"indicator--5a3ce66e-70b4-47e7-b965-46f6950d210f" ,
"indicator--5a3ce680-90d4-478d-95db-48a6950d210f" ,
"indicator--5a3ce68d-1940-4ea6-becd-44fe950d210f" ,
"indicator--5a3ce6a1-3f1c-4d5d-bac7-406d950d210f" ,
"indicator--5a3ce6ae-98d8-4270-b88f-47f2950d210f" ,
"relationship--8bbe006d-57cf-40fe-845d-fa6330a07dd4" ,
"relationship--d34ef0ac-f579-4028-b079-6134c3ba9609" ,
"relationship--c31cd3b2-3b2b-403a-ace6-294d07474b98" ,
"relationship--112c8c22-3623-4e1d-9864-e990eb1964af" ,
"relationship--6ebde123-e714-4076-bddd-463d27bcbb48" ,
"relationship--9136d15f-db48-49a3-8ac0-f611558d0a15" ,
"relationship--0349b68f-4bc2-46a2-af6e-d36fd83042a5" ,
"relationship--12289648-d342-46bb-ab67-e67e22292e6b" ,
"relationship--fd8d907f-f705-443c-ac13-7059c40a8963" ,
"relationship--c20b12ee-2e2d-4a6c-b651-c30f80c57ac4" ,
"relationship--056502e1-7ae7-4a88-a801-947f6c020230" ,
"relationship--21954809-85a5-4958-b8db-ddc1b5603014" ,
"relationship--8b6bd872-0695-4f02-a580-5024f4aede8c" ,
"relationship--da7770c3-3a14-4d56-826e-396797850e4b" ,
"relationship--9a8fb7c8-e1c6-448d-85e8-fdc378ff8530" ,
"relationship--7f1eddde-f9ae-4bb3-ab94-0eb54c2b94f7" ,
"relationship--247e9e63-7e96-4ea0-8254-d89aa0925d94" ,
"relationship--bba0da91-0ded-4e20-ad99-9fc3bcac3d49" ,
"relationship--2a42c10f-2d53-4165-883f-9e25a55e6dc5" ,
"relationship--131bea11-05b9-4f82-a54a-39096838d5e6"
] ,
"labels" : [
"Threat-Report" ,
"misp:tool=\"MISP-STIX-Converter\"" ,
"workflow:state=\"incomplete\"" ,
"workflow:todo=\"create-missing-misp-galaxy-cluster-values\"" ,
"workflow:todo=\"create-missing-misp-galaxy-cluster\"" ,
"misp-galaxy:threat-actor=\"Sofacy\"" ,
"misp-galaxy:exploit-kit=\"Sednit EK\"" ,
"misp-galaxy:tool=\"GAMEFISH\"" ,
"misp-galaxy:mitre-malware=\"JHUHUGIT\"" ,
"misp-galaxy:tool=\"X-Tunnel\"" ,
"misp-galaxy:mitre-malware=\"XTunnel\"" ,
"misp-galaxy:mitre-malware=\"ADVSTORESHELL\"" ,
"misp-galaxy:tool=\"EVILTOSS\"" ,
"misp-galaxy:mitre-malware=\"USBStealer\"" ,
"misp-galaxy:tool=\"X-Agent\"" ,
"misp-galaxy:mitre-malware=\"XAgentOSX\"" ,
"misp-galaxy:mitre-malware=\"CHOPSTICK\"" ,
"misp-galaxy:exploit-kit=\"DealersChoice\"" ,
"misp-galaxy:mitre-malware=\"Downdelph\""
] ,
"object_marking_refs" : [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5a3c2fda-78f4-44b7-8366-46da02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-21T22:05:21.000Z" ,
"modified" : "2017-12-21T22:05:21.000Z" ,
"first_observed" : "2017-12-21T22:05:21Z" ,
"last_observed" : "2017-12-21T22:05:21Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5a3c2fda-78f4-44b7-8366-46da02de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\"" ,
"osint:source-type=\"blog-post\"" ,
"osint:certainty=\"93\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5a3c2fda-78f4-44b7-8366-46da02de0b81" ,
"value" : "https://www.welivesecurity.com/2017/12/21/sednit-update-fancy-bear-spent-year/"
} ,
{
"type" : "x-misp-attribute" ,
"spec_version" : "2.1" ,
"id" : "x-misp-attribute--5a3c2fee-7c8c-438a-8f7f-465402de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-21T22:05:21.000Z" ,
"modified" : "2017-12-21T22:05:21.000Z" ,
"labels" : [
"misp:type=\"text\"" ,
"misp:category=\"External analysis\"" ,
"osint:source-type=\"blog-post\"" ,
"osint:certainty=\"93\""
] ,
"x_misp_category" : "External analysis" ,
"x_misp_type" : "text" ,
"x_misp_value" : "The Sednit group \u2014 also known as Strontium, APT28, Fancy Bear or Sofacy\u2009\u2014\u2009is a group of attackers operating since 2004, if not earlier, and whose main objective is to steal confidential information from specific targets.\r\n\r\nThis article is a follow-up to ESET\u2019s presentation at BlueHat in November 2017. Late in 2016 we published a white paper covering Sednit activity between 2014 and 2016. Since then, we have continued to actively track Sednit\u2019s operations, and today we are publishing a brief overview of what our tracking uncovered in terms of the group\u2019s activities and updates to their toolset. The first section covers the update of their attack methodology: namely, the ways in which this group tries to compromise their targets systems. The second section covers the evolution of their tools, with a particular emphasis on a detailed analysis of a new version of their flagship malware: Xagent."
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3c3045-ab0c-4d38-8efe-459002de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-21T22:05:57.000Z" ,
"modified" : "2017-12-21T22:05:57.000Z" ,
"description" : "Xagent Samples" ,
"pattern" : "[domain-name:value = 'movieultimate.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-21T22:05:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3c3045-61dc-495c-ae8a-471e02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-21T22:05:57.000Z" ,
"modified" : "2017-12-21T22:05:57.000Z" ,
"description" : "Xagent Samples" ,
"pattern" : "[domain-name:value = 'meteost.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-21T22:05:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3c3045-e354-4978-a6b4-49ad02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-21T22:05:57.000Z" ,
"modified" : "2017-12-21T22:05:57.000Z" ,
"description" : "Xagent Samples" ,
"pattern" : "[domain-name:value = 'faststoragefiles.org']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-21T22:05:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3c3045-968c-4572-9f64-491502de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-21T22:05:57.000Z" ,
"modified" : "2017-12-21T22:05:57.000Z" ,
"description" : "Xagent Samples" ,
"pattern" : "[domain-name:value = 'nethostnet.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-21T22:05:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3c3045-eb44-433f-a13a-44b902de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-21T22:05:57.000Z" ,
"modified" : "2017-12-21T22:05:57.000Z" ,
"description" : "Xagent Samples" ,
"pattern" : "[domain-name:value = 'fsportal.net']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-21T22:05:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3c3045-6a88-479d-b799-4d3d02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-21T22:05:57.000Z" ,
"modified" : "2017-12-21T22:05:57.000Z" ,
"description" : "Xagent Samples" ,
"pattern" : "[domain-name:value = 'fastdataexchange.org']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-21T22:05:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3c3045-7480-4831-a5c4-48c802de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-21T22:05:57.000Z" ,
"modified" : "2017-12-21T22:05:57.000Z" ,
"description" : "Xagent Samples" ,
"pattern" : "[domain-name:value = 'newfilmts.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-21T22:05:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3cd5b6-9568-4342-b2ab-4c62950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T09:51:50.000Z" ,
"modified" : "2017-12-22T09:51:50.000Z" ,
"description" : "Win32/Sednit.AX" ,
"pattern" : "[file:hashes.SHA1 = '68064fc152e23d56e541714af52651cb4ba81aaf' AND file:name = 'Bulletin.doc' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T09:51:50Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3cd604-e11c-4de5-bbbf-c170950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T09:53:08.000Z" ,
"modified" : "2017-12-22T09:53:08.000Z" ,
"description" : "Win32/Exploit.CVE-2016-4117.A" ,
"pattern" : "[file:hashes.SHA1 = 'f3805382ae2e23ff1147301d131a06e00e4ff75f' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T09:53:08Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3cd693-fd9c-4fcf-b69a-439c950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T09:55:31.000Z" ,
"modified" : "2017-12-22T09:55:31.000Z" ,
"description" : "Win32/Exploit.Agent.NUB" ,
"pattern" : "[file:hashes.SHA1 = '512bdfe937314ac3f195c462c395feeb36932971' AND file:name = 'OC_PSO_2017.doc' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T09:55:31Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3cd6c2-d290-4787-910f-4e6d950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T09:56:18.000Z" ,
"modified" : "2017-12-22T09:56:18.000Z" ,
"description" : "Win32/Exploit.Agent.NTR" ,
"pattern" : "[file:hashes.SHA1 = '30b3e8c0f3f3cf200daa21c267ffab3cad64e68b' AND file:name = 'NASAMS.doc' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T09:56:18Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3cd74e-1504-40ff-9a28-4501950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T09:58:38.000Z" ,
"modified" : "2017-12-22T09:58:38.000Z" ,
"description" : "Win32/Exploit.Agent.NTO" ,
"pattern" : "[file:hashes.SHA1 = '4173b29a251cd9c1cab135f67cb60acab4ace0c5' AND file:name = 'Programm_Details.doc' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T09:58:38Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3cd775-e4cc-44bb-89b6-4c5a950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T09:59:17.000Z" ,
"modified" : "2017-12-22T09:59:17.000Z" ,
"description" : "Win32/Exploit.Agent.NTR" ,
"pattern" : "[file:hashes.SHA1 = '12a37cfdd3f3671074dd5b0f354269cec028fb52' AND file:name = 'Operation_in_Mosul.rtf' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T09:59:17Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3cd82f-2788-4561-bbeb-5165950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T10:02:23.000Z" ,
"modified" : "2017-12-22T10:02:23.000Z" ,
"description" : "SWF/Agent.L" ,
"pattern" : "[file:hashes.SHA1 = '15201766bd964b7c405aeb11db81457220c31e46' AND file:name = 'ARM-NATO_ENGLISH_30_NOV_2016.doc' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T10:02:23Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3cd847-b5a0-42f7-ac4b-5165950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T10:02:47.000Z" ,
"modified" : "2017-12-22T10:02:47.000Z" ,
"description" : "Win32/Exploit.Agent.BL" ,
"pattern" : "[file:hashes.SHA1 = '8078e411fbe33864dfd8f87ad5105cc1fd26d62e' AND file:name = 'Olympic-Agenda-2020-20-20-Recommendations.doc' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T10:02:47Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3cd861-65c0-4b69-9429-4f37950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T10:03:13.000Z" ,
"modified" : "2017-12-22T10:03:13.000Z" ,
"description" : "Win32/Exploit.Agent.NUG" ,
"pattern" : "[file:hashes.SHA1 = '33447383379ca99083442b852589111296f0c603' AND file:name = 'Merry_Christmas!.docx' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T10:03:13Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3cd87d-f514-4071-a5f7-4ec2950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T10:03:41.000Z" ,
"modified" : "2017-12-22T10:03:41.000Z" ,
"description" : "Win32/Exploit.Agent.NWZ" ,
"pattern" : "[file:hashes.SHA1 = 'd5235d136cfcadbef431eea7253d80bde414db9d' AND file:name = 'Trump\u2019s_Attack_on_Syria_English.docx' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T10:03:41Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3cd896-f6cc-4e52-bcb2-442c950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T10:04:06.000Z" ,
"modified" : "2017-12-22T10:04:06.000Z" ,
"description" : "Win32/Sednit.BN" ,
"pattern" : "[file:hashes.SHA1 = 'f293a2bfb728060c54efeeb03c5323893b5c80df' AND file:name = 'Hotel_Reservation_Form.doc' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T10:04:06Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3cd8ae-54d0-46bb-adbb-4c5a950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T10:04:30.000Z" ,
"modified" : "2017-12-22T10:04:30.000Z" ,
"description" : "Win32/Sednit.BN" ,
"pattern" : "[file:hashes.SHA1 = 'bb10ed5d59672fbc6178e35d0feac0562513e9f0' AND file:name = 'SB_Doc_2017-3_Implementation_of_Key_Taskings_and_Next_Steps.doc' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T10:04:30Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3cd8bb-a704-4f1d-a235-444e950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T10:04:43.000Z" ,
"modified" : "2017-12-22T10:04:43.000Z" ,
"pattern" : "[file:hashes.SHA1 = '4873bafe44cff06845faa0ce7c270c4ce3c9f7b9' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T10:04:43Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3cd8c9-6568-406a-853c-4862950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T10:04:57.000Z" ,
"modified" : "2017-12-22T10:04:57.000Z" ,
"pattern" : "[file:hashes.SHA1 = '169c8f3e3d22e192c108bc95164d362ce5437465' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T10:04:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3cd8db-2838-4466-a986-4afb950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T10:05:15.000Z" ,
"modified" : "2017-12-22T10:05:15.000Z" ,
"description" : "Win32/Sednit.BN" ,
"pattern" : "[file:hashes.SHA1 = 'cc7607015cd7a1a4452acd3d87adabdd7e005bd7' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T10:05:15Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3cd8fb-cd14-4b00-9710-430c950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T10:05:47.000Z" ,
"modified" : "2017-12-22T10:05:47.000Z" ,
"description" : "Win32/Exploit.Agent.NTM" ,
"pattern" : "[file:hashes.SHA1 = '5d2c7d87995cc5b8184baba2c7a1900a48b2f42d' AND file:name = 'Caucasian_Eagle_ENG.docx' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T10:05:47Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3cd90e-538c-4b7e-95dc-5276950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T10:06:06.000Z" ,
"modified" : "2017-12-22T10:06:06.000Z" ,
"description" : "SWF/Exploit.CVE-2017-11292.A" ,
"pattern" : "[file:hashes.SHA1 = '7aada8bcc0d1ab8ffb1f0fae4757789c6f5546a3' AND file:name = 'World War3.docx' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T10:06:06Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3cd927-e410-489c-abfc-4b63950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T10:06:31.000Z" ,
"modified" : "2017-12-22T10:06:31.000Z" ,
"description" : "VBA/DDE.E" ,
"pattern" : "[file:hashes.SHA1 = '68c2809560c7623d2307d8797691abf3eafe319a' AND file:name = 'SaberGuardian2017.docx' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T10:06:31Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3cd93c-716c-4918-a00f-4671950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T10:06:52.000Z" ,
"modified" : "2017-12-22T10:06:52.000Z" ,
"description" : "VBA/DDE.L" ,
"pattern" : "[file:hashes.SHA1 = '1c6c700ceebfbe799e115582665105caa03c5c9e' AND file:name = 'IsisAttackInNewYork.docx' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T10:06:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3cda96-85c4-45a1-82ea-c5ed950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T10:17:09.000Z" ,
"modified" : "2017-12-22T10:17:09.000Z" ,
"description" : "Win64/Sednit.Z" ,
"pattern" : "[file:hashes.SHA1 = '6f0fc0ebba3e4c8b26a69cdf519edf8d1aa2f4bb' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T10:17:09Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3cdbc7-dbec-4b8c-8ba3-4c5a950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T10:21:34.000Z" ,
"modified" : "2017-12-22T10:21:34.000Z" ,
"description" : "Win64/Sednit.Z" ,
"pattern" : "[file:hashes.SHA1 = 'e19f753e514f6adec8f81bcdefb9117979e69627' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T10:21:34Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3cdbf6-f814-491f-9f93-4c59950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T10:23:33.000Z" ,
"modified" : "2017-12-22T10:23:33.000Z" ,
"description" : "Win32/Sednit.BO" ,
"pattern" : "[file:hashes.SHA1 = '961468ddd3d0fa25beb8210c81ba620f9170ed30' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T10:23:33Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3cdc09-6fbc-4ca1-bfaa-c5ed950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T10:22:52.000Z" ,
"modified" : "2017-12-22T10:22:52.000Z" ,
"description" : "Win32/Sednit.BO" ,
"pattern" : "[file:hashes.SHA1 = 'a0719b50265505c8432616c0a4e14ed206981e95' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T10:22:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3cdc21-856c-48bd-a757-4f4b950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T10:23:49.000Z" ,
"modified" : "2017-12-22T10:23:49.000Z" ,
"description" : "Win64/Sednit.Y" ,
"pattern" : "[file:hashes.SHA1 = '2cf6436b99d11d9d1e0c488af518e35162ecbc9c' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T10:23:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3cdc37-89e8-4a2d-823a-4af8950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T10:23:13.000Z" ,
"modified" : "2017-12-22T10:23:13.000Z" ,
"description" : "Win64/Sednit.Y" ,
"pattern" : "[file:hashes.SHA1 = 'fec29b4f4dccc59770c65c128dfe4564d7c13d33' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T10:23:13Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3cdc48-b9a0-4775-a03f-5156950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T10:22:12.000Z" ,
"modified" : "2017-12-22T10:22:12.000Z" ,
"description" : "Win64/Sednit.Z" ,
"pattern" : "[file:hashes.SHA1 = '57d7f3d31c491f8aef4665ca4dd905c3c8a98795' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T10:22:12Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3cdc5a-8760-4efa-949a-4c5a950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T10:24:43.000Z" ,
"modified" : "2017-12-22T10:24:43.000Z" ,
"description" : "Win32/Sednit.BO" ,
"pattern" : "[file:hashes.SHA1 = 'a3bf5b5cf5a5ef438a198a6f61f7225c0a4a7138' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T10:24:43Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3cdc72-1538-4c66-af46-427b950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T10:24:27.000Z" ,
"modified" : "2017-12-22T10:24:27.000Z" ,
"description" : "Win32/Sednit.BO" ,
"pattern" : "[file:hashes.SHA1 = '1958e722afd0dba266576922abc98aa505cf5f9a' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T10:24:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3ce3a9-f070-4403-a1f6-4b8c950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T13:17:25.000Z" ,
"modified" : "2017-12-22T13:17:25.000Z" ,
"description" : "Win32/Sednit.AX\t" ,
"pattern" : "[file:hashes.SHA1 = '9f6bed7d7f4728490117cbc85819c2e6c494251b' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T13:17:25Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3ce3c3-34b4-4e1f-b238-4399950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T13:15:38.000Z" ,
"modified" : "2017-12-22T13:15:38.000Z" ,
"description" : "Win32/Sednit.BS" ,
"pattern" : "[file:hashes.SHA1 = '4bc722a9b0492a50bd86a1341f02c74c0d773db7' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T13:15:38Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3ce3d4-07bc-4af3-90fc-4798950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T13:16:40.000Z" ,
"modified" : "2017-12-22T13:16:40.000Z" ,
"description" : "Win32/Sednit.BS" ,
"pattern" : "[file:hashes.SHA1 = 'ab354807e687993fbeb1b325eb6e4ab38d428a1e' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T13:16:40Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3ce3ea-580c-477c-9b73-4e57950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T13:17:09.000Z" ,
"modified" : "2017-12-22T13:17:09.000Z" ,
"description" : "Win32/Sednit.BR" ,
"pattern" : "[file:hashes.SHA1 = '9c47ca3883196b3a84d67676a804ff50e22b0a9f' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T13:17:09Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3ce404-efc0-4f15-864e-55ea950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T13:07:56.000Z" ,
"modified" : "2017-12-22T13:07:56.000Z" ,
"description" : "Win32/Sednit.BN" ,
"pattern" : "[file:hashes.SHA1 = '8a68f26d01372114f660e32ac4c9117e5d0577f1' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T13:07:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3ce417-7cd4-4c36-8a73-55ea950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T13:15:01.000Z" ,
"modified" : "2017-12-22T13:15:01.000Z" ,
"description" : "Win32/Sednit.BN" ,
"pattern" : "[file:hashes.SHA1 = '476fc1d31722ac26b46154cbf0c631d60268b28a' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T13:15:01Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3ce42b-2e0c-4a26-b6c8-47a3950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T13:08:51.000Z" ,
"modified" : "2017-12-22T13:08:51.000Z" ,
"description" : "Win32/Sednit.BN" ,
"pattern" : "[file:hashes.SHA1 = 'f9fd3f1d8da4ffd6a494228b934549d09e3c59d1' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T13:08:51Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3ce43a-5478-4f65-95b2-4e1e950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T13:12:22.000Z" ,
"modified" : "2017-12-22T13:12:22.000Z" ,
"description" : "Win32/Sednit.BG" ,
"pattern" : "[file:hashes.SHA1 = 'e338d49c270baf64363879e5eecb8fa6bdde8ad9' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T13:12:22Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3ce44a-ce70-42b7-80b8-c328950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T11:05:56.000Z" ,
"modified" : "2017-12-22T11:05:56.000Z" ,
"description" : "Win32/Sednit.BG" ,
"pattern" : "[file:hashes.SHA1 = '6e167da3c5d887fa2e58da848a2245d11b6c5ad6' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T11:05:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3ce58a-3198-4cb8-9d51-44e5950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T10:59:22.000Z" ,
"modified" : "2017-12-22T10:59:22.000Z" ,
"pattern" : "[domain-name:value = 'servicecdp.com' AND domain-name:resolves_to_refs[*].value = '87.236.211.182']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T10:59:22Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "network"
}
] ,
"labels" : [
"misp:name=\"domain-ip\"" ,
"misp:meta-category=\"network\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3ce5f8-3418-4f7b-ae41-4bca950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T11:01:12.000Z" ,
"modified" : "2017-12-22T11:01:12.000Z" ,
"pattern" : "[domain-name:value = 'wmdmediacodecs.com' AND domain-name:resolves_to_refs[*].value = '95.215.45.43']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T11:01:12Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "network"
}
] ,
"labels" : [
"misp:name=\"domain-ip\"" ,
"misp:meta-category=\"network\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3ce60a-6db8-4212-b194-4339950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T11:01:30.000Z" ,
"modified" : "2017-12-22T11:01:30.000Z" ,
"pattern" : "[domain-name:value = 'mvband.net' AND domain-name:resolves_to_refs[*].value = '89.45.67.144']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T11:01:30Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "network"
}
] ,
"labels" : [
"misp:name=\"domain-ip\"" ,
"misp:meta-category=\"network\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3ce61a-c1f0-4c7c-b815-4fa9950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T11:01:46.000Z" ,
"modified" : "2017-12-22T11:01:46.000Z" ,
"pattern" : "[domain-name:value = 'mvtband.net' AND domain-name:resolves_to_refs[*].value = '89.33.246.117']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T11:01:46Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "network"
}
] ,
"labels" : [
"misp:name=\"domain-ip\"" ,
"misp:meta-category=\"network\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3ce63e-0240-46f5-b9ed-4759950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T11:02:22.000Z" ,
"modified" : "2017-12-22T11:02:22.000Z" ,
"pattern" : "[domain-name:value = 'servicecdp.com' AND domain-name:resolves_to_refs[*].value = '87.236.211.182']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T11:02:22Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "network"
}
] ,
"labels" : [
"misp:name=\"domain-ip\"" ,
"misp:meta-category=\"network\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3ce64e-8bf8-4dc6-be49-437f950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T11:02:38.000Z" ,
"modified" : "2017-12-22T11:02:38.000Z" ,
"pattern" : "[domain-name:value = 'runvercheck.com' AND domain-name:resolves_to_refs[*].value = '185.156.173.70']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T11:02:38Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "network"
}
] ,
"labels" : [
"misp:name=\"domain-ip\"" ,
"misp:meta-category=\"network\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3ce65c-fc40-4585-817e-4ca3950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T11:02:52.000Z" ,
"modified" : "2017-12-22T11:02:52.000Z" ,
"pattern" : "[domain-name:value = 'remsupport.org' AND domain-name:resolves_to_refs[*].value = '191.101.31.96']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T11:02:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "network"
}
] ,
"labels" : [
"misp:name=\"domain-ip\"" ,
"misp:meta-category=\"network\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3ce66e-70b4-47e7-b965-46f6950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T11:03:10.000Z" ,
"modified" : "2017-12-22T11:03:10.000Z" ,
"pattern" : "[domain-name:value = 'viters.org' AND domain-name:resolves_to_refs[*].value = '89.187.150.44']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T11:03:10Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "network"
}
] ,
"labels" : [
"misp:name=\"domain-ip\"" ,
"misp:meta-category=\"network\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3ce680-90d4-478d-95db-48a6950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T11:03:28.000Z" ,
"modified" : "2017-12-22T11:03:28.000Z" ,
"pattern" : "[domain-name:value = 'myinvestgroup.com' AND domain-name:resolves_to_refs[*].value = '146.185.253.132']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T11:03:28Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "network"
}
] ,
"labels" : [
"misp:name=\"domain-ip\"" ,
"misp:meta-category=\"network\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3ce68d-1940-4ea6-becd-44fe950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T11:03:41.000Z" ,
"modified" : "2017-12-22T11:03:41.000Z" ,
"pattern" : "[domain-name:value = 'space-delivery.com' AND domain-name:resolves_to_refs[*].value = '86.106.131.141']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T11:03:41Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "network"
}
] ,
"labels" : [
"misp:name=\"domain-ip\"" ,
"misp:meta-category=\"network\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3ce6a1-3f1c-4d5d-bac7-406d950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T11:04:01.000Z" ,
"modified" : "2017-12-22T11:04:01.000Z" ,
"pattern" : "[domain-name:value = 'satellitedeluxpanorama.com' AND domain-name:resolves_to_refs[*].value = '89.34.111.160']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T11:04:01Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "network"
}
] ,
"labels" : [
"misp:name=\"domain-ip\"" ,
"misp:meta-category=\"network\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a3ce6ae-98d8-4270-b88f-47f2950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-12-22T11:04:14.000Z" ,
"modified" : "2017-12-22T11:04:14.000Z" ,
"pattern" : "[domain-name:value = 'webviewres.net' AND domain-name:resolves_to_refs[*].value = '185.216.35.26']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-12-22T11:04:14Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "network"
}
] ,
"labels" : [
"misp:name=\"domain-ip\"" ,
"misp:meta-category=\"network\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
"id" : "relationship--8bbe006d-57cf-40fe-845d-fa6330a07dd4" ,
"created" : "2017-12-22T10:17:06.000Z" ,
"modified" : "2017-12-22T10:17:06.000Z" ,
"relationship_type" : "communicates-with" ,
"source_ref" : "indicator--5a3cda96-85c4-45a1-82ea-c5ed950d210f" ,
"target_ref" : "indicator--5a3c3045-ab0c-4d38-8efe-459002de0b81"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
"id" : "relationship--d34ef0ac-f579-4028-b079-6134c3ba9609" ,
"created" : "2017-12-22T10:21:31.000Z" ,
"modified" : "2017-12-22T10:21:31.000Z" ,
"relationship_type" : "communicates-with" ,
"source_ref" : "indicator--5a3cdbc7-dbec-4b8c-8ba3-4c5a950d210f" ,
"target_ref" : "indicator--5a3c3045-61dc-495c-ae8a-471e02de0b81"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
"id" : "relationship--c31cd3b2-3b2b-403a-ace6-294d07474b98" ,
"created" : "2017-12-22T10:23:30.000Z" ,
"modified" : "2017-12-22T10:23:30.000Z" ,
"relationship_type" : "communicates-with" ,
"source_ref" : "indicator--5a3cdbf6-f814-491f-9f93-4c59950d210f" ,
"target_ref" : "indicator--5a3c3045-e354-4978-a6b4-49ad02de0b81"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
"id" : "relationship--112c8c22-3623-4e1d-9864-e990eb1964af" ,
"created" : "2017-12-22T10:22:49.000Z" ,
"modified" : "2017-12-22T10:22:49.000Z" ,
"relationship_type" : "communicates-with" ,
"source_ref" : "indicator--5a3cdc09-6fbc-4ca1-bfaa-c5ed950d210f" ,
"target_ref" : "indicator--5a3c3045-968c-4572-9f64-491502de0b81"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
"id" : "relationship--6ebde123-e714-4076-bddd-463d27bcbb48" ,
"created" : "2017-12-22T10:23:46.000Z" ,
"modified" : "2017-12-22T10:23:46.000Z" ,
"relationship_type" : "communicates-with" ,
"source_ref" : "indicator--5a3cdc21-856c-48bd-a757-4f4b950d210f" ,
"target_ref" : "indicator--5a3c3045-e354-4978-a6b4-49ad02de0b81"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
"id" : "relationship--9136d15f-db48-49a3-8ac0-f611558d0a15" ,
"created" : "2017-12-22T10:23:09.000Z" ,
"modified" : "2017-12-22T10:23:09.000Z" ,
"relationship_type" : "communicates-with" ,
"source_ref" : "indicator--5a3cdc37-89e8-4a2d-823a-4af8950d210f" ,
"target_ref" : "indicator--5a3c3045-eb44-433f-a13a-44b902de0b81"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
"id" : "relationship--0349b68f-4bc2-46a2-af6e-d36fd83042a5" ,
"created" : "2017-12-22T10:22:09.000Z" ,
"modified" : "2017-12-22T10:22:09.000Z" ,
"relationship_type" : "communicates-with" ,
"source_ref" : "indicator--5a3cdc48-b9a0-4775-a03f-5156950d210f" ,
"target_ref" : "indicator--5a3c3045-6a88-479d-b799-4d3d02de0b81"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
"id" : "relationship--12289648-d342-46bb-ab67-e67e22292e6b" ,
"created" : "2017-12-22T10:24:40.000Z" ,
"modified" : "2017-12-22T10:24:40.000Z" ,
"relationship_type" : "communicates-with" ,
"source_ref" : "indicator--5a3cdc5a-8760-4efa-949a-4c5a950d210f" ,
"target_ref" : "indicator--5a3c3045-7480-4831-a5c4-48c802de0b81"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
"id" : "relationship--fd8d907f-f705-443c-ac13-7059c40a8963" ,
"created" : "2017-12-22T10:24:24.000Z" ,
"modified" : "2017-12-22T10:24:24.000Z" ,
"relationship_type" : "communicates-with" ,
"source_ref" : "indicator--5a3cdc72-1538-4c66-af46-427b950d210f" ,
"target_ref" : "indicator--5a3c3045-7480-4831-a5c4-48c802de0b81"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
"id" : "relationship--c20b12ee-2e2d-4a6c-b651-c30f80c57ac4" ,
"created" : "2017-12-22T12:57:39.000Z" ,
"modified" : "2017-12-22T12:57:39.000Z" ,
"relationship_type" : "communicates-with" ,
"source_ref" : "indicator--5a3ce3a9-f070-4403-a1f6-4b8c950d210f" ,
"target_ref" : "indicator--5a3ce58a-3198-4cb8-9d51-44e5950d210f"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
"id" : "relationship--056502e1-7ae7-4a88-a801-947f6c020230" ,
"created" : "2017-12-22T13:15:18.000Z" ,
"modified" : "2017-12-22T13:15:18.000Z" ,
"relationship_type" : "communicates-with" ,
"source_ref" : "indicator--5a3ce3c3-34b4-4e1f-b238-4399950d210f" ,
"target_ref" : "indicator--5a3ce6ae-98d8-4270-b88f-47f2950d210f"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
"id" : "relationship--21954809-85a5-4958-b8db-ddc1b5603014" ,
"created" : "2017-12-22T13:15:28.000Z" ,
"modified" : "2017-12-22T13:15:28.000Z" ,
"relationship_type" : "communicates-with" ,
"source_ref" : "indicator--5a3ce3d4-07bc-4af3-90fc-4798950d210f" ,
"target_ref" : "indicator--5a3ce6a1-3f1c-4d5d-bac7-406d950d210f"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
"id" : "relationship--8b6bd872-0695-4f02-a580-5024f4aede8c" ,
"created" : "2017-12-22T13:16:54.000Z" ,
"modified" : "2017-12-22T13:16:54.000Z" ,
"relationship_type" : "communicates-with" ,
"source_ref" : "indicator--5a3ce3ea-580c-477c-9b73-4e57950d210f" ,
"target_ref" : "indicator--5a3ce68d-1940-4ea6-becd-44fe950d210f"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
"id" : "relationship--da7770c3-3a14-4d56-826e-396797850e4b" ,
"created" : "2017-12-22T13:07:24.000Z" ,
"modified" : "2017-12-22T13:07:24.000Z" ,
"relationship_type" : "communicates-with" ,
"source_ref" : "indicator--5a3ce404-efc0-4f15-864e-55ea950d210f" ,
"target_ref" : "indicator--5a3ce680-90d4-478d-95db-48a6950d210f"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
"id" : "relationship--9a8fb7c8-e1c6-448d-85e8-fdc378ff8530" ,
"created" : "2017-12-22T13:14:43.000Z" ,
"modified" : "2017-12-22T13:14:43.000Z" ,
"relationship_type" : "communicates-with" ,
"source_ref" : "indicator--5a3ce417-7cd4-4c36-8a73-55ea950d210f" ,
"target_ref" : "indicator--5a3ce66e-70b4-47e7-b965-46f6950d210f"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
"id" : "relationship--7f1eddde-f9ae-4bb3-ab94-0eb54c2b94f7" ,
"created" : "2017-12-22T13:08:26.000Z" ,
"modified" : "2017-12-22T13:08:26.000Z" ,
"relationship_type" : "communicates-with" ,
"source_ref" : "indicator--5a3ce42b-2e0c-4a26-b6c8-47a3950d210f" ,
"target_ref" : "indicator--5a3ce60a-6db8-4212-b194-4339950d210f"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
"id" : "relationship--247e9e63-7e96-4ea0-8254-d89aa0925d94" ,
"created" : "2017-12-22T13:08:37.000Z" ,
"modified" : "2017-12-22T13:08:37.000Z" ,
"relationship_type" : "communicates-with" ,
"source_ref" : "indicator--5a3ce42b-2e0c-4a26-b6c8-47a3950d210f" ,
"target_ref" : "indicator--5a3ce61a-c1f0-4c7c-b815-4fa9950d210f"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
"id" : "relationship--bba0da91-0ded-4e20-ad99-9fc3bcac3d49" ,
"created" : "2017-12-22T13:12:00.000Z" ,
"modified" : "2017-12-22T13:12:00.000Z" ,
"relationship_type" : "communicates-with" ,
"source_ref" : "indicator--5a3ce43a-5478-4f65-95b2-4e1e950d210f" ,
"target_ref" : "indicator--5a3ce5f8-3418-4f7b-ae41-4bca950d210f"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
"id" : "relationship--2a42c10f-2d53-4165-883f-9e25a55e6dc5" ,
"created" : "2017-12-22T11:05:34.000Z" ,
"modified" : "2017-12-22T11:05:34.000Z" ,
"relationship_type" : "communicates-with" ,
"source_ref" : "indicator--5a3ce44a-ce70-42b7-80b8-c328950d210f" ,
"target_ref" : "indicator--5a3ce64e-8bf8-4dc6-be49-437f950d210f"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
"id" : "relationship--131bea11-05b9-4f82-a54a-39096838d5e6" ,
"created" : "2017-12-22T11:05:53.000Z" ,
"modified" : "2017-12-22T11:05:53.000Z" ,
"relationship_type" : "communicates-with" ,
"source_ref" : "indicator--5a3ce44a-ce70-42b7-80b8-c328950d210f" ,
"target_ref" : "indicator--5a3ce65c-fc40-4585-817e-4ca3950d210f"
} ,
{
"type" : "marking-definition" ,
"spec_version" : "2.1" ,
"id" : "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ,
"created" : "2017-01-20T00:00:00.000Z" ,
"definition_type" : "tlp" ,
"name" : "TLP:WHITE" ,
"definition" : {
"tlp" : "white"
}
}
]
}
