2023-04-21 13:25:09 +00:00
{
2023-06-14 17:31:25 +00:00
"type" : "bundle" ,
"id" : "bundle--5ace0663-370c-40d0-b651-44f4950d210f" ,
"objects" : [
{
"type" : "identity" ,
"spec_version" : "2.1" ,
"id" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:57:01.000Z" ,
"modified" : "2018-04-11T14:57:01.000Z" ,
"name" : "CIRCL" ,
"identity_class" : "organization"
} ,
{
"type" : "report" ,
"spec_version" : "2.1" ,
"id" : "report--5ace0663-370c-40d0-b651-44f4950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:57:01.000Z" ,
"modified" : "2018-04-11T14:57:01.000Z" ,
"name" : "OSINT - IcedID Banking Trojan Teams up with Rovnix for Distribution" ,
"published" : "2018-04-11T14:57:19Z" ,
"object_refs" : [
"observed-data--5ace06a2-3540-4b10-93c1-4d5c950d210f" ,
"url--5ace06a2-3540-4b10-93c1-4d5c950d210f" ,
"x-misp-attribute--5ace06df-df4c-4cb0-8ae2-4fe0950d210f" ,
"indicator--5ace0764-684c-435f-947e-4c52950d210f" ,
"indicator--5ace0765-c62c-4282-8cbf-42e5950d210f" ,
"indicator--5ace0765-1b44-4bee-897b-4a28950d210f" ,
"indicator--5ace07bf-5dd8-4cec-aa80-477b950d210f" ,
"indicator--5ace07c0-77ac-417a-87f1-4ea7950d210f" ,
"indicator--5ace07c0-dde4-4249-a568-4d83950d210f" ,
"indicator--5ace07c1-e79c-436d-a3da-4025950d210f" ,
"indicator--5ace07c1-9300-4d27-b73a-4c60950d210f" ,
"indicator--5ace07c2-50cc-4691-b529-4a6d950d210f" ,
"indicator--5ace07c2-4b6c-461f-acbb-4678950d210f" ,
"indicator--5ace07c3-a1b4-433e-96d1-4b01950d210f" ,
"indicator--5ace07c3-ae30-4de1-8300-432f950d210f" ,
"indicator--5ace07c4-8d80-4388-8b65-41a4950d210f" ,
"indicator--5ace07c4-202c-40ad-91af-445c950d210f" ,
"indicator--5ace07c5-352c-4d3e-aa85-4d60950d210f" ,
"indicator--5ace07c5-c2ec-4f1b-b606-4fd0950d210f" ,
"indicator--5ace07c6-c994-477a-8609-49ef950d210f" ,
"indicator--5ace07c6-096c-4d43-afa3-41d6950d210f" ,
"indicator--5ace07c7-c1f4-4249-854b-4d05950d210f" ,
"indicator--5ace07c7-ca7c-4245-9331-41f3950d210f" ,
"indicator--5ace07c8-8920-4e9f-b40c-4d5d950d210f" ,
"indicator--5ace07c9-406c-4a41-95a2-4603950d210f" ,
"indicator--5ace07c9-d5e8-408b-99b5-4133950d210f" ,
"indicator--5ace07c9-e7c4-43b4-a2a7-4a0b950d210f" ,
"indicator--5ace07ca-e130-43b0-a823-4da4950d210f" ,
"indicator--5ace07ca-eed4-481c-8342-4cd9950d210f" ,
"indicator--5ace07cb-b218-49dc-98d2-4e4a950d210f" ,
"indicator--5ace07cc-5b50-4fc6-841f-4332950d210f" ,
"indicator--5ace0811-b73c-458b-a293-4c2b950d210f" ,
"indicator--5ace0812-6e48-4501-b367-4a2e950d210f" ,
"indicator--2bc43e30-aad8-4cfe-8b81-6278dc5f379d" ,
"x-misp-object--7356e593-a254-40dc-a9fc-cc3097082ec0" ,
"indicator--9d02783e-3b55-4812-a175-0f6a5723b9b2" ,
"x-misp-object--8804329c-ddaa-49c7-be35-93876273c67f" ,
"indicator--b720682a-33ee-4acd-bb6f-51e4a1cee39f" ,
"x-misp-object--504cc2f6-9851-4bf3-a1f6-b9a84c97067e" ,
"indicator--52993adb-1a53-45a4-94d2-30a610c27fd9" ,
"x-misp-object--59492ad3-2ee2-4392-8dea-8453b7040c67" ,
"indicator--82693e02-8fc5-467c-9eba-707ae180d347" ,
"x-misp-object--c7ee13b7-32d0-4c0d-9017-7ddfec33e02b" ,
"indicator--d8060440-11f0-4674-8694-784e4c5a5325" ,
"x-misp-object--85ad4dc3-f78d-4801-807e-aeba3082767e" ,
"indicator--68ee4e84-8ae1-41b8-8234-e6c754ceda16" ,
"x-misp-object--36ced79c-295d-4940-9cf8-e76ccc283863" ,
"indicator--6656459f-8619-49cd-84c9-ca816054ee27" ,
"x-misp-object--f93ed223-e3f7-49f1-848f-ad5db448ffd5" ,
"indicator--c26ea7da-a977-42cb-8d5e-391a9efec8a2" ,
"x-misp-object--5bab0717-3cc2-4e37-80d1-963b979f28bf" ,
"indicator--2e8aca83-efe2-4f29-9430-7714a56aecbb" ,
"x-misp-object--f3fb8e23-4ca8-449c-b327-7b2b27f85a1e" ,
"indicator--8df3ae73-42f3-4ba3-87e7-04c4be578283" ,
"x-misp-object--1fa2e353-ac87-47bf-8bf3-b635e06c5fcd" ,
"indicator--8e710904-eb33-4fed-9104-5997e11aa525" ,
"x-misp-object--e1ff779a-c2bc-4ed9-a18f-815cb5791c31" ,
"indicator--f63376a8-74ab-4697-806c-3cac1c460c50" ,
"x-misp-object--51e911da-e139-4bb4-8339-dfe5bd2e4f94" ,
"indicator--b1ce2cc9-5d81-442e-85a0-15f0148d20ed" ,
"x-misp-object--964fb53d-7228-4f0d-8d81-ebfe0d47ba2e" ,
"indicator--99530dee-a6be-43e5-a901-355807d5e959" ,
"x-misp-object--a046da2b-64c9-425b-b530-745287082e1f" ,
"indicator--dd1084e8-640e-4e9b-9bb3-b15288465629" ,
"x-misp-object--b0261080-5394-4a20-935c-104dc477dea0" ,
"indicator--40b689ad-909c-4bdf-b60b-7e2434a0d2ad" ,
"x-misp-object--ba176916-70c3-4a01-9d39-fb2d46d49b1f" ,
"indicator--650e0658-1a9a-49d3-a71c-2bca2c81575f" ,
"x-misp-object--ca1f75bb-eaa2-4681-85cd-2238ab5a3452" ,
"indicator--443c8958-7a0a-4505-b809-7c5573c66f0e" ,
"x-misp-object--14e75518-cf2c-4585-84bc-ea25bf34373b" ,
"indicator--2228da8c-df64-430c-82ea-408a9961b7af" ,
"x-misp-object--af3cf082-332b-4814-a96a-da533f84c06f" ,
"indicator--f503491f-6adf-4a8c-adfe-22c83d17b049" ,
"x-misp-object--632d79f8-fee2-4258-8898-5d1e0a7c729e" ,
"indicator--6c538a2a-8a0d-4562-b2e2-f9c5317dc1ec" ,
"x-misp-object--d1f89b92-435b-48bd-87f3-088663f1dd9f" ,
"indicator--6d44632f-9fc4-4d8b-aeb3-2173dd9ea4e9" ,
"x-misp-object--581ddc5b-72c1-4fe5-8d1c-6b51ae761ec2" ,
"indicator--06c65048-d1ec-4f49-83f8-69f906fb8426" ,
"x-misp-object--082bcc2c-2673-464d-a3d5-038d83c53255" ,
"indicator--33ffdc21-76a4-4a9d-8483-2621db37e09e" ,
"x-misp-object--0a4652ca-2a5a-4f46-9b74-58569181df1f" ,
"indicator--f3107367-b8b2-4966-9adf-2541a70aa7ec" ,
"x-misp-object--719a0ad9-8c06-45d6-9f58-9a552fcf39ee" ,
"indicator--21f75cd7-6a6b-4031-a122-06380ee2fd95" ,
"x-misp-object--fb3889d5-e301-4ae5-8e3f-f064ba25fedf" ,
"indicator--017b5770-d46e-4885-85b0-bcec1fb85ec6" ,
"x-misp-object--f1d72ac1-ab69-4d3e-a4a2-ee45e597e4d7" ,
2023-12-14 13:47:04 +00:00
"relationship--7c2a65d5-47b8-4c1c-b39d-a134009ab4c7" ,
"relationship--c6e397e9-3869-4793-9a50-21e485eb73e2" ,
"relationship--1d07556a-80af-4dea-b03e-418a6fb2a01e" ,
"relationship--50830032-414a-43ed-88e9-cee6469bbf78" ,
"relationship--0d239470-c33a-47d6-8444-7f7dde0e3931" ,
"relationship--258cd43e-86fa-4464-ad1c-4224d8bed627" ,
"relationship--e2a36a6f-e7e9-4c37-8c91-d97969a826d3" ,
"relationship--a83732c2-4b50-433f-afbd-338b20f01764" ,
"relationship--a5db0184-fd1a-4d93-bf9c-4503c331336d" ,
"relationship--6b440a02-eb58-40b6-8ea5-beb70afa5ef9" ,
"relationship--0f1e3561-3947-4056-a1bb-34f8751bc0fa" ,
"relationship--357cf27d-1d61-4fe7-aa8f-80d00a894e77" ,
"relationship--2295c7fa-451a-4f0d-b656-56840d609581" ,
"relationship--4e0fdc1d-3f3c-4b34-9c8f-0665a4030a1a" ,
"relationship--aa5761b8-fbd3-461b-aae1-e93121c48620" ,
"relationship--c03bfdb1-948c-428d-a9a9-3cd5a6123eda" ,
"relationship--98b4816c-a0f2-4b65-a5e5-a648188e7475" ,
"relationship--71d8d3d0-3bbf-4983-ab52-120e238a2438" ,
"relationship--901fac5b-8720-46b8-ba46-a1e43a7e781e" ,
"relationship--06956a62-f96c-411c-a65d-879d80eaee9a" ,
"relationship--f7a0ce26-88b2-4af7-bc02-46fff8ef8c47" ,
"relationship--00e7c40c-3fa6-484f-9ec9-2bc5cb127992" ,
"relationship--3105fc97-9fa4-4aa2-95c3-c96b662c8eb3" ,
"relationship--064f76ab-aeab-488e-9972-3a2d8ab41787" ,
"relationship--ad900696-2e10-4bad-a4f0-63cc2366e31a" ,
"relationship--bd5c97d0-14ff-4f41-abe3-c9da76e62a4b" ,
"relationship--7416da4e-14b5-4de0-8756-022b1c82db9b" ,
"relationship--95232642-46c4-48fb-9c5e-7eae63eb60ea"
2023-06-14 17:31:25 +00:00
] ,
"labels" : [
"Threat-Report" ,
"misp:tool=\"MISP-STIX-Converter\"" ,
"misp-galaxy:banker=\"IcedID\"" ,
"workflow:todo=\"create-missing-misp-galaxy-cluster\"" ,
"workflow:todo=\"create-missing-misp-galaxy-cluster-values\""
] ,
"object_marking_refs" : [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5ace06a2-3540-4b10-93c1-4d5c950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:54:47.000Z" ,
"modified" : "2018-04-11T14:54:47.000Z" ,
"first_observed" : "2018-04-11T14:54:47Z" ,
"last_observed" : "2018-04-11T14:54:47Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5ace06a2-3540-4b10-93c1-4d5c950d210f"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\"" ,
"osint:source-type=\"blog-post\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5ace06a2-3540-4b10-93c1-4d5c950d210f" ,
"value" : "http://blog.talosintelligence.com/2018/04/icedid-banking-trojan.html"
} ,
{
"type" : "x-misp-attribute" ,
"spec_version" : "2.1" ,
"id" : "x-misp-attribute--5ace06df-df4c-4cb0-8ae2-4fe0950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:54:48.000Z" ,
"modified" : "2018-04-11T14:54:48.000Z" ,
"labels" : [
"misp:type=\"comment\"" ,
"misp:category=\"External analysis\"" ,
"osint:source-type=\"blog-post\""
] ,
"x_misp_category" : "External analysis" ,
"x_misp_type" : "comment" ,
"x_misp_value" : "Cisco has noticed an increase in infections by the banking trojan IcedID through our Advanced Malware Protection (AMP) system. Security researchers first reported a new banking Trojan known as \"IcedID\" [1] in November 2017. At the time of discovery, IcedID was being distributed by Emotet, another well-known banking trojan malware. In late February and throughout March 2018, we noticed an increase in infections from IcedID being detected throughout the AMP ecosystem. Like in November 2017, some of the infections could be traced to Emotet, but this time, many detections could instead be traced to emails with attached malicious Microsoft Word documents containing macros. When the malicious documents are opened and the macros are enabled, Rovnix, another trojan, would be downloaded and executed, which subsequently downloads IcedID. In addition to Rovnix, many of the samples downloaded a second payload, a Bytecoin miner (Bytecoin is a crypto currency similar to bitcoin)."
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ace0764-684c-435f-947e-4c52950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T13:02:28.000Z" ,
"modified" : "2018-04-11T13:02:28.000Z" ,
"description" : "Malicious Document" ,
"pattern" : "[file:hashes.SHA256 = 'b0457ecdcc1940850af6d858e2f2e91e555a71f250f53b7ba9d4434a81810032']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T13:02:28Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ace0765-c62c-4282-8cbf-42e5950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T13:02:29.000Z" ,
"modified" : "2018-04-11T13:02:29.000Z" ,
"description" : "Rovnix" ,
"pattern" : "[file:hashes.SHA256 = '5916b8c0c0668d106ebfcad97eb5c90687c873a732eb61f00e5d7033f8fd85ed']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T13:02:29Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ace0765-1b44-4bee-897b-4a28950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T13:02:29.000Z" ,
"modified" : "2018-04-11T13:02:29.000Z" ,
"description" : "Unpacked IcedID binary demonstrating injection (see hook on ntdll!ZwCreateUserProcess at 0x4016a6)" ,
"pattern" : "[file:hashes.SHA256 = 'd5164e296c7e7a0c3b2a9e34f07bebcdd0ab7df9ab63ca7dffac6d65e60b0b25']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T13:02:29Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ace07bf-5dd8-4cec-aa80-477b950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T13:03:59.000Z" ,
"modified" : "2018-04-11T13:03:59.000Z" ,
"description" : "IcedID binaries" ,
"pattern" : "[file:hashes.SHA256 = '0bd92149834e083320bc5a51f21ac768e26a115c0d589aae22d56ce4c5cf2330']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T13:03:59Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ace07c0-77ac-417a-87f1-4ea7950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T13:04:00.000Z" ,
"modified" : "2018-04-11T13:04:00.000Z" ,
"description" : "IcedID binaries" ,
"pattern" : "[file:hashes.SHA256 = '0ca2971ffedf0704ac5a2b6584f462ce27bac60f17888557dc8cd414558b479e']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T13:04:00Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ace07c0-dde4-4249-a568-4d83950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T13:04:00.000Z" ,
"modified" : "2018-04-11T13:04:00.000Z" ,
"description" : "IcedID binaries" ,
"pattern" : "[file:hashes.SHA256 = '0ea7f227bcbc0b7cd9d1d951a8dfde56f8d18989e4f4c2b0290246e282a14842']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T13:04:00Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ace07c1-e79c-436d-a3da-4025950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T13:04:01.000Z" ,
"modified" : "2018-04-11T13:04:01.000Z" ,
"description" : "IcedID binaries" ,
"pattern" : "[file:hashes.SHA256 = '107f44919999afc3ddf9c8d1e552ca8463c71ac53fbeaf62ab7de80aba796e15']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T13:04:01Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ace07c1-9300-4d27-b73a-4c60950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T13:04:01.000Z" ,
"modified" : "2018-04-11T13:04:01.000Z" ,
"description" : "IcedID binaries" ,
"pattern" : "[file:hashes.SHA256 = '1f8b4e2ef4c318625447884156be50691555e409242252e504ab15ade5bba4d8']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T13:04:01Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ace07c2-50cc-4691-b529-4a6d950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T13:04:02.000Z" ,
"modified" : "2018-04-11T13:04:02.000Z" ,
"description" : "IcedID binaries" ,
"pattern" : "[file:hashes.SHA256 = '24bde557761930ec48a6573c2f7f538be784652e7c55224ba474e443bd1d8c55']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T13:04:02Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ace07c2-4b6c-461f-acbb-4678950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T13:04:02.000Z" ,
"modified" : "2018-04-11T13:04:02.000Z" ,
"description" : "IcedID binaries" ,
"pattern" : "[file:hashes.SHA256 = '4c851e40390df6021c8396c9141d50b52d2dc027586a2edb5f682707987adfad']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T13:04:02Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ace07c3-a1b4-433e-96d1-4b01950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T13:04:03.000Z" ,
"modified" : "2018-04-11T13:04:03.000Z" ,
"description" : "IcedID binaries" ,
"pattern" : "[file:hashes.SHA256 = '64f3abc5b0b65cd4bca68b3200cf2d645d3557fbc6dfe36a127734c3ce436860']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T13:04:03Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ace07c3-ae30-4de1-8300-432f950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T13:04:03.000Z" ,
"modified" : "2018-04-11T13:04:03.000Z" ,
"description" : "IcedID binaries" ,
"pattern" : "[file:hashes.SHA256 = '693599aa847dece5b5cfcca5d545fe5f3f87e5acd10ed807e731741ee306ab4c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T13:04:03Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ace07c4-8d80-4388-8b65-41a4950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T13:04:04.000Z" ,
"modified" : "2018-04-11T13:04:04.000Z" ,
"description" : "IcedID binaries" ,
"pattern" : "[file:hashes.SHA256 = '70e2782079e95e312d7e2de69a6ac0f56874caaf021e1e3f45750f62b7d386ff']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T13:04:04Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ace07c4-202c-40ad-91af-445c950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T13:04:04.000Z" ,
"modified" : "2018-04-11T13:04:04.000Z" ,
"description" : "IcedID binaries" ,
"pattern" : "[file:hashes.SHA256 = '7700fe76b40bc4a0f1b93ae32b9f34c595ef0e2886632e26ebf5f43be1aea63c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T13:04:04Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ace07c5-352c-4d3e-aa85-4d60950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T13:04:05.000Z" ,
"modified" : "2018-04-11T13:04:05.000Z" ,
"description" : "IcedID binaries" ,
"pattern" : "[file:hashes.SHA256 = '7c89b72451f7361cc3f120d0c38287fe5acc9f6e8210279cfe09318d6fe92869']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T13:04:05Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ace07c5-c2ec-4f1b-b606-4fd0950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T13:04:05.000Z" ,
"modified" : "2018-04-11T13:04:05.000Z" ,
"description" : "IcedID binaries" ,
"pattern" : "[file:hashes.SHA256 = '8408fd2fab0b7fce952d6338164040eeb5ae910cbf355ea41f798e04998507bc']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T13:04:05Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ace07c6-c994-477a-8609-49ef950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T13:04:06.000Z" ,
"modified" : "2018-04-11T13:04:06.000Z" ,
"description" : "IcedID binaries" ,
"pattern" : "[file:hashes.SHA256 = '84a664fd2ca39c0a7258bed6f8d3e707bcf6c597bb4f94401940b4e005578dae']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T13:04:06Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ace07c6-096c-4d43-afa3-41d6950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T13:04:06.000Z" ,
"modified" : "2018-04-11T13:04:06.000Z" ,
"description" : "IcedID binaries" ,
"pattern" : "[file:hashes.SHA256 = '84ecae42c9c88ae5c2bdf51d546421b02d06bcf57b48b2abafdbd38d81bacfa8']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T13:04:06Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ace07c7-c1f4-4249-854b-4d05950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T13:04:07.000Z" ,
"modified" : "2018-04-11T13:04:07.000Z" ,
"description" : "IcedID binaries" ,
"pattern" : "[file:hashes.SHA256 = '8ce7889ca54f6c480ee3534fbeb2383779583e258b1e4ac5b851b578a40bc31f']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T13:04:07Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ace07c7-ca7c-4245-9331-41f3950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T13:04:07.000Z" ,
"modified" : "2018-04-11T13:04:07.000Z" ,
"description" : "IcedID binaries" ,
"pattern" : "[file:hashes.SHA256 = '9426acf9edf6479374905b743ab0a550183c2b1869af1a8da2bb69a25e2cad1e']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T13:04:07Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ace07c8-8920-4e9f-b40c-4d5d950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T13:04:08.000Z" ,
"modified" : "2018-04-11T13:04:08.000Z" ,
"description" : "IcedID binaries" ,
"pattern" : "[file:hashes.SHA256 = '995de239c8160435f50675d42a20cf773e6a3e10c8812f4d680114170e07f914']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T13:04:08Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ace07c9-406c-4a41-95a2-4603950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T13:04:08.000Z" ,
"modified" : "2018-04-11T13:04:08.000Z" ,
"description" : "IcedID binaries" ,
"pattern" : "[file:hashes.SHA256 = '9b5930266d5494553f3801d62d7ef20dc866fadda0ee654da85e01042aa91338']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T13:04:08Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ace07c9-d5e8-408b-99b5-4133950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T13:04:09.000Z" ,
"modified" : "2018-04-11T13:04:09.000Z" ,
"description" : "IcedID binaries" ,
"pattern" : "[file:hashes.SHA256 = 'a5779442a31d66407cec78d1d58832a847d5929587cb22b8ad7459f4a28deeef']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T13:04:09Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ace07c9-e7c4-43b4-a2a7-4a0b950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T13:04:09.000Z" ,
"modified" : "2018-04-11T13:04:09.000Z" ,
"description" : "IcedID binaries" ,
"pattern" : "[file:hashes.SHA256 = 'a88f9196456011043bd404377146f7443550a6f11a08fcfac29a55273bd75509']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T13:04:09Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ace07ca-e130-43b0-a823-4da4950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T13:04:10.000Z" ,
"modified" : "2018-04-11T13:04:10.000Z" ,
"description" : "IcedID binaries" ,
"pattern" : "[file:hashes.SHA256 = 'da1e9b6766b9a6445c77ac522a73cc763be2f2500fb1ed8af63e2c47e0f884fb']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T13:04:10Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ace07ca-eed4-481c-8342-4cd9950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T13:04:10.000Z" ,
"modified" : "2018-04-11T13:04:10.000Z" ,
"description" : "IcedID binaries" ,
"pattern" : "[file:hashes.SHA256 = 'e899b27d0e241914cba36c43dfb686bf008237d10beff9114f9aad04b7c919de']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T13:04:10Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ace07cb-b218-49dc-98d2-4e4a950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T13:04:11.000Z" ,
"modified" : "2018-04-11T13:04:11.000Z" ,
"description" : "IcedID binaries" ,
"pattern" : "[file:hashes.SHA256 = 'ed578c318be8a671b4b3d23db9b3fc4bd031befe490543d60e6bcf0759fc51c5']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T13:04:11Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ace07cc-5b50-4fc6-841f-4332950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T13:04:12.000Z" ,
"modified" : "2018-04-11T13:04:12.000Z" ,
"description" : "IcedID binaries" ,
"pattern" : "[file:hashes.SHA256 = 'ffc7479a186f1101a9e7800d8830d235ba6797dc293ade57864f2db26fa58c0f']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T13:04:12Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ace0811-b73c-458b-a293-4c2b950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:54:48.000Z" ,
"modified" : "2018-04-11T14:54:48.000Z" ,
"pattern" : "[domain-name:value = 'efoijowufjaowudawd.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T14:54:48Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ace0812-6e48-4501-b367-4a2e950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:54:48.000Z" ,
"modified" : "2018-04-11T14:54:48.000Z" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '86.123.64.43']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T14:54:48Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--2bc43e30-aad8-4cfe-8b81-6278dc5f379d" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:54:52.000Z" ,
"modified" : "2018-04-11T14:54:52.000Z" ,
"pattern" : "[file:hashes.MD5 = 'de0f64b2cc9cdff5a94ea64828bf90b2' AND file:hashes.SHA1 = '3268a5fcebd1297bdcb12f649d36174d63e15d41' AND file:hashes.SHA256 = '693599aa847dece5b5cfcca5d545fe5f3f87e5acd10ed807e731741ee306ab4c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T14:54:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--7356e593-a254-40dc-a9fc-cc3097082ec0" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:54:50.000Z" ,
"modified" : "2018-04-11T14:54:50.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-03-30T06:28:47" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21ba-435c-4cf5-bdb4-403e02de0b81"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/693599aa847dece5b5cfcca5d545fe5f3f87e5acd10ed807e731741ee306ab4c/analysis/1522391327/" ,
"category" : "External analysis" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21ba-910c-4c87-82af-4c1602de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "43/65" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21bb-c0bc-40aa-a922-48a402de0b81"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--9d02783e-3b55-4812-a175-0f6a5723b9b2" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:54:54.000Z" ,
"modified" : "2018-04-11T14:54:54.000Z" ,
"pattern" : "[file:hashes.MD5 = '22ff684a20a1f1ede284761a5c57a384' AND file:hashes.SHA1 = 'e417cd53530be1fcd42f859013c58c16eaac3385' AND file:hashes.SHA256 = '0ea7f227bcbc0b7cd9d1d951a8dfde56f8d18989e4f4c2b0290246e282a14842']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T14:54:54Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--8804329c-ddaa-49c7-be35-93876273c67f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:54:52.000Z" ,
"modified" : "2018-04-11T14:54:52.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-03-10T13:22:52" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21bc-2de4-4ca2-b500-451502de0b81"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/0ea7f227bcbc0b7cd9d1d951a8dfde56f8d18989e4f4c2b0290246e282a14842/analysis/1520688172/" ,
"category" : "External analysis" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21bd-7eb0-4c67-85f0-4b9002de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "36/67" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21bd-481c-4bc1-8431-45de02de0b81"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--b720682a-33ee-4acd-bb6f-51e4a1cee39f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:54:56.000Z" ,
"modified" : "2018-04-11T14:54:56.000Z" ,
"pattern" : "[file:hashes.MD5 = '02562517436df9302ebb50f2594766f7' AND file:hashes.SHA1 = 'ffbe3d79715cce770bfc61c3f33d32f8c36bb97b' AND file:hashes.SHA256 = '8ce7889ca54f6c480ee3534fbeb2383779583e258b1e4ac5b851b578a40bc31f']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T14:54:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--504cc2f6-9851-4bf3-a1f6-b9a84c97067e" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:54:55.000Z" ,
"modified" : "2018-04-11T14:54:55.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-04-02T19:13:43" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21bf-b0d4-4747-85ea-466f02de0b81"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/8ce7889ca54f6c480ee3534fbeb2383779583e258b1e4ac5b851b578a40bc31f/analysis/1522696423/" ,
"category" : "External analysis" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21bf-f27c-462e-a3da-46ca02de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "50/67" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21c0-cc30-4577-96c2-446502de0b81"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--52993adb-1a53-45a4-94d2-30a610c27fd9" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:54:59.000Z" ,
"modified" : "2018-04-11T14:54:59.000Z" ,
"pattern" : "[file:hashes.MD5 = 'a63746f323cdeca4b13c2cdcd5463c7a' AND file:hashes.SHA1 = '77fc4e19f659803a379d0fa47008a904af55f54f' AND file:hashes.SHA256 = '995de239c8160435f50675d42a20cf773e6a3e10c8812f4d680114170e07f914']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T14:54:59Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--59492ad3-2ee2-4392-8dea-8453b7040c67" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:54:57.000Z" ,
"modified" : "2018-04-11T14:54:57.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-04-06T08:43:30" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21c1-43f0-4bc0-8e89-47ba02de0b81"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/995de239c8160435f50675d42a20cf773e6a3e10c8812f4d680114170e07f914/analysis/1523004210/" ,
"category" : "External analysis" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21c2-077c-4973-b9ac-47b002de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "42/65" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21c2-1750-4cb0-8191-40d302de0b81"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--82693e02-8fc5-467c-9eba-707ae180d347" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:01.000Z" ,
"modified" : "2018-04-11T14:55:01.000Z" ,
"pattern" : "[file:hashes.MD5 = '5933c9c8483252be0bffd8a3bfb4dcc6' AND file:hashes.SHA1 = 'eae0c11f5d7a5004868982152797ee0121d28704' AND file:hashes.SHA256 = '9426acf9edf6479374905b743ab0a550183c2b1869af1a8da2bb69a25e2cad1e']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T14:55:01Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--c7ee13b7-32d0-4c0d-9017-7ddfec33e02b" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:54:59.000Z" ,
"modified" : "2018-04-11T14:54:59.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-04-05T20:00:04" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21c4-514c-4f5c-9521-41ae02de0b81"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/9426acf9edf6479374905b743ab0a550183c2b1869af1a8da2bb69a25e2cad1e/analysis/1522958404/" ,
"category" : "External analysis" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21c4-c648-4d32-b174-4c9e02de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "50/66" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21c5-222c-4cfe-b70a-43cc02de0b81"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--d8060440-11f0-4674-8694-784e4c5a5325" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:04.000Z" ,
"modified" : "2018-04-11T14:55:04.000Z" ,
"pattern" : "[file:hashes.MD5 = '25672dcae009a4bb84b4095397376146' AND file:hashes.SHA1 = '9f39267a26079cda994a533823194534e00866dc' AND file:hashes.SHA256 = '4c851e40390df6021c8396c9141d50b52d2dc027586a2edb5f682707987adfad']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T14:55:04Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--85ad4dc3-f78d-4801-807e-aeba3082767e" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:03.000Z" ,
"modified" : "2018-04-11T14:55:03.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-03-22T07:48:09" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21c7-9ae8-49e4-b2fa-43f902de0b81"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/4c851e40390df6021c8396c9141d50b52d2dc027586a2edb5f682707987adfad/analysis/1521704889/" ,
"category" : "External analysis" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21c7-aa40-4b28-8cf1-450202de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "46/65" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21c8-49d4-427c-bd16-40e802de0b81"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--68ee4e84-8ae1-41b8-8234-e6c754ceda16" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:07.000Z" ,
"modified" : "2018-04-11T14:55:07.000Z" ,
"pattern" : "[file:hashes.MD5 = 'd11515bda0737ddbd8fa6dc8e9a6093e' AND file:hashes.SHA1 = '76a5655b74d2b65343f6a5f760a8ba8609691238' AND file:hashes.SHA256 = '84ecae42c9c88ae5c2bdf51d546421b02d06bcf57b48b2abafdbd38d81bacfa8']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T14:55:07Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--36ced79c-295d-4940-9cf8-e76ccc283863" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:05.000Z" ,
"modified" : "2018-04-11T14:55:05.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-03-24T05:23:21" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21c9-0e68-4e9b-83ed-417502de0b81"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/84ecae42c9c88ae5c2bdf51d546421b02d06bcf57b48b2abafdbd38d81bacfa8/analysis/1521869001/" ,
"category" : "External analysis" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21c9-8a50-4af0-a5a0-41e602de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "36/66" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21ca-f0e4-4771-82d9-455302de0b81"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--6656459f-8619-49cd-84c9-ca816054ee27" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:09.000Z" ,
"modified" : "2018-04-11T14:55:09.000Z" ,
"pattern" : "[file:hashes.MD5 = '073b555c56edc56c220cbbb8cbdc7d1a' AND file:hashes.SHA1 = '34ea6b41d518e3ae16c0b52bf5889c0db1466a98' AND file:hashes.SHA256 = '64f3abc5b0b65cd4bca68b3200cf2d645d3557fbc6dfe36a127734c3ce436860']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T14:55:09Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--f93ed223-e3f7-49f1-848f-ad5db448ffd5" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:07.000Z" ,
"modified" : "2018-04-11T14:55:07.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-04-11T09:48:06" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21cb-6938-4413-bb6c-47c902de0b81"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/64f3abc5b0b65cd4bca68b3200cf2d645d3557fbc6dfe36a127734c3ce436860/analysis/1523440086/" ,
"category" : "External analysis" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21cc-62e8-4ab0-9f80-441b02de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "55/67" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21cd-3710-47fb-96fc-44ce02de0b81"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--c26ea7da-a977-42cb-8d5e-391a9efec8a2" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:12.000Z" ,
"modified" : "2018-04-11T14:55:12.000Z" ,
"pattern" : "[file:hashes.MD5 = 'f9e3f15a41b6dd4ab25d95a957abee6a' AND file:hashes.SHA1 = '794e1343af82ac981e77a5c086ed9e6c25ecfbc1' AND file:hashes.SHA256 = '5916b8c0c0668d106ebfcad97eb5c90687c873a732eb61f00e5d7033f8fd85ed']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T14:55:12Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--5bab0717-3cc2-4e37-80d1-963b979f28bf" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:10.000Z" ,
"modified" : "2018-04-11T14:55:10.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-04-11T09:22:06" ,
"category" : "Other" ,
"comment" : "Rovnix" ,
"uuid" : "5ace21ce-ead0-4911-9180-492902de0b81"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/5916b8c0c0668d106ebfcad97eb5c90687c873a732eb61f00e5d7033f8fd85ed/analysis/1523438526/" ,
"category" : "External analysis" ,
"comment" : "Rovnix" ,
"uuid" : "5ace21ce-5d4c-4ace-b76e-414802de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "51/67" ,
"category" : "Other" ,
"comment" : "Rovnix" ,
"uuid" : "5ace21cf-0ee0-43fb-8da8-4b0e02de0b81"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--2e8aca83-efe2-4f29-9430-7714a56aecbb" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:14.000Z" ,
"modified" : "2018-04-11T14:55:14.000Z" ,
"pattern" : "[file:hashes.MD5 = '46e96df14e74915e86a22516d4c111be' AND file:hashes.SHA1 = 'bb948aaa1b0a6f3dd5f5b3b9917411875f100ac3' AND file:hashes.SHA256 = '0bd92149834e083320bc5a51f21ac768e26a115c0d589aae22d56ce4c5cf2330']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T14:55:14Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--f3fb8e23-4ca8-449c-b327-7b2b27f85a1e" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:13.000Z" ,
"modified" : "2018-04-11T14:55:13.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-04-02T17:50:19" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21d1-dc04-4263-8a3e-4bd702de0b81"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/0bd92149834e083320bc5a51f21ac768e26a115c0d589aae22d56ce4c5cf2330/analysis/1522691419/" ,
"category" : "External analysis" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21d1-0658-4e4d-bb9f-4ab902de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "49/66" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21d1-4a20-45b1-ba60-4d8b02de0b81"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--8df3ae73-42f3-4ba3-87e7-04c4be578283" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:16.000Z" ,
"modified" : "2018-04-11T14:55:16.000Z" ,
"pattern" : "[file:hashes.MD5 = 'd515779b40cac09f1b28caed78406ade' AND file:hashes.SHA1 = 'c944aa2b8b363c671ef9c80eb97ab9465a3b41a2' AND file:hashes.SHA256 = '84a664fd2ca39c0a7258bed6f8d3e707bcf6c597bb4f94401940b4e005578dae']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T14:55:16Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--1fa2e353-ac87-47bf-8bf3-b635e06c5fcd" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:15.000Z" ,
"modified" : "2018-04-11T14:55:15.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-04-05T19:59:15" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21d3-dd00-4449-b426-433402de0b81"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/84a664fd2ca39c0a7258bed6f8d3e707bcf6c597bb4f94401940b4e005578dae/analysis/1522958355/" ,
"category" : "External analysis" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21d3-0878-4c9c-8c0f-420402de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "39/66" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21d3-1478-4a0a-8079-422102de0b81"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--8e710904-eb33-4fed-9104-5997e11aa525" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:19.000Z" ,
"modified" : "2018-04-11T14:55:19.000Z" ,
"pattern" : "[file:hashes.MD5 = '60e1089b8a0b4d02981d305ddf60953c' AND file:hashes.SHA1 = '2c320e30337b6e5c18c5abe1734bab125fd571f2' AND file:hashes.SHA256 = 'a88f9196456011043bd404377146f7443550a6f11a08fcfac29a55273bd75509']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T14:55:19Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--e1ff779a-c2bc-4ed9-a18f-815cb5791c31" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:17.000Z" ,
"modified" : "2018-04-11T14:55:17.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-04-02T08:09:27" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21d5-08c0-4fae-b03b-40d902de0b81"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/a88f9196456011043bd404377146f7443550a6f11a08fcfac29a55273bd75509/analysis/1522656567/" ,
"category" : "External analysis" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21d5-efec-42d5-85e8-41d502de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "35/66" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21d6-605c-4780-b782-425802de0b81"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--f63376a8-74ab-4697-806c-3cac1c460c50" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:21.000Z" ,
"modified" : "2018-04-11T14:55:21.000Z" ,
"pattern" : "[file:hashes.MD5 = 'be79cd947879a66db8c1f11b598a250b' AND file:hashes.SHA1 = '4723713da700594f1ba484b7e993e0cdf072b87f' AND file:hashes.SHA256 = '107f44919999afc3ddf9c8d1e552ca8463c71ac53fbeaf62ab7de80aba796e15']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T14:55:21Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--51e911da-e139-4bb4-8339-dfe5bd2e4f94" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:19.000Z" ,
"modified" : "2018-04-11T14:55:19.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-03-23T15:24:31" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21d8-72bc-4dd9-9e5e-40a602de0b81"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/107f44919999afc3ddf9c8d1e552ca8463c71ac53fbeaf62ab7de80aba796e15/analysis/1521818671/" ,
"category" : "External analysis" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21d8-185c-489f-83e4-476c02de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "48/66" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21d8-128c-42d0-ab99-403d02de0b81"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--b1ce2cc9-5d81-442e-85a0-15f0148d20ed" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:23.000Z" ,
"modified" : "2018-04-11T14:55:23.000Z" ,
"pattern" : "[file:hashes.MD5 = 'd4abe68c54567b9db2bc35a03ae91bc9' AND file:hashes.SHA1 = '6d9e86c0066b21b02b941034389fe4bd96293961' AND file:hashes.SHA256 = '0ca2971ffedf0704ac5a2b6584f462ce27bac60f17888557dc8cd414558b479e']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T14:55:23Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--964fb53d-7228-4f0d-8d81-ebfe0d47ba2e" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:22.000Z" ,
"modified" : "2018-04-11T14:55:22.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-04-11T09:45:54" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21da-09ac-4637-a101-45f502de0b81"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/0ca2971ffedf0704ac5a2b6584f462ce27bac60f17888557dc8cd414558b479e/analysis/1523439954/" ,
"category" : "External analysis" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21da-7e10-482f-b41d-4dfd02de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "52/66" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21db-eea8-4e6c-98f4-4b1502de0b81"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--99530dee-a6be-43e5-a901-355807d5e959" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:26.000Z" ,
"modified" : "2018-04-11T14:55:26.000Z" ,
"pattern" : "[file:hashes.MD5 = '86f8c16a3241f99136391428a107c30a' AND file:hashes.SHA1 = 'a4459860666c7ef8006f01c2b787093128f17c11' AND file:hashes.SHA256 = 'b0457ecdcc1940850af6d858e2f2e91e555a71f250f53b7ba9d4434a81810032']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T14:55:26Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--a046da2b-64c9-425b-b530-745287082e1f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:24.000Z" ,
"modified" : "2018-04-11T14:55:24.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-04-10T08:24:33" ,
"category" : "Other" ,
"comment" : "Malicious Document" ,
"uuid" : "5ace21dc-bb44-48a5-807f-435502de0b81"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/b0457ecdcc1940850af6d858e2f2e91e555a71f250f53b7ba9d4434a81810032/analysis/1523348673/" ,
"category" : "External analysis" ,
"comment" : "Malicious Document" ,
"uuid" : "5ace21dc-b318-41ac-a08e-403602de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "33/60" ,
"category" : "Other" ,
"comment" : "Malicious Document" ,
"uuid" : "5ace21dd-c404-4f89-8a6a-4d2f02de0b81"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--dd1084e8-640e-4e9b-9bb3-b15288465629" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:28.000Z" ,
"modified" : "2018-04-11T14:55:28.000Z" ,
"pattern" : "[file:hashes.MD5 = '1562e6fc78c2b71ece80d783263bef82' AND file:hashes.SHA1 = '2fa2f0738d3c8935ee87427da7d10768282fe139' AND file:hashes.SHA256 = '70e2782079e95e312d7e2de69a6ac0f56874caaf021e1e3f45750f62b7d386ff']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T14:55:28Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--b0261080-5394-4a20-935c-104dc477dea0" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:26.000Z" ,
"modified" : "2018-04-11T14:55:26.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-03-30T08:29:37" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21de-d024-4a20-8084-4fe102de0b81"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/70e2782079e95e312d7e2de69a6ac0f56874caaf021e1e3f45750f62b7d386ff/analysis/1522398577/" ,
"category" : "External analysis" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21df-7448-4bdd-92d2-407802de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "51/67" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21df-89b0-466f-9250-454302de0b81"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--40b689ad-909c-4bdf-b60b-7e2434a0d2ad" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:30.000Z" ,
"modified" : "2018-04-11T14:55:30.000Z" ,
"pattern" : "[file:hashes.MD5 = '9e0fca43d0ddfff8198a0885bd264d3a' AND file:hashes.SHA1 = 'e338ef5198c2bd588eb980931582e7705db28866' AND file:hashes.SHA256 = 'ed578c318be8a671b4b3d23db9b3fc4bd031befe490543d60e6bcf0759fc51c5']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T14:55:30Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--ba176916-70c3-4a01-9d39-fb2d46d49b1f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:28.000Z" ,
"modified" : "2018-04-11T14:55:28.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-04-02T19:30:12" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21e1-c080-402d-b8a4-4a7c02de0b81"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/ed578c318be8a671b4b3d23db9b3fc4bd031befe490543d60e6bcf0759fc51c5/analysis/1522697412/" ,
"category" : "External analysis" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21e1-f394-4bf6-8267-43bd02de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "50/66" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21e1-2dac-489c-b8c0-4aae02de0b81"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--650e0658-1a9a-49d3-a71c-2bca2c81575f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:32.000Z" ,
"modified" : "2018-04-11T14:55:32.000Z" ,
"pattern" : "[file:hashes.MD5 = '6bf4004030ce5238ec2b130d6ce861b9' AND file:hashes.SHA1 = '0d6f36b77d30db9c08c830da8fe0e30312d18515' AND file:hashes.SHA256 = 'a5779442a31d66407cec78d1d58832a847d5929587cb22b8ad7459f4a28deeef']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T14:55:32Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--ca1f75bb-eaa2-4681-85cd-2238ab5a3452" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:31.000Z" ,
"modified" : "2018-04-11T14:55:31.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-03-28T21:41:05" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21e3-48bc-48c2-922a-4dde02de0b81"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/a5779442a31d66407cec78d1d58832a847d5929587cb22b8ad7459f4a28deeef/analysis/1522273265/" ,
"category" : "External analysis" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21e3-11d8-4390-a4ba-491202de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "27/66" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21e4-ad54-450a-bc97-43e902de0b81"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--443c8958-7a0a-4505-b809-7c5573c66f0e" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:35.000Z" ,
"modified" : "2018-04-11T14:55:35.000Z" ,
"pattern" : "[file:hashes.MD5 = '6d1c4739b4a9cb7b78930a45687402b1' AND file:hashes.SHA1 = '2cb241c465a7300b6d4c1f3fc9d58daa53e424c7' AND file:hashes.SHA256 = 'd5164e296c7e7a0c3b2a9e34f07bebcdd0ab7df9ab63ca7dffac6d65e60b0b25']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T14:55:35Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--14e75518-cf2c-4585-84bc-ea25bf34373b" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:33.000Z" ,
"modified" : "2018-04-11T14:55:33.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-04-06T07:50:13" ,
"category" : "Other" ,
"comment" : "Unpacked IcedID binary demonstrating injection (see hook on ntdll!ZwCreateUserProcess at 0x4016a6)" ,
"uuid" : "5ace21e5-22c0-4dc7-b0dc-441502de0b81"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/d5164e296c7e7a0c3b2a9e34f07bebcdd0ab7df9ab63ca7dffac6d65e60b0b25/analysis/1523001013/" ,
"category" : "External analysis" ,
"comment" : "Unpacked IcedID binary demonstrating injection (see hook on ntdll!ZwCreateUserProcess at 0x4016a6)" ,
"uuid" : "5ace21e5-6bc0-4abf-991f-425302de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "42/66" ,
"category" : "Other" ,
"comment" : "Unpacked IcedID binary demonstrating injection (see hook on ntdll!ZwCreateUserProcess at 0x4016a6)" ,
"uuid" : "5ace21e6-9750-42d0-971c-43da02de0b81"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--2228da8c-df64-430c-82ea-408a9961b7af" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:37.000Z" ,
"modified" : "2018-04-11T14:55:37.000Z" ,
"pattern" : "[file:hashes.MD5 = 'f25b97573927299e975d786e2a42bd32' AND file:hashes.SHA1 = '7d79296d9cfe36cca96997c2983b3b820e25ffed' AND file:hashes.SHA256 = '7700fe76b40bc4a0f1b93ae32b9f34c595ef0e2886632e26ebf5f43be1aea63c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T14:55:37Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--af3cf082-332b-4814-a96a-da533f84c06f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:35.000Z" ,
"modified" : "2018-04-11T14:55:35.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-03-19T18:35:27" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21e7-14b4-413f-b893-499202de0b81"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/7700fe76b40bc4a0f1b93ae32b9f34c595ef0e2886632e26ebf5f43be1aea63c/analysis/1521484527/" ,
"category" : "External analysis" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21e8-fabc-4f31-9eef-4b6302de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "47/65" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21e8-7d24-45bb-b059-491702de0b81"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--f503491f-6adf-4a8c-adfe-22c83d17b049" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:39.000Z" ,
"modified" : "2018-04-11T14:55:39.000Z" ,
"pattern" : "[file:hashes.MD5 = '1a9323b210ec81404aa509b9079fd71e' AND file:hashes.SHA1 = 'd12766fd4a4275d48cc94c20c6bb0cf7878352c7' AND file:hashes.SHA256 = '1f8b4e2ef4c318625447884156be50691555e409242252e504ab15ade5bba4d8']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T14:55:39Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--632d79f8-fee2-4258-8898-5d1e0a7c729e" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:37.000Z" ,
"modified" : "2018-04-11T14:55:37.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-03-26T00:31:21" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21e9-66b4-4a67-8ff4-4e9402de0b81"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/1f8b4e2ef4c318625447884156be50691555e409242252e504ab15ade5bba4d8/analysis/1522024281/" ,
"category" : "External analysis" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21ea-79ac-44a8-95d5-4f6d02de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "29/67" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21ea-8d60-4c30-9996-4e6902de0b81"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--6c538a2a-8a0d-4562-b2e2-f9c5317dc1ec" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:41.000Z" ,
"modified" : "2018-04-11T14:55:41.000Z" ,
"pattern" : "[file:hashes.MD5 = 'dcd0ca97e1f341bcca4dbcf0facc7908' AND file:hashes.SHA1 = '607dce9aa1d528701e7fb6439560673f3ed799d6' AND file:hashes.SHA256 = 'da1e9b6766b9a6445c77ac522a73cc763be2f2500fb1ed8af63e2c47e0f884fb']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T14:55:41Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--d1f89b92-435b-48bd-87f3-088663f1dd9f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:40.000Z" ,
"modified" : "2018-04-11T14:55:40.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-03-14T19:08:10" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21ec-3e98-44c0-b97c-4af202de0b81"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/da1e9b6766b9a6445c77ac522a73cc763be2f2500fb1ed8af63e2c47e0f884fb/analysis/1521054490/" ,
"category" : "External analysis" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21ec-02e0-442b-a470-42b702de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "43/64" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21ed-bb90-47d5-929c-42e302de0b81"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--6d44632f-9fc4-4d8b-aeb3-2173dd9ea4e9" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:44.000Z" ,
"modified" : "2018-04-11T14:55:44.000Z" ,
"pattern" : "[file:hashes.MD5 = 'e16d5492bfb200fe4269988868c185e0' AND file:hashes.SHA1 = '73bc3b6561e3864f3fc5a719c369c95b00ac800d' AND file:hashes.SHA256 = '8408fd2fab0b7fce952d6338164040eeb5ae910cbf355ea41f798e04998507bc']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T14:55:44Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--581ddc5b-72c1-4fe5-8d1c-6b51ae761ec2" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:42.000Z" ,
"modified" : "2018-04-11T14:55:42.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-03-23T13:59:34" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21ee-8dd4-4848-9a4b-422d02de0b81"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/8408fd2fab0b7fce952d6338164040eeb5ae910cbf355ea41f798e04998507bc/analysis/1521813574/" ,
"category" : "External analysis" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21ef-39e4-4821-865e-4d7802de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "45/67" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21ef-79f8-4758-9e96-42bc02de0b81"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--06c65048-d1ec-4f49-83f8-69f906fb8426" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:46.000Z" ,
"modified" : "2018-04-11T14:55:46.000Z" ,
"pattern" : "[file:hashes.MD5 = 'c28f58ce162bc146a5d44e2473e39210' AND file:hashes.SHA1 = 'e340fec254c3e813726f6fc8939dc8486ec76082' AND file:hashes.SHA256 = 'ffc7479a186f1101a9e7800d8830d235ba6797dc293ade57864f2db26fa58c0f']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T14:55:46Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--082bcc2c-2673-464d-a3d5-038d83c53255" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:44.000Z" ,
"modified" : "2018-04-11T14:55:44.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-04-05T20:21:19" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21f1-c4bc-4b23-9575-4b1102de0b81"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/ffc7479a186f1101a9e7800d8830d235ba6797dc293ade57864f2db26fa58c0f/analysis/1522959679/" ,
"category" : "External analysis" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21f1-17cc-4486-940f-408f02de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "51/65" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21f1-5068-49a3-89fb-457002de0b81"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--33ffdc21-76a4-4a9d-8483-2621db37e09e" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:48.000Z" ,
"modified" : "2018-04-11T14:55:48.000Z" ,
"pattern" : "[file:hashes.MD5 = '1aefa7f9824f775504550360b5cc90c0' AND file:hashes.SHA1 = '9d3745c8ab300c6df60732923e328482f2ca52bd' AND file:hashes.SHA256 = '24bde557761930ec48a6573c2f7f538be784652e7c55224ba474e443bd1d8c55']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T14:55:48Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--0a4652ca-2a5a-4f46-9b74-58569181df1f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:47.000Z" ,
"modified" : "2018-04-11T14:55:47.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-03-25T13:10:29" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21f3-87bc-4035-97d4-498a02de0b81"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/24bde557761930ec48a6573c2f7f538be784652e7c55224ba474e443bd1d8c55/analysis/1521983429/" ,
"category" : "External analysis" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21f3-bc18-48c3-86ed-4a6202de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "42/66" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21f4-9a24-40ca-bc4c-45ee02de0b81"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--f3107367-b8b2-4966-9adf-2541a70aa7ec" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:51.000Z" ,
"modified" : "2018-04-11T14:55:51.000Z" ,
"pattern" : "[file:hashes.MD5 = '7b56a528f8f6155555fa360b3c36c8da' AND file:hashes.SHA1 = 'f4d2bd10a6a16b4fca17507483e963e194389f65' AND file:hashes.SHA256 = '9b5930266d5494553f3801d62d7ef20dc866fadda0ee654da85e01042aa91338']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T14:55:51Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--719a0ad9-8c06-45d6-9f58-9a552fcf39ee" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:49.000Z" ,
"modified" : "2018-04-11T14:55:49.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-04-10T21:29:30" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21f5-d428-40bb-ae55-44fb02de0b81"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/9b5930266d5494553f3801d62d7ef20dc866fadda0ee654da85e01042aa91338/analysis/1523395770/" ,
"category" : "External analysis" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21f6-410c-47a2-9b82-46ee02de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "54/66" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21f6-6ad8-4a0d-a010-474b02de0b81"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--21f75cd7-6a6b-4031-a122-06380ee2fd95" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:53.000Z" ,
"modified" : "2018-04-11T14:55:53.000Z" ,
"pattern" : "[file:hashes.MD5 = 'e3b5fe82eb8f4162b1d4d6d861447ecf' AND file:hashes.SHA1 = '2093fbf65cbe5fed4289f4ce252527cc0ff0b9c3' AND file:hashes.SHA256 = 'e899b27d0e241914cba36c43dfb686bf008237d10beff9114f9aad04b7c919de']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T14:55:53Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--fb3889d5-e301-4ae5-8e3f-f064ba25fedf" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:51.000Z" ,
"modified" : "2018-04-11T14:55:51.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-03-07T01:24:50" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21f7-4134-4212-bc2a-4a3602de0b81"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/e899b27d0e241914cba36c43dfb686bf008237d10beff9114f9aad04b7c919de/analysis/1520385890/" ,
"category" : "External analysis" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21f8-c38c-45dd-ab89-48dc02de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "45/68" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21f8-a18c-41e0-8975-4d2a02de0b81"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--017b5770-d46e-4885-85b0-bcec1fb85ec6" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:55.000Z" ,
"modified" : "2018-04-11T14:55:55.000Z" ,
"pattern" : "[file:hashes.MD5 = '3c6a6ca8a46a6adf19a0d3b1b0a7be27' AND file:hashes.SHA1 = 'a21db84f0d6c67e5550a421a23998adf2ad1082a' AND file:hashes.SHA256 = '7c89b72451f7361cc3f120d0c38287fe5acc9f6e8210279cfe09318d6fe92869']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-04-11T14:55:55Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--f1d72ac1-ab69-4d3e-a4a2-ee45e597e4d7" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-04-11T14:55:54.000Z" ,
"modified" : "2018-04-11T14:55:54.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-03-22T08:55:19" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21fa-ff58-410e-8e7e-41b502de0b81"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/7c89b72451f7361cc3f120d0c38287fe5acc9f6e8210279cfe09318d6fe92869/analysis/1521708919/" ,
"category" : "External analysis" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21fa-5f88-4533-a756-498402de0b81"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "47/68" ,
"category" : "Other" ,
"comment" : "IcedID binaries" ,
"uuid" : "5ace21fb-8f14-4523-a9bd-451902de0b81"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2023-12-14 13:47:04 +00:00
"id" : "relationship--7c2a65d5-47b8-4c1c-b39d-a134009ab4c7" ,
2023-06-14 17:31:25 +00:00
"created" : "2018-04-11T14:55:55.000Z" ,
"modified" : "2018-04-11T14:55:55.000Z" ,
2023-04-21 13:25:09 +00:00
"relationship_type" : "analysed-with" ,
2023-06-14 17:31:25 +00:00
"source_ref" : "indicator--2bc43e30-aad8-4cfe-8b81-6278dc5f379d" ,
"target_ref" : "x-misp-object--7356e593-a254-40dc-a9fc-cc3097082ec0"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2023-12-14 13:47:04 +00:00
"id" : "relationship--c6e397e9-3869-4793-9a50-21e485eb73e2" ,
2023-06-14 17:31:25 +00:00
"created" : "2018-04-11T14:55:55.000Z" ,
"modified" : "2018-04-11T14:55:55.000Z" ,
2023-04-21 13:25:09 +00:00
"relationship_type" : "analysed-with" ,
2023-06-14 17:31:25 +00:00
"source_ref" : "indicator--9d02783e-3b55-4812-a175-0f6a5723b9b2" ,
"target_ref" : "x-misp-object--8804329c-ddaa-49c7-be35-93876273c67f"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2023-12-14 13:47:04 +00:00
"id" : "relationship--1d07556a-80af-4dea-b03e-418a6fb2a01e" ,
2023-06-14 17:31:25 +00:00
"created" : "2018-04-11T14:55:55.000Z" ,
"modified" : "2018-04-11T14:55:55.000Z" ,
2023-04-21 13:25:09 +00:00
"relationship_type" : "analysed-with" ,
2023-06-14 17:31:25 +00:00
"source_ref" : "indicator--b720682a-33ee-4acd-bb6f-51e4a1cee39f" ,
"target_ref" : "x-misp-object--504cc2f6-9851-4bf3-a1f6-b9a84c97067e"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2023-12-14 13:47:04 +00:00
"id" : "relationship--50830032-414a-43ed-88e9-cee6469bbf78" ,
2023-06-14 17:31:25 +00:00
"created" : "2018-04-11T14:55:55.000Z" ,
"modified" : "2018-04-11T14:55:55.000Z" ,
2023-04-21 13:25:09 +00:00
"relationship_type" : "analysed-with" ,
2023-06-14 17:31:25 +00:00
"source_ref" : "indicator--52993adb-1a53-45a4-94d2-30a610c27fd9" ,
"target_ref" : "x-misp-object--59492ad3-2ee2-4392-8dea-8453b7040c67"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2023-12-14 13:47:04 +00:00
"id" : "relationship--0d239470-c33a-47d6-8444-7f7dde0e3931" ,
2023-06-14 17:31:25 +00:00
"created" : "2018-04-11T14:55:55.000Z" ,
"modified" : "2018-04-11T14:55:55.000Z" ,
2023-04-21 13:25:09 +00:00
"relationship_type" : "analysed-with" ,
2023-06-14 17:31:25 +00:00
"source_ref" : "indicator--82693e02-8fc5-467c-9eba-707ae180d347" ,
"target_ref" : "x-misp-object--c7ee13b7-32d0-4c0d-9017-7ddfec33e02b"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2023-12-14 13:47:04 +00:00
"id" : "relationship--258cd43e-86fa-4464-ad1c-4224d8bed627" ,
2023-06-14 17:31:25 +00:00
"created" : "2018-04-11T14:55:56.000Z" ,
"modified" : "2018-04-11T14:55:56.000Z" ,
2023-04-21 13:25:09 +00:00
"relationship_type" : "analysed-with" ,
2023-06-14 17:31:25 +00:00
"source_ref" : "indicator--d8060440-11f0-4674-8694-784e4c5a5325" ,
"target_ref" : "x-misp-object--85ad4dc3-f78d-4801-807e-aeba3082767e"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2023-12-14 13:47:04 +00:00
"id" : "relationship--e2a36a6f-e7e9-4c37-8c91-d97969a826d3" ,
2023-06-14 17:31:25 +00:00
"created" : "2018-04-11T14:55:56.000Z" ,
"modified" : "2018-04-11T14:55:56.000Z" ,
2023-04-21 13:25:09 +00:00
"relationship_type" : "analysed-with" ,
2023-06-14 17:31:25 +00:00
"source_ref" : "indicator--68ee4e84-8ae1-41b8-8234-e6c754ceda16" ,
"target_ref" : "x-misp-object--36ced79c-295d-4940-9cf8-e76ccc283863"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2023-12-14 13:47:04 +00:00
"id" : "relationship--a83732c2-4b50-433f-afbd-338b20f01764" ,
2023-06-14 17:31:25 +00:00
"created" : "2018-04-11T14:55:56.000Z" ,
"modified" : "2018-04-11T14:55:56.000Z" ,
2023-04-21 13:25:09 +00:00
"relationship_type" : "analysed-with" ,
2023-06-14 17:31:25 +00:00
"source_ref" : "indicator--6656459f-8619-49cd-84c9-ca816054ee27" ,
"target_ref" : "x-misp-object--f93ed223-e3f7-49f1-848f-ad5db448ffd5"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2023-12-14 13:47:04 +00:00
"id" : "relationship--a5db0184-fd1a-4d93-bf9c-4503c331336d" ,
2023-06-14 17:31:25 +00:00
"created" : "2018-04-11T14:55:57.000Z" ,
"modified" : "2018-04-11T14:55:57.000Z" ,
2023-04-21 13:25:09 +00:00
"relationship_type" : "analysed-with" ,
2023-06-14 17:31:25 +00:00
"source_ref" : "indicator--c26ea7da-a977-42cb-8d5e-391a9efec8a2" ,
"target_ref" : "x-misp-object--5bab0717-3cc2-4e37-80d1-963b979f28bf"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2023-12-14 13:47:04 +00:00
"id" : "relationship--6b440a02-eb58-40b6-8ea5-beb70afa5ef9" ,
2023-06-14 17:31:25 +00:00
"created" : "2018-04-11T14:55:57.000Z" ,
"modified" : "2018-04-11T14:55:57.000Z" ,
2023-04-21 13:25:09 +00:00
"relationship_type" : "analysed-with" ,
2023-06-14 17:31:25 +00:00
"source_ref" : "indicator--2e8aca83-efe2-4f29-9430-7714a56aecbb" ,
"target_ref" : "x-misp-object--f3fb8e23-4ca8-449c-b327-7b2b27f85a1e"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2023-12-14 13:47:04 +00:00
"id" : "relationship--0f1e3561-3947-4056-a1bb-34f8751bc0fa" ,
2023-06-14 17:31:25 +00:00
"created" : "2018-04-11T14:55:57.000Z" ,
"modified" : "2018-04-11T14:55:57.000Z" ,
2023-04-21 13:25:09 +00:00
"relationship_type" : "analysed-with" ,
2023-06-14 17:31:25 +00:00
"source_ref" : "indicator--8df3ae73-42f3-4ba3-87e7-04c4be578283" ,
"target_ref" : "x-misp-object--1fa2e353-ac87-47bf-8bf3-b635e06c5fcd"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2023-12-14 13:47:04 +00:00
"id" : "relationship--357cf27d-1d61-4fe7-aa8f-80d00a894e77" ,
2023-06-14 17:31:25 +00:00
"created" : "2018-04-11T14:55:57.000Z" ,
"modified" : "2018-04-11T14:55:57.000Z" ,
2023-04-21 13:25:09 +00:00
"relationship_type" : "analysed-with" ,
2023-06-14 17:31:25 +00:00
"source_ref" : "indicator--8e710904-eb33-4fed-9104-5997e11aa525" ,
"target_ref" : "x-misp-object--e1ff779a-c2bc-4ed9-a18f-815cb5791c31"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2023-12-14 13:47:04 +00:00
"id" : "relationship--2295c7fa-451a-4f0d-b656-56840d609581" ,
2023-06-14 17:31:25 +00:00
"created" : "2018-04-11T14:55:57.000Z" ,
"modified" : "2018-04-11T14:55:57.000Z" ,
2023-04-21 13:25:09 +00:00
"relationship_type" : "analysed-with" ,
2023-06-14 17:31:25 +00:00
"source_ref" : "indicator--f63376a8-74ab-4697-806c-3cac1c460c50" ,
"target_ref" : "x-misp-object--51e911da-e139-4bb4-8339-dfe5bd2e4f94"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2023-12-14 13:47:04 +00:00
"id" : "relationship--4e0fdc1d-3f3c-4b34-9c8f-0665a4030a1a" ,
2023-06-14 17:31:25 +00:00
"created" : "2018-04-11T14:55:57.000Z" ,
"modified" : "2018-04-11T14:55:57.000Z" ,
2023-04-21 13:25:09 +00:00
"relationship_type" : "analysed-with" ,
2023-06-14 17:31:25 +00:00
"source_ref" : "indicator--b1ce2cc9-5d81-442e-85a0-15f0148d20ed" ,
"target_ref" : "x-misp-object--964fb53d-7228-4f0d-8d81-ebfe0d47ba2e"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2023-12-14 13:47:04 +00:00
"id" : "relationship--aa5761b8-fbd3-461b-aae1-e93121c48620" ,
2023-06-14 17:31:25 +00:00
"created" : "2018-04-11T14:55:57.000Z" ,
"modified" : "2018-04-11T14:55:57.000Z" ,
2023-04-21 13:25:09 +00:00
"relationship_type" : "analysed-with" ,
2023-06-14 17:31:25 +00:00
"source_ref" : "indicator--99530dee-a6be-43e5-a901-355807d5e959" ,
"target_ref" : "x-misp-object--a046da2b-64c9-425b-b530-745287082e1f"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2023-12-14 13:47:04 +00:00
"id" : "relationship--c03bfdb1-948c-428d-a9a9-3cd5a6123eda" ,
2023-06-14 17:31:25 +00:00
"created" : "2018-04-11T14:55:57.000Z" ,
"modified" : "2018-04-11T14:55:57.000Z" ,
2023-04-21 13:25:09 +00:00
"relationship_type" : "analysed-with" ,
2023-06-14 17:31:25 +00:00
"source_ref" : "indicator--dd1084e8-640e-4e9b-9bb3-b15288465629" ,
"target_ref" : "x-misp-object--b0261080-5394-4a20-935c-104dc477dea0"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2023-12-14 13:47:04 +00:00
"id" : "relationship--98b4816c-a0f2-4b65-a5e5-a648188e7475" ,
2023-06-14 17:31:25 +00:00
"created" : "2018-04-11T14:55:57.000Z" ,
"modified" : "2018-04-11T14:55:57.000Z" ,
2023-04-21 13:25:09 +00:00
"relationship_type" : "analysed-with" ,
2023-06-14 17:31:25 +00:00
"source_ref" : "indicator--40b689ad-909c-4bdf-b60b-7e2434a0d2ad" ,
"target_ref" : "x-misp-object--ba176916-70c3-4a01-9d39-fb2d46d49b1f"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2023-12-14 13:47:04 +00:00
"id" : "relationship--71d8d3d0-3bbf-4983-ab52-120e238a2438" ,
2023-06-14 17:31:25 +00:00
"created" : "2018-04-11T14:55:57.000Z" ,
"modified" : "2018-04-11T14:55:57.000Z" ,
2023-04-21 13:25:09 +00:00
"relationship_type" : "analysed-with" ,
2023-06-14 17:31:25 +00:00
"source_ref" : "indicator--650e0658-1a9a-49d3-a71c-2bca2c81575f" ,
"target_ref" : "x-misp-object--ca1f75bb-eaa2-4681-85cd-2238ab5a3452"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2023-12-14 13:47:04 +00:00
"id" : "relationship--901fac5b-8720-46b8-ba46-a1e43a7e781e" ,
2023-06-14 17:31:25 +00:00
"created" : "2018-04-11T14:55:58.000Z" ,
"modified" : "2018-04-11T14:55:58.000Z" ,
2023-04-21 13:25:09 +00:00
"relationship_type" : "analysed-with" ,
2023-06-14 17:31:25 +00:00
"source_ref" : "indicator--443c8958-7a0a-4505-b809-7c5573c66f0e" ,
"target_ref" : "x-misp-object--14e75518-cf2c-4585-84bc-ea25bf34373b"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2023-12-14 13:47:04 +00:00
"id" : "relationship--06956a62-f96c-411c-a65d-879d80eaee9a" ,
2023-06-14 17:31:25 +00:00
"created" : "2018-04-11T14:55:58.000Z" ,
"modified" : "2018-04-11T14:55:58.000Z" ,
2023-04-21 13:25:09 +00:00
"relationship_type" : "analysed-with" ,
2023-06-14 17:31:25 +00:00
"source_ref" : "indicator--2228da8c-df64-430c-82ea-408a9961b7af" ,
"target_ref" : "x-misp-object--af3cf082-332b-4814-a96a-da533f84c06f"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2023-12-14 13:47:04 +00:00
"id" : "relationship--f7a0ce26-88b2-4af7-bc02-46fff8ef8c47" ,
2023-06-14 17:31:25 +00:00
"created" : "2018-04-11T14:55:58.000Z" ,
"modified" : "2018-04-11T14:55:58.000Z" ,
2023-04-21 13:25:09 +00:00
"relationship_type" : "analysed-with" ,
2023-06-14 17:31:25 +00:00
"source_ref" : "indicator--f503491f-6adf-4a8c-adfe-22c83d17b049" ,
"target_ref" : "x-misp-object--632d79f8-fee2-4258-8898-5d1e0a7c729e"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2023-12-14 13:47:04 +00:00
"id" : "relationship--00e7c40c-3fa6-484f-9ec9-2bc5cb127992" ,
2023-06-14 17:31:25 +00:00
"created" : "2018-04-11T14:55:58.000Z" ,
"modified" : "2018-04-11T14:55:58.000Z" ,
2023-04-21 13:25:09 +00:00
"relationship_type" : "analysed-with" ,
2023-06-14 17:31:25 +00:00
"source_ref" : "indicator--6c538a2a-8a0d-4562-b2e2-f9c5317dc1ec" ,
"target_ref" : "x-misp-object--d1f89b92-435b-48bd-87f3-088663f1dd9f"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2023-12-14 13:47:04 +00:00
"id" : "relationship--3105fc97-9fa4-4aa2-95c3-c96b662c8eb3" ,
2023-06-14 17:31:25 +00:00
"created" : "2018-04-11T14:55:58.000Z" ,
"modified" : "2018-04-11T14:55:58.000Z" ,
2023-04-21 13:25:09 +00:00
"relationship_type" : "analysed-with" ,
2023-06-14 17:31:25 +00:00
"source_ref" : "indicator--6d44632f-9fc4-4d8b-aeb3-2173dd9ea4e9" ,
"target_ref" : "x-misp-object--581ddc5b-72c1-4fe5-8d1c-6b51ae761ec2"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2023-12-14 13:47:04 +00:00
"id" : "relationship--064f76ab-aeab-488e-9972-3a2d8ab41787" ,
2023-06-14 17:31:25 +00:00
"created" : "2018-04-11T14:55:58.000Z" ,
"modified" : "2018-04-11T14:55:58.000Z" ,
2023-04-21 13:25:09 +00:00
"relationship_type" : "analysed-with" ,
2023-06-14 17:31:25 +00:00
"source_ref" : "indicator--06c65048-d1ec-4f49-83f8-69f906fb8426" ,
"target_ref" : "x-misp-object--082bcc2c-2673-464d-a3d5-038d83c53255"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2023-12-14 13:47:04 +00:00
"id" : "relationship--ad900696-2e10-4bad-a4f0-63cc2366e31a" ,
2023-06-14 17:31:25 +00:00
"created" : "2018-04-11T14:55:58.000Z" ,
"modified" : "2018-04-11T14:55:58.000Z" ,
2023-04-21 13:25:09 +00:00
"relationship_type" : "analysed-with" ,
2023-06-14 17:31:25 +00:00
"source_ref" : "indicator--33ffdc21-76a4-4a9d-8483-2621db37e09e" ,
"target_ref" : "x-misp-object--0a4652ca-2a5a-4f46-9b74-58569181df1f"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2023-12-14 13:47:04 +00:00
"id" : "relationship--bd5c97d0-14ff-4f41-abe3-c9da76e62a4b" ,
2023-06-14 17:31:25 +00:00
"created" : "2018-04-11T14:55:58.000Z" ,
"modified" : "2018-04-11T14:55:58.000Z" ,
2023-04-21 13:25:09 +00:00
"relationship_type" : "analysed-with" ,
2023-06-14 17:31:25 +00:00
"source_ref" : "indicator--f3107367-b8b2-4966-9adf-2541a70aa7ec" ,
"target_ref" : "x-misp-object--719a0ad9-8c06-45d6-9f58-9a552fcf39ee"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2023-12-14 13:47:04 +00:00
"id" : "relationship--7416da4e-14b5-4de0-8756-022b1c82db9b" ,
2023-06-14 17:31:25 +00:00
"created" : "2018-04-11T14:55:58.000Z" ,
"modified" : "2018-04-11T14:55:58.000Z" ,
2023-04-21 13:25:09 +00:00
"relationship_type" : "analysed-with" ,
2023-06-14 17:31:25 +00:00
"source_ref" : "indicator--21f75cd7-6a6b-4031-a122-06380ee2fd95" ,
"target_ref" : "x-misp-object--fb3889d5-e301-4ae5-8e3f-f064ba25fedf"
} ,
{
"type" : "relationship" ,
"spec_version" : "2.1" ,
2023-12-14 13:47:04 +00:00
"id" : "relationship--95232642-46c4-48fb-9c5e-7eae63eb60ea" ,
2023-06-14 17:31:25 +00:00
"created" : "2018-04-11T14:55:58.000Z" ,
"modified" : "2018-04-11T14:55:58.000Z" ,
2023-04-21 13:25:09 +00:00
"relationship_type" : "analysed-with" ,
2023-06-14 17:31:25 +00:00
"source_ref" : "indicator--017b5770-d46e-4885-85b0-bcec1fb85ec6" ,
"target_ref" : "x-misp-object--f1d72ac1-ab69-4d3e-a4a2-ee45e597e4d7"
} ,
{
"type" : "marking-definition" ,
"spec_version" : "2.1" ,
"id" : "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ,
"created" : "2017-01-20T00:00:00.000Z" ,
"definition_type" : "tlp" ,
"name" : "TLP:WHITE" ,
"definition" : {
"tlp" : "white"
}
}
2023-04-21 13:25:09 +00:00
]
}
