adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/5b0438ad-6d20-4a53-9a8b-2c1c0acd0835.json

908 lines
38 KiB
JSON
Raw Normal View History

chg: [feed] added
2023-04-21 13:25:09 +00:00
{
chg: [feed] feed updated
2023-06-14 17:31:25 +00:00
"type": "bundle",
"id": "bundle--5b0438ad-6d20-4a53-9a8b-2c1c0acd0835",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2021-05-24T09:48:49.000Z",
"modified": "2021-05-24T09:48:49.000Z",
"name": "Synovus Financial",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--5b0438ad-6d20-4a53-9a8b-2c1c0acd0835",
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2021-05-24T09:48:49.000Z",
"modified": "2021-05-24T09:48:49.000Z",
"name": "Emotet 5-18-2018",
"published": "2020-05-11T07:55:59Z",
"object_refs": [
"indicator--5b0438c4-c7ac-49a6-b78f-2c420acd0835",
"indicator--5b0438c4-20f0-4baa-b9ad-2c420acd0835",
"indicator--5b0438c4-1464-4a92-bcd8-2c420acd0835",
"indicator--5b0438c4-6724-4133-9846-2c420acd0835",
"indicator--5b0438c4-caf4-4260-a33f-2c420acd0835",
"indicator--5b0438c4-6944-4ac5-bb83-2c420acd0835",
"indicator--5b0438c4-fa54-4b42-a740-2c420acd0835",
"indicator--5b0438c4-6978-4f21-8e03-2c420acd0835",
"indicator--5b0438c4-5114-4463-aac3-2c420acd0835",
"indicator--5b0438c4-a450-43be-80a9-2c420acd0835",
"indicator--5b0438c4-b090-4a74-bec9-2c420acd0835",
"indicator--5b0438c4-7ed0-41b4-aa42-2c420acd0835",
"indicator--5b0438c4-7444-4a71-a9d9-2c420acd0835",
"indicator--5b0438c4-f0a0-46ed-8938-2c420acd0835",
"indicator--5b0438c4-9548-496f-96fb-2c420acd0835",
"indicator--5b0438c4-2c44-4426-895e-2c420acd0835",
"indicator--5b0438c4-4c8c-4d5e-b966-2c420acd0835",
"indicator--5b0438c4-b078-43e2-9d5d-2c420acd0835",
"indicator--5b0438c5-fbd8-4d17-bb11-2c420acd0835",
"indicator--5b0438d9-9b24-475a-9eb1-08ef0acd0835",
"indicator--5b0438d9-ae60-4a28-b202-08ef0acd0835",
"observed-data--5b0438e9-88c4-4681-aa0b-2c060acd0835",
"url--5b0438e9-88c4-4681-aa0b-2c060acd0835",
"indicator--5b043a2d-d2e0-4a3a-a20f-2ade0acd0835",
"indicator--5b043a2d-6a18-4b90-b690-2ade0acd0835",
"indicator--5b043a2d-cc18-4e88-95f6-2ade0acd0835",
"indicator--5b043a2d-6720-440e-a5c4-2ade0acd0835",
"indicator--5b043a2e-b2f8-4984-9875-2ade0acd0835",
"indicator--5b043a2e-ba3c-44c1-8389-2ade0acd0835",
"indicator--5b043a2e-c00c-4b03-9b9d-2ade0acd0835",
"indicator--5b043a2e-aeac-4727-aa52-2ade0acd0835",
"indicator--5b043a2e-1968-4be5-a86d-2ade0acd0835",
"indicator--5b043935-825c-49d4-b93c-08ef0acd0835"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"misp-galaxy:tool=\"Emotet\"",
"osint:source-type=\"pastie-website\"",
"osint:source-type=\"microblog-post\""
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5b0438c4-c7ac-49a6-b78f-2c420acd0835",
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2018-05-22T15:47:41.000Z",
"modified": "2018-05-22T15:47:41.000Z",
"description": "Emotet",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '50.37.10.78' AND network-traffic:dst_port = '80']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-22T15:47:41Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"veris:action:malware:variety=\"C2\"",
"diamond-model:Infrastructure"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5b0438c4-20f0-4baa-b9ad-2c420acd0835",
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2018-05-22T15:47:42.000Z",
"modified": "2018-05-22T15:47:42.000Z",
"description": "Emotet",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '50.84.214.74' AND network-traffic:dst_port = '80']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-22T15:47:42Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"veris:action:malware:variety=\"C2\"",
"diamond-model:Infrastructure"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5b0438c4-1464-4a92-bcd8-2c420acd0835",
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2018-05-22T15:47:42.000Z",
"modified": "2018-05-22T15:47:42.000Z",
"description": "Emotet",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '65.25.17.131' AND network-traffic:dst_port = '80']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-22T15:47:42Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"veris:action:malware:variety=\"C2\"",
"diamond-model:Infrastructure"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5b0438c4-6724-4133-9846-2c420acd0835",
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2018-05-22T15:47:42.000Z",
"modified": "2018-05-22T15:47:42.000Z",
"description": "Emotet",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '67.20.224.109' AND network-traffic:dst_port = '80']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-22T15:47:42Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"veris:action:malware:variety=\"C2\"",
"diamond-model:Infrastructure"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5b0438c4-caf4-4260-a33f-2c420acd0835",
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2018-05-22T15:47:42.000Z",
"modified": "2018-05-22T15:47:42.000Z",
"description": "Emotet",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '69.129.91.38' AND network-traffic:dst_port = '80']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-22T15:47:42Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"veris:action:malware:variety=\"C2\"",
"diamond-model:Infrastructure"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5b0438c4-6944-4ac5-bb83-2c420acd0835",
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2018-05-22T15:47:42.000Z",
"modified": "2018-05-22T15:47:42.000Z",
"description": "Emotet",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '70.167.17.7' AND network-traffic:dst_port = '80']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-22T15:47:42Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"veris:action:malware:variety=\"C2\"",
"diamond-model:Infrastructure"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5b0438c4-fa54-4b42-a740-2c420acd0835",
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2018-05-22T15:47:42.000Z",
"modified": "2018-05-22T15:47:42.000Z",
"description": "Emotet",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '72.49.55.42' AND network-traffic:dst_port = '80']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-22T15:47:42Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"veris:action:malware:variety=\"C2\"",
"diamond-model:Infrastructure"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5b0438c4-6978-4f21-8e03-2c420acd0835",
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2018-05-22T15:47:42.000Z",
"modified": "2018-05-22T15:47:42.000Z",
"description": "Emotet",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '86.209.63.166' AND network-traffic:dst_port = '80']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-22T15:47:42Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"veris:action:malware:variety=\"C2\"",
"diamond-model:Infrastructure"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5b0438c4-5114-4463-aac3-2c420acd0835",
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2018-05-22T15:47:42.000Z",
"modified": "2018-05-22T15:47:42.000Z",
"description": "Emotet",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '105.228.39.7' AND network-traffic:dst_port = '80']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-22T15:47:42Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"veris:action:malware:variety=\"C2\"",
"diamond-model:Infrastructure"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5b0438c4-a450-43be-80a9-2c420acd0835",
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2018-05-22T15:47:42.000Z",
"modified": "2018-05-22T15:47:42.000Z",
"description": "Emotet",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '119.18.8.51' AND network-traffic:dst_port = '80']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-22T15:47:42Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"veris:action:malware:variety=\"C2\"",
"diamond-model:Infrastructure"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5b0438c4-b090-4a74-bec9-2c420acd0835",
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2018-05-22T15:47:41.000Z",
"modified": "2018-05-22T15:47:41.000Z",
"description": "Emotet",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '169.0.250.138' AND network-traffic:dst_port = '80']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-22T15:47:41Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"veris:action:malware:variety=\"C2\"",
"diamond-model:Infrastructure"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5b0438c4-7ed0-41b4-aa42-2c420acd0835",
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2018-05-22T15:47:42.000Z",
"modified": "2018-05-22T15:47:42.000Z",
"description": "Emotet",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '179.52.46.11' AND network-traffic:dst_port = '80']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-22T15:47:42Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"veris:action:malware:variety=\"C2\"",
"diamond-model:Infrastructure"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5b0438c4-7444-4a71-a9d9-2c420acd0835",
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2018-05-22T15:47:42.000Z",
"modified": "2018-05-22T15:47:42.000Z",
"description": "Emotet",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '192.227.112.57' AND network-traffic:dst_port = '80']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-22T15:47:42Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"veris:action:malware:variety=\"C2\"",
"diamond-model:Infrastructure"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5b0438c4-f0a0-46ed-8938-2c420acd0835",
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2018-05-22T15:47:42.000Z",
"modified": "2018-05-22T15:47:42.000Z",
"description": "Emotet",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '199.167.209.11' AND network-traffic:dst_port = '80']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-22T15:47:42Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"veris:action:malware:variety=\"C2\"",
"diamond-model:Infrastructure"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5b0438c4-9548-496f-96fb-2c420acd0835",
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2018-05-22T15:47:42.000Z",
"modified": "2018-05-22T15:47:42.000Z",
"description": "Emotet",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '222.112.169.133' AND network-traffic:dst_port = '80']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-22T15:47:42Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"veris:action:malware:variety=\"C2\"",
"diamond-model:Infrastructure"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5b0438c4-2c44-4426-895e-2c420acd0835",
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2018-05-22T15:47:42.000Z",
"modified": "2018-05-22T15:47:42.000Z",
"description": "Emotet",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '37.120.170.231' AND network-traffic:dst_port = '443']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-22T15:47:42Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"veris:action:malware:variety=\"C2\"",
"diamond-model:Infrastructure"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5b0438c4-4c8c-4d5e-b966-2c420acd0835",
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2018-05-22T15:47:42.000Z",
"modified": "2018-05-22T15:47:42.000Z",
"description": "Emotet",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '174.140.167.85' AND network-traffic:dst_port = '443']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-22T15:47:42Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"veris:action:malware:variety=\"C2\"",
"diamond-model:Infrastructure"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5b0438c4-b078-43e2-9d5d-2c420acd0835",
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2018-05-22T15:47:42.000Z",
"modified": "2018-05-22T15:47:42.000Z",
"description": "Emotet",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '188.226.223.31' AND network-traffic:dst_port = '443']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-22T15:47:42Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"veris:action:malware:variety=\"C2\"",
"diamond-model:Infrastructure"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5b0438c5-fbd8-4d17-bb11-2c420acd0835",
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2018-05-22T15:47:42.000Z",
"modified": "2018-05-22T15:47:42.000Z",
"description": "Emotet",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '217.160.93.187' AND network-traffic:dst_port = '443']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-22T15:47:42Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"veris:action:malware:variety=\"C2\"",
"diamond-model:Infrastructure"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5b0438d9-9b24-475a-9eb1-08ef0acd0835",
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2018-05-22T15:48:33.000Z",
"modified": "2018-05-22T15:48:33.000Z",
"description": "Emotet",
"pattern": "[url:value = 'http://lemat.sk/YQJHmA']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-22T15:48:33Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"adversary:infrastructure-status=\"compromised\"",
"diamond-model:Infrastructure"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5b0438d9-ae60-4a28-b202-08ef0acd0835",
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2018-05-22T15:48:33.000Z",
"modified": "2018-05-22T15:48:33.000Z",
"description": "Emotet",
"pattern": "[url:value = 'http://columbiainstitute.org/O/YBC4RQ/']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-22T15:48:33Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"adversary:infrastructure-status=\"compromised\"",
"diamond-model:Infrastructure"
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5b0438e9-88c4-4681-aa0b-2c060acd0835",
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2018-05-22T15:42:18.000Z",
"modified": "2018-05-22T15:42:18.000Z",
"first_observed": "2018-05-22T15:42:18Z",
"last_observed": "2018-05-22T15:42:18Z",
"number_observed": 1,
"object_refs": [
"url--5b0438e9-88c4-4681-aa0b-2c060acd0835"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"Support Tool\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--5b0438e9-88c4-4681-aa0b-2c060acd0835",
"value": "https://www.virustotal.com/#/file/1b9e1f248b3dd13e0c8668117caa7f8af1e34918f1e9ac6f71d619e50fd91538/detection"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5b043a2d-d2e0-4a3a-a20f-2ade0acd0835",
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2018-05-22T15:48:33.000Z",
"modified": "2018-05-22T15:48:33.000Z",
"description": "Emotet",
"pattern": "[url:value = 'http://emulsiflex.com/Wz51Bq1/']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-22T15:48:33Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"adversary:infrastructure-status=\"compromised\"",
"diamond-model:Infrastructure"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5b043a2d-6a18-4b90-b690-2ade0acd0835",
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2018-05-22T15:48:33.000Z",
"modified": "2018-05-22T15:48:33.000Z",
"description": "Emotet",
"pattern": "[url:value = 'http://e-muhr.de/IcS1A5z/']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-22T15:48:33Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"adversary:infrastructure-status=\"compromised\"",
"diamond-model:Infrastructure"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5b043a2d-cc18-4e88-95f6-2ade0acd0835",
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2018-05-22T15:48:33.000Z",
"modified": "2018-05-22T15:48:33.000Z",
"description": "Emotet",
"pattern": "[url:value = 'http://emulsiflex.com/Wz51Bq1']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-22T15:48:33Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"adversary:infrastructure-status=\"compromised\"",
"diamond-model:Infrastructure"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5b043a2d-6720-440e-a5c4-2ade0acd0835",
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2018-05-22T15:48:33.000Z",
"modified": "2018-05-22T15:48:33.000Z",
"description": "Emotet",
"pattern": "[url:value = 'http://lemat.sk/YQJHmA/']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-22T15:48:33Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"adversary:infrastructure-status=\"compromised\"",
"diamond-model:Infrastructure"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5b043a2e-b2f8-4984-9875-2ade0acd0835",
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2018-05-22T15:48:33.000Z",
"modified": "2018-05-22T15:48:33.000Z",
"description": "Emotet",
"pattern": "[url:value = 'http://columbiainstitute.org/O/YBC4RQ']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-22T15:48:33Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"adversary:infrastructure-status=\"compromised\"",
"diamond-model:Infrastructure"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5b043a2e-ba3c-44c1-8389-2ade0acd0835",
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2018-05-22T15:48:33.000Z",
"modified": "2018-05-22T15:48:33.000Z",
"description": "Emotet",
"pattern": "[url:value = 'http://sweatshop.org/dnqN0nl']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-22T15:48:33Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"adversary:infrastructure-status=\"compromised\"",
"diamond-model:Infrastructure"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5b043a2e-c00c-4b03-9b9d-2ade0acd0835",
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2018-05-22T15:48:33.000Z",
"modified": "2018-05-22T15:48:33.000Z",
"description": "Emotet",
"pattern": "[url:value = 'http://www.gardonyrefhir.hu/gmQuF9x']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-22T15:48:33Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"adversary:infrastructure-status=\"compromised\"",
"diamond-model:Infrastructure"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5b043a2e-aeac-4727-aa52-2ade0acd0835",
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2018-05-22T15:48:33.000Z",
"modified": "2018-05-22T15:48:33.000Z",
"description": "Emotet",
"pattern": "[url:value = 'http://sweatshop.org/dnqN0nl/']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-22T15:48:33Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"adversary:infrastructure-status=\"compromised\"",
"diamond-model:Infrastructure"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5b043a2e-1968-4be5-a86d-2ade0acd0835",
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2018-05-22T15:48:33.000Z",
"modified": "2018-05-22T15:48:33.000Z",
"description": "Emotet",
"pattern": "[url:value = 'http://e-muhr.de/IcS1A5z']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-22T15:48:33Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"adversary:infrastructure-status=\"compromised\"",
"diamond-model:Infrastructure"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5b043935-825c-49d4-b93c-08ef0acd0835",
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
"created": "2018-05-22T15:37:25.000Z",
"modified": "2018-05-22T15:37:25.000Z",
"pattern": "[file:hashes.MD5 = '923a8d46eca1e77e020e0ac0951226d8' AND file:hashes.SHA1 = '45ef0de6aa324ebebdf9ba61129cd316e19973ae' AND file:hashes.SHA256 = '1b9e1f248b3dd13e0c8668117caa7f8af1e34918f1e9ac6f71d619e50fd91538' AND file:hashes.SSDEEP = '3072:8ZL3fu/kIS5c7+iMfmGkV1C5o63qaGymSUO:G0fac7Kflgao63qaGLS' AND file:name = '22468.exe' AND file:x_misp_text = 'Emotet' AND file:x_misp_state = 'Malicious']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-05-22T15:37:25Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
chg: [feed] added
2023-04-21 13:25:09 +00:00
]
}
Reference in a new issue Copy permalink