2023-04-21 13:25:09 +00:00
{
2023-06-14 17:31:25 +00:00
"type" : "bundle" ,
"id" : "bundle--5bfd7696-5874-4de3-acf3-4478950d210f" ,
"objects" : [
{
"type" : "identity" ,
"spec_version" : "2.1" ,
"id" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T17:09:14.000Z" ,
"modified" : "2018-11-27T17:09:14.000Z" ,
"name" : "CIRCL" ,
"identity_class" : "organization"
} ,
{
"type" : "report" ,
"spec_version" : "2.1" ,
"id" : "report--5bfd7696-5874-4de3-acf3-4478950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T17:09:14.000Z" ,
"modified" : "2018-11-27T17:09:14.000Z" ,
"name" : "OSINT - DNSpionage Campaign Targets Middle East" ,
"published" : "2018-11-27T17:20:04Z" ,
"object_refs" : [
"x-misp-attribute--5bfd76aa-1978-4706-96ab-4795950d210f" ,
"observed-data--5bfd76b7-2150-40f1-bcf0-45c1950d210f" ,
"url--5bfd76b7-2150-40f1-bcf0-45c1950d210f" ,
"indicator--5bfd77ab-0e54-41cd-9846-4b59950d210f" ,
"indicator--5bfd77ab-d404-4f61-96d7-465c950d210f" ,
"indicator--5bfd77ac-07a8-4505-bc1a-42a2950d210f" ,
"indicator--5bfd77ac-47b4-4aa1-a4ce-4249950d210f" ,
"indicator--5bfd77ad-c6a0-43e1-933f-4527950d210f" ,
"indicator--5bfd77ad-64c4-4f18-b372-4bcf950d210f" ,
"indicator--5bfd77ae-b530-4ddb-93cb-47a8950d210f" ,
"indicator--5bfd77ae-eccc-4314-a8d4-49d8950d210f" ,
"indicator--5bfd77af-7364-425f-97d6-40db950d210f" ,
"indicator--5bfd77af-63ec-4f18-a2fd-4ec4950d210f" ,
"indicator--5bfd77c7-d470-494a-be58-4980950d210f" ,
"indicator--5bfd77e0-fbb0-4b89-aa5f-4808950d210f" ,
"indicator--5bfd77e0-421c-4574-adca-4866950d210f" ,
"indicator--5bfd77e1-1974-4553-a30a-4cae950d210f" ,
"indicator--5bfd77fa-7770-4829-8002-4ad0950d210f" ,
"indicator--5bfd77fb-be64-4578-9d94-432e950d210f" ,
"indicator--5bfd77fb-6e28-4951-a4b9-40fb950d210f" ,
"indicator--5bfd7826-b5bc-482e-a28b-40f8950d210f" ,
"indicator--5bfd7827-4588-4e21-8357-46a3950d210f" ,
"indicator--5bfd7827-f984-473a-abe0-4fb5950d210f" ,
"indicator--5bfd783c-daf8-40c2-a92d-4976950d210f" ,
"indicator--5bfd783d-af70-4573-a50e-4816950d210f" ,
"observed-data--5bfd79ba-9690-4fe1-8117-4976e387cbd9" ,
"network-traffic--5bfd79ba-9690-4fe1-8117-4976e387cbd9" ,
"ipv4-addr--5bfd79ba-9690-4fe1-8117-4976e387cbd9" ,
"observed-data--5bfd79bb-06c0-4e27-8d8e-4805e387cbd9" ,
"network-traffic--5bfd79bb-06c0-4e27-8d8e-4805e387cbd9" ,
"ipv4-addr--5bfd79bb-06c0-4e27-8d8e-4805e387cbd9" ,
"observed-data--5bfd79bc-defc-4d9d-ae52-45e5e387cbd9" ,
"network-traffic--5bfd79bc-defc-4d9d-ae52-45e5e387cbd9" ,
"ipv4-addr--5bfd79bc-defc-4d9d-ae52-45e5e387cbd9" ,
"observed-data--5bfd79bd-01c8-4c91-96f3-4098e387cbd9" ,
"network-traffic--5bfd79bd-01c8-4c91-96f3-4098e387cbd9" ,
"ipv4-addr--5bfd79bd-01c8-4c91-96f3-4098e387cbd9" ,
"observed-data--5bfd79bd-c714-4d3f-9807-42e5e387cbd9" ,
"network-traffic--5bfd79bd-c714-4d3f-9807-42e5e387cbd9" ,
"ipv4-addr--5bfd79bd-c714-4d3f-9807-42e5e387cbd9" ,
"observed-data--5bfd7bc8-433c-4ebd-91b6-49ee950d210f" ,
"file--5bfd7bc8-433c-4ebd-91b6-49ee950d210f" ,
"artifact--5bfd7bc8-433c-4ebd-91b6-49ee950d210f" ,
"indicator--6e6483af-2f0d-424d-a499-d6a3e6353299" ,
"x-misp-object--84a65bd8-7fce-49dd-a208-c370fd9b4712" ,
"indicator--bf245fce-307d-43b4-99a1-1621912adaa1" ,
"x-misp-object--eefe884e-c9ac-4c89-a933-c7a28b86f3e4" ,
"indicator--4000505b-9af4-4fce-9268-7be10e3505ad" ,
"x-misp-object--8287973f-a9fd-4a35-a0e1-7078c2728c2f" ,
"indicator--825a35c4-4f37-4ab4-99aa-102f48160497" ,
"x-misp-object--ebaeaa9d-fa51-4c9f-9d88-0496e017318b" ,
"indicator--d0fd14c2-720a-4bb3-bc6f-f2caa1412a2e" ,
"x-misp-object--b59e3757-0be0-4ea6-91c2-cf6eb149c993"
] ,
"labels" : [
"Threat-Report" ,
"misp:tool=\"MISP-STIX-Converter\"" ,
"estimative-language:confidence-in-analytic-judgment=\"moderate\""
] ,
"object_marking_refs" : [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
} ,
{
"type" : "x-misp-attribute" ,
"spec_version" : "2.1" ,
"id" : "x-misp-attribute--5bfd76aa-1978-4706-96ab-4795950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T17:06:17.000Z" ,
"modified" : "2018-11-27T17:06:17.000Z" ,
"labels" : [
"misp:type=\"text\"" ,
"misp:category=\"External analysis\"" ,
"osint:source-type=\"blog-post\""
] ,
"x_misp_category" : "External analysis" ,
"x_misp_type" : "text" ,
"x_misp_value" : "Cisco Talos recently discovered a new campaign targeting Lebanon and the United Arab Emirates (UAE) affecting .gov domains, as well as a private Lebanese airline company. Based on our research, it's clear that this adversary spent time understanding the victims' network infrastructure in order to remain under the radar and act as inconspicuous as possible during their attacks.\r\n\r\nBased on this actor's infrastructure and TTPs, we haven't been able to connect them with any other campaign or actor that's been observed recently. This particular campaign utilizes two fake, malicious websites containing job postings that are used to compromise targets via malicious Microsoft Office documents with embedded macros. The malware utilized by this actor, which we are calling \"DNSpionage,\" supports HTTP and DNS communication with the attackers.\r\n\r\nIn a separate campaign, the attackers used the same IP to redirect the DNS of legitimate .gov and private company domains. During each DNS compromise, the actor carefully generated Let's Encrypt certificates for the redirected domains. These certificates provide X.509 certificates for TLS free of charge to the user. We don't know at this time if the DNS redirections were successful.\r\n\r\nIn this post, we will break down the attackers' methods and show how they used malicious documents to attempt to trick users into opening malicious websites that are disguised as \"help wanted\" sites for job seekers. Additionally, we will describe the malicious DNS redirection and the timeline of the events."
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5bfd76b7-2150-40f1-bcf0-45c1950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T17:06:16.000Z" ,
"modified" : "2018-11-27T17:06:16.000Z" ,
"first_observed" : "2018-11-27T17:06:16Z" ,
"last_observed" : "2018-11-27T17:06:16Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5bfd76b7-2150-40f1-bcf0-45c1950d210f"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\"" ,
"osint:source-type=\"blog-post\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5bfd76b7-2150-40f1-bcf0-45c1950d210f" ,
"value" : "https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bfd77ab-0e54-41cd-9846-4b59950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T16:58:19.000Z" ,
"modified" : "2018-11-27T16:58:19.000Z" ,
"description" : "Domains in the MEA certificate (on 185.20.187.8):" ,
"pattern" : "[domain-name:value = 'memail.mea.com.lb']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-11-27T16:58:19Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"hostname\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bfd77ab-d404-4f61-96d7-465c950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T16:58:19.000Z" ,
"modified" : "2018-11-27T16:58:19.000Z" ,
"description" : "Domains in the MEA certificate (on 185.20.187.8):" ,
"pattern" : "[domain-name:value = 'autodiscover.mea.com.lb']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-11-27T16:58:19Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"hostname\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bfd77ac-07a8-4505-bc1a-42a2950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T16:58:20.000Z" ,
"modified" : "2018-11-27T16:58:20.000Z" ,
"description" : "Domains in the MEA certificate (on 185.20.187.8):" ,
"pattern" : "[domain-name:value = 'owa.mea.com.lb']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-11-27T16:58:20Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"hostname\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bfd77ac-47b4-4aa1-a4ce-4249950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T16:58:20.000Z" ,
"modified" : "2018-11-27T16:58:20.000Z" ,
"description" : "Domains in the MEA certificate (on 185.20.187.8):" ,
"pattern" : "[domain-name:value = 'www.mea.com.lb']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-11-27T16:58:20Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"hostname\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bfd77ad-c6a0-43e1-933f-4527950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T16:58:21.000Z" ,
"modified" : "2018-11-27T16:58:21.000Z" ,
"description" : "Domains in the MEA certificate (on 185.20.187.8):" ,
"pattern" : "[domain-name:value = 'autodiscover.mea.aero']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-11-27T16:58:21Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"hostname\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bfd77ad-64c4-4f18-b372-4bcf950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T16:58:21.000Z" ,
"modified" : "2018-11-27T16:58:21.000Z" ,
"description" : "Domains in the MEA certificate (on 185.20.187.8):" ,
"pattern" : "[domain-name:value = 'autodiscover.meacorp.com.lb']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-11-27T16:58:21Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"hostname\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bfd77ae-b530-4ddb-93cb-47a8950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T16:58:22.000Z" ,
"modified" : "2018-11-27T16:58:22.000Z" ,
"description" : "Domains in the MEA certificate (on 185.20.187.8):" ,
"pattern" : "[domain-name:value = 'meacorp.com.lb']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-11-27T16:58:22Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"hostname\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bfd77ae-eccc-4314-a8d4-49d8950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T16:58:22.000Z" ,
"modified" : "2018-11-27T16:58:22.000Z" ,
"description" : "Domains in the MEA certificate (on 185.20.187.8):" ,
"pattern" : "[domain-name:value = 'memailr.meacorp.com.lb']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-11-27T16:58:22Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"hostname\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bfd77af-7364-425f-97d6-40db950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T16:58:23.000Z" ,
"modified" : "2018-11-27T16:58:23.000Z" ,
"description" : "Domains in the MEA certificate (on 185.20.187.8):" ,
"pattern" : "[domain-name:value = 'meoutlook.meacorp.com.lb']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-11-27T16:58:23Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"hostname\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bfd77af-63ec-4f18-a2fd-4ec4950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T16:58:23.000Z" ,
"modified" : "2018-11-27T16:58:23.000Z" ,
"description" : "Domains in the MEA certificate (on 185.20.187.8):" ,
"pattern" : "[domain-name:value = 'tmec.mea.com.lb']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-11-27T16:58:23Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"hostname\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bfd77c7-d470-494a-be58-4980950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T16:58:47.000Z" ,
"modified" : "2018-11-27T16:58:47.000Z" ,
"description" : "C2 Server Domain" ,
"pattern" : "[domain-name:value = '0ffice36o.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-11-27T16:58:47Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bfd77e0-fbb0-4b89-aa5f-4808950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T16:59:12.000Z" ,
"modified" : "2018-11-27T16:59:12.000Z" ,
"description" : "C2 Server IP" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.20.184.138']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-11-27T16:59:12Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bfd77e0-421c-4574-adca-4866950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T16:59:12.000Z" ,
"modified" : "2018-11-27T16:59:12.000Z" ,
"description" : "C2 Server IP" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.20.187.8']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-11-27T16:59:12Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bfd77e1-1974-4553-a30a-4cae950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T16:59:13.000Z" ,
"modified" : "2018-11-27T16:59:13.000Z" ,
"description" : "C2 Server IP" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.161.211.72']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-11-27T16:59:13Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bfd77fa-7770-4829-8002-4ad0950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T16:59:38.000Z" ,
"modified" : "2018-11-27T16:59:38.000Z" ,
"description" : "DNSpionage sample" ,
"pattern" : "[file:hashes.SHA256 = '2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-11-27T16:59:38Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bfd77fb-be64-4578-9d94-432e950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T16:59:39.000Z" ,
"modified" : "2018-11-27T16:59:39.000Z" ,
"description" : "DNSpionage sample" ,
"pattern" : "[file:hashes.SHA256 = '82285b6743cc5e3545d8e67740a4d04c5aed138d9f31d7c16bd11188a2042969']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-11-27T16:59:39Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bfd77fb-6e28-4951-a4b9-40fb950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T16:59:39.000Z" ,
"modified" : "2018-11-27T16:59:39.000Z" ,
"description" : "DNSpionage sample" ,
"pattern" : "[file:hashes.SHA256 = '45a9edb24d4174592c69d9d37a534a518fbe2a88d3817fc0cc739e455883b8ff']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-11-27T16:59:39Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bfd7826-b5bc-482e-a28b-40f8950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T17:00:22.000Z" ,
"modified" : "2018-11-27T17:00:22.000Z" ,
"description" : "(LB submit)" ,
"pattern" : "[file:hashes.SHA256 = '9ea577a4b3faaf04a3bddbfcb934c9752bed0d0fc579f2152751c5f6923f7e14']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-11-27T17:00:22Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bfd7827-4588-4e21-8357-46a3950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T17:00:23.000Z" ,
"modified" : "2018-11-27T17:00:23.000Z" ,
"description" : "(LB submit)" ,
"pattern" : "[file:hashes.SHA256 = '15fe5dbcd31be15f98aa9ba18755ee6264a26f5ea0877730b00ca0646d0f25fa']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-11-27T17:00:23Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bfd7827-f984-473a-abe0-4fb5950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T17:00:23.000Z" ,
"modified" : "2018-11-27T17:00:23.000Z" ,
"description" : "(RU submit)" ,
"pattern" : "[file:hashes.SHA256 = 'e279985597af22dddf1217ee35a8cffb17d1418ae1b4bae2d9ea79c0c6963a85']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-11-27T17:00:23Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bfd783c-daf8-40c2-a92d-4976950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T17:00:44.000Z" ,
"modified" : "2018-11-27T17:00:44.000Z" ,
"description" : "Fake job website" ,
"pattern" : "[domain-name:value = 'hr-wipro.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-11-27T17:00:44Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bfd783d-af70-4573-a50e-4816950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T17:00:45.000Z" ,
"modified" : "2018-11-27T17:00:45.000Z" ,
"description" : "Fake job website" ,
"pattern" : "[domain-name:value = 'hr-suncor.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-11-27T17:00:45Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5bfd79ba-9690-4fe1-8117-4976e387cbd9" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T17:07:06.000Z" ,
"modified" : "2018-11-27T17:07:06.000Z" ,
"first_observed" : "2018-11-27T17:07:06Z" ,
"last_observed" : "2018-11-27T17:07:06Z" ,
"number_observed" : 1 ,
"object_refs" : [
"network-traffic--5bfd79ba-9690-4fe1-8117-4976e387cbd9" ,
"ipv4-addr--5bfd79ba-9690-4fe1-8117-4976e387cbd9"
] ,
"labels" : [
"misp:type=\"ip-src\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "network-traffic" ,
"spec_version" : "2.1" ,
"id" : "network-traffic--5bfd79ba-9690-4fe1-8117-4976e387cbd9" ,
"src_ref" : "ipv4-addr--5bfd79ba-9690-4fe1-8117-4976e387cbd9" ,
"protocols" : [
"tcp"
]
} ,
{
"type" : "ipv4-addr" ,
"spec_version" : "2.1" ,
"id" : "ipv4-addr--5bfd79ba-9690-4fe1-8117-4976e387cbd9" ,
"value" : "91.199.39.133"
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5bfd79bb-06c0-4e27-8d8e-4805e387cbd9" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T17:07:07.000Z" ,
"modified" : "2018-11-27T17:07:07.000Z" ,
"first_observed" : "2018-11-27T17:07:07Z" ,
"last_observed" : "2018-11-27T17:07:07Z" ,
"number_observed" : 1 ,
"object_refs" : [
"network-traffic--5bfd79bb-06c0-4e27-8d8e-4805e387cbd9" ,
"ipv4-addr--5bfd79bb-06c0-4e27-8d8e-4805e387cbd9"
] ,
"labels" : [
"misp:type=\"ip-src\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "network-traffic" ,
"spec_version" : "2.1" ,
"id" : "network-traffic--5bfd79bb-06c0-4e27-8d8e-4805e387cbd9" ,
"src_ref" : "ipv4-addr--5bfd79bb-06c0-4e27-8d8e-4805e387cbd9" ,
"protocols" : [
"tcp"
]
} ,
{
"type" : "ipv4-addr" ,
"spec_version" : "2.1" ,
"id" : "ipv4-addr--5bfd79bb-06c0-4e27-8d8e-4805e387cbd9" ,
"value" : "40.101.8.168"
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5bfd79bc-defc-4d9d-ae52-45e5e387cbd9" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T17:07:08.000Z" ,
"modified" : "2018-11-27T17:07:08.000Z" ,
"first_observed" : "2018-11-27T17:07:08Z" ,
"last_observed" : "2018-11-27T17:07:08Z" ,
"number_observed" : 1 ,
"object_refs" : [
"network-traffic--5bfd79bc-defc-4d9d-ae52-45e5e387cbd9" ,
"ipv4-addr--5bfd79bc-defc-4d9d-ae52-45e5e387cbd9"
] ,
"labels" : [
"misp:type=\"ip-src\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "network-traffic" ,
"spec_version" : "2.1" ,
"id" : "network-traffic--5bfd79bc-defc-4d9d-ae52-45e5e387cbd9" ,
"src_ref" : "ipv4-addr--5bfd79bc-defc-4d9d-ae52-45e5e387cbd9" ,
"protocols" : [
"tcp"
]
} ,
{
"type" : "ipv4-addr" ,
"spec_version" : "2.1" ,
"id" : "ipv4-addr--5bfd79bc-defc-4d9d-ae52-45e5e387cbd9" ,
"value" : "104.16.1.7"
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5bfd79bd-01c8-4c91-96f3-4098e387cbd9" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T17:07:09.000Z" ,
"modified" : "2018-11-27T17:07:09.000Z" ,
"first_observed" : "2018-11-27T17:07:09Z" ,
"last_observed" : "2018-11-27T17:07:09Z" ,
"number_observed" : 1 ,
"object_refs" : [
"network-traffic--5bfd79bd-01c8-4c91-96f3-4098e387cbd9" ,
"ipv4-addr--5bfd79bd-01c8-4c91-96f3-4098e387cbd9"
] ,
"labels" : [
"misp:type=\"ip-src\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "network-traffic" ,
"spec_version" : "2.1" ,
"id" : "network-traffic--5bfd79bd-01c8-4c91-96f3-4098e387cbd9" ,
"src_ref" : "ipv4-addr--5bfd79bd-01c8-4c91-96f3-4098e387cbd9" ,
"protocols" : [
"tcp"
]
} ,
{
"type" : "ipv4-addr" ,
"spec_version" : "2.1" ,
"id" : "ipv4-addr--5bfd79bd-01c8-4c91-96f3-4098e387cbd9" ,
"value" : "185.20.184.138"
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5bfd79bd-c714-4d3f-9807-42e5e387cbd9" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T17:07:09.000Z" ,
"modified" : "2018-11-27T17:07:09.000Z" ,
"first_observed" : "2018-11-27T17:07:09Z" ,
"last_observed" : "2018-11-27T17:07:09Z" ,
"number_observed" : 1 ,
"object_refs" : [
"network-traffic--5bfd79bd-c714-4d3f-9807-42e5e387cbd9" ,
"ipv4-addr--5bfd79bd-c714-4d3f-9807-42e5e387cbd9"
] ,
"labels" : [
"misp:type=\"ip-src\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "network-traffic" ,
"spec_version" : "2.1" ,
"id" : "network-traffic--5bfd79bd-c714-4d3f-9807-42e5e387cbd9" ,
"src_ref" : "ipv4-addr--5bfd79bd-c714-4d3f-9807-42e5e387cbd9" ,
"protocols" : [
"tcp"
]
} ,
{
"type" : "ipv4-addr" ,
"spec_version" : "2.1" ,
"id" : "ipv4-addr--5bfd79bd-c714-4d3f-9807-42e5e387cbd9" ,
"value" : "185.161.211.79"
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5bfd7bc8-433c-4ebd-91b6-49ee950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T17:15:52.000Z" ,
"modified" : "2018-11-27T17:15:52.000Z" ,
"first_observed" : "2018-11-27T17:15:52Z" ,
"last_observed" : "2018-11-27T17:15:52Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--5bfd7bc8-433c-4ebd-91b6-49ee950d210f" ,
"artifact--5bfd7bc8-433c-4ebd-91b6-49ee950d210f"
] ,
"labels" : [
"misp:type=\"attachment\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--5bfd7bc8-433c-4ebd-91b6-49ee950d210f" ,
"name" : "image3.png" ,
"content_ref" : "artifact--5bfd7bc8-433c-4ebd-91b6-49ee950d210f"
} ,
{
"type" : "artifact" ,
"spec_version" : "2.1" ,
"id" : "artifact--5bfd7bc8-433c-4ebd-91b6-49ee950d210f" ,
"payload_bin" : " i V B O R w 0 K G g o A A A A N S U h E U g A A B Y 4 A A A P S C A I A A A B T b N k M A A A A A 3 N C S V Q I C A j b 4 U / g A A A A X 3 p U W H R S Y X c g c H J v Z m l s Z S B 0 e X B l I E F Q U D E A A A i Z 40 p P z U s t y k x W K C j K T 8 v M S e V S A A N j E y 4 T S x N L o 0 Q D A w M L A w g w N D A w N g S S R k C 2 O V Q o 0 Q A F m J i b p Q G h u V m y m S m I z w U A T 7 o V a B s t 2 I w A A C A A S U R B V H i c 7 L 3 X n x x H l u 93 T p i 0 V V m + q w 3 Q D Q w M C Y I A Z 5 a X a + / s X j 3 o o z d 9 P v p L p V e 9 S L q 7 K + n u n Z 3 V D D k c k i B B u D b l f d p w e o j q Q j c A w g w J g A T y + 4 H J q n S R U Z k Z E S d + 5 x w 0 x g D A n X v H Q u o 4 l V I b R p E g A g A Y g D P / b R Y N P P m 9 E D r J h M t J t x 2 G P g c A Y 4 w 9 M k E E e 7 S n M A a U M l J q I b V S B o w B Y z Z H X n 9 Y L 25 O Z w A A E D m n v u 8 w R p 955 H c Y R N R a K y U B g F J G E M 0 L 9 y k p K S k p K X k N K K V E U Q g p l Z K U U t / 3 G e N v 7 O y M U c 910 v i 7 o 0 f / m x T 9 Z u u y 79 f f 2 N m f w N i e j 1 b a d m Y Q C S E I C A D a a K O 1 M c a A Q U A 80 y n a f A k A g I C A h B A A 1 F o D G A C 0 G D D 2 C A D r 78 j 6 H 7 I 52 G k B t N Y K A J A Q g g Q Q w R i t t T H a r H t T g I h I C C I i o D F G G 22 M 3 v T p 1 m s B j T k 9 I w A i 2 u P b 5 a f P / r Z Y r c a 93 h 1 K t / b 2 / 5 d K 9 I F S S u u y W 1 R S U l L y y 8 Z 1 e L v V A A B m P 4 c e A 4 B a 6 P z I 424 a L d u 4 v n B j x p A x 6 s F 7 Z 3 H 4 i z H G I O K m L 1 g 2 y C U l J S U l b w t K K f V 9722 d 3 m z m L y g g B a C b X s 2 b B 20 X i P K n O z Q E 4 F W 7 O f T p 7 V 90 h N M C P L U v A i H P P d e r F e 3 n B k O g A K c T b G W v q K S k p O Q d 4 l y j / t a t 4 y U l J S U l J S U l L 4 m 1 V A B Q R A b 2 T 8 n 7 B C J F p I h k b a 0 o K S k p K X m H K B v 1 k p K S k p K S k l 8 e p 36 h i E g Q G A L 7 x U s E S l 4 V a 6 d A A g g b L + K S k p K S k n e D t a n C l J q 5 k p K S k p K S k l 8 S 5 j T 6 A g H r A 4 K l q e J 9 g w I 5 q 6 o w Z Y e 2 p K S k 5 J f O 5 j 2 + N l V o b Z Q 2 Q m q p j P 5 L 3 / N P R + F 8 K f D 1 i v Y Q k R J k F D k n l D x 5 q k 34 z 83 C u w S e 4 W 2 X p a S k p K S k 5 H W A A G z t A A J v L q h n y c 8 B R I 7 I s D R R l Z S U l L y L r E 0 V U p m s U N N F E a d S K P 1 q 8 Z P P Z Q R 5 d T M H n j d W / K R j a g R k F F 2 H V g L W q D r U f b I x M 8 Y o p b T W S m l j 9E957 p 8 B i I S u I a W 1 o q S k p K T k X c P Y N B k M i Y P o I J a m i v c L R E 6 Q I 9 I y V k V J S U n J u 8 f a V H E 8 T F a Z O p m I R a K E A v X y 5 o Y n M p k + S 5 h w 9 q t n t i T P G 0 X / i K b H W k A Y A Z f q Z p V d 2 N K t m u O 7 l D M C p z I K K W V e F E Y b R i l 5 f o z s X y D G m K I o C C G O 4 z B G S 2 t F S U l J S c k 7 w + M E I E j J e n a 9 j M D 1 f m F / d E S K g G U C k J K S k p J 3 j H W j / o d v p o v M H M 5 g l h N N H A 0E4 K V f + Y 9 V F Z u s 3 O f W P m m q O L 8 W n j R H P O / T K 2 H 9 H l A V W C S d i v l w W V z Z C y 50 w 42 p Q k q Z Z f k q j h m l z U b d 89 y //GQ/S7IsnyULrQ0gIHEpKbUVJSUlJSXvGLhOAwFlrIr3D6SIBJGUSexKSkpK3j3Wpoo/3Vsmio4LL1ZUE2KQvkR66jMKirNhKp5qLM4qLZ5sSl5oDTndAZ956BftigRAUZOTOBMIMUXTiNwo5LA2VSitNaPUdR3f9wLff6Xj//xBwDhOCiG01lopUgatKCkpKSl5x0BrqrCxKkpVxXsGMiSsdAApKSkp+VlhAIwxWoMxoE8jQ8KpkoCgzd314oHpulH/5jAFx8eKS1wfNGi9eef/oC3BAOLzLQ3POjc+Ial4YctybodXGmdb/w9ERqjDM5l8fzJxUF3bj+xqrY2UklLSaTeDwA98n7N3rYtDEJVSaZYprZXW9J2LG1pSUlJS8l5jez6EgeGAHMpYFe8ZiAzRQWQIWPp/lJSUlPwcMOtwkKaQRigjlVFKa2MQgFJkBBlDTglnhL5ocL8enA/mwgncSkAYUmOU0WcDTD771b+xjjxjyyf/f9GxnjRCnPlwfnRtTkNwvshmgdbzxCASRpA5hRSrpRzPdSHU6aGM0pozFvh+JQw5Y+9erAqtje+52ug0y80rhUotKSkpKSn5uWMzliEiw7Wd4l2bcih5ERwJR2SlA0hJSUnJW8cYMMYU0iS5SnMd5zordKGMVFoZjWAYJZwgp+g7pOqzwKMuJ5T+oPJ/3agrZZRSSiqUQgultYanvDueLMozkn089fklR8dP5it9bnuDT8a7ePYR7T8IxlBEY5TUWmuD5y7LmJcu4i8bm4n1/bjWkpKSkpL3CgRkgA4gK1UV7x3Ibb5SgBcofUtKSkpKXjfGGKHMPJEn42I4l7NYxbkutBFaS6MQDUPCARmayCPbDd5tOO26G/qMkmfn2WCb42ptlJJESqWkUc9N22n9TZ5M/vHUVs9dC/ByATSf8e3aDPGy6grQSoHVnTxdkvciXrQBMPZHe/evtaSkpKTkfcHYGQcEYIgMgQGUYTXfL6ygZm2qKCkpKSl5S1g9RVroWSyHM/FoVIzmaplBJo0CMAhA0BgArUEZ0GbmQFKoRChpoK2h6jOHPcNYwc4cXhuttJZaieeYKsyZv6f/4plv8cxnXG/zPFPFY4mEObcXnFt39lyn656UYvzQ8dGgQtD6aXeV90dpUNopSkpKSkreQYw5zQDCARiY0lTxvkGRWBMV/nB3s6SkpKTk9WKMEdLMVvJeLzueiMnKpAIBmesSzojDwXWMNipJRZqrTJiVVKuJmGUqkyaX+mI74CHCU9IKdub4RmulldQ/rKo4TfRhzn+Bm2Vzxmxx9vsf5qnMpWsTxHoZn157Zr8XWCvOmiqMMs+2Srz7Y/j1tNM7fpUlJSUlJe8Xj9vvdfoPWqoq3j9smJIyVkVJSUnJ20Qos0zVeCFOpqI/V5mghLIo5NWAVXzqOcio0VoVgq1SNVmp6UrMV0osFSU5JRgF3HeIw58MtPnYAcRYVYWSWkn9PFWFOWOMePYW51c/32DxrLVnlRNPHPfcNvgCHxCrvECDmuAzVBXvgZXiHO/TtZaUlJSUvBcYAESgCDamZmmqeL9AYKc/PSm7OSUlJSVvi1yY4Uz0pmIW60wQILwS8r0O226yTo1xhqtUg2EV101y9WBQPBoSbUyciuFCObToRCJ0aY1wSp5lqgAAMFprhRq1llr/cKyKpwNVnFu7/qfqs712UA04AEhl0lwuEzFZFojQqXsAMJxlBHG76QFAb5quUnnuOM8QTTx9Rnxsr/gBEAG0QU2IVj+hr0eSpuPxBABarWbg+wCgtRZCSKmUVpQQ13XZO5H61F5XksTT6TTPckJIGIatVssPgtd0LqWkUooQ+hbrMInj4XAYxzEAUEZdxw3CsFarua77ms6YpulkPAaAZqvl+/5rOssPkaXpdDoFgEaj4b3xs1uSJBmt63z9ignDsNPpBGH44n3jeDgcaqObzVYQBJTSdy+bz48hy7L5bAYAtXrd87wn1tqaB4B2pxP8wHOd5/lyuQSAarVKEOM4NgBBECBinudGa+44jLF3oOaTJBmNhkkcG/PK9+FZlFJFUSilEIBSyh2H0l/GENoYY4wRQqRJAohhGHL+OFBllmXz+TzPMgBwPa9Wqz19R70NbAYQ/UqqCillluVxnCyXyyIvAMD13FqtFoaB4/BX/b1stC8ppBASCfq+98vqA+R5sXnGXdd5Y+dVStsnBQAoIY77FzwpdK2qKGNVlJSUlPylKKUKIdI0Xa1iAKhUQt/3Hf4KrWEh9GQpRwudFKiBcspCn3XqrNtgFZ8W0mRCIUCryjwHs8KkhZ6s5CpWsZDjperN8tAnnkNdfq4neVZVYYxRWoPWUmv1dAk2hgMDmxAPT0aSWK82eqfh/89/t/3hfgQAi0Qej5KvHy7++9djTvE/32wAwD9/PmCU/I9/1QaE//13veUqf7qVMedDWZw5oQGwdohzAZ+fdlNERNBANDFGPcuJ8S80XozHk//7//0dAPzD330WXNgDACHEYrFcxUmWZa7rdLc6v6xuyg8hhFg
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--6e6483af-2f0d-424d-a499-d6a3e6353299" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T17:09:02.000Z" ,
"modified" : "2018-11-27T17:09:02.000Z" ,
"pattern" : "[file:hashes.MD5 = 'd2052cb9016dab6592c532d5ea47cb7e' AND file:hashes.SHA1 = '1c1fbda6ffc4d19be63a630bd2483f3d2f7aa1f5' AND file:hashes.SHA256 = '2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-11-27T17:09:02Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--84a65bd8-7fce-49dd-a208-c370fd9b4712" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T17:09:04.000Z" ,
"modified" : "2018-11-27T17:09:04.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-11-27T16:07:22" ,
"category" : "Other" ,
"uuid" : "9c2d143f-d491-4afc-9e0b-6503bd33421e"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec/analysis/1543334842/" ,
"category" : "External analysis" ,
"uuid" : "1c5fc483-b964-4969-8b7b-6fb343e6b1a4"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "27/66" ,
"category" : "Other" ,
"uuid" : "861f0fee-95e9-4a77-adc7-7b56fc44bb17"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--bf245fce-307d-43b4-99a1-1621912adaa1" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T17:09:05.000Z" ,
"modified" : "2018-11-27T17:09:05.000Z" ,
"pattern" : "[file:hashes.MD5 = '48320f502811645fa1f2f614bd8a385a' AND file:hashes.SHA1 = '1f007ab17b62cca88a5681f02089ab33adc10eec' AND file:hashes.SHA256 = '15fe5dbcd31be15f98aa9ba18755ee6264a26f5ea0877730b00ca0646d0f25fa']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-11-27T17:09:05Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--eefe884e-c9ac-4c89-a933-c7a28b86f3e4" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T17:09:07.000Z" ,
"modified" : "2018-11-27T17:09:07.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-11-27T16:10:08" ,
"category" : "Other" ,
"uuid" : "e87b0956-d6a7-4677-ade1-e88763b6824c"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/15fe5dbcd31be15f98aa9ba18755ee6264a26f5ea0877730b00ca0646d0f25fa/analysis/1543335008/" ,
"category" : "External analysis" ,
"uuid" : "64af8286-4eb6-4fbd-9709-63f829fd7545"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "24/59" ,
"category" : "Other" ,
"uuid" : "65f0de8b-c1b9-436f-b1f0-7cc10e5a132a"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--4000505b-9af4-4fce-9268-7be10e3505ad" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T17:09:08.000Z" ,
"modified" : "2018-11-27T17:09:08.000Z" ,
"pattern" : "[file:hashes.MD5 = 'ba6bd22449d990be6fd9acf7e710c192' AND file:hashes.SHA1 = '14810a41ad9cca0f1028483e0ed3f52591772a61' AND file:hashes.SHA256 = 'e279985597af22dddf1217ee35a8cffb17d1418ae1b4bae2d9ea79c0c6963a85']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-11-27T17:09:08Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--8287973f-a9fd-4a35-a0e1-7078c2728c2f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T17:09:09.000Z" ,
"modified" : "2018-11-27T17:09:09.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-11-27T05:32:45" ,
"category" : "Other" ,
"uuid" : "7d8312d5-277c-41b9-968f-debc2f28976d"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/e279985597af22dddf1217ee35a8cffb17d1418ae1b4bae2d9ea79c0c6963a85/analysis/1543296765/" ,
"category" : "External analysis" ,
"uuid" : "744b795b-0f4d-4428-94a2-78bb84392988"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "1/57" ,
"category" : "Other" ,
"uuid" : "0c749f4d-79de-44e6-8b84-af9b9da6c64c"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--825a35c4-4f37-4ab4-99aa-102f48160497" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T17:09:10.000Z" ,
"modified" : "2018-11-27T17:09:10.000Z" ,
"pattern" : "[file:hashes.MD5 = '807482efce3397ece64a1ded3d436139' AND file:hashes.SHA1 = '9ea865e000e3e15cec15efc466801bb181ba40a1' AND file:hashes.SHA256 = '9ea577a4b3faaf04a3bddbfcb934c9752bed0d0fc579f2152751c5f6923f7e14']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-11-27T17:09:10Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--ebaeaa9d-fa51-4c9f-9d88-0496e017318b" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T17:09:12.000Z" ,
"modified" : "2018-11-27T17:09:12.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-11-27T05:31:55" ,
"category" : "Other" ,
"uuid" : "8cd9e418-9e12-481c-bb48-133603686037"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/9ea577a4b3faaf04a3bddbfcb934c9752bed0d0fc579f2152751c5f6923f7e14/analysis/1543296715/" ,
"category" : "External analysis" ,
"uuid" : "19294000-dacb-4a1a-9e30-6aca6211ece9"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "26/58" ,
"category" : "Other" ,
"uuid" : "b9b3772e-c257-45e0-9508-0b0701be1ddc"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--d0fd14c2-720a-4bb3-bc6f-f2caa1412a2e" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T17:09:13.000Z" ,
"modified" : "2018-11-27T17:09:13.000Z" ,
"pattern" : "[file:hashes.MD5 = 'c00c9f6ebf2979292d524acff19dd306' AND file:hashes.SHA1 = '1022620da25db2497dc237adedb53755e6b859e3' AND file:hashes.SHA256 = '45a9edb24d4174592c69d9d37a534a518fbe2a88d3817fc0cc739e455883b8ff']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-11-27T17:09:13Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--b59e3757-0be0-4ea6-91c2-cf6eb149c993" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-11-27T17:09:14.000Z" ,
"modified" : "2018-11-27T17:09:14.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-11-20T21:56:27" ,
"category" : "Other" ,
"uuid" : "e60e9d16-e737-46fe-b844-903b12497fb5"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/45a9edb24d4174592c69d9d37a534a518fbe2a88d3817fc0cc739e455883b8ff/analysis/1542750987/" ,
"category" : "External analysis" ,
"uuid" : "2b939201-2374-42a8-9c04-2c1bed37ecdc"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "33/67" ,
"category" : "Other" ,
"uuid" : "9eea241b-cd72-4723-aeb3-d7ef52caaa2c"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "marking-definition" ,
"spec_version" : "2.1" ,
"id" : "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ,
"created" : "2017-01-20T00:00:00.000Z" ,
"definition_type" : "tlp" ,
"name" : "TLP:WHITE" ,
"definition" : {
"tlp" : "white"
}
}
2023-04-21 13:25:09 +00:00
]
}
