adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/5cd2770d-27fc-4e41-8bfe-476e950d210f.json

1374 lines
311 KiB
JSON
Raw Normal View History

chg: [feed] feed updated
2023-06-14 17:31:25 +00:00
{
"type": "bundle",
"id": "bundle--5cd2770d-27fc-4e41-8bfe-476e950d210f",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T11:23:43.000Z",
"modified": "2019-05-08T11:23:43.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "grouping",
"spec_version": "2.1",
"id": "grouping--5cd2770d-27fc-4e41-8bfe-476e950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T11:23:43.000Z",
"modified": "2019-05-08T11:23:43.000Z",
"name": "OSINT - Spear Phishing Campaign Targets Ukraine Government and Military; Infrastructure Reveals Potential Link to So-Called Luhansk People's Republic",
"context": "suspicious-activity",
"object_refs": [
"observed-data--5cd2771f-ddb0-4c67-aec6-4ab5950d210f",
"url--5cd2771f-ddb0-4c67-aec6-4ab5950d210f",
"x-misp-attribute--5cd278cd-95bc-4427-b42b-4da4950d210f",
"observed-data--5cd27965-10d0-45d5-8cf7-414a950d210f",
"file--5cd27965-10d0-45d5-8cf7-414a950d210f",
"artifact--5cd27965-10d0-45d5-8cf7-414a950d210f",
"indicator--5cd28fc2-029c-430e-b467-4874950d210f",
"indicator--5cd28fc2-0b98-4394-9e6e-400e950d210f",
"indicator--5cd28fc2-1c3c-465f-9da1-46a6950d210f",
"indicator--5cd28fc2-040c-4b9d-acbe-4736950d210f",
"indicator--5cd28fc2-e740-41e0-9c43-46fe950d210f",
"indicator--5cd28fc3-80e8-44fb-8a12-4711950d210f",
"indicator--5cd28fc3-7fbc-46ee-a244-4810950d210f",
"indicator--5cd28fc3-e080-4de0-b890-4d46950d210f",
"indicator--5cd28fc3-69ac-43d8-9c6f-4f14950d210f",
"indicator--5cd28fc3-9f68-430d-ad9f-44df950d210f",
"indicator--5cd28fc3-ebac-4ea8-b26e-4fdb950d210f",
"indicator--5cd28fc3-e74c-4a45-8f50-427b950d210f",
"indicator--5cd28fc3-6a70-467d-afad-47ae950d210f",
"indicator--5cd28fc3-d0ac-4022-9a64-441d950d210f",
"indicator--5cd28fc3-f0e8-4849-8ef4-4799950d210f",
"indicator--5cd28fc3-e648-4dfe-8bf1-4a4d950d210f",
"indicator--5cd28fc3-422c-465a-b913-413e950d210f",
"indicator--5cd28fc3-c0b0-4bc1-b45c-4adb950d210f",
"indicator--5cd28fc3-679c-4030-a00e-4676950d210f",
"indicator--5cd28fc3-5b88-41ef-a3cc-4aeb950d210f",
"indicator--5cd28fc3-4bb0-496f-9175-4bd5950d210f",
"indicator--5cd28fc3-70f8-49f1-b17c-48c9950d210f",
"observed-data--5cd290e9-165c-4464-a604-4c13950d210f",
"domain-name--5cd290e9-165c-4464-a604-4c13950d210f",
"indicator--5cd2a7cc-bb0c-4865-a988-451b950d210f",
"indicator--5cd2a7cc-1d60-441b-89ee-439e950d210f",
"indicator--5cd2a7cc-6414-401b-bf87-44b7950d210f",
"indicator--5cd2a7cc-2fbc-4328-856a-403d950d210f",
"indicator--5cd2a7cc-aaf4-4905-b166-4fd9950d210f",
"indicator--5cd2a7cc-641c-4b80-9bc8-42c6950d210f",
"indicator--5cd2ae7d-6724-42a1-9f71-6b3d950d210f",
"indicator--5cd2ae7d-8f94-4724-ad31-6b3d950d210f",
"indicator--5cd27f3c-49f0-4ff5-8fca-40a0950d210f",
"indicator--5cd280c9-a63c-467d-91ec-49c8950d210f",
"indicator--5cd281d0-85c8-4572-b487-45b1950d210f",
"indicator--5cd282dc-a808-4591-b3a3-472f950d210f",
"indicator--5cd28329-c834-4d7c-a1c4-4b38950d210f",
"indicator--5cd2836d-8148-4123-a015-4318950d210f",
"indicator--5cd29268-0a88-4a5b-a417-418c950d210f",
"indicator--5cd2a311-775c-41b7-b6c3-4c2a950d210f",
"indicator--5cd2a46c-bf78-416e-a7ee-6b3e950d210f",
"indicator--5cd2a73d-e1f4-4904-a5fc-6b06950d210f",
"indicator--5cd2a74d-1344-4c51-be2d-6b06950d210f",
"indicator--5cd2a762-6fa8-47af-ac81-499e950d210f",
"indicator--5cd2a776-885c-4236-abe2-6d70950d210f",
"indicator--5cd2ae66-1350-46cc-adb5-4cf9950d210f",
"indicator--5cd2b0f1-5a7c-47d7-b5f8-4380950d210f",
"indicator--5cd2b198-1d2c-4463-99e6-4ef5950d210f",
"indicator--5cd2b1c8-e3bc-47a5-bc20-6b3d950d210f",
"relationship--72073269-a97d-40d2-bada-1da751cf9a43",
"relationship--ee674d10-199b-4d26-8a63-25ef69fcfd02",
"relationship--ad341fe7-3ec5-421f-ae10-223dbce64d22",
"relationship--9b4097c9-e5b9-4fd0-93b4-8389d9e1eb19",
"relationship--e8666fbb-187e-47a1-b156-4768cd0dd907",
"relationship--f086988b-d88f-44bf-acb4-5b8351e40f06"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"osint:source-type=\"blog-post\"",
"workflow:todo=\"expansion\"",
"enisa:nefarious-activity-abuse=\"spear-phishing-attacks\""
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5cd2771f-ddb0-4c67-aec6-4ab5950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T06:28:47.000Z",
"modified": "2019-05-08T06:28:47.000Z",
"first_observed": "2019-05-08T06:28:47Z",
"last_observed": "2019-05-08T06:28:47Z",
"number_observed": 1,
"object_refs": [
"url--5cd2771f-ddb0-4c67-aec6-4ab5950d210f"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--5cd2771f-ddb0-4c67-aec6-4ab5950d210f",
"value": "https://www.fireeye.com/blog/threat-research/2019/04/spear-phishing-campaign-targets-ukraine-government.html"
},
{
"type": "x-misp-attribute",
"spec_version": "2.1",
"id": "x-misp-attribute--5cd278cd-95bc-4427-b42b-4da4950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T06:35:57.000Z",
"modified": "2019-05-08T06:35:57.000Z",
"labels": [
"misp:type=\"text\"",
"misp:category=\"External analysis\""
],
"x_misp_category": "External analysis",
"x_misp_type": "text",
"x_misp_value": "In early 2019, FireEye Threat Intelligence identified a spear phishing email targeting government entities in Ukraine. The spear phishing email included a malicious LNK file with PowerShell script to download the second-stage payload from the command and control (C&C) server. The email was received by military departments in Ukraine and included lure content related to the sale of demining machines. \r\n\r\nThis latest activity is a continuation of spear phishing that targeted the Ukrainian Government as early as 2014. The email is linked to activity that previously targeted the Ukrainian Government with RATVERMIN. Infrastructure analysis indicates the actors behind the intrusion activity may be associated with the so-called Luhansk People's Republic (LPR)."
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5cd27965-10d0-45d5-8cf7-414a950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T06:38:29.000Z",
"modified": "2019-05-08T06:38:29.000Z",
"first_observed": "2019-05-08T06:38:29Z",
"last_observed": "2019-05-08T06:38:29Z",
"number_observed": 1,
"object_refs": [
"file--5cd27965-10d0-45d5-8cf7-414a950d210f",
"artifact--5cd27965-10d0-45d5-8cf7-414a950d210f"
],
"labels": [
"misp:type=\"attachment\"",
"misp:category=\"Payload delivery\""
]
},
{
"type": "file",
"spec_version": "2.1",
"id": "file--5cd27965-10d0-45d5-8cf7-414a950d210f",
"name": "Picture1.png",
"content_ref": "artifact--5cd27965-10d0-45d5-8cf7-414a950d210f"
},
{
"type": "artifact",
"spec_version": "2.1",
"id": "artifact--5cd27965-10d0-45d5-8cf7-414a950d210f",
"payload_bin": "iVBORw0KGgoAAAANSUhEUgAAA7wAAAK+CAYAAACB/BKIAAAABGdBTUEAALGPC/xhBQAAIABJREFUeJzsvQmUZMlZ3zsDQttIllmEl2c/np+xecbYBmwwi0CA9DBgI2zOE5Ytg7EsYw/HB4kDGIRYjC3QMtqXETPTo5npvadn7a4la8nKrCWrcqmsqlwq96zc970ys6uqt//7vsi8WVl71tZV3f195/xPZd+8GTduRNzo+N344otHHnnkETz66KN473vfi/Pnz2NtdQ2rK6tYubGCGzduiEQikUgkEolEIpFIdKrF/MocyzxbLBaRSqWQSCTwCAPv+973Ppx94SzKpTJWVlYEdkUikUgkEolEIpFIdF+JOVbj2VKxhGQy2QLej33sYxgfH1dfnnQmRSLRg6P6ch3LtWWlk86LSCQSiUQikejhEHNttVpFJptpAe+FCxfg9/tPPGMikejBUaPeQCFXQCadQS6bU/8+6TyJRCKRSCQSiR4O1et1lCvlFvBazBaUSqV9J9JoNFRCy8vLHfEx1lFkcrv0+d9HnX73NbR/H9U1RKKHUfwMFfIFhEIh+Hw+BAIB5HN59YyddN5EIpFIJBKJRA+HeMJFAa/ft7/ZXXZPZJ/oeDwOn9+HhYUFJbfbjUAwoHyla9XaoTJXrVRVOv6AX6WrXYOvx9fl6x9mxojzl8lkEIvF4PV5O+nz56WlJfXdYe9BJHoYxS+L+BkKh8IqWAC7kqTTafVvPs4wfNJ5FIlEIpFIJBI9+OoAL8/A9PqjSrmCaDSqZmy0mRsexLJ4Noddo71er/pcLBT3PVPKMM2/499zOpwef9auwdfj4/w3lUyp/Own/WazqYJzcVqc9uZ74M98nBUOh9W5/JuTriyR6DSrXC4jnUqrZ3VmeqbzAsnhcHSkHTPPmOFyupCIJ9SLq73Tb6Jeo/QjQcxazJg2mzHv8CGayKFS057NBnLxKGJLYcpDWMF1OBhEOJJAoVJDvdlKi5/laiZO31F/FWyf11aQzk9kiygvNzrXbdJ1l7xuzM5YYTZZYLXNwx9JYbmxvz6hmk8h4l+E3TyDaUrHFYihTB1ws+sclbd0DAs2C2amZmC1LiAYz3Xur5BKqPsLhjbmmxUKhqi/WkK2tEzp7JQPKqNkHIlIBLFkYftzKA+NUhYhfxDJfAmVOpUB9eHFVBSRWB71rvtuNhuoZBMIdJ2r6qpSQMA5D/P0NKx2B1zeEHLl/c3sNxvLSIQWYZuZwQyVPdd3qlDd0i4a9SqificspmnMmOfg8UepDDa/qKT8Uz6XvA4q12mYLfOIpYtYrvdah61yS8VjyHbdR7WQRjzsg8NupXTNmLW7EEtxuo0NeWzWKogHF+FasFPbt8BC+fRH0vtuQ1qZ15crSHA7CERRqtXR2O03zTrq5Twi1LbjmRJq9e76W29vXH7c3gKx3L7zxGm452epvmfo/mZVGo1N96baSj4J1xw9R9Nm2GwO+ILxrue3F3FZlhD2uGCldmGx2LHg8qu2taHNq3vOwUt5mp4ywT6/iEgig+qWPNVRq5RUWYaWNj3TXDZUv4uUxgyXDdWty7u0z3bMz0IJsQDl12qhsrFSG3EiGMt06qxWyCIVi6i+Z/MzHeZnml8SxrLUf7Xy1qC2VKF8BQMR6qeaG/oPVT7VAsKBELKF8oa6bj1TVaTo2Y+Ho+0y29wX8vWC1L9EkKbnub5D+2xQ+ytmU/Sb6DZ54HJdRpbuKRRu98V8H6ylOMrVBhpaX0z9Spn6lWBAu+eQ+v+Dz8sWq7v0YyKRSLQ/LdeX9we8DKM8u8qds+qgw60Zmwh1oprUzA4dZ3Dkf/OAlgPX9JI+n5fNZtXv+Pe7pc/X586R87OfgDg8c6ylrzrXTdfohnftHhiqBXpFop3Fzwy/gOJnOJfLolgqoFQqbhEf5+8ZkDlc/N59T5NgKwL/3AwMhjEYGAQt9HnMiLGxKYKceeRp0NygwatnegpmvR5jegMmjOOYGGt/nrDBS4PrIg/OGnUkvTZMGAyUngFGg7GjsVEDPEsJ5KvUXxFw1YopWCcmYBgZwSSBkokG9FNGI0b1RkzNuOm8WmcgupPUQD8TJiCahHGcNEn5N5swMjqGKYuXBpZlNfjlfBUTQUxNGKE3mggK6F5MkzCMT8EZzqBOnXXENQfrJN+3UeVdP6pXMrTvZZzODWaqnQHl1rzUEZ63YX58HFMme6s8Np9D+Yg7p2HUj8HhTyBTIqBariLmmsG4kcq63LrnZr2GAuWXy9FoWUQyV8IynceDcev4BPRDRlhsVM6UV+MI3eu0Felyo6dBLF9vyWmh347CZLHBNDmFCarXiYlppIrL7ftrokCD5ZDDTHml86yzmKL6nhgz0HXnKd/LnfaTJnBeME/ASN9P83l0vtEwQeCRpoH/3v83cbn5bVY4CFYD6RZ0VzMRmKlOuR0ajVOYpXsdHx6hdMfhDCXaYNwkoMphwTQF4+goJqhcTARq05OtNjQ9R2BSqm6pg91UK2aQDrthoPrRj44jnq9geYcyXS4XkCQg5zY7Ru3E5FxS9afVc3d7myIw5PY2RuXC7W25B+8pTqOcDrfTmKJnZAqW6VYaC8FUJw2uz1zcT8+kAaMj45iZMWNyclLlf8rkRLmxtR1uEcMpQayNn8dhI8xmC7ULep6GqVzpmUoWa6pdNBs15FMxzI5TGQ8ZYJu1Ur3T8zJOUG/3o9oBxyJCTjvmTJQe1YXe4FQvDzgfzeUSyrkY5deIEcqv3T6nynBc32rHmV7aMeW3UkxTPsZhoLqfIsifnjbBxGVFbWRmIYwav0iKB+CaNau+h5/hsdGx1nPN9Utt2Uj92KSN8r3cylshSWOTeZNqd4vx8kZIp/qopYMYp99NUv8U4hcP3c9VLQ87vzCctiBI7bi7L+Trrfcr1M9SHmcdPsRS+S19XJHy4JulNm2cVHlobPq+TlDunhynNj+GcUpvgvrWcXUN7qMsWErm1MuxxnINUepX1P2OGTr9GPfZRuME5heXUOYXOjL2EolEh9S+gJeBj9fkdYNiN4huFn/P6fKsT2+zODfUeexizL/rJX2GXs4P56sXIOVzOHhOL+l330M2kxU3TJFoG/FzwS+pnE6nmrHlfc84It5e4mexUqlgbm6utXygVtv2GW7WK4j4XDAb9RifmYc/HEE8GoHX7cAUDSZ1ujH4afBWp4Gug0DGTIMwy7wbPq8XPg/Pqs1ibGgMM1YXAslSG+gmMTw4jjm7Ex6PF962Ft0eArciKssNVEt5RJw2DF4bhmXWgUCIX4RRn+D3YME6jYFBgmMaUGYru79sa1AnG3POYHhkiqDMqfIfi4ThsJowoBtHIJZBiSNZVwn+6ZiOznN6Q4gshRDyuWGeGMPo1BwKVGbpGA12/ZRPjwcetxsT/X0YGTNjweFu3YPXT4Px+o6DcZ558dM1zEODqtzC2erGwSTB+XKlANvYIPquXcesJ4I0A+Yy1cGcEYP9FuQI0OoEMMVMHHNcDsNTcAcTKFaX6bdZ5GIeDPUNqMFyJB5HgO6BZxDHBkfgCOe3zPxtEYFCOZfAtEGHiWk7gksx6oeDcM/ZYOgfpDwlaPDfoMF7CWHvAp03jEnLAsLROJWNG3aCtgmCB0cgpQChUS3AaZsiKJuEyebAUixB5erCxKAOZrsPnqXsnrDF5bZIcDtLIOdJskdRk+rUgpHhCQKZOXh9QcTiMfgXXTCNDGHC5EIwwrOcyygRgOj7+2GeXYDbG8QSv1QN+TA3bcTAqAlLqRxqPc5kNetlJEIeukcDBgYGcP3aEKLZ8rbA26jkEQt6YDOb1EsTPbUVgy2AbLGm8r+5vanZOKory4RetTcG8Z1enLTUSiNga6Ux5/IjxC+O6d44Df2UXaVRJ6irFLLw03ncVhyuACL0/IYCXswRfI326+FLFnecTezuB4opP3TX+tRsazhC7SLoVzPL+r5BzAczasa+RpAZ8cxhuG8IswsEbIkYvK45Vf9DehOihYqaIQ8uOgg+CZj1ehhGhtE3aCfgXVZtoZpPIhmYR3/fGBYW/UgkktS2FuGY7b0dN+t
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd28fc2-029c-430e-b467-4874950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T08:13:54.000Z",
"modified": "2019-05-08T08:13:54.000Z",
"pattern": "[email-message:from_ref.value = 're2a1er1@yandex.ru']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T08:13:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"email-src\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd28fc2-0b98-4394-9e6e-400e950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T08:13:54.000Z",
"modified": "2019-05-08T08:13:54.000Z",
"description": "Domain Registered by re2a1er1@yandex.ru - possibly mimicks 24tv.ua, A large news portal in Ukraine",
"pattern": "[domain-name:value = '24ua.website']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T08:13:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd28fc2-1c3c-465f-9da1-46a6950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T08:13:54.000Z",
"modified": "2019-05-08T08:13:54.000Z",
"description": "Domain Registered by re2a1er1@yandex.ru - possibly mimicks censor.net.ua, A large news portal in Ukraine",
"pattern": "[domain-name:value = 'censor.website']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T08:13:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd28fc2-040c-4b9d-acbe-4736950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T08:13:54.000Z",
"modified": "2019-05-08T08:13:54.000Z",
"description": "Domain Registered by re2a1er1@yandex.ru - possibly mimicks fakty.ua, A large news portal in Ukraine",
"pattern": "[domain-name:value = 'fakty.website']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T08:13:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd28fc2-e740-41e0-9c43-46fe950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T08:13:54.000Z",
"modified": "2019-05-08T08:13:54.000Z",
"description": "Domain Registered by re2a1er1@yandex.ru - possibly mimicks Volodymyr Borysovych Groysman ( V. B. Groysman is a politician who has been the Prime Minister of Ukraine since April 14, 2016)",
"pattern": "[domain-name:value = 'groysman.host']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T08:13:54Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd28fc3-80e8-44fb-8a12-4711950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T08:13:55.000Z",
"modified": "2019-05-08T08:13:55.000Z",
"description": "Domain Registered by re2a1er1@yandex.ru - possibly mimicks gordonua.com, A large mail service in Ukraine",
"pattern": "[domain-name:value = 'gordon.co.ua']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T08:13:55Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"hostname\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd28fc3-7fbc-46ee-a244-4810950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T08:13:55.000Z",
"modified": "2019-05-08T08:13:55.000Z",
"description": "Domain Registered by re2a1er1@yandex.ru - possibly mimicks ukr.net, A large news portal in Ukraine",
"pattern": "[domain-name:value = 'mailukr.net']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T08:13:55Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd28fc3-e080-4de0-b890-4d46950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T08:13:55.000Z",
"modified": "2019-05-08T08:13:55.000Z",
"description": "Domain Registered by re2a1er1@yandex.ru - possibly mimicks me.gov.ua, Ukraine's Ministry of Economic Development and Trade",
"pattern": "[domain-name:value = 'me.co.ua']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T08:13:55Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"hostname\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd28fc3-69ac-43d8-9c6f-4f14950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T08:13:55.000Z",
"modified": "2019-05-08T08:13:55.000Z",
"description": "Domain Registered by re2a1er1@yandex.ru - possibly mimicks novaposhta.ua, Ukraine's largest logistics services company",
"pattern": "[domain-name:value = 'novaposhta.website']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T08:13:55Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd28fc3-9f68-430d-ad9f-44df950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T08:13:55.000Z",
"modified": "2019-05-08T08:13:55.000Z",
"description": "Domain Registered by re2a1er1@yandex.ru - possibly mimicks olx.ua, Ukraine's largest online ad platform",
"pattern": "[domain-name:value = 'olx.website']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T08:13:55Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd28fc3-ebac-4ea8-b26e-4fdb950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T08:13:55.000Z",
"modified": "2019-05-08T08:13:55.000Z",
"description": "Domain Registered by re2a1er1@yandex.ru - possibly mimicks online.ua, A large news portal in Ukraine",
"pattern": "[domain-name:value = 'onlineua.website']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T08:13:55Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd28fc3-e74c-4a45-8f50-427b950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T08:13:55.000Z",
"modified": "2019-05-08T08:13:55.000Z",
"description": "Domain Registered by re2a1er1@yandex.ru - possibly mimicks rst.ua, One of the largest car sales websites in Ukraine",
"pattern": "[domain-name:value = 'rst.website']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T08:13:55Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd28fc3-6a70-467d-afad-47ae950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T08:13:55.000Z",
"modified": "2019-05-08T08:13:55.000Z",
"description": "Domain Registered by re2a1er1@yandex.ru - TV-related",
"pattern": "[domain-name:value = 'satv.pw']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T08:13:55Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd28fc3-d0ac-4022-9a64-441d950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T08:13:55.000Z",
"modified": "2019-05-08T08:13:55.000Z",
"description": "Domain Registered by re2a1er1@yandex.ru - possibly mimicks sinoptik.ua, The largest weather website in Ukraine",
"pattern": "[domain-name:value = 'sinoptik.website']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T08:13:55Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd28fc3-f0e8-4849-8ef4-4799950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T08:13:55.000Z",
"modified": "2019-05-08T08:13:55.000Z",
"description": "Domain Registered by re2a1er1@yandex.ru - possibly mimicks spectator.co.uk, A large news portal in the UK",
"pattern": "[domain-name:value = 'spectator.website']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T08:13:55Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd28fc3-e648-4dfe-8bf1-4a4d950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T08:13:55.000Z",
"modified": "2019-05-08T08:13:55.000Z",
"description": "Domain Registered by re2a1er1@yandex.ru - TV-related",
"pattern": "[domain-name:value = 'tv.co.ua']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T08:13:55Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"hostname\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd28fc3-422c-465a-b913-413e950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T08:13:55.000Z",
"modified": "2019-05-08T08:13:55.000Z",
"description": "Domain Registered by re2a1er1@yandex.ru - possibly mimicks uatoday.news, A large news portal in Ukraine",
"pattern": "[domain-name:value = 'uatoday.website']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T08:13:55Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd28fc3-c0b0-4bc1-b45c-4adb950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T08:13:55.000Z",
"modified": "2019-05-08T08:13:55.000Z",
"description": "Domain Registered by re2a1er1@yandex.ru - possibly mimicks ukrposhta.ua, State Post of Ukraine",
"pattern": "[domain-name:value = 'ukrposhta.website']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T08:13:55Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd28fc3-679c-4030-a00e-4676950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T08:13:55.000Z",
"modified": "2019-05-08T08:13:55.000Z",
"description": "Domain Registered by re2a1er1@yandex.ru - possibly mimicks unian.net, A large news portal in Ukraine",
"pattern": "[domain-name:value = 'unian.pw']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T08:13:55Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd28fc3-5b88-41ef-a3cc-4aeb950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T08:13:55.000Z",
"modified": "2019-05-08T08:13:55.000Z",
"description": "Domain Registered by re2a1er1@yandex.ru",
"pattern": "[domain-name:value = 'vj2.pw']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T08:13:55Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd28fc3-4bb0-496f-9175-4bd5950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T08:21:18.000Z",
"modified": "2019-05-08T08:21:18.000Z",
"description": "Domain Registered by re2a1er1@yandex.ru - possibly mimicks zik.ua, A large news portal in Ukraine",
"pattern": "[domain-name:value = 'z1k.pw']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T08:21:18Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd28fc3-70f8-49f1-b17c-48c9950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T08:21:27.000Z",
"modified": "2019-05-08T08:21:27.000Z",
"description": "Military news",
"pattern": "[domain-name:value = 'milnews.info']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T08:21:27Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5cd290e9-165c-4464-a604-4c13950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T08:22:41.000Z",
"modified": "2019-05-08T08:22:41.000Z",
"first_observed": "2019-05-08T08:22:41Z",
"last_observed": "2019-05-08T08:22:41Z",
"number_observed": 1,
"object_refs": [
"domain-name--5cd290e9-165c-4464-a604-4c13950d210f"
],
"labels": [
"misp:type=\"hostname\"",
"misp:category=\"Network activity\""
]
},
{
"type": "domain-name",
"spec_version": "2.1",
"id": "domain-name--5cd290e9-165c-4464-a604-4c13950d210f",
"value": "xn--90adzbis.xn--c1avg"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd2a7cc-bb0c-4865-a988-451b950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T09:56:28.000Z",
"modified": "2019-05-08T09:56:28.000Z",
"pattern": "[domain-name:value = 'akamainet022.info']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T09:56:28Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd2a7cc-1d60-441b-89ee-439e950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T09:56:28.000Z",
"modified": "2019-05-08T09:56:28.000Z",
"pattern": "[domain-name:value = 'notifymail.ru']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T09:56:28Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd2a7cc-6414-401b-bf87-44b7950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T09:56:28.000Z",
"modified": "2019-05-08T09:56:28.000Z",
"pattern": "[domain-name:value = 'akamainet066.info']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T09:56:28Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd2a7cc-2fbc-4328-856a-403d950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T09:56:28.000Z",
"modified": "2019-05-08T09:56:28.000Z",
"pattern": "[domain-name:value = 'akamainet024.info']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T09:56:28Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd2a7cc-aaf4-4905-b166-4fd9950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T09:56:28.000Z",
"modified": "2019-05-08T09:56:28.000Z",
"pattern": "[domain-name:value = 'akamaicdn.ru']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T09:56:28Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd2a7cc-641c-4b80-9bc8-42c6950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T09:56:28.000Z",
"modified": "2019-05-08T09:56:28.000Z",
"pattern": "[domain-name:value = 'cdnakamai.ru']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T09:56:28Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd2ae7d-6724-42a1-9f71-6b3d950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T10:25:01.000Z",
"modified": "2019-05-08T10:25:01.000Z",
"description": "C&C",
"pattern": "[url:value = 'http://sinoptik.website/OxslV6']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T10:25:01Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd2ae7d-8f94-4724-ad31-6b3d950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T10:25:01.000Z",
"modified": "2019-05-08T10:25:01.000Z",
"description": "C&C",
"pattern": "[url:value = 'http://cdn1186.site/zG4roJ']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T10:25:01Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd27f3c-49f0-4ff5-8fca-40a0950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T07:15:37.000Z",
"modified": "2019-05-08T07:15:37.000Z",
"pattern": "[email-message:body = 'Dear Colleagues,\r\n\r\nPlease accept the best regards from representatives of Armtrac Ltd. which were on the meeting held on 24th May in Astana. My name is Alex Gallil and I\\'m am responsible person from Armtrac Ltd. for cooperation development with Ukrainian partners. \r\nAs part of conversation held between our sides, were discussed joint opportunities in demining activities, development of demining vehicles, ammunition recycling, participation in tenders with further technology transfer and other. Among other were discussed the border surveillance system which is highly interesting for us.\r\n\r\nSincerely,\r\nAlex Gallil\r\nExecutive manager' AND email-message:from_ref.display_name = 'Armtrac' AND email-message:date = '2019-01-22 11:35' AND email-message:subject = 'SPEC-20T-MK2-000-ISS-4.10-09-2018-STANDARD' AND email-message:body_multipart[0].body_raw_ref.name = 'Armtrac-Commercial.7z' AND email-message:body_multipart[0].content_disposition = 'attachment']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T07:15:37Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "network"
}
],
"labels": [
"misp:name=\"email\"",
"misp:meta-category=\"network\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd280c9-a63c-467d-91ec-49c8950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T07:16:10.000Z",
"modified": "2019-05-08T07:16:10.000Z",
"pattern": "[file:hashes.MD5 = '982565e80981ce13c48e0147fb271fe5' AND file:name = 'Armtrac-Commercial.7z' AND file:x_misp_state = 'Malicious']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T07:16:10Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd281d0-85c8-4572-b487-45b1950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T07:22:50.000Z",
"modified": "2019-05-08T07:22:50.000Z",
"pattern": "[file:hashes.MD5 = 'e92d01d9b1a783a23477e182914b2454' AND file:name = 'Armtrac-Commercial.zip' AND file:x_misp_state = 'Malicious']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T07:22:50Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd282dc-a808-4591-b3a3-472f950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T07:18:52.000Z",
"modified": "2019-05-08T07:18:52.000Z",
"description": "benign document from the official Armtrac website",
"pattern": "[file:hashes.MD5 = '0d6a46eb0d0148aafb34e287fcafa68f' AND file:name = 'Armtrac-20T-with-Equipment-35078.pdf' AND file:x_misp_state = 'Harmless']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T07:18:52Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd28329-c834-4d7c-a1c4-4b38950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T07:20:09.000Z",
"modified": "2019-05-08T07:20:09.000Z",
"description": "benign document from the official Armtrac website",
"pattern": "[file:hashes.MD5 = 'bace12f3be3d825c6339247f4bd73115' AND file:name = 'SPEC-20T-MK2-000-ISS-4.10-09-2018-STANDARD.pdf' AND file:x_misp_state = 'Harmless']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T07:20:09Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd2836d-8148-4123-a015-4318950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T07:21:17.000Z",
"modified": "2019-05-08T07:21:17.000Z",
"description": "Malicious LNK file that executes a PowerShell script.\r\nInterestingly, while the LNK file used a forged extension to impersonate a PDF document, the icon was replaced with a Microsoft Word document icon.",
"pattern": "[file:hashes.MD5 = 'ec0fb9d17ec77ad05f9a69879327e2f9' AND file:name = 'SPEC-10T-MK2-000-ISS-4.10-09-2018-STANDARD.pdf.lnk' AND file:x_misp_state = 'Malicious']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T07:21:17Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd29268-0a88-4a5b-a417-418c950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T08:25:12.000Z",
"modified": "2019-05-08T08:25:12.000Z",
"pattern": "[domain-name:value = 'sinoptik.website' AND domain-name:value = 'www.sinoptik.website' AND domain-name:resolves_to_refs[*].value = '78.140.167.89' AND domain-name:resolves_to_refs[*].value = '78.140.164.221' AND domain-name:resolves_to_refs[*].value = '185.125.46.158' AND domain-name:resolves_to_refs[*].value = '78.140.167.89']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T08:25:12Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "network"
}
],
"labels": [
"misp:name=\"domain-ip\"",
"misp:meta-category=\"network\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd2a311-775c-41b7-b6c3-4c2a950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T09:36:17.000Z",
"modified": "2019-05-08T09:36:17.000Z",
"pattern": "[file:hashes.MD5 = '47161360b84388d1c254eb68ad3d6dfa' AND file:x_misp_state = 'Malicious']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T09:36:17Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd2a46c-bf78-416e-a7ee-6b3e950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T09:42:04.000Z",
"modified": "2019-05-08T09:42:04.000Z",
"pattern": "[file:hashes.MD5 = '242f0ab53ac5d194af091296517ec10a' AND file:x_misp_state = 'Malicious']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T09:42:04Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd2a73d-e1f4-4904-a5fc-6b06950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T09:54:05.000Z",
"modified": "2019-05-08T09:54:05.000Z",
"pattern": "[file:hashes.MD5 = '07633a79d28bb8b4ef8a6283b881be0e' AND file:x_misp_state = 'Malicious']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T09:54:05Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd2a74d-1344-4c51-be2d-6b06950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T09:54:21.000Z",
"modified": "2019-05-08T09:54:21.000Z",
"pattern": "[file:hashes.MD5 = '5feae6cb9915c6378c4bb68740557d0a' AND file:x_misp_state = 'Malicious']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T09:54:21Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd2a762-6fa8-47af-ac81-499e950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T09:54:42.000Z",
"modified": "2019-05-08T09:54:42.000Z",
"pattern": "[file:hashes.MD5 = 'dc0ab74129a4be18d823b71a54b0cab0' AND file:x_misp_state = 'Malicious']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T09:54:42Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd2a776-885c-4236-abe2-6d70950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T09:55:02.000Z",
"modified": "2019-05-08T09:55:02.000Z",
"pattern": "[file:hashes.MD5 = 'bbcce9c91489eef00b48841015bb36c1' AND file:x_misp_state = 'Malicious']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T09:55:02Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd2ae66-1350-46cc-adb5-4cf9950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T10:24:38.000Z",
"modified": "2019-05-08T10:24:38.000Z",
"pattern": "[file:hashes.MD5 = 'fe198e90813c5ee1cfd95edce5241e25' AND file:name = '\u0412\u0438\u0441\u043d\u043e\u0432\u043a\u0438. S021000262_1901141812000. Scancopy_0003. HP LaserJet Enterprise 700 M775dn(CC522A).docx.lnk' AND file:x_misp_state = 'Malicious']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T10:24:38Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd2b0f1-5a7c-47d7-b5f8-4380950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T10:35:29.000Z",
"modified": "2019-05-08T10:35:29.000Z",
"description": "ZIP archive containing a malicious LNK file",
"pattern": "[file:hashes.MD5 = 'a5300dc3e19f0f0b919de5cda4aeb71c' AND file:name = '\u041a\u041c\u0423 \u0431\u0430\u0437\u0430 \u0434\u0430\u043d\u0438\u0445.zip' AND file:x_misp_state = 'Malicious']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T10:35:29Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd2b198-1d2c-4463-99e6-4ef5950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T10:38:16.000Z",
"modified": "2019-05-08T10:38:16.000Z",
"description": "Benign decoy document",
"pattern": "[file:hashes.MD5 = 'a40fb835a54925aea12ffaa0d76f4ca7' AND file:name = '\u0414\u043e\u0434\u0430\u0442\u043e\u043a.pdf' AND file:x_misp_state = 'Malicious']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T10:38:16Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd2b1c8-e3bc-47a5-bc20-6b3d950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-08T10:39:04.000Z",
"modified": "2019-05-08T10:39:04.000Z",
"description": "Malicious LNK that executes a PowerShell script",
"pattern": "[file:hashes.MD5 = '4b8aac0649c3a846c24f93dc670bb1ef' AND file:name = '\u041a\u041c\u0423_\u0431\u0430\u0437\u0430_\u0434\u0430\u043d\u0438\u0445_\u043e\u0440\u0433\u0430\u043d\u0438_\u0443\u043f\u0440,_\u0421\u0413_\u041a\u041c\u0423.rtf.lnk' AND file:x_misp_state = 'Malicious']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-08T10:39:04Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--72073269-a97d-40d2-bada-1da751cf9a43",
"created": "2019-05-08T07:06:58.000Z",
"modified": "2019-05-08T07:06:58.000Z",
"relationship_type": "same-as",
"source_ref": "indicator--5cd27f3c-49f0-4ff5-8fca-40a0950d210f",
"target_ref": "observed-data--5cd27965-10d0-45d5-8cf7-414a950d210f"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ee674d10-199b-4d26-8a63-25ef69fcfd02",
"created": "2019-05-08T07:15:37.000Z",
"modified": "2019-05-08T07:15:37.000Z",
"relationship_type": "contains",
"source_ref": "indicator--5cd27f3c-49f0-4ff5-8fca-40a0950d210f",
"target_ref": "indicator--5cd280c9-a63c-467d-91ec-49c8950d210f"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ad341fe7-3ec5-421f-ae10-223dbce64d22",
"created": "2019-05-08T07:16:10.000Z",
"modified": "2019-05-08T07:16:10.000Z",
"relationship_type": "contains",
"source_ref": "indicator--5cd280c9-a63c-467d-91ec-49c8950d210f",
"target_ref": "indicator--5cd281d0-85c8-4572-b487-45b1950d210f"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9b4097c9-e5b9-4fd0-93b4-8389d9e1eb19",
"created": "2019-05-08T07:21:47.000Z",
"modified": "2019-05-08T07:21:47.000Z",
"relationship_type": "contains",
"source_ref": "indicator--5cd281d0-85c8-4572-b487-45b1950d210f",
"target_ref": "indicator--5cd282dc-a808-4591-b3a3-472f950d210f"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e8666fbb-187e-47a1-b156-4768cd0dd907",
"created": "2019-05-08T07:22:14.000Z",
"modified": "2019-05-08T07:22:14.000Z",
"relationship_type": "contains",
"source_ref": "indicator--5cd281d0-85c8-4572-b487-45b1950d210f",
"target_ref": "indicator--5cd28329-c834-4d7c-a1c4-4b38950d210f"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--f086988b-d88f-44bf-acb4-5b8351e40f06",
"created": "2019-05-08T07:22:39.000Z",
"modified": "2019-05-08T07:22:39.000Z",
"relationship_type": "contains",
"source_ref": "indicator--5cd281d0-85c8-4572-b487-45b1950d210f",
"target_ref": "indicator--5cd2836d-8148-4123-a015-4318950d210f"
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
]
}
Reference in a new issue Copy permalink