2023-06-14 17:31:25 +00:00
{
"type" : "bundle" ,
"id" : "bundle--5cd91555-359c-4dc4-8d30-5c7c950d210f" ,
"objects" : [
{
"type" : "identity" ,
"spec_version" : "2.1" ,
"id" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2019-05-13T07:58:43.000Z" ,
"modified" : "2019-05-13T07:58:43.000Z" ,
"name" : "CIRCL" ,
"identity_class" : "organization"
} ,
{
"type" : "grouping" ,
"spec_version" : "2.1" ,
"id" : "grouping--5cd91555-359c-4dc4-8d30-5c7c950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2019-05-13T07:58:43.000Z" ,
"modified" : "2019-05-13T07:58:43.000Z" ,
"name" : "OSINT - BR banker sample Bankerflux" ,
"context" : "suspicious-activity" ,
"object_refs" : [
"indicator--5cd91978-e20c-4db1-aa46-5c80950d210f" ,
"indicator--5cd91978-db5c-4411-9e7b-5c80950d210f" ,
"x-misp-object--5cd91962-0644-411a-8bf1-56a6950d210f" ,
"indicator--5cd923a2-d3dc-47c9-9404-47eb950d210f"
] ,
"labels" : [
"Threat-Report" ,
"misp:tool=\"MISP-STIX-Converter\"" ,
"osint:source-type=\"microblog-post\""
] ,
"object_marking_refs" : [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5cd91978-e20c-4db1-aa46-5c80950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2019-05-13T07:15:04.000Z" ,
"modified" : "2019-05-13T07:15:04.000Z" ,
"description" : "C2" ,
"pattern" : "[domain-name:value = 'test.discoverthings.pw']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2019-05-13T07:15:04Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"hostname\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5cd91978-db5c-4411-9e7b-5c80950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2019-05-13T07:15:04.000Z" ,
"modified" : "2019-05-13T07:15:04.000Z" ,
"description" : "C2" ,
"pattern" : "[domain-name:value = 'port2010kmjutre.camdvr.org']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2019-05-13T07:15:04Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"hostname\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--5cd91962-0644-411a-8bf1-56a6950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2019-05-13T07:14:42.000Z" ,
"modified" : "2019-05-13T07:14:42.000Z" ,
"labels" : [
"misp:name=\"microblog\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "text" ,
"object_relation" : "post" ,
"value" : "Interesting BR #banker sample, #bankerflux found by @malwrhunterteam drops a few binaries via @googledrive c2's: test.discoverthings[.]pw port2010kmjutre.camdvr[.]org hash f363206183d838911458139b45d0ac6d on @mal_share" ,
"category" : "Other" ,
"uuid" : "5cd91962-60f0-4baf-9ea2-56a6950d210f"
} ,
{
"type" : "text" ,
"object_relation" : "type" ,
"value" : "Twitter" ,
"category" : "Other" ,
"uuid" : "5cd91962-305c-43b1-a44e-56a6950d210f"
} ,
{
"type" : "url" ,
"object_relation" : "url" ,
"value" : "https://twitter.com/James_inthe_box/status/1107613603144712192" ,
"category" : "Network activity" ,
"to_ids" : true ,
"uuid" : "5cd91962-904c-42cd-b5c6-56a6950d210f"
} ,
{
"type" : "text" ,
"object_relation" : "username-quoted" ,
"value" : "@malwrhunterteam" ,
"category" : "Other" ,
"uuid" : "5cd91962-36e8-47e1-bafb-56a6950d210f"
} ,
{
"type" : "text" ,
"object_relation" : "username-quoted" ,
"value" : "@googledrive" ,
"category" : "Other" ,
"uuid" : "5cd91962-e624-4d47-83ae-56a6950d210f"
} ,
{
"type" : "text" ,
"object_relation" : "username-quoted" ,
"value" : "@mal_share" ,
"category" : "Other" ,
"uuid" : "5cd91962-3a54-4001-93d2-56a6950d210f"
} ,
{
"type" : "datetime" ,
"object_relation" : "creation-date" ,
"value" : "18 Mar 2019 5:03 AM" ,
"category" : "Other" ,
"uuid" : "5cd91962-e0f0-4bb8-ad21-56a6950d210f"
} ,
{
"type" : "text" ,
"object_relation" : "username" ,
"value" : "James_inthe_box" ,
"category" : "Other" ,
"uuid" : "5cd91962-99a8-41dd-93af-56a6950d210f"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "microblog"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5cd923a2-d3dc-47c9-9404-47eb950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2019-05-13T07:58:26.000Z" ,
"modified" : "2019-05-13T07:58:26.000Z" ,
"pattern" : "[file:hashes.MD5 = 'f363206183d838911458139b45d0ac6d' AND file:x_misp_state = 'Malicious']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2019-05-13T07:58:26Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "marking-definition" ,
"spec_version" : "2.1" ,
"id" : "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ,
"created" : "2017-01-20T00:00:00.000Z" ,
"definition_type" : "tlp" ,
"name" : "TLP:WHITE" ,
"definition" : {
"tlp" : "white"
}
}
]
}
