2023-04-21 13:25:09 +00:00
{
2023-06-14 17:31:25 +00:00
"type" : "bundle" ,
"id" : "bundle--5ea0b0dc-45d0-4d5e-bed5-4271950d210f" ,
"objects" : [
{
"type" : "identity" ,
"spec_version" : "2.1" ,
"id" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-06-21T12:45:51.000Z" ,
"modified" : "2020-06-21T12:45:51.000Z" ,
"name" : "The DFIR Report" ,
"identity_class" : "organization"
} ,
{
"type" : "report" ,
"spec_version" : "2.1" ,
"id" : "report--5ea0b0dc-45d0-4d5e-bed5-4271950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-06-21T12:45:51.000Z" ,
"modified" : "2020-06-21T12:45:51.000Z" ,
"name" : "Ursnif Campaign f1.pipen.at" ,
"published" : "2020-06-21T12:46:13Z" ,
"object_refs" : [
"indicator--5ea0bf72-a404-46cb-9e31-f094950d210f" ,
"indicator--5ea0bf8a-3d60-4926-8e26-48d2950d210f" ,
"indicator--5ea0c030-71cc-4f22-8581-41d6950d210f" ,
"indicator--5ea0c031-7ac4-4bc9-831d-4e7b950d210f" ,
"indicator--5ea0c031-6c9c-46f4-aaad-469f950d210f" ,
"indicator--5ea0c031-46c4-4615-a1d0-4bcf950d210f" ,
"indicator--5ea0c031-8064-4f69-9943-450d950d210f" ,
"indicator--5ea0c031-33a0-4356-b3da-4ea2950d210f" ,
"indicator--5ea0c031-acc0-43a9-b3e3-4982950d210f" ,
"indicator--5ea0c031-76f4-45d2-91eb-4e95950d210f" ,
"indicator--5ea0c031-2f00-48a6-9ec5-4a66950d210f" ,
"indicator--5ea0c031-85f8-4bf2-93c6-4d36950d210f" ,
"indicator--5ea0c031-71c4-4233-ac67-4d76950d210f" ,
"indicator--5ea0c031-a808-4e2b-8f73-496b950d210f" ,
"indicator--5ea0c031-c06c-4a9d-a243-41ce950d210f" ,
"indicator--5ea0c031-eab4-40ce-a731-4c3b950d210f" ,
"indicator--5ea0c031-bd40-4f0d-9e71-481f950d210f" ,
"indicator--5ea0c031-c414-4113-bf4e-4570950d210f" ,
"indicator--5ea0c031-e518-4d7d-82de-44db950d210f" ,
"indicator--5ea0c127-7bc4-420e-80a1-4906950d210f" ,
"indicator--5ea0c19a-ea44-47bf-81f6-4afa950d210f" ,
"indicator--5ea0c214-bba4-482c-87f8-418b950d210f" ,
"indicator--5ea0c214-4adc-4fc8-8d3a-423e950d210f" ,
"observed-data--5ea2e114-0484-477f-a0b2-4e78950d210f" ,
"url--5ea2e114-0484-477f-a0b2-4e78950d210f" ,
"indicator--5ea0b101-a724-46a5-9060-41b0950d210f" ,
"indicator--5ea0b118-cffc-4507-a726-4372950d210f" ,
"indicator--5ea0b13e-4388-4958-95d6-480a950d210f" ,
"indicator--5ea0b152-5c98-4557-8fc2-435b950d210f" ,
"indicator--5ea0b1cc-e7e0-4612-bcfc-4c33950d210f" ,
"indicator--5ea0b1e5-1dd0-45f4-a7ec-46d6950d210f" ,
"indicator--5ea0b202-5a8c-4ab3-91da-40d5950d210f" ,
"indicator--5ea0b220-0a78-43c7-9f35-4e45950d210f" ,
"indicator--5ea0b22d-41ac-43c4-a3d2-466b950d210f" ,
"indicator--5ea0b23e-7268-4c60-8e21-484a950d210f" ,
"indicator--5ea0bec1-9598-455b-b114-49c4950d210f"
] ,
"labels" : [
"Threat-Report" ,
"misp:tool=\"MISP-STIX-Converter\"" ,
"misp-galaxy:malpedia=\"Gozi\"" ,
"Cobalt Strike" ,
"Ursnif" ,
"misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1192\"" ,
"misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"" ,
"misp-galaxy:mitre-attack-pattern=\"Compile After Delivery - T1500\"" ,
"misp-galaxy:mitre-attack-pattern=\"Mshta - T1170\"" ,
"misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"" ,
"misp-galaxy:mitre-attack-pattern=\"Regsvr32 - T1117\"" ,
"misp-galaxy:mitre-attack-pattern=\"Commonly Used Port - T1043\"" ,
"misp-galaxy:mitre-attack-pattern=\"Standard Application Layer Protocol - T1071\""
] ,
"object_marking_refs" : [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0bf72-a404-46cb-9e31-f094950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T22:09:05.000Z" ,
"modified" : "2020-04-22T22:09:05.000Z" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '8.208.90.28']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-06T00:00:00Z" ,
"valid_until" : "2020-04-21T00:00:00Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\"" ,
"kill-chain:Command and Control" ,
"Ursnif"
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0bf8a-3d60-4926-8e26-48d2950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T22:09:05.000Z" ,
"modified" : "2020-04-22T22:09:05.000Z" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '47.241.106.208']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-21T00:00:00Z" ,
"valid_until" : "2020-04-22T00:00:00Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\"" ,
"kill-chain:Command and Control" ,
"Ursnif"
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0c030-71cc-4f22-8581-41d6950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T22:09:05.000Z" ,
"modified" : "2020-04-22T22:09:05.000Z" ,
"pattern" : "[domain-name:value = 'dianer.at']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-22T22:09:05Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\"" ,
"Ursnif" ,
"kill-chain:Command and Control"
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0c031-7ac4-4bc9-831d-4e7b950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T22:08:57.000Z" ,
"modified" : "2020-04-22T22:08:57.000Z" ,
"pattern" : "[domain-name:value = 'api10.dianer.at']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-22T22:08:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\"" ,
"Ursnif" ,
"kill-chain:Command and Control"
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0c031-6c9c-46f4-aaad-469f950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T22:08:57.000Z" ,
"modified" : "2020-04-22T22:08:57.000Z" ,
"pattern" : "[domain-name:value = 'mobify.at']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-22T22:08:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\"" ,
"Ursnif" ,
"kill-chain:Command and Control"
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0c031-46c4-4615-a1d0-4bcf950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T22:09:04.000Z" ,
"modified" : "2020-04-22T22:09:04.000Z" ,
"pattern" : "[domain-name:value = 'pipen.at']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-22T22:09:04Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\"" ,
"Ursnif" ,
"kill-chain:Command and Control"
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0c031-8064-4f69-9943-450d950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T22:08:58.000Z" ,
"modified" : "2020-04-22T22:08:58.000Z" ,
"pattern" : "[domain-name:value = 'f1.pipen.at']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-22T22:08:58Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\"" ,
"Ursnif" ,
"kill-chain:Command and Control"
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0c031-33a0-4356-b3da-4ea2950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T22:09:04.000Z" ,
"modified" : "2020-04-22T22:09:04.000Z" ,
"pattern" : "[domain-name:value = 'been.dianer.at']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-22T22:09:04Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\"" ,
"Ursnif" ,
"kill-chain:Command and Control"
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0c031-acc0-43a9-b3e3-4982950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T22:09:04.000Z" ,
"modified" : "2020-04-22T22:09:04.000Z" ,
"pattern" : "[domain-name:value = 'deem.dianer.at']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-22T22:09:04Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\"" ,
"Ursnif" ,
"kill-chain:Command and Control"
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0c031-76f4-45d2-91eb-4e95950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T22:08:57.000Z" ,
"modified" : "2020-04-22T22:08:57.000Z" ,
"pattern" : "[domain-name:value = 'vv.malorun.at']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-22T22:08:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\"" ,
"Ursnif" ,
"kill-chain:Command and Control"
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0c031-2f00-48a6-9ec5-4a66950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T22:08:57.000Z" ,
"modified" : "2020-04-22T22:08:57.000Z" ,
"pattern" : "[domain-name:value = 'www.kamalak.at']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-22T22:08:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\"" ,
"Ursnif" ,
"kill-chain:Command and Control"
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0c031-85f8-4bf2-93c6-4d36950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T22:08:56.000Z" ,
"modified" : "2020-04-22T22:08:56.000Z" ,
"pattern" : "[domain-name:value = 'free.up100n.at']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-22T22:08:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\"" ,
"Ursnif" ,
"kill-chain:Command and Control"
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0c031-71c4-4233-ac67-4d76950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T22:08:55.000Z" ,
"modified" : "2020-04-22T22:08:55.000Z" ,
"pattern" : "[domain-name:value = 'ahah100.at']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-22T22:08:55Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\"" ,
"Ursnif" ,
"kill-chain:Command and Control"
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0c031-a808-4e2b-8f73-496b950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T22:08:47.000Z" ,
"modified" : "2020-04-22T22:08:47.000Z" ,
"pattern" : "[domain-name:value = 'two.ahah100.at']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-22T22:08:47Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\"" ,
"Ursnif" ,
"kill-chain:Command and Control"
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0c031-c06c-4a9d-a243-41ce950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T22:08:56.000Z" ,
"modified" : "2020-04-22T22:08:56.000Z" ,
"pattern" : "[domain-name:value = 'ahonpot.at']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-22T22:08:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\"" ,
"Ursnif" ,
"kill-chain:Command and Control"
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0c031-eab4-40ce-a731-4c3b950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T22:08:56.000Z" ,
"modified" : "2020-04-22T22:08:56.000Z" ,
"pattern" : "[domain-name:value = 'targoo.at']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-22T22:08:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\"" ,
"Ursnif" ,
"kill-chain:Command and Control"
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0c031-bd40-4f0d-9e71-481f950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T22:08:57.000Z" ,
"modified" : "2020-04-22T22:08:57.000Z" ,
"pattern" : "[domain-name:value = 'kamalak.at']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-22T22:08:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\"" ,
"Ursnif" ,
"kill-chain:Command and Control"
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0c031-c414-4113-bf4e-4570950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T22:08:57.000Z" ,
"modified" : "2020-04-22T22:08:57.000Z" ,
"pattern" : "[domain-name:value = 'api5.malorun.at']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-22T22:08:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\"" ,
"Ursnif" ,
"kill-chain:Command and Control"
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0c031-e518-4d7d-82de-44db950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T22:08:56.000Z" ,
"modified" : "2020-04-22T22:08:56.000Z" ,
"pattern" : "[domain-name:value = 'dxdeedle.host']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-22T22:08:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\"" ,
"Ursnif" ,
"kill-chain:Command and Control"
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0c127-7bc4-420e-80a1-4906950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T22:12:39.000Z" ,
"modified" : "2020-04-22T22:12:39.000Z" ,
"description" : "VNC module" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '162.244.35.233']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-16T00:00:00Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\"" ,
"Ursnif" ,
"kill-chain:Command and Control"
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0c19a-ea44-47bf-81f6-4afa950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T22:14:43.000Z" ,
"modified" : "2020-04-22T22:14:43.000Z" ,
"description" : "TVRAT" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '89.39.107.106']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-16T00:00:00Z" ,
"valid_until" : "2020-04-17T00:00:00Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\"" ,
"kill-chain:Command and Control"
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0c214-bba4-482c-87f8-418b950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T22:16:13.000Z" ,
"modified" : "2020-04-22T22:16:13.000Z" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '23.81.246.22']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-16T00:00:00Z" ,
"valid_until" : "2020-04-17T00:00:00Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\"" ,
"Cobalt Strike" ,
"kill-chain:Command and Control"
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0c214-4adc-4fc8-8d3a-423e950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T22:16:14.000Z" ,
"modified" : "2020-04-22T22:16:14.000Z" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '93.190.138.35']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-16T00:00:00Z" ,
"valid_until" : "2020-04-17T00:00:00Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\"" ,
"Cobalt Strike" ,
"kill-chain:Command and Control"
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5ea2e114-0484-477f-a0b2-4e78950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-24T12:52:36.000Z" ,
"modified" : "2020-04-24T12:52:36.000Z" ,
"first_observed" : "2020-04-24T12:52:36Z" ,
"last_observed" : "2020-04-24T12:52:36Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5ea2e114-0484-477f-a0b2-4e78950d210f"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5ea2e114-0484-477f-a0b2-4e78950d210f" ,
"value" : "https://thedfirreport.com/2020/04/24/ursnif-via-lolbins/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0b101-a724-46a5-9060-41b0950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T21:02:57.000Z" ,
"modified" : "2020-04-22T21:02:57.000Z" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' 8 a 1 f f c 3 e a 2280 f 34 f 91 d f 70 e f 538880 b ' A N D f i l e : h a s h e s . S H A 1 = ' a 5 d 8 c 89 c 49 a e 8 d 0 2 c c 1e6 c 32 a 223e0 c 0 0 b 3e6 b f 1 ' A N D f i l e : h a s h e s . S H A 256 = ' 3440 b c 915 d 40 d 1 b c a b 8 d 5 e f 946 d 18 f e 10419385559689 e b f 2 b a 36 c 9 e a e 61 f a a f ' A N D f i l e : n a m e = ' o p e n _ a t t a c h _ a 1 i # 793032 . z i p ' A N D f i l e : s i z e = ' 209791 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A F 2 o l l A v a M t Y r j M D A H 8 z A w A g A B w A O G E x Z m Z j M 2 V h M j I 4 M G Y z N G Y 5 M W R m N z B l Z j U z O D g 4 M G J V V A k A A w G x o F 4 B s a B e d X g L A A E E I Q A A A A Q h A A A A J X w 0 X 5 n Z H O 0 q s s J 4 g D Z F P e y Z c I B Z p n 3 K Q m W V n x W C b x F G + 25 o K 8 S u X r T 0 B v U d C + i d U w W p e T P N 9 V U R 7 o f T k o Z Y N C H J A l I H I v 9 b r V c Y r N g v r f M S w t h b C N u / L s D j k c u H D v w 8 g v D g b 2 K l 90 v o m S Q 7 z Q F 5 d 7 S 4 i c Q I 24 k t o E e 1 i G e e D F X x o o i e S n + N R W p Q a d y G X A 2 W g 62 S 4 l 1 m c B D 9 W Z T A n L l p G H + A z a 0 / W c I a j W i 6 / h w B p c h q / 5 c M h s z u T K M E I R X S 5 b X i 8 i 2 J i u I y v x U d t q V 4 + h 34 X L Q G u l U q e K Y r R N W V U r a x L j q H K 7 Q G I 63 s / y t G g 0 i U a I p 3 y 6 c e L b g 6 p f e 3 X a Z e P x M O E X I U Z m k F u L h 2 g S h 7 m P z g d V T X O f i P 7 y x L x G K E 2 X N S J i m 5 F R 1 i u q h Y R u Y Y H e w W T r V f z 7 C 9 d z a d e R C x + y I W 4 a l a 3 O h V L q X M r 7 i Z H y m t V w v T 0 J k a E y Q x X f G o + z D C l 7 P + n s n B A 12 d b G h Q 1 i d 2 k g 4 k L G w B o Q v q 6 z m 47 H r K r B p n J d s 0 j D v G e U F Y d b 1 O N v + 2 V M k 2 K l 43 w S 18 S T v k P S D N s 50 J d B h W M a k N C Z K b t + 3 b Q c a / j w E i J l + q I b w N + X C C Q O h c f s p P 1 I c t R l F + W i s p Q j S G J m p i U B 1 Y w n J c w i m X U T N h 1 p k Y B + J S u h Y d y 6 O b b 6 C p 1 I K 6 f 3 M R + G t f Z s U j h 1 v 8 v S W s f 9 l j 0 X I / b I 4 i R A h M H 2 S L 2 R O 9 u H P Z 3 E a O Z O 3 s + Z F E x 3 Z y Q Q Z Z 8 T 6 k d p r I m / 56 I a B 6 Y b X J m 3 B o / 0 F 8 I m 7 Q t A l 5 V E c L X s a 7 N / e Z W u v + P D g J l n E O V h h n h g S O G W m Z B 8 m m g k 8 l 6 a Q B H Q E F u c V r q c H w 79 J j j 1 m P 9 C p a T Z M W c W N g o p D B N J h n C x i 0 28 N z O s x s j l E I D K g N J J g M k f N Z 7 f o l X a a f q D j h a C S E b s r A L v H R g e 6 m X J J T Y F t D U K G I K 7 O F 3 S 8 Q z e o W g b v t x G n K K 80 r H j h t F A y C z a B x C Y N T 9 Z 6 I 60 o q S 5 b r z I E v E B 6 s b d B N r m C I l G v m 2 q j N q 1 O Z E O T l V m N P G k L E W R H J G 4 q 4 R / R K 7 X k X Y b h N 5 a q u 1 a M D 8 a 7 B A d M k T P h F B i w S b e F m x 2 C u l 4 e f w t 3 i b t b m b 6 j C 0 u r x X h J F G z J B 9 S z / i J h W w v 1 T W M J J I t u f p X Q A Q c 6 i t a y K Z s G r f v C 8 I A / 8E5 z n p H p j b 0 x k D o J s s + h L i a 8 e e o G N 6 s + u W 9 w z L Y 2 g 6 n 2 c u 6 N n a A G L n z 7 A 6 j B X H 5 O W 2 u 7 d q U b 8 X 0 C 6 f x f Z R e O G R c / c A E s b 8 d F a n B L T E Q 6 s Y 7 S f 3 H x / n K A j F 0 J A o 5 c F p 20 Q s 26 G r 3 Z J 2 B E x u f X X c V z c g M I S U o K D 3 L K A y f S L 7 z 6 q h W s o S 7 u w r 0 + I / A J 33 T c 0 h W a 87 g u A V C 9 j G i H M c w 77 g s w T e 6 Q + b t P W 0 f w f b 3 s G j a J h Z q i e G B h S G Z J / b W 2 R 8 N w c e h 4 p v 4 W o 6 U d b a e 5 q 9 F F h K + j + l P N c z //oZ+by/7VTGo3F13sOYtIFadjlpZrIHUZL4D4K76LArsQexL+0MCJ172vYSXz+maxIcksAwC2SDn0xYlHgNDo3D1MhQBGAvpKBJ6Kjct26F2uE5vkqj8TnykCLadkmioUgshk00vlOE8w+7hZ42FntP0uT1en+x3BsigH5cB+2o8iw8G8dcrsOMbqABlgzOVGCr8SJ5Zy0bK1+gY/qhTOIhpW3z2hk48WlwUP12wWFRCvWokoXNL8lBVS6wTwqGXpgnR1MJNx9qdqKWecEH3OfATvQUNNpzmAXEmFb5QgDlvGo0DP8H9gLaF5bGJc2sztIBtj/a3xlYUCYX/ZUSbJ0iRGM5KbbQ89iLQYdGBOJ/rUM9khPAfpnUugH7IeqoUB8DRYPwaaUsxtpPhjLYWslhQmfrXSzRdF0XjB97it3WYEGVGV4JatZA/HsgrxPoOsiG8vzsOIxBJWvRS4fpw7moI3VhSmRBso5s9MF8+OVmELzTtM6PFRl9geNQ1jMjo33NRdznthJEboW/m/9DVXzhKnt7V7Qdg6jWhTEwyTn30fKd0rVX5IdmGiyWPDn8EnWpKtZgqktoCUlbARCGdHW58vZ55kWS4048K24UGZDJctbqME7gfcHmDSszeum4FMWic8p/H6shTv83BVLZyOzeMmA1MlOQtWZaja3NDr7usmXV0/PWQbUdA9CjEzXM4HJXuugt0F8bYQQfKpEuWNSocgxY7XoblOVBVHBvlFV7TrW1BfDgwT+/m7KvufaCals6/SVSXduF4hM8UNXCQzD55gZQ8t/58wYXxTaoK20eMGGuNq47F8VpJQcJdD4roUJPivLdqhoUmkJfjBvk3o0PAdPa6VLKklX9dH9jeK5BHe5m99Yh1ZN+4gux2YKiCQuZuOJLBhbPj4ByKzrG3tXB8viIDo/eNseKl4FgYvuCcbVQPATHL/+axh5D3y0jmSOOQZxRexirPXCYF8bM30hzrz1KTcvInfDTQFa7kvnOsydyJ6Fa5rUT5dx+OthNWaLMpc995Sip7EtMWzRLXokQNIclI7Kd2LjQTftAcAF81zoC7HS9KaXOh5r2Wa0MdbP6Z6hjcomhhv9IXi/FixW6Olgo20wnL/1EY07sLef0nrVcnhOIC6blFGY6RE6mqOC/ZCgJRUQ9y1WKw/HgGk1QXGD73rwDtWy/QhOwgKxk/yKMtgptU1+cchk704dhh24gwBkXL2UYMbaiJu8jS7WEPLLTV8F2oKwgNryFTQMWJyKTzYDSjXM30PAN1dBTxNjZjOAXvtQcb90UGcR369h3+Guq0qFSx3O4TRiZzENp5r2RxZFdokRKA7zhPyclydYHzdXkx4X7NhAXg3or97xY2iIwhBb1+gxYekkYT1aDgSJ9P3hYjAxyx3TjZLCf2TmYIIIjf4pJUmYHJ/ufVz47CVxQJY0HOybFCTZfXhb/8Zry4AxboQmEl6nMRmkzSF1H/e7/9gbj8hoKlJ+FQZlhVJswodmbneX+KofUiOItoBpK5tphZzIbTWdTHzmQ+co9OcWqd4Cj6qC3pDhGVyiPQPb2sUURlqzL4Hlr1xA/xCXm8BbmvulJRjoPUKvshWQC8RkF9nYZa8FU13cjmGECm8QZYIQa+864me2CIayjZOmQ/BNcq3yVtkseUGYZXljDeFhEeWWYZbDaMxfNPhH3S9AY7mFsoryIKDxIeniilzia/ctqMfWERjSGxqdKOBGDBYhykQ9nb/FSdN+/nQUJL27GisJ/h/FQm2SAf2Pqbnkn06+QRN24F4MsgIPNLNpE+2ZUakrXKGlUgN4+ig6Wh5xFuAAzu2LS14nDhdboqdIo1AzgjQNn2gQsdMomC8QKqnKOXkPI8edppYCVocOta3UjCauEv7E+1nGIjXTIYTvqnHhN9WDiLcW7BHZdmjnb5JLwx83QpTpOsT2ZrR5Iw3NYGNh1XxG13tT1cLD6vSKVN87ZRPshZWFgheNxVkGOi8MQqGaoW5YP52Z/2Z7jaXjryEt2jxJp7sN9y6MbcW5WblgQlp7MqnqJbT9S2j7+Bn324Kpz8KXo9Er+rm6LPiIj+M4snrG8E2z9CXm01bZ4THKh4GnQ0xcqjfU7GVzHH3Q7e9XsfbM5dJog3XVS6NbVhtwRzktXcXDsUqU6s0CW3F4zkhLhboEN0J9vJqsn39fw/g/i8Yr2oxpodWV63hU5tyhlYTLArNt9rCrmP0S
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-22T21:02:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0b118-cffc-4507-a726-4372950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T21:03:20.000Z" ,
"modified" : "2020-04-22T21:03:20.000Z" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' d 819173 a 8 b a b d f 625 c 2774 b b f 17 e d 710 ' A N D f i l e : h a s h e s . S H A 1 = ' 629e79904 e d f c b e d e 3e7 d 4 f f 9240 c 8571 d 8e2291 ' A N D f i l e : h a s h e s . S H A 256 = ' 588058 c d 3661 c 48 b 372 a d 870 c e 3e03 a f 62e61 f f d 917355895 a c 8342736704673 ' A N D f i l e : n a m e = ' X i k F Y e h x R . t x t ' A N D f i l e : s i z e = ' 183296 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A G q o l l D J h F / S 8 A M C A A D M A g A g A B w A Z D g x O T E 3 M 2E4 Y m F i Z G Y 2 M j V j M j c 3 N G J i Z j E 3 Z W Q 3 M T B V V A k A A x i x o F 4 Y s a B e d X g L A A E E I Q A A A A Q h A A A A 2 x R J z F H I 9 g 38 C R C a s o 0 + m J r A Y O 1 v C S 3 K M U 8 e A c Z Z q x 4 + H Y w 2 Z W x B X O k 8 a x z R v x x f B E s h I G 0 k 4 f W l Q w X F s S b 1 J j d o o a Y P n X u H k X 9 L K f d g 1 b G g d G / P g G I b c w 4 W N C g S y w Q i 0 p + q 9 C e y 3 B s G N A 4 N m O 5 k a F / H D B H v + Y s 7 t S / n J C x C C O u 9 G 3 m b 33 s Q n v k Y Q F / 9 k m J + y w O 6 o 61 z j H P I C O x O p D C g k r A H m 7 i c e j w k 7 c w 6 a a c z o D k Q c Q / e w a B P y y + g I S s Z S c 8 N I e S / 9 M 66 E x 4 D / Y R P / 7 v o m + I c I I h R W k T F i R f F Y 7 G n E W N d F x U y H A T w Y b Q N x v 8 p i N 1 U o t b C J t n N Y 1 u K r L 3 f C r c C M T 60 A R v E 3 C A g u K 3 H h v i q Z 2 F y S h C O s J j f P q h i Y 9 a H 4 R W O 4 W z g B g I H 1 S 26 M O p A u d N j Y k a M B D 36 u y 0 2 s D n x G V Q 6 d o l t t a Y I l B m u b w f D d 7 S Y 8 p o E c / c 1 v H E Z L N Q 2 J h h D H P Q G 9 X S D l L x r 4 D 0 Y y o j D r 0 h 0 s O 5 c Q + m l c w / 4 w I Q w 0 5 a W I T A u j p f y W J b E x / 8 E F x u Y R x T + B / y x K f 93 H w K H Z 8 / l I 3 P P U L e 9 m l H j g Y S g F u n w e R E 3 V 0 e P 9 c w X s Y E o l z u u I p G L m u 8 l v r E / 7 F 3 g r V t 0 d o E q 2 r p n F R L T z R S 4 K Y m h N X v 8 s B W l u X F l e u d g 3 P Q 9 c H v X X M B 5 B G O X S l m W / Y d s p I y I 7 K B 4 c q W j B W 9 E x d X K I 0 B L v b 5 s y x x 87 O / U e l H q 90 n 1 X Z 1 N 3 T 5 B 5 + f c k y + P 9 o j b D M / e W v c R q Y F J 56 l U k s 22 K z 33 J 3 I e t N L a I d W C k z i 9 + V P x s E + Z e Q S n U w b C 9 N r 2 f p Z z r v k d v 58 t h 4 R P T + e / 7 s O g Y V V h m v u t z u a 5 b a c H F u K q o z C q Y + 4 w z A Z R z / J j J N l G e x 7 X J D J O k 0 v G r T g j w A t 5 e K m P G 8 l Q 5 M z 2 C k z s o k z 55 j T F O I R H U L A l 7 E o X z l 5 n 6 B 6 Y C T T 8 Q Z M a C e 90e2 N E v q q a + y r + i G v c B F J p U Y 6 o u j 2 j V P B v Q P Y M a M H D o w I a m d O + e Y z H Q W d f I T f s C g N L M u z O 1 W j D f A R m D w r I E r / M w G t C W y T W a 1 a f i i T O C X q N e E q G B h O p D 3 G / L 70 U r X w N V R L 4 F + o 5 i Z k D 9 W T S n v Z G o 4 b c H a t 3 Y w a 2 N U n h R u t i o W R T 37 O K u 0 l 53 u m Q V C B Z 13 m r T 2 L O 2 u g d U v I L b G o q v 35 t o X t l a Z L S j K W v r o x B 5 X g S M o t 0 V r C T J y b O V s x 4 / K p t r v 5 y R r B T 8 A D n z O M D + m q 5 Z J q s l u I c 80 k v L X u 3 y b 29 I f J r v J U j n h o c E n o U w 5 o J s b a F L 9 x Z c y n + p l R Q x C q B c 53 X g V C M 9 f r 6 V W + / r q V 1 t O y Q R V J p 6 h c b 78 q 11 W C + U 8 y d s h c q f K v E E e U 2 f b A Q 2 L 7 J r h E U b m z g E r F d N o U x + v g A 1 u W C P b b W e E N s x N r v i t U W g y i R 9 S R 5 R H N e J b o f L D X e O h g 0 2 U O n o g 6 k Q N q F O l h + t L r j 2 X x l o u D X t z X D C F J f O M I z m t o R K g 9 V u H b k l / C E z r 7 N 4 X L N R X l R e 6 / d c r y G E 4 g W c F K S 1 W 1 t F h 1 u W t e T y w 8 R 6 L f M 27 y H 2 Q u F z T I h O g X d / h j K X u A j / W 64 G t 3 O d P K w t w J p X e s p h z N V D 9 P A r 58 V z U w G Q 3 i 7 y 9 j b x n I S 0 K g o B b g 0 F t Q + 6 F b z k k f k 9 p w W f 4 d O 3 r t s k A M V x n o R a S 0 M i m J I q F E g Q Y r u 50 N R a g n M r R 12 L 9 H D 0 N 5 x f C P + h k P I k 2 s 2 m 2 d T F / N u 722 + + x l p q 0 H 6 g s R 710 s U d 7 j 1 L H 4 i h v 8 U M p w F m Z p i d T k 1 J O T 0 a 0 S D J D A B m q b I c U G L 8 Z H U S 0 j B V q d h 2 C T r + 79 h t Z 67 f 0 6 C x c L E b 5 v C / i x g f a l d v t / 4 I T i w l i g a L 2 W q z r t 925 w a R n i 7 w 9 X x r O j n 7 H z h S M b 3 + K J x i y V 7 d a g s + J J A y M t x S U s Y H d U m 8 O q / p f h w 9 n 7 w m 7 Z g / j / j s n 3 F 2 G d o 7 X g u i X r r I 3 O L 5 R 6 R v X e R g 9 E t m S p q q O R q t Z 6 X a B E d 9 + U F G c L N + f S Q b o f S q G c b I m x / K 5 w y I U l L F b B 3 Z g 8 v X P V E y Q I 2 S r c U r f h f M i N I C 9 E l Y z S o e H U b 2 a h w X w 5 v Y B 4 m w G R L / n U q v n z t k 5 R m q x z H K n E S j L f 16 i j C 2 F s 0 R 6 f e P S 6 c O W + P 5 g N N Q r k i e I H c p k p D R V 2 Y b / E 4 i G y B v f m H / v a c j + 5 y 0 W k / n r x D Q N B g U 0 q l 8 E r Y + p b R h X + e O 7 p 5 u U o 0 M 6 f m a 0 i Y l Y F G 9 d 6 l R Z a I v w Q O A S Z u + n 8 R m Q D x x v i 7 d g g R R L U G A e k L r w u b 9 b Z q s H + I B Y 4 e B C J O 8 r l 2 D o L W 8 b b U x D / 6 A 77 F P l Y m i h J p s T g V J a R F 3 M r K h f A z 9 Y A m M D A //hTfUaVtbGKAfccWVQesdCKXj6+MbilVYwwlyBYFboeCOY8yI4dN6ynETRyG5JU+BLgm3KUdjPdc8ps9hpYkmQo0IXmBySB6V3sW4ZRpyvZ1COT30YP6Ko/EqVUcT6j9+YAZyJdv9nJEkAO0OwotSCmEVPk3vUq3HMM2Gtmr1oW4DqfqkiWBzkn8StD9wiNz/FtdeSdpvuoVJQJu6ETM13FfWbLy0g4DxoSe1Urp/Ti9JQd2BEBe3DiTa50f5ADAZtb+xfGgV3wd4vURW1iJduIjbh0eOysWPTkN+DiBuqLFAtqug+/VCR+993s+kKpOdP26mlpjS2GS13/nK7nOUFVrZ9JogG3NFr/D+fz24kmCV9HEGYyqZbW/aJEAdqyq8siJQb6KI8a22Kaenl3PRV1parwsusSNkBHFyFE5g3O4a5tsIo2U4T9mpG5oSMvQWtUg4yOF36/Pb4cT9jPxVPuFjl1Kkxl9CNhOAhosQj8gFP757AllaKd+LcTp5tJ5ZYnI3/uUcnheqPN0DoZskbY+D9UeYzoWgd/m77lLhmALPRmj1Als2esjcqzD8PMoefUtXdb27dGVaaGx6Xz/I0G443tESH0dYhbf3CnmWpZGXi22Hk7gOPJ9C8u7Eb7ynauS1AGYekg4zpBBVHKQBkMlNHeSvtiHMX01VmqoXWA1jt9GmxEO/I/IrGgUG7yw/MiJxyAXRsCjrjyb7IcigdBhSXzpyHak1j3+naLfrSDJLi88J+gBD/QLtHj9Ro1aJsPO9HXwNS8SZIrtY0gkwYYdfOI97hOtAGKg80OnTFpfVV1erk/Lkw1+GQc45/5yFy5rvkLCHVQ2SF4Gfo6Qov7rsWA1rJ2RtnHrXz2ojGd/l7j3edqULLm7P8ZYMCpUpnk7Q7Ri1/vJbPLG4hagd6UjBdpANNQXYGdKMw1ofx6PBWQo5DJEOCLKHhowQvSkr/31l99l1VcPlMJxBcB6//RD8SGpyAu6eD6VPfEbwnHAgCeyvHhL2lZzpj9/N396jcDd8ua/Ds8305Ks8Uz4qEslycLJUnopcqPnCVqdvsy5OkxvRhrBb3sTXe85PZxs/5+OdqZVqyo0g64oGL7DvG5GW3KQ6u4Q4xz/EFao7KuL73uDHp+fIqtQhI5YiEfctkgiS7CTvroFYhpypfoS85PsxupfomY80Kc/67TamDYFcAiasxfO/TMJClzxJG3vE6fov5W2hLwhUfYTjZO9H5xnGORar1nRPCuiolk/PoqSurKx5LjJbVBIFLJ2I0TBZ0m+YHJbIHmuoqNPagdSNFqkXkf7ZrLNBnB+qyEuu5Ay6EYL0d8oDMpU8Y2td/QzSjBY/iqpumWFf5JL1OnV/mrqNNctYdgsy9nConDQ/aIOlR1Bc4c94XphLLaUJ
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-22T21:03:20Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0b13e-4388-4958-95d6-480a950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T21:03:58.000Z" ,
"modified" : "2020-04-22T21:03:58.000Z" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' 334 f c 19e4 c 1358 d 0 979 c 0 a 74 a 321278 e ' A N D f i l e : h a s h e s . S H A 1 = ' a e d 74 c b b a 6 a 3 d a 72 d 16 a 205 b 2893865 e d d c 2e936 ' A N D f i l e : h a s h e s . S H A 256 = ' 28 b 935 b a 6987 b 2784 a 654951 d 304 f f 2e86367 b 0 64 d 1 a 9201215892 f e 547 b 0 d 9 a ' A N D f i l e : n a m e = ' n . d l l ' A N D f i l e : s i z e = ' 185344 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A H 2 o l l D v C I W q g Z E B A A D U A g A g A B w A M z M 0 Z m M x O W U 0 Y z E z N T h k M D k 3 O W M w Y T c 0 Y T M y M T I 3 O G V V V A k A A z 6 x o F 4 + s a B e d X g L A A E E I Q A A A A Q h A A A A L H 7 p Q T 9 w R A U T X 2 Q x g p 9 r h I D G M 7e7 j M 7 C 7 / I + P D i P a Z k v 7 z z K j L h 6 N I R j w q D + M N E S l o z 6 f t b j 17 P d + o p Q 1 z 9 C b B 5 X N J b W m Y S V H z q + o 61 s / R V 1 j B R 2 w 81 o K x N l o w G s 1 + 8 a O d u p Y + 1 H v E n g j P g v H z G S r 4 Y y Y 5 T d 5 V E X D u t 5 x d e e l H e B m / p H z u o K k e Q P K 3 B K S P T t M 7 Z l e J L Q 9 Q 8 W N P C B u v i 417 O U m F z j 7 X Z c h A y 2 h F e a s 3 y + 0 + A W U R e Z z b 2 e J 0 W S K 7 F X 3 w t i n m 6 C v l g 4 i p s e Y h 2 O c i E e q N L k 419 f h D I G l p m B 3 v Z 6 K V u 48 K y 3 A P O f W l 0 l m e I j w S D c e r j 5 H a n C p 5 V j A c m t N p U 7 e i H C A h N b 0 T q R 0 s 1 S K 3 n Q F 0 H U Z H 6 A O l x N r Q S E e u Y 3 c O n 55 V R C T Z A 3 Y T G F 6 N x z V + q m a c F v c a z 7 g H X y t P S w 0 w Z W y H Y T u Q b T u B e f U H 3 o j N / m s q D w 5 E Z m G p r T i E x 7 T P I 2 q 2 q Q r 8 B u D A 4 t s I v G D d 7 D I Z x i o U N 1 R g I M M A G f P + T X / m K Y g K m v 3 b V x x W s 8 A T E q v n P L I X H W V 4 e Q / P 3 D H L H J O d p F v + g w 1 K 8 X 2 r u I v l I 0 G Q C g 9 m 7 N x g R 1 q B J i l O I z W T Q E U A x j P h L O + Y K K E D s b d r 8 b g b p p n 4 v l t N w 187 m 5 W 54 x e k / e M K f 7 l t 4 g A I z S I n E b R L 9 r n E C z / y o j n U V k Q 2 r v 72 P E I 1 h b X T N 7 E H g p A 5 t v z n b B j 8 g + v v H t 1 J / W f x P 9 G U v P z A y r p u d o W v m w r L f v / j n m e 8 h + R W B g a t M o v 7 t 29 A D f l 76 C V q 0 g Q G a G e 1 p K H 1 m u i g V g V I J X Z D X x R Z 7 h R s q A 9 i 5 m 3 r F O S K 2 T g d O g H u p s u p 7 k c e V v 6 q 0 y E 4 r S z L 2 H Y D w 2 k I e m R i 8 K E G x K v W q Q 9 R d o d k x m p Q 7 X o U W C u Q H l y Y F v m 7 + p a A b V U c Q X I D C i i 3 q A H v k y c P P a 3 h G 4 J 2 D D w 6 F 8 Y D S h d B z F u 1 l p y M W d g Q u c v h a 3 l D u z p L r p x v U d 9 q y 87 f g N w s 8 L y A w m Y 4 x a X X S 8 R V w o c Z S a 1 x V c Q a 6 d Q F S b R / 5 F b 4 X l j j b s x T 8 Z 3 x 3 W v n I h U 7 a o S e R L l + r A Q X x D U w i a D p l P c W T n j l y l s Y p A h 6 k 7 R + y v a T j G A X A R x V 1 e y 9 e V j u l m 3 I J y Z / C D Q z B z t A L Y u v e t D V / k U + w 30 f h T y P B t j z t v 4 L x K 0 H U j w w g T j i S C F H t g 3 h q r + s H 0 S 5 e O F w h S N T / i w q C + N s r k H i I W T 5 o K J y W T Z G d 8E0 K P 3 r K M Y A 6 I q t O w n D z Q o 8 w e J 7 L I + C B x w S a G i W t v 9 g m 5 e + p c y T v V 56 K P R 6 z j d w X H K V I S o b 2 a m L r D 1 n i b v N 8 u M E v 7 / T k t a j 4 D t a F N p J y w e T F U C 9 p j S 6 p + 0 + L n N u L R k K m M Z l J U m V + o 3 L p + O B m Z g / Y P g 63 s G M x 3 z P w A R V k u X S f N F h / S A C l 4 Y C z 31 X f x L T m i 2 H u P S 8 Q c f O 2 q T f K M H F j F b i o L O h Q H 7 D E j U o f W d 60 r 7 Z 4 + V e D i 5 b B 2 h d y x G 4 b b m 3 w N a r 3 v Q S n T B P 0 H e + m V p f 2 W Y Q 3 C 0 A c T E / u X F / F d u Z R / + R Y N 0 s w C R g a I A q Q N 7 Z m h E u B 43 e b p n D m V Y + t / D q J / X v O e l R t 97 c 57 o 2 Z Y x N M Y 3 w v s 5 k y y X L p d F C U 4 N c l r R w O 3 z k t w Z c b K 3 C 35 O K I + 7 d t O 6 b L q S + c G b H x 0 m 0 I I d s X e B 8 b q F S N U f g M R o y O E n Y b S 3 I D r C R e v m P + o K L / o T p B B 1 L w j 2 X r K u Z C q 0 m E 6 G v n 9 s v 0 0 8 H k N X h q m a D C e i Q g t y / 1 k s h y S C E E l H T g O p 6 B / k m 7 Q f y M D D m s w h d 5 U h f 7 K 3 h 5 A m + / + o s 4 d o K j e u a O T 2 l G y s 9 D 5 Y i Q j B D t V 1 d C M P h + n K g 7 R i h L 1 i Y C v I R p 5 A a w r D t R s D g O C A s + R n Y T q 3 w M l L p c Z 5 w 1 f t X Z k c o G 3 y E m n 1 H v 83 T h i 2 q 7 S A F q J V U 73e4 F K v 1 J Y 4 J E q 7 / 894 m 2 / Y r R f i I J 3 P y F s n 8 K M + o d o 6 c K L x B c p F 1 t i k F X 2 q P s R q / M B 2 K m d i c U N B D w Z C S O Y l F L D 403 O E y X Z l z o 0 x T z 7 a J W V s E z J e Y d h r K X S U s h b y J B w C O I h y H 2E7 G H S + h I 39 q p + j A I v T F 1 Z N e m w g 2 X r v w K s k v G v x K l Y v Z 6 C y D 7 w M d P Q j q m S p M U V L 0 h 5 k J n k 8 y o R F P w y 18 e C D 6 I R i Y c r W l k r X 8 j N f l S t E v Q 8e7 F s P s a 2 f v W C P 5 P o h M 7 v S 4 o n Y N p k n U 7 h R v n 6 C g 22 s 30 t B e 3 q 2 w K P m X f N 9 G o P l z l 4 N R t N Y y A M F Y l G z X 5 z D m + q A k O a F a h O i a e p + B u m H x i I j z x q T X u 7 e a I Q 2 G + W T Z Q b h D R 1 s z d q a V w j N z Q p Y E 0 U 1 h 0 e w O + + s Y y 3 m R + N b D e Z I p 6 D + b y 7 c U W v B 4 i W Z o v U f F A V f u u p X V u X Z v J R 12 B E T j R v 4 j I K o 5 q Y g L T 9 X G 2 p e Z T D C p n M V h R y Y w y O + T t A j e E a Y q Z A r Z D k B / W S Z 78 r a g w v F z B R C 7 W T b T i v u C s m j m 4 p z J 7 V a O c t V t m M W A 9 M d 9 r 294 K B Z U a t v e 2 A W W + c f g z g 9 m c t C H s f 9 h D f M w n g H 2 J j u H 96 z 6 C 5 e t d P x C y T P / t V z G h 3 l x S 0 0 N 9 l p M k f n 383 Z A Y l N x x i o 1 S s j + 8 x W S a O + V I 4 x v 1 O r 1 b 2 v 7 F N 3 x S T u O J t p d x o P 6 V z i F G q Q b h s x 94 N I I Y 3 d a 1 k P N T A 0 I G 8 X o 7 z f v d g G N + 1 P c L a I a T E k p 9 c j U r 5 C v b r 6 p U Z r N g 6 Y 8 k v N b Z 3 s x + / r R U i t Z d X u 7 i y r 1 p D m + k o C L L w b M r t f I T B M p w t D b D p I 5 H A o P I w b J T C G c A G l a K C a R k K 8 m Y p k w K l N P F 0 o F e c U q W T E k c z I K + S B V N K x k Q q F Z K U + g E R j V g V d F d L 1 t W 3 r y R 1 u v R X b a Z r u V f E c F r t t 6 / Q 0 59 B 2 J 9 z R x l U 8 M Y K B B W e f J v q Q 0 y 4 r 1 Z T B f h n J 6 + P K f a n W t d c 3 a e 5 W 7 a c G n 5 L E G K d p k 2 z O U H i H 8 S 7 S u R 3 V v Y N 0 W 9e8 n g p I u S h E S + l F l M 0 J o q n n F 0 c y N X + M l 4 v J 0 3 E u T 5 l K J A E c j F M K j 8 d q V G f B h l q C 4 v O h o A p j 12 S f K L M N + w g D 4 C G 7 D R e 0 U F x J 4 q M R 7 x B K U x 29 Q a Z W 7 E J P s M K I 6 / 6 + v Z y f 5 m z X 5 r / d 2 U J u X A d G k 1 k n + b P m 0 R t K q e 9 c v 3 m J c R / I D 6 S O D O S / z 8 b 5 l y c Z 1 c I I n 5 J v I h K q O k m q G Z H h N J r l d C 88 S e c d k 63 h c s Y H 5 + 0 M w E L l 2 S q N h c K w J m u O 4 B c R a E r 5 Q b C 4 s i r D V / W j W y u 9 F Y S o N o q h P N B J e 6 l H + 5 G 4 j 1 f x Z s W B 6 N R W t v B 78 Y d L G t n b / 0 C g S k 4 U s i a b y a S v V K 2 C L Q / b M f F I i G 0 t g l E M t m P q J E 3 x W E p P i e 1 V M u a j A O K X f r t w A k 308 O 0 X S f a 8 m f 74 s m F m l G s f j / r M h / A i r r G l W r f i c 29 P R K S f l b C f h r h / 7 C a g M 4 B O F J i r S 34 W E 4 B Q C 2 I h E k e s O / n s F + d d e N Q V Y Z r w x O x y r A 7 u 0 F + Q A T l J I 5 t J B d 8 U e O k / c w F / O K n c 8 m l R r a 3 I N M t c P z r u y n X 9 i W k Z h 9 N D F g x q v K H y I d 7 i b 5 W B I T J G k + M + 9 a w x M 2 l I i e B d e 5 c P m d Q B h 4 x D Y f q e p o 8 x a 3 Q C m + 9 u P W C D 0E2 j e i B s u z V 5 z n e b z + c g b + E 8 x v y + U y G 9 u C d M v U U L c B u o O r W o L g 7 x 9 F P 7 g n k K S m K z + r H + w R m B E R l J 0 l S r 0 t K D R 47 o q m f W q B S k H l A L 3 Q f O w Q J V Q u 90 c I X B l V p r u i f Z L W S N e 5 o G E R S n a W j O H i o P U 3 S b V 5 Z 3 k a f d 2 R W F o / R V X 0 u v 5 t T C J w 8 Q d t j J Z G H 4 p 0 y s N U K e q E 7 / n y K r Z u d 8 Z i 0 9
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-22T21:03:58Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0b152-5c98-4557-8fc2-435b950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T21:04:18.000Z" ,
"modified" : "2020-04-22T21:04:18.000Z" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' 1 d 6869199813 a 9090478312 c 2 e c 13 e c 9 ' A N D f i l e : h a s h e s . S H A 1 = ' 0 11e7948 d c 760e8 c 4 d 5 f 7 a 41 b b 0 37e9 c a b c 1e262 ' A N D f i l e : h a s h e s . S H A 256 = ' d 2 a c 48 b a 8 a 476 c d 6166 a 0 c 35 e b e 276 d 136 b 1 b 82e865560 b 2564 f 39 b 5 c 7 f 3 a 3 a 9 ' A N D f i l e : n a m e = ' a r t c . d l l ' A N D f i l e : s i z e = ' 372736 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A I m o l l B 0 H 63 k p M o C A A C w B Q A g A B w A M W Q 2 O D Y 5 M T k 5 O D E z Y T k w O T A 0 N z g z M T J j M m V j M T N l Y z l V V A k A A 1 K x o F 5 S s a B e d X g L A A E E I Q A A A A Q h A A A A e t 5 M 4 U o X l 6 Q g u 0 8 y A 3 l Y x O 4 i Z u R k D 7 y A Z u X F g 38 J W b 4 y F N G 1 c f 3 d h z U H R O x 0 x S o 5 G X 3 L 7 o Z K a 44 I 2 K + y r 7 M Q S U C x c f x 3 C x Y M j o a g i y k B e O K 7 Z W 7 F P 19 H C v j P N p s O l m K 4 d B t y I g n M T B B J y q N h 9 A w K L 6 p w G h a K b L 4 B Y i 4 o b 5 W v h A O X Z D e Q F D J I O 73 u z a 3 E H / 1 i W j U j + u 3 b B b 6 k S w D z N I w I 21 e i H a M d V 4 J T R p z R / 5 f t X f P S Q b P c g W j U F H J K f z / g 2 x W u e H 4 d L J I g G I O X I S i f d s q P k 3 d a m g H r u i u 4 Q S s g G k D E L 7 e x 7 a l 0 k V D F g Z R U g A j Y 2 P e 1 v y + o Z U 72 U R 3 S 9 V z I Z h M T L H R D 5 K O D D u N Z x H 0 e R S B k N I 0 N q E z Y g 0 w r m l 9 C k c h g K V M 2E6 / j A Y 328 w I l q F 8 s 0 d E x f L l e c J U 4 C q E L e e P W T s 4 F + C l i t y 0 Z j I 8 W W D t b z z W i 37 L g O g 4 g E Y T M f o o F a z X 1 a 2 b x g P U n T M + t Y R y f W 4 P W L p 7 O A L c / B U e V v N j V 82 j k M 2 b i D K w L m h G 1 B h A r J A b / q J e M O 5 a i K + m l g P 1 T r + 4 i T M o d 3 k I p F 2 S 0 e f a G f C R Z J E V v p b 1 T Q R e b H d E + 247 m O 0 h X S V d 1 Z b t m q A 4 u k U W s T 1 n F u 0 a q j A g x 1E2 x a j L N z j F Z w C m Z u k K h x 3 S / e X Z 8 J 21 V s L O b k y y 5 k Z f Z S W c Z C D B k m + g r K 13 d K P f F x A B a Q F O 6 H v t U e p D S R p s o 158 M l Z G H k L r g c I q l G p X o H i B 3 N L b e A N x Y 28 Q H L O i Q b k 0 b C C l / T y V o B m p h l c 0 Z Q S H Q G 7 n h V r V c 7 s h d O v S + U q Z h o b j 51 l r o 3865 O s p R M K 5 U n U 5 F P 7 a a m j D 4 C 51 t x A R D y + u A P 5 I 0 q h y g v / N m K H E j C D q f P V L + 6 + U z 79 r P q O R 47 p d A u v i s 6 K E R R H t t H q I d e I h a M e Z 3 x b 6 k O h 98 n f / o U y I Q i 7 c Y B V 3 s y 3 a 3E94 Z b U w W 7 T V A X k z C W w i Y m q a c J 4 t f Q 2 k o d x c I G q O E Y 0 x e Y p B h H / N p B O 5 p f Q E h n a r G Q H m R W H D 2 H F L 9 y f 3 U g 4 K M 4 S x c E 5 r 4 p i E d P o 72 X k 6 t u 1 E / W H 7 D I I i y 9 W p r S 0 r r 6 Q M d s q h R g e / a F p x + t 6 t a + Q s t I z h k 3 W N N k u o F 8 b 8 l l U m A A G r G t h I + a m Y z r o 0 d A z D W J B r 2 D W x 3 j P I J I v q s U A J H a M V j 0 5 z C H h / g S m t j d i P 3 w t 2 X t K d h n 3 M q v n q s D Q a + F a h h B M I s f 44 U 5 y H 5 O X + E q q F 3 + A 5 Q j f z D j h L O N O B p b u G s 45 s D F c d t y b A N h d C l R H h z Y 1 j u G 0 u K Z 95 E r Z U s V k e G f a e p V l J y H 4 R s / A 2 f M Z B n 53 P P R w z 9 f t h q z U m X w h c Y 4 L U k u N l u k L 9 S b 4 P y d F T l W N O S g 8 V T D q C h k o e y b K + C q v 85 r W k q Q V G k 0 X 6 n m 1 F V X q h u f n / 4 H X f G F L f I 7 N e G Y x 4 a r 6 y Q J r H F X V j 7 U 0 C Y 3 g H U s k J r D 2 i m q 8 C M Z A O g / 1 A l T 4 D q E W m 3 Q 696 C Y O z X s n x R j 24 f c a b S I j L x v 0 k g 2 K b 8 W V 4 Q s + g P T k x + F a i e c P 8 w 8 F E w s y A C 5 J M 2 s S S j v 9 x C D J c 8 u S Z 51 u H 0 n / C 6 T d c T C r K U g V 80 n L K n T Y 5 i 9 / S Z u 4 / L d U C M 1 K n 4 Y s D J g k u 3 v t u a C P + V 6 u + 6 l U K I A 2 j p t A f g C o d N h 1 a p d b M 4 O 0 g e U 7 y 7 G h l o U S 0 y i Y n u J 4 + P j D L + t J / S v u T 0 s l W D p r k 7 c s Z R S T O 5 c F X o j 4 K U k o d / A o s p d Y b 76 f d f x Q n J Z F o x G 8 q 89 c m i g x C d + w s B x R Z K r w w X S x B R k k W H / v F Y + b R J 5 u r O y Z f t U / M E + Z U Y 9 i W n a V i 7 e J P W M B N o Y Z J n J S H n N Z 5 h u g j c m m h q 40 I A X F J S a e k F 1 J 707 R 7 u I b v 0 e c 89 X H g 2 e s k D / A Y 2 U e 4 S C Q t m C u j 5 g w F B f X K q H M 61 w s k s 9 N Q G a 6 j E 1 l 3 D w L v 3 f 0 I L i 3 G C R n p h 2 N m j 4 w W P D f x p i O l w C 0 V / a F 64 t X e 0 B k I Q P G y t b 6 + M e p 0 2 x s A 1 Y G p E C i x M a H k n L Z n E T f 4 Y b 8 n o r z l M s v i 54 R O H n U b 3 y x T 3 / z 6 P x q o + k x i K R F 4 + / n S j V W k v X s R p Z B 4 L d A 5 o A E V 5 Y Q G g Y b O a n D e o U f 0 / Y J 6 i 2 O H 3 Z P T g J S A 21 p v 67 v I e A L 7 V m Q P u V + o O W q / 4 n n D R + 5 n l a 4 V w A 1 G a a 9 R a n k 8 O e Z D N u n Q V M Z 8 z T Z A L B x E S V F j W a N X 8 V o j k + J 4 H s i m 25 S T Q V //fPeYgo6w8R4Al6OSWGAq5CFOBj2L1ubZMBtQXGsp8rnDrvSZWtws88vV8gZCsryQ65sf1QOGtLnaRdK9F1eGzZKujV+WINZVSoyXcsjy7Lz7+F17V/37J/+HlRF1F9rP+cboaxq2M7z2RoAUZ680k2b3TMZZsIvkCMm4l0dJDHQO1NLLqfScJMv/HhvRtqxbOjf3rgVLBcF/PScCNepNcywICrWE9oWmkKykpyHEZIdKilB9PpIxdISlA42UqOU43g9nwbZtyWQ+1IPxg3xAM9LyJu8XX878q8gnCBVH3hA/eIBwATC2FtXHm9A2qR64AFw5cKMgfocl2xVA+P3+cvY6scHCwb78CPvY7uQn8oIfHYLFJa5F3aSaa8X9UF523UNQ4iMS8SjM+6gOLNnQT7yCmJLPM1j/xjzcXtPU3dJk9XOnQJyk6OR37mMCm+NLgwxFgKi6lupdGxenJa0j955AMznYAU0WZOteWethRpjb5/jpdszlNubuKCglFJqVwncAuYAZfRrrQp9tOtXIlq17cn0U//mST0kfUXlCJRjTBY1fFHbvwkVdyDVB4dFlNYRIkddxIVuUdTcif+++zbQc47/bbLofIhRmucV3BJ9eMZxK0MnkkFqikHJIzRZkZbb/8U/JFQkg9D09nnmZiYypL4Gvp6bp4bKav2OWRAXeGW58L2irW9dCbOlr1ESGyjmEh7OsgN7TxbEE7vbce1Qe1s7uXqAmIExkCr3j9Z5r7cywTJXBDgZ9cGEYQi7v2vMZccpRK+hOIEUM5pEjOJHIOk6nohiykbLagqgCeVbdqnf3CTanxj6vVTVH7897/5EMB4JhuejtIOtB9AtEG5fJsCBZone2MRAC9CowHNBb+O8UrNotd9EQdzYD8i6vqWJiXhZiKppHqG/Ds0+z+H5r71nfP1MIrmk4A80ixLUKtUKWigpxwc/8Ue6pfLeo+Dhs4r6Ez0gkIdH95ptEGQMslqyJ3qoFGpBfaKCIkh2ccgyZA2R6USb3dpnXHRy7SSnMHkv3gdoKAdXkaE2U2Dc6UxTMIhTjgpieKFPkJ6ArO4GIk0WflO38+nR+1d/rb0hQ8bG5E/qQmosUyXY+GP4hTUak1PVP+jFOWeegM+QZBWnMYSfhooLrwyjiUNwY3qe3SuyonpfGBk7bVZ41ur1uhX6bz/uJj5sLaLeJZrn5AL85TgmagTrrBV7s+kVghSE+sSdbaJDIDrIq6Xw94A/EmfK+nKKmrewPZCY4AVnk8oZ3LUfpMBgmTcGJYZw988l1n5BIvP+qbAVnClIb3Uns9S7M8bNKC5jEsvj2a4j0de/mPywoHUw2Xa7gR9JD8u7ioz9iu5rCnRvERL0B+P2JpVD9VVvFxa7ZdKqSOWCResxZJB9+UJotPrmMP9sCrLGnQ2NCm1OaNdi+05p9g68+I3wgH3xJnVS6N8SoGxleiHqu8W9pBJxVHUBKJ2EbUrH3INshcdHWR0HSsixwkj6UQBGBXthFCd1eAxBrFUn9nKXGppM+K+
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-22T21:04:18Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0b1cc-e7e0-4612-bcfc-4c33950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T21:06:20.000Z" ,
"modified" : "2020-04-22T21:06:20.000Z" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' f c 22 d 0 c 3 f 15 c 763 c c f 1 a 5 f 56 f 35 b 795 f ' A N D f i l e : h a s h e s . S H A 1 = ' 284 a f d a 4 c e d a 3880864 b f 692 f 153 a b 0 354 c a 7359 ' A N D f i l e : h a s h e s . S H A 256 = ' 0 8 f 3 b 51 c 8493 c 5 e d 8948 a b 35 c 956 a 465e0043094248 d 2 f 27 a 5 d 8 f a 9 a 696e3 c b f ' A N D f i l e : n a m e = ' l d r . e x e ' A N D f i l e : s i z e = ' 387072 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A M q o l l C v t l + / M O Y B A A D o B Q A g A B w A Z m M y M m Q w Y z N m M T V j N z Y z Y 2 N m M W E 1 Z j U 2 Z j M 1 Y j c 5 N W Z V V A k A A 8 y x o F 7 M s a B e d X g L A A E E I Q A A A A Q h A A A A + q 8 c I I t o 5 s Y f S W B d 48 F F 5 v F g d r p i i T D B R c h S u u L G K V l 6 m 8 r P z a S 7 A W 8 L y z O N y 9 a K N G 2 M U S v i V 5 w z l w a m t e 56 F / a 3 e I p X G E W 8 r y k L W I E H p 1 f h e s y 9 J 0 d i T y M 57 d p R 0 I W 90 W g Y m 5 e i B n n l + g N E G e V n E i r 1 G + 0 V J w U C b f h 31 K W 7 s x H 3 x c C F e w K e Q Z k a a X 8 S 1 a 4 d J 1 z f B L 4 H g N 4 f K I L 5 h s 43 n Z 3 Y T Z 1 w K r + P u j 7 s R f W w l R v p i D u i I H V 7 i k L 376 w s H A 7 k 7 v T f T G g w 11 K M O P t 9 B k I I q a H g p w 1 I K 51 X Y x d w L b g O X w D F s 7 D b R f j A B 6 L 6 n 93 P e 8 n X p f f U Z v G E H 4 h t j X N 2 H M M + R X 5 h 7 I q 38 g 38 I z z k p b t r L d x w K 9 E E F H O U 2 W S c 8 y J w p k g 9 c B o D B 9 c o V 675 y Z 1 y R p x x a 0 I K P z 8 h 3 D G / E + E 8 l 8 j B m R T C 0 D P v y X T q R P G r d a T 5 c Y h 2 k k R p u G Q S J f H 6 V K Y z z p 0 a / z D r w 666 D Q G J M 8 F B 81 D K 0 x r l Z D Y B l y L 9 h Z h v F t e k 9 f R X E 9 i E N u H 4 w X 6 D t 7 K j R Z M i G Z M W N v K 4 N K l U c w h B r L w 0 S 73 g 0 F J p h R l / g o x D S V j c G u 4 g 0 X q b c r l 4 Q O e R 8 k Q i h W n E G h y D G O / 7 b k U L / G / P q n n S e 7 J i z b O A 1 t A x 9 h Z F + A B l k G k o v W S Z 6 C 9 u x u g w 5 M f v q G O 9 + d 9 V N R G I k Z I f R d A v R y 8 A G / k w Y l l d / n 3 F a w T K h B q t e W X i 4 r U x L r Y w g L H b p i a 7 Y w b J x a l 6 r V / M V w Z Q + r S K 5 q / Z j o D l b w Z o H 6 P l a U n A v D t 9 Z S M 25 k / s a o H C k 9327 t 5 f M I m / 2 K U e l O d P w Y / x p t p b r n s + V 0 B L x 9 v M s E m T m 4 y Q I R z n n A t g e 25 T 9 R 0 27 M C k Z / F G H W w X Z 85 a t V 0 5 n L L F 2 T G V 2 g G y c Y y e f p I y 1 d k 94 z d T 9 W N 0 K F v d m l 5 q A 15 c z g e + o w g z 6 H Q Y n o z T p P t f A / M l b 94 W J u 0 Z p r K K Z u K 2 h W S g E M t i u c Y H n J W P 5 Z u t i U p / 19 Y z B T W p g y t H r N G J r 3 T q i k s 6 x E 2 A 47 C x O + M o 6 w a X V 2 I A z n R 0 32 g + / k T + F k N T 1 u j i m k 6 R j g 3 n o w D d P K X l e o Q i D p i 2 r 2 y G y P B q G u c P A t E F z 7 B a O H c 3 m U S A H N p d o 5 e e O 9 f w 6 w C o K o 621 N / h Y H 1 n r A p p 2 w J 5 b s L E + i T 0 l I f L 8 q 0 5 u h / J H + i w 6 N U m f Z W G Z t 3 n b d A Y + l B k + O t P y D Q 0 Q M F a i x b B U 0 26 / e W y t x 1 u S 27 I d 5 v e Z 3 F m b V u h b 9 + 8 c B E q f D i a m i T f 48 C r V T x e d n 41 E a i h 6 l L 6 l O 88 t 20 R K U P v R 8 L 0 4 Y r y R m c 0 H B v s r D M p q F 0 J w w v x b c V 7 z R l 2 U a D 3 O o e 1 K Q H t x f s y C v k t C 0 0 7 Q m A T 5 B y u I T z w k U D o z 2 s 2 J c T U f C z h o P v x V e D H V 9 E n E 3 N E 4 a 4 L o 6 Q w 7 s K r f c H p o l r 9 d l N j a / m N x 8 L K C i S M K N m x a q Y + U 7 w 6 d n 6 Y I M b W Z J F t G Q h H u n V / I W G a D k j 4 Z r R X j D 5 t x C 3 H L P w j 5 H A R y N h k p 3 t J 3 k N h o n c r c I G c h r p b z R O M q n C h o M 75 T r b l m h X B e h K I z 9 f / y D d V 3 l 6 h B g t m B Z Q 4 V L b J v g G 9 T R F Z s z X T 8 n m L P b Y 2 q 8 X P j U 1 d U G 99 g 7 b f 4 x d 3 S V 1 i i z M g 3 M B m 5 j W f 13 Q J Y e 3 x E 49 S e R f / o w 8 P U j 2 o 18 J x / H 4 g I Q q c O m 7 Z t A U f V E X C H G q M / J C 9 T w O O q v L G 2 H 1 U Z G G S B B l W T U v 4 V x B t R J 2 Z N j q 1 y O B / T T y H B P j a 0 U 7 O O v d e I / X R y 8 n b 3 W A 0 8 C 7 M 3 W N O T f 0 e M t 5 v k a 7 p h M N I B g X I J P h h p P L D k O t L s T W j s Z I d h Q Y 4360 m i W P q N o I w 5 D g 1 Z D m t o c P B j d x d C b M B 75 B a Q + v t m h E X p S V D G p D b O G p R U 1 O N t C 5 A 7 e / o 2 h n h e 1 D v 0 5 + s p D o W / k 5 O x M i F w e T h Y p N G 2 u 9 x b e u Z 5 h c W I E j z v 4 R m P l Z l O 2 z z v S H d 0 30 X Q k s P A Z z t K u P i E i m P A 4 m g P 8 h p d K E S U c v 0 O p C m 0 c 7 v m s U b y X k 18 E n I h h + G p N I z l k / B 83 s 7 U Q 9 M h F p E j L n t 4 X V u F I g O 5 E l 5 s O D u K O 1 Q t y C S o 0 E c 6 k p g y e A S J G V o l t o t J K D M M d F N 2 j g 1 f w i u A u y P c X 1 t 6 B u m 92 S I A o l v 5 s 8 i 7 c e a + u h Y v o f t Q t B c m a 3 I j x s e 5 N 9 g 98 A a X W L G y A 0 2 Y 6 B g F D m J O O L C n r t Z u l r 3 Z d q X o S M l / + 5 b + k + J g W K 1 M X J r t 9 f I s B v 55 s h / V U / X 5 A x L c Y 3 + A 6 y w 3 w b W y z b 7 d p l o w V W N O l R s k R s 5 L w j 7 a G A 8 q e G H 0 m 8 T d g y E h s D q G i l G h / R F J D 6 + D b / C 4 H F 4 s u X v j X T F E 1 H 2 x V b p 4 x g p M e i Y O C T B v p r z 5 Y j M l 1 H J g 9 p G Z l V s e 5 H E 1 h J P B r y s N O e o s y Q k p S 5 C 6 s R 8 f m p N b n / T Q U W P + x Y v N w k 1 Y P 94 j k J / S l S H d L x K 4 U z W K j Z o 4 C i Q e J l r X d 0 26 z o p L 0 H 67 t U V Y 4 o h P / b X Q e v U i U o 6 J d W R 34 a y 6 t G P R 3 p l c K W O N j Q w 15 + 2 G c C C j u p w c H p v H r h i b T w I q e M J b 7 Z V B B y s o b N 7 G b U I d J p F d l b k d H P k N f 12 k K X I 7 w Z X O O 307 q m v C Q T O Y E N e L p J V s x k O t f 2 I o q M 9 N M G d A i m y 4 D a 4 z I l B M w G K s i B i l w D s f 8 i H K H l U L A Q q / p A B R V q 6 c P q n q e Q I C f 0 O + u Z K j H w l 4 k p Z K b N T e q I b y 38 L f p U 0 L 1 h T R + c I F Q b N A + u / e O N W R c E W I I V 6 g f G B S f k / w q S Z O 6 s 5 p 0 g I L 9 n f r P g y 5 a M 5 A E s o N t T I c G F F A z Z 5 a p r P u H N t s D X i 6 V X v I F p 48 X 4 N r g n Y A A A F q C j G w U 5 A Y E V 4 Q M D A z f 3 Y F G w L 3 Q S 1 t U g s Y 1 S U 0 v Q H A W W 2 Z 5 / X O t J V E B 8 r U q m d e p V V w c b 5 T C 6 f V J 30 u e P B d q c M s 6 K b 9 D K k 3 d y D u V k Z i w w r S E z w T j x u 3 + 41 / L O J W V E 8 f e G h 4 d Z S k a B l P Z G Y + y c y 8 Q x b I 35 Y c P K G y q 67 Q 5 y 1 v a K r 9 / v q 0 8 j y V k z Q l N q f e / L R E I H J h A J h l g P 316 J J x m N A r g x w J m x x n q z 3 k S 26 J T 4 E M + I Y M F Z J 0 J M G o P P 2 n C 9 h d r 528 f l c / b B l c D C e n Z x s 2 K E C 7 F F N A / y w A U x B V i S Y 8 j I v + K 45 L 2 Y B I S L c w d E X k U t u r 8 T 4 Z + A N F K C q X Z p 5 Z Y P 5 c / U S t L S l P E p i l 3 f u d e D v 3 Z 0 C 2 P i + 42 z R Z H r y 7 l B t / 8 d X H L C M Q V x G V V J 9 / N G A U T C d r L Z 12 M / h d w 7 x c u Y n d C 8 Y M q V G p Q A I W n z A / j b H 31 p u l v 3 d s G w z C W U f U s A q z F 3 + l c Q O d f d j f s o 1 I q u k S 3 G 2 Y B e R X g g 7 r 3 Z 0 b a s j H Q P 2 i o 44 s z k X y 8 j L 5 y O v M c m W p 5 J R C / Y a 9 j W I l Q s R R b A j v w b 5 c G 53 V C H Q D Y W a g J s s 5e76 O U u 5 Y l d O i Q L 4 d x a e A L s p j C o V n v z z P g t D 5 B b 7 m 0 M 8 Z M / B 9 j H X r 1 z 4 O N U c j i e Z j 4 t l D p N 0 a y u e f U R M 1 B K e b t T x w A m p 4 E T w h / l E n d z h h Z l 1 a i Y c T E e U 3 N p z / o o i V i X 4 P + H k x c 0 R P J W 6 S F w H o c P A i U d O j E C E w F t y L S 6 y Y S 9 u k K B P m 2 T w 5 c l 8 G 6 q F P 17 E N f R j r G q F p V k Y y u x 68 M a T m 0 9 E t G + l m 4 i E 8 I K g u n D t 4 m / t l I o T v V q X s u 9 o A N X k S 6 y u e / K B r c C k g R R F H 353 d / H q h f 1 A 1 h N W B q a K 6 w u m + v p a 6 + a T r D d o L C G x b 5 S g U W 3 b A H X F a p K f Y c m 7 a e h W B P 7 y e L y a o y w O X V I d K K g 1 Q b A 2 D t n 9 X u w J O i Q Q i o 9 v W g 4 d d k z
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-22T21:06:20Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0b1e5-1dd0-45f4-a7ec-46d6950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T21:06:45.000Z" ,
"modified" : "2020-04-22T21:06:45.000Z" ,
"pattern" : "[file:hashes.MD5 = '009b53fffb404e7b0dd1479617e967b9' AND file:hashes.SHA1 = '742d5399415e96bfe1a2dfd9af3b9e3cb8d8000c' AND file:hashes.SHA256 = '915ff83ab8e1a4ad1e9e63ea84bab24e36b88f9264c42085569786079232ff75' AND file:name = 'Authtdvr.ps1' AND file:size = '145' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIANeollALrJdUkQAAAJEAAAAgABwAMDA5YjUzZmZmYjQwNGU3YjBkZDE0Nzk2MTdlOTY3YjlVVAkAA+WxoF7lsaBedXgLAAEEIQAAAAQhAAAA5DVZcCdPKxfpEPkX6RausqwihySatiBEByVhoWyiljpElg12JX9PcZbal+EA2aFZPamXpqZ1N+lxtjBTaRSEjlnltgBXsTUjLA7qqhxtKkBAe7op4DTCI+JWeIiNszPfMDzOarB/BJwtc0t2PsT8+BrTYkPx1wOBh4c12n+AReGI+SiG+vCb1qtwSyoHPNhQuVBLBwgLrJdUkQAAAJEAAABQSwMECgAJAAAA16iWUKL1JQ8YAAAADAAAAC0AHAAwMDliNTNmZmZiNDA0ZTdiMGRkMTQ3OTYxN2U5NjdiOS5maWxlbmFtZS50eHRVVAkAA+WxoF7lsaBedXgLAAEEIQAAAAQhAAAATVezZiSCLZLdoVu0DjK1fNXqX9+mCHW3UEsHCKL1JQ8YAAAADAAAAFBLAQIeAxQACQAIANeollALrJdUkQAAAJEAAAAgABgAAAAAAAEAAACkgQAAAAAwMDliNTNmZmZiNDA0ZTdiMGRkMTQ3OTYxN2U5NjdiOVVUBQAD5bGgXnV4CwABBCEAAAAEIQAAAFBLAQIeAwoACQAAANeollCi9SUPGAAAAAwAAAAtABgAAAAAAAEAAACkgfsAAAAwMDliNTNmZmZiNDA0ZTdiMGRkMTQ3OTYxN2U5NjdiOS5maWxlbmFtZS50eHRVVAUAA+WxoF51eAsAAQQhAAAABCEAAABQSwUGAAAAAAIAAgDZAAAAigEAAAAA' AND file:content_ref.x_misp_filename = 'Authtdvr.ps1' AND file:content_ref.hashes.MD5 = '009b53fffb404e7b0dd1479617e967b9' AND file:content_ref.mime_type = 'application/zip' AND file:content_ref.encryption_algorithm = 'mime-type-indicated' AND file:content_ref.decryption_key = 'infected')]" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-22T21:06:45Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0b202-5a8c-4ab3-91da-40d5950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T21:07:14.000Z" ,
"modified" : "2020-04-22T21:07:14.000Z" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' 897 b 0 7 f e e b 22 f 8 d e 7378740 c 33052 f 1 c ' A N D f i l e : h a s h e s . S H A 1 = ' e 75260 f 9347068 d 26714 f 99719 b 5e65 d 7316 f 5e7 ' A N D f i l e : h a s h e s . S H A 256 = ' a 59 d 6490e8 b b 757 d 0 8 a e 3e0 e 800 c c 8 b 1 b 3 d 90 b 960e10 d 6 c a 46166 a 450111505 a ' A N D f i l e : n a m e = ' p e u h o p 32 . e x e ' A N D f i l e : s i z e = ' 382464 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A O e o l l B N + Y g 6 T d M B A A D W B Q A g A B w A O D k 3 Y j A 3 Z m V l Y j I y Z j h k Z T c z N z g 3 N D B j M z M w N T J m M W N V V A k A A w K y o F 4 C s q B e d X g L A A E E I Q A A A A Q h A A A A c Q r 3 L f h k M K h c i t D h e m R y a j B L N O I m N q s t 23 m L d 6 C o R 5 B s x j + q p t 1 l w P 0 S I Y G S 9 A / i b j v p o u T v 9 m 2 d e 8 t k v r 6 K P b k r 7 j p c T 25 R 0 a b m R B U 3 L 8 R A o a u h s a 8 o F G Z N A D L 9 O 3 s 9 S / S n c 9 L A l U 8 I P U k f 3 s T N 0 m i T 0 + r m J X V 1 Y T T k F O x K 2 S 4 B T 5 c d 62 T u U 7 S 2 T Z U X 3 h D Z q B m A V b z c r V z E l P Z y F c d z w 8 c / 9 h w / g A T y K L r u e o 5 d E V k W v z I t V E S j L m R G D 8 G e W C Q i B l 1 X Q a r w p P F 4 h Z g O 9 l H N b q A R H 78 W B 24 O u F x J N l y w n H B 0 Q / F f 9 Q H N S z 3 F H n 0 l o y + K s B M W I c c H B V a V p K 4 c w 0 5 j u f 0 R k G d s 2 p E 5 Y Q / s g + A 5 l F Q c t x 8 e H j N H Z Z n U e K J e X / R v n i C Q o C 3 s k v / B N z 3 j T p T n e N p w w S b v / f 2 w C B a y L x J O D E I Q 72 G I 1 z 6 k e p I b g t B w j Y z d / X Q X e B z 8 i v e D l v w n B z a + N i G 4 J y v 7 q N t n F u D P Y r R M 0 B G L 5 Q T 7 p P 8 S D / u + J I T 7 + M a T g I T 81 k T p 5 R V 6 X d X X O U k D 3 b V U + I A r T g g D m 8 j n y K V 9 i A 8 G D d s v 1 N w Y t c i 1 A 41 U 0 b z 5 W Y s v x K F w w i h 6 G H q 3 X b q m b F I Z F 7 c n R H O E M c g M v O W M D Q F + I Z 60 l W D l 6 + k t H / W 3 I W Z F c W r C N 3 m O z 627 d R 66 r 7 M j P a y i q m d s y a N u j F I f r U 4 G 7 O T p G K F S w / k 8 B m m b L O m + v z G + 1 R F m R u s l y u i J z Z T s Q g 5 j J t z z p x R C a b d q l U 7 I p y A a b 2 m t o V c r H y w E m D 67 s T S 9 B o j R W u S y G v j H A 6 m / 9 l 1 d B H M W Y H 2 f n O z V Z v 8 e Z z S r Q K d + U 24 d W k w D F G b f 97 + L H y X Q V s f t 2 L Z z Y a 3 q x C f 7 k X d i A Q w T V g 8 w l R x t g U J a 7 Z 9 c V e L l O e B e T S f J e t Y D C v g o Y z W P S 36 + + A X q g V r 67 r E B j y + w J T q e v K s a C C Y v s E m C o c L s A + D T k L F 34 P + 6 V q M i t w 84e6 Q F h T P Y 31 H e l 0 E P A F + D y y F E D 9 B 4 G e S o M F z q J C T f d T A n C 5 b V l 2 q r C M M G V U O L 7 U d 5 b I N n 4 Z d A k H q m l L A f R r D q o Y 6 Q L N 9 / 8 U G m T x 8 q C G j G G R W x M 2 + f D W / e N H + b 4 t A J m S 5 Y Y 7 V 76 U X X f E 9 m / x f u 8 U U e G R 0 V t B a R l v 2 U V / t M M L M 8 / a l 0 p m r h s 8 U 3 b 2 f 0 z S Q i h Q e V + s d 8 I G S 3 + E n R r r Z A j a 1 h o / p s o + c g z w z C q m k h 0 M g D B F B d Y Q c U 4 b J s c b H U O v S b P g T o C 6 w q E s D 3 U L F Z E B P p k N M T Q H J 5 j T b P E s M M 7 r 4 W 0 S f h o b / Q T r X 5 Y j g r j I b S A j C c D C o F E 3 Q P m E g z P N K 2 H y O / k 26 f 5 a Q I M 9 p t E m 8 t G G e S 8 y b v g 8 g 2 V n E 8 K v q p J 77 D Z d f b U E X u h i E w G f W F J C H w j F R p R 8 u V E I p U C p 1 c C E 21 Q x d 1 h Q 3 X 5 V A T w Y q m y v M S r 4 e g c Q X y h t / S k p R v 4 f q e 7 q 6 f s A G u q x a O b Q D q E 6 r q e Y H Z h z t N v 3 J V D O H c N + f s g u v N + z O b a Q P V h L q L Y P F r b a 3 L k i w U j 7 H V 9 / v 68 m d w p V Z R O f A d R H t g f n 3 d Q j 7 b K I m f K r v O Z q x 7 P C h u w 85 o S q M a A 9 x J 0 L g f u X C Q B G N c b D N s d j A X V m N P f a M 0 i a R f e b k t c K Q a d S L S 29 F 4 L l M R 2 + + Q 74 T j 6 j x v q M E H F E b V m w Q k Z r 2 E r S y i J + 9 d 5 h t t p U F q T N G H S z l Q s e 4 k 2 S 7 u r 4 J i S L R l + E 6 e z 4 c d O Z H 1 k U r 5 t i 9 q i r S U V u O X 4 c d r T 5 I B C G A 74 F m 3 v m W Q g L q k a C m t t F 2 O 0 N q M W t A u + N 0 W I B i w Z 9 E V / s y l e 3 J j S m 5 U B l K S r p / q 3 g X R 0 j q T k P B d O f i K 5 p c B 2 p T r g n s z K R i g b D c A b G t b M 32 n E d 2 I U S / H w L x v V w y P Z i q U t G b s m 8 R v 9 z p h 5 y s g A u q v A 6 C S 2 L v S n 7 s U P 0 I c t R x r c C T V O L s s H B S p d s z M y k l r u x b e X r r p G 4 N q i 5 I R c v R R / g 5 U R v 8 R O l s b P 8 d E 1 x a Y R z r V s V m S K R I 6 Y r D I I Z k D j H I J 8 X R c 5 F H Z + h 83 x j o X v v + v N z m x B t Y W Q u t U e R M / F Y q Q c 2 B W Z l L b p H g r a D H e P X y Y r e g I 4 H v Y 3 t 42 R 428 + E 43 c 7 U j W 6 U G + + o u 1 m b 0 A K x 6 r B 4 a J 1 h S L Q G w R e I a Y d L U B G a N R A l U L S q X v c U t S B n k u V N p 4 h / C 8 E h a I 9 G 7 w O S 41 X X A X g Y j f f 7 G q M p P E U j n n x h n 9 b R H W 9 z 8 E W l Y 84 f B x J P 2 i A y 3 e q / j t / E Q c P 9 i 5 W b j L d z R 78 T k H y b V S V e q d t f U z Z d j / Q q q X d V i 0 q 7 m / F n n h 2 L q 7 Q r q R 2 N K o P l O 0 q W H E r J S V z M d M o f o I E f L t J Z X I x w R 7 Q o h M 8 M 1 y b Q s M K 0 w R R m P O x a V Z K Q 3 L e 89 G y / j S n g 9 o P W y V E u I 3 G s h Q 0 s J N i 95 m W K B F e / a f P g Q n P d i k D K n O S 85 c z t D v F 7 e s h t E x c o 1 u F l 2 J N b E 5 q m y F d l z h f 2 y a F K I P 2 P C I f K 9 b E O q X D o k b S M t 2 a / Q D E o h e 1 G R + R 5 j W C q g h H 2 d d g 4 H o a v Y H d r s w X u 0 z 5 D Y c c z w 2 n G g G B E n r i b X d L a U c v 78 u q j r P U J a z 6 B w d c F 6 H a T 9 s E Y d X J U 2 C w c W y 3 s d U h L Q + + 6 y i O q 1 a s K 5 Z + G I k Y U 7 N 4 N r O h A K J h 2 U 8 Z j L g C W J 3 M K e a S Y W 1 V / M y Y C F d u C g X U R a 8 p c 1 I g n q g 2 W v n f l I 98 / k E / + 4 h 3 N e w G a E l I r D 4 V I C Y q A n G + Z Z r e V d y j c W z m H p 99 Z m 2 G E a N o W 3 F i O G C V e y e k z t q s 0 n + c b W P 0 8 W 7 r y 6 c 6 X p M l k / o z Q y e 9 P p H 9 f s D W X A M U / e c m W B a u 3 Y T g j 91 O m 4 J t Y r O x m k H u u Y w b + F V V v 98 X Y t I o o d W v e + J K D S t j V Q p 417 r U L t l d H p 17 L H B 0 2 I 6 B 37 O c l c a m H 3 H m o Z z 6 k v 8 d F O V n q 8 U i 3 N u j N E P s d a Z / E 8 C / K j I 4 b Q s E I p q w 7 J Y O d 0 S A f u q 9 e q A X j C o K D 6 U x 6 r r D s T H J 0 1 X d 8 D A 1 s / W K z u W C K E U 7 A y h X W p z V f / X v 0 L M J F v t y V M U K n t h j a L 0 / q A 6 l 7 //HblgGAKDgQf/mKLPzRnD4AZaHwjuqldJXTNSAJUeVdrT8RUVHECGJM+iBEYehWYhD1STSM+ZBD21xnOpT849ufF91wgnlxKjPexGM9bGGvHX/ZZG/mu2R0AHDpeDY24LlK8te1mS/pHYhz4KmSZj+fhU1ExL4MN/Cgsz5Vnz3GY/COIe8glNe45n+p6NMkqOTkFYPdP/hvIayM45cE08LJR5LVy28JJXypCMDry5hKn0aPdXFjbMuybmUE4DzxmOt9H05Knf0CK/h7nudpJODd8MvrYj8SRIG9f9/uSI8tkg9lpjTLOQs9WBub3Kmj/RHH9OtsZc9cfXxhvuLsU3vHOIYDs3xEPfPzNRjx2QwMxpzgEjmKPH2flLpXUpHneCsHNx4/gJz+Vs119wkr9s2/qvF00YlfN52ePOIaxM2u3qY0uebc209NTlptMjHVaVzRsE5WKEaTaGKCaZjV0Rw0IDJVk6us/RWnUvBLdg1ueuJ8UG8XQSTfHjvsviNjBDs7BIqUAfvP6WY/t6hEm8xPgYkn2RownrrW3rHws9hshXHWY7fWuaREEHPkg4Nh8AF12e0s+HxwFL2QomryRFFr2KS/Lc7pKkHCHhwBuRdw+1KMzgmM9rlMNjx41VUMziyK1ysJschs+2Qo3xx+xMf48RCj5DLSV3M5mWxu1yv+X9Ji59zo6NvNDjLyQF+VhrVMj+/NB/m844+VzbXpdr3
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-22T21:07:14Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0b220-0a78-43c7-9f35-4e45950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T21:07:44.000Z" ,
"modified" : "2020-04-22T21:07:44.000Z" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' 334 f c 19e4 c 1358 d 0 979 c 0 a 74 a 321278 e ' A N D f i l e : h a s h e s . S H A 1 = ' a e d 74 c b b a 6 a 3 d a 72 d 16 a 205 b 2893865 e d d c 2e936 ' A N D f i l e : h a s h e s . S H A 256 = ' 28 b 935 b a 6987 b 2784 a 654951 d 304 f f 2e86367 b 0 64 d 1 a 9201215892 f e 547 b 0 d 9 a ' A N D f i l e : n a m e = ' n w w . d l l ' A N D f i l e : s i z e = ' 185344 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A P a o l l D v C I W q g Z E B A A D U A g A g A B w A M z M 0 Z m M x O W U 0 Y z E z N T h k M D k 3 O W M w Y T c 0 Y T M y M T I 3 O G V V V A k A A y C y o F 4 g s q B e d X g L A A E E I Q A A A A Q h A A A A K t q G i 8 H 2 s / M K d Y O y u G F Q C h w K L 0 z v + 4 K 0 x g D j Z I S C F T O I 1 u e 52 A H 13 F 0 X / e W C s T J T z f p p I V Z u G i r E / L X g g A L V N R V B J Y 7 u E + g v z X Y y W P q L f v x q c I S W t O 8 S O R L b F s y 8 m d P t K W P d T L H v h s R F + m Y 0 K W v o R c + s 6 y B o 4 z j W P U E p m X U Y + B O L 2 F k D 9 V u k 0 C L K w 2 I G K r u i 53 h C 6 k c G Q l J j z / N D F Q p 7 N Y h k q y w 8 i M J L b / g m p d l b x 2 T 1 l / 9 e V z P I t R O b U S 34 U T S E u N N 3 R X A V G f t O Z 3 I g M k L N m s P H 7 / t A f e / T f j + T d 7 F s A c i 2 C s g f A T W H X V r X 4 n a y k o T k j l P 75 F 4 A X 3 M K a L r J e n + y g t 4 u 7 E T i F f p p + + N M K V K c R T Z d c E Y b o U h 8 M s u G E 58 m 44 X 5 W 5E0 K S o a V X 4 U 7 B N V 4 M J s t e W L 3 t L g T W m N S o l B 5 G N i f 3 / 9 R B l B G 8 k K l K a b D 9 Q D c M d a f G 0 v R D L G w 3 n / h z X w a o y u A n z T 8 o p f B U D h x P N 5 m q i j 4 Q T I 1 V O m c 83 J Z / d r 3 t u J s H p 5 A n 3 G e Z J M g I r 1 o i K 5 b v w M r 4 I E S m 8 q 0 V I 8 C K w C t o F 9 H p j V 8 v 9 g U 65 i e n w 8 S X 3 D m z w + 4 a p H T D I O 4 M 58 r d S 0 S 9 j M i c u v e 0 e N p S L b D B i 1 M C u I + G U X r q x O O e 7 z 9 d S 7 W V R s N W H U f X I F C + 7 d / b 37 I 4 d W 6 j V 37 B 1 Z l X 0 D T + 1 L 1 f l Y T F H A P q f v q z M F Y M o v U 6 a 56 C A K Y q I d r A h n S t b V x e k 7 X i 13 b 9 C Y i c a l i 0 F R n f N K u Z 1 l 51 p T z c i h w d 10 m s + k G 66 B S L 9 o r x s t y 0 0 K K N I 5 Q i x 1 P c v 9 c q 99 k / n 4 e t q H a Y p e l s 1 z z o f K T i K F H d A p H 0 d I o M H B G n a j x f / g 2 K b c b 6 + F 7 A y B 9 C 8 W 8 G z V U t O 0 r s v o 9 u O a D g V A X D S Y 5 U K E F x u X p G O C K 8 s h L P J z q b L b g Z B H m l O M H Q h 5 J M 2 o h p / C H v / b k 7 O Q 3 l Q l + d X D E Z w y U y 9 Y j y J o N I t p 6 u 9 H / e x e g A a f 50 A g Y 60 y S J t o S b S x W B Z u N 5 F M 563 q o 3 q o M 8 m g + W c D 7 p 6 v N w y B B a u 9 b J N Q h T Y p 7 t z 2 n B / 6 r E 1 u R T P g b V 7 t 5 a e D Q r o C R h V 9 D b a 8 z G L B u c A y 9 f O J 1 J Q u / o o Q n u c 9 K u + a K 85 J T O U F z 8 u h i F w H X V P O x 3 k n N F q j A d F B S 8 h C 2 B S P X k 6 d 8 p 9 j I 2 B + j x D 2 Z Z 9 Z 4 W I 0 T V K l + x h Y y o O O t r 5 v i W A M K k c z C y W F d W o O j G g i 9 w z K t w i G a v x 0 u + c W P q 9 r O F 3 Q / z U o a / b E L i p E u x N R a a Z b K J g B o + 4 l j T N 4 H j 4 b k g t / V l e q f t 0 7 p S D c w M U Q w 7 B D f m v u 6 d m / R A 6 N O h T h V I 9 f v J y Q r r V 7 u K E x Q E W M X Y B D q M u n p y 87 P 8 b x H D w f S z 3 F a b S B v X B C L M 7 A 2 e L o w C C k 0 A P v C / Z 9 w 0 75 b x B G f N E o t D 4 j L m L G v p 6 c m O I u V G 8 V D Z 0 X 8 e F 6 j R g M g e t i g c E z 615 U Q A 6 o S 8 q 7 P F 0 A G d j V Y c c V y G i 5 X h R o V E n r Z B n U d 6 R w s t M f E b j X H / L a 3 n b w 37 K V R M O k b c F b U T 0 j R F p 84 g p w T g T x S 99 T X r J 4 l 3 P 4 c k u P W L 11 p / S 8 p A c Z E F 9 k s f S Z o P p N H m 94 d 2 L 2 C G 0 T b G i t f K a o G Y 12 i x k g A q T J 0 c u T 475 u I I Y r D R M D i U 4 m E / e X A X j d 0 5 l t w B y h j V 9 / K X 4 m g 6 c 3 j 16 / h w 3 k U n L m X U z p A M N K g D N 5 + O l A z Z D v k W y Y + z N w u W r u f P 12 P 16 U t d q t T L + Q s 8 N 6 J b Y o f 1 z U p 3 J F G + Q W c 3 g z o Y / d g p B j Q a r e y k i n U K h A b J d A a W N J 4 X c I o e 5 Y W V g d J J f 9 A m 0 C J E 2 o c l + a / T t P 0 9 t K F 1 J l d 31 p c W J c F 502 J d Q P m s 15 F U h 1 i a K Z D h p O L S K J B k C U D K Z z W 3 G j d x E 63 J 1 o 9 z m //kVfYdDtPowT9HRH6z0Di/QPaymz+oOUv+0rjMSmb7c0dmueJAGeL53b+g4T/0A38EgoOrf0OiSlH0d0XUtfpX4jPtjguG2zt4t3Jcqnmx1TNk4hgWDVQ1irj7iWDuU8GJW8YUZvV83pzX5bRp95cIjiYzY9yzlP+tgOKcdSS650COdbfYO2pQHPzFiegH4VK0QLJgx+/6irJoICO5re6TcewmBkypKxkt336opH7icTIUVnVrHMzDe9DDwSoX7smE67bHFNO52B8sZ0NOG7PjpX7zNUFtKFt94mgtARAV5yChyGf4VfaXUun1xNEknQBYGStG+12t0pM6yhwdVbwFkUDdEQPLPtEIzuQBSCaPFe/AGw9d3akfhaptmSrsGqXfM3p9fB0wYtg9Xh4yaXRazI6RMC81dBv/jjOHKg6FKNWOMHD/bSNUwNDVaQX5tq4EVoGGUc/mCSEig/oSsIPGDzH0xfQN5DQPQ9sPspLqH7G/HATxJb0I/hZnGMODq2fQUUy79RtYL/GqQ7/f0MoyUeOZh2KQMzMMRYTqsZr4Thx3jD8n0TFsICsSAYo/zGFGB80l7M+++GWecVqzpKy7I1giuhOcfrH9Pgmd/GdgHJWeSIb/TUY/FqZNtinX8e9DqM5PxoDmcOjyvMkp9yUXzXDT4xk8p6jcLKGvOMEiL48c+eazLs1AakFZ1BQtbTYmHz03huSyeWV8MaIAXL6eZpDiayIQ9I2MHALPT/bdRTP4kzPrs+zFv88fmGYh5S+13SoBCFSjNIRbEcM+aWdGPjS1HfSthNRKSJwScr6SfbTsWRMIaO2ALslmEVHkE0lfvw/nmjgDFP4ChMC1ns9tIy4HN0oB3zm9F/j1HTp2+Q+mfNqpBEBvj02DVLqnJew6l21MhFcFnwFoYPSHyjryJHeCG3eJ84OyjPX8tICWUtDSfVN+TaKWY5aFC8OAuDgq3FWoy0RNVeaBl9q+Ew+BKeHpc0u54KPw/VANZAHLRrPrZMStt1Ol7TEBtDimwCszDo0+9Gk3xwJfMAR3KxSzet0B8ZRf6a6iAi230oo/Qyl++XZgkJVBM4iPguXVifXA85yebLOVzOnIRghBVnBknf0gpHxhrEw9gU1TrTFDhASMTGTLZyFkQBwdk04/2De/i1yilXZewKzx8Xne9DEPj8RhS3W9rgrVW+qNb+5O3vagkXvjhh3Tk8MwTjIvYi/b6SEcZrbF/94qxl+LgIsViLKYzuNGM9MtWmVS6prbvRpOFFYvknibVWnMP+nSydueOwkTkzgLl8O4hKg8exDbk3OrWazF9m2A/vCcgxujxvJSeD76QxsM0RYZy/z1pvlAQOyFj/fg7CNBVanM//gveZ+nsWLnzm+VxVQXzSE9oJQ5l0eexwdaR4squPOBbIu0U8yBagbV7aeaP3g77vpy+qCNlewslVK1CYWSAJVZnJCK5f6HvlsHGdoTBmJ0jf0+baf/o8kRLvl0eS3UiyIY5Zq3Wli4K2jh3+cbZFxyrCkgQM3LhNSLeAheyeOaBUxP7gx699LKTRJFis0S4wbx02U5NET4d1gV54vCqfFdox+to7Dx9cWmJmA26sYBdVXPpRe6WWNpf+K0UdWXIK08XkY5MGwajXhW32/Snd3LG367aKiTgw9PWPjhHLCEncE0rGnvn1KSbo5EYLcqFuI2/NKPDb7ywMqtXz4LGRrbifHaUSKLRJ3oQfn5VO3vlTFG56wJ+R2DYoavcyokmMawNdWRZqgPZnEZD0PsdTiMnMSeeS7r7tGY7OKMnsVDrgzXeC9Q8c/PYxj30WeQXV3xJ28WpkOC6
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-22T21:07:44Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0b22d-41ac-43c4-a3d2-466b950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T21:07:57.000Z" ,
"modified" : "2020-04-22T21:07:57.000Z" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' 1 d 6869199813 a 9090478312 c 2 e c 13 e c 9 ' A N D f i l e : h a s h e s . S H A 1 = ' 0 11e7948 d c 760e8 c 4 d 5 f 7 a 41 b b 0 37e9 c a b c 1e262 ' A N D f i l e : h a s h e s . S H A 256 = ' d 2 a c 48 b a 8 a 476 c d 6166 a 0 c 35 e b e 276 d 136 b 1 b 82e865560 b 2564 f 39 b 5 c 7 f 3 a 3 a 9 ' A N D f i l e : n a m e = ' a t r . d l l ' A N D f i l e : s i z e = ' 372736 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A P 2 o l l B 0 H 63 k p M o C A A C w B Q A g A B w A M W Q 2 O D Y 5 M T k 5 O D E z Y T k w O T A 0 N z g z M T J j M m V j M T N l Y z l V V A k A A y 2 y o F 4 t s q B e d X g L A A E E I Q A A A A Q h A A A A S V l 8 c P r p c 532 b Q N / i A i a e + E H B + Q 0 y p Y l A f d B g 4 w 8 r v D a h k e J c u L c 2 q c F O w 9 p 9 V r p S h l T j w e o N U 5 J / H k v W I k U p l z b 1 T H Y Y G N L o B u w f 8 q w A t 7 M q E l V S m M 9 Q f / 6 X O J v u h f E y B U D a k A p 1 q u N D Q G R P E 4 s 26 h y Q p a 1 u 5 F S 3 o Q F S 7 z t 1 g s U b g D t r m H 5 G b h W H w j w k a c 4 z a t d z 0 S O s l L j M J K E 5 b 1 h + E 3 j i 4 V X P / T I m / b x 5 l x N U 76 o f / p O r E 9 v H K 9 m V B Y x 23 x n 6 c i T X L T D t 5 W J h h q i L y f o N 5 q r f A S f b E 5 a X 62 / Y D W n U C T M l B R 66 v a q s D v J p I V i V J 3 D L W g s d R d L z i P A C t F J C u t m m T L 0 l r b e x b s P 7 J b J / R m L L e A 572 G N t H z U o f r g A p O J t C c H p Y 20 H n Y 1 + a a f 3 P C 5 C s A F 8 v v s m B B v / 5 t Y 972 k 4 K T P 4 f x u F E k p o f L y X 9 y l k k C X y o f W r Z R o S a W T 5 + A F h J N e P H + 55 J z z + g I n y Z i + q U D n 614 F m e f S w F O D d P u S H X L 7 a m + / r E m C 2 A 0 S Z k Q 0 a Y K S i j p 1 n u K v b A Y o D n / A P w d i m C S T P E W D 9 N L K x i m h T X q t N m w H r O L G A U a J y 7 G k F c 39 f c j g m j s s Y P 4 C Q 7 C x 92 i B g B T h r n z K 8 h 4 c J u A L U Z q Y 3 + j 4 I i 6 V W y S W S y B N 1 f r 4 i O p H V z T W e 1 + 5 d m 3 o y O R s L 18 o Y T 0 b T b c W A H I f Z t h E 0 P M Y x c 5 S h J b 0 f E C 2 s e n k 3 q D A b + R 2 f u 78 j / s 0 Z s W I S Z u B g 473 q 7 O Y k A w 2 G a S 3 b W c h O o j B + N 1 v G f 6 F 7 p D 2 + I j C f a L G 8 H j c D Q g L c W 47 N 5 j f I b l + 3 e n N Q H q X y Y Q f 6 s 5 B u J b V B T y k H G I T 7 + n / O 8 l w F R v W A P 2 n Z G X h k 4 n S / 1 r f G g u d p U r d R i v k 2 X E V X 39 A 3 q f k y v S n h s 9 K I q 2 O p N + G e 6 s 1 v Y e Y L L m V m R 9 O 4 H f c e k Z O 9 R p z y w C r v y L P N 8 f x 9 M a B s t j i H D 9 i U W 38 S 9 N Q Y 2 g c j 6 n u j i q E Q d w s n u z I D K y n c H T I i 4 n i C 0 q 60 p C O A M B F U + F J g H H Q 5 X g S x 2 b f g 5 n 51 M + + J 5 B z X M I 1 Y N X n 8 h 2 M h D 0 s p C 88 S X 4 a w n y w D Q k k 78 m e a 1 V j l R s N 4 z h 9 V 4 Z 930 y q D m k h L q 2 e t y X i l 0 B h t X G h J M w r s W s C t Y Z E g B r Y A H g L n u c Y s 4 / s T D k O 83 Q D c 8 q f C 8 t 34 i I g 1 c M z F 4 t m 1 t h 2 G x X p K Z W f E E N C j x A v G I r H t U s C j n 1 N K 9 K q j F 3 X f Z o n W V l s U X E n B N w v J z w t 0 1 G K K q E s z X t B V T E M t C T o r Q h P d x R r 52 Z h u C C i y Z C 7 P U a a u D b 5 + f 8 T 3 n r 3 B S O c N k Q B x U L z W G W T u R h k N 5308 w X 2 K J 5 X z z 6 k / 3 F i e 3 a 0 Z m 4 W m H w f r u e d W O H P K k R T E E w D A R N M 6 P c O B 6 m v E d C q n K X O m q M Q g t Y F n c i M R 0 J C G q o G v 171 X O i g H 1 h 3 S s N 1 W A j p M W F x H N I i D P V O O C f m 1 H F F p y 7 B M O t 71 T + H u u 4 S O U c H N J o v d 9 E c Z g G 9 y S K y l 2 x X 4 G a F s N B 8 I Z Y x Q I n 1 N U r s 69 V M X 0 m m N u k P x U B / 68 K K Q x X 3 G K + V I 4 g B G M P D P q Y 7 z t 5 P I l a m c Z q U O 2 U q W W E r T s U v C h q E S 0 i Y V W 9 T j N J j q 3 C n x U N 9 g N S I z R Z h I 4 P A k m 9 V V P A N O v B t X n Y g U V I g v P U V t / m m k r 0 K 2 p j t G 7 r b d w U C 3 I T o P T / 0 L B I r B Q k w u K 9 + 3 q O D O p p x K U l D d 2 I 6 f D s U n K R F R l i y q W 4 h 9 G b A P l 9 i O 6 k b C Y h / Y N Q K C l u r y k W G K 6 + 1 G + l h z 7 S r n D U j 2 x x o X 5 Q C R b A O i n s / z X K X / f R U s x M x s I 8 i Z M d 8 t T 1 E y s D O u Z P G b o H 9 l u h G B 3 r E f q 2 h U 1 U X h C 2 R d i 6 Z + / t B A G s w g g 0 z + 7 R d L 8 P c E h X y b 44 e x d 7 + d M j S v / T 3 y e L 4 K H i P M Q S x m R x p m b F X K j 9 Z E b u V z R H N e H d X i K L c H e 905 b 3 E g M B p r Q q l b O A B t u Z P 7 j I X z v A K H l Q / 8 T 2 H m J r N Y 6 G b g w q l A L F i 9 R R u S w p L f e s z 9 I p i t p B e y / c n F G g c m S 1 x / x L d 1 G 8 D b G O F 68 Q d E 5 M Z S U n 7 H E d 9 W U c I x z 4 u 0 2 R F k l 82 J C H D 7 X X C t f a P 0 52 M j H o 998 O 5 j V m T d B f x X 7 v w R / j 1 y Q 1 G 5 A o T H X Q 95 o J T C J b c + 9 n E X g w T U O b D / W r 3 b X f S 3 B k m r b 29 h 7 t 2E7 x 0 L s 3 N m V g r 7 U Y U E 2 P 309 f d K 6 f Z C B R N z 0 c 0 3 E z P L c X D 5 V R 3 H c U N l h m B 9 x E c B k L x U 0 m 46 c O c M y I m + d y 7 V T s u u r 968 n R 73 H N X P j j 0 H H t r Q V / b 8 z c + D 1 w 3 p P M 45 V N K w t h 0 O K 9 J / J 2 / E 87 I v q G W h + S X 7 D p r j 2 V 1 R t l P c I e 4 U F 38 U E b Y V J D G 8 A 7 S 2 M 3 W 1 Y Y A 3 u 5 + H T 8 n Q E p r 3 n R M F a n V i S U 38 g H X q R q H d o q W 5 b m B j / z s x u I 9 a y S 84 f 2 I 5 / w p x z 7 m a n 5 B u K 2 j L a 1 c p B i w Q / b H 32 L A f l t q 8 h L r T 8 B p y g Q Q b B c r a w H O m K t K B R h 7 / E g r 9 h O H 8 W q Z F e R d a m i b L T x j 0 2 k s e 3 u l J B v s X m 5 w m B J n m y g k l N v u 1 V n z T G / A o h 3 q b j o n n i V 8 u M 1 r a o Y m k O B a X O 6705 z x v u C w B F n y s p b z w 6 u P u b a g h X q E o 5 s y C J 0 U p s g u O f q 5 Z 5 z c 2 e t r 6 u i 4 B u M 3 X e Y q x G 57 q d O s 1 S o L t X f o i 2 Q L / j 6 e K P T H G B H 8 + l T + c 5 r N K J J M Z 6 L c s Z b 3 r / O J L n 4 Q 8 t m q l s 6e9 v r 0 646 g H 8 R 3 Z t O E w V 4 u V T U 0 I d J y 5 p t m A B 3 M / m g M c 1 k B K M L B u 71 Q 4 I M L n C D J d m 0 3 u U 9 X m L J M c L 3 r R A T j G c 4 P n W x Q E D f 6 I 343 S / V h k u Q j o V x R b g t m 99 C m r O k G B I D V h B F i P 6 H 3 + S / 8 l 3 K B 8 J w h w l B 6 T T c W j R 9 P 9 f u g i x r y X 0 0 l U + s n l O d 27 a f W L 3 w M n d I 4 e B 0 L l o 1 q m N g i + N 6 U E l d 7 y x g + m I c e 4 L Q H e z K K K 3 y i A u J x k 289 W b d Y p Y B b N N B V q w b 71 E E V / j u B b Z d 3 s D + N y E N C w Y w B 8 P B p q e L C q A D c 4 b q t j w n h P R i / a i t C F C q q 3 e M d 86 p z L t 7 k h c N U 0 i 1 e K 88 E O n G 65 w / E b x f d W K v Z K I + u 7 J j L W L Z P h d x m i W b O 3 W T v A / 4 r t 4 E b L q w d 6 E g 5 G 3 d 4 X V e a X P R 41 r l D l 1 V v t A 78 D N i J W w 1 I T V S 8 n P 9 t O g p 1 a b P m y + F Z S z m X 6 R i / C / k N b 1 Z w u 5 S Y s m j C i i D x w l S e B 8 y z x j e I e f L X + D m n A 0 y A q 1 m 3 k j C k r C k 6 k K e 1 c m M u s 6 Z U S / F 2 + y 1 i U + g f n Z R L Z a 92 Q q P c G M u A Q 7 X A n n f g 2 Y y f S l C 6 L J T M u / 5 v I 734 D o H 3 u X Q S 8 X F u v P z 6 e E c D j + U V H r 1 b c E 0 f H p D G Q i Q d t 0 q r G S B h Z L r F K Q q A k F S + D x 7 q s G h O p U n 0 Y 21 j S 3 R n t w f t Y C c z l F o 5 s w r f n u J R z 94 Y o R 6 X o Q Q + x V X w m Q 1 w + u 7 D X f G c / b 40 w t q 0 8 g R N 3 t l w n 5 V R 79 w X P u x l 75 O + u T x + q 6 T b g J G U i w b U 4 h Z 59 Y S Y R i F M 8 L d b w I 8 l E X v d 60 p P e w y C e j 9 m J u D u 3 n 40 t J 27 h h S E f e V I a P u f p Z I A b K O S x 0 x e v i A C D 3 j o a X d w f K M r V 9 X E o r X 0 56 t m 9 b i d O p / B 8 i P b R A P d / U Y A K 88 L G E d Q G 80 e f W E I w J b w M 5 J Y D 6 J i s 0 Q 3 O h V C D 2 m i g u O l x x Q / W Z Z J W 2 e K d d X Y 5 e L K W N 6 P g o t j 9 c y v t w T c p I J o + w u M 2 n o B T a z o + r p I K e o 3 v E f P D i B a o P a r Z k K c 6 O 3 O C i N N B T P B F M Q h 1 / 4 S D N P S R Y g r s Y a a + c g V J j d
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-22T21:07:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0b23e-7268-4c60-8e21-484a950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T21:08:14.000Z" ,
"modified" : "2020-04-22T21:08:14.000Z" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' d 819173 a 8 b a b d f 625 c 2774 b b f 17 e d 710 ' A N D f i l e : h a s h e s . S H A 1 = ' 629e79904 e d f c b e d e 3e7 d 4 f f 9240 c 8571 d 8e2291 ' A N D f i l e : h a s h e s . S H A 256 = ' 588058 c d 3661 c 48 b 372 a d 870 c e 3e03 a f 62e61 f f d 917355895 a c 8342736704673 ' A N D f i l e : n a m e = ' Q a B J C Q J n s O D D . t x t ' A N D f i l e : s i z e = ' 183296 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A A e p l l D J h F / S 8 A M C A A D M A g A g A B w A Z D g x O T E 3 M 2E4 Y m F i Z G Y 2 M j V j M j c 3 N G J i Z j E 3 Z W Q 3 M T B V V A k A A z 2 y o F 49 s q B e d X g L A A E E I Q A A A A Q h A A A A V Y l 3 K i T e k O S 7 U E Q 5 c H 7 z e s x 0 b l m 1 s K J z b 4 V v 5 a 6 b 2 i L A B K v T t 3 G n m V l f G y b 9 n T j S 0 3 n o h J 7 O r z i s w 0 a I D 4 q U n V F g d k U 6 m 5 l 7 y W 63 E A P D I B Y / M q u O 6 E d + R S A 83 y k q v y W Y p n A C u y l v W s m u W I m + D U F Q h / l m + E e x K K I Q h 0 F l r P d k x 8 w T 6 Z P V a 7 O i 4 J L K v f U b / w t S 9 w c u k z o h K 6 n c + 7 F L 5 t P J X 0 P V / e a Q 22 + D U 9 W f K l C Z X V G A u v v W C J o 4 a N E D X C 1 u q y s l O k 5 C z z e z P N c X K P X D G X 0 f 42 h X C D C g e //F6rIk41YW5uzTKrAt2ZnLmGqyntNgzv1LDnmC4zanBn4FXAfdxLqxJQ4JbIdyf5SZpFEHJzSEY0p0VBtwCHrG95hmIVTCzo2P0FhXeCT3k6ZLfirh49IfsY85nyHK8GmVQRBN4xEQK82VNBy+px34BZD+3DGNp1bgIVe2+ILhJPA0+v1TTnc26+hr2Rz5IN9N8McwxuovqccD76Jk0f7YgEGjapm88mwIUDIBUgZnhKn6p0tbp5g6hiDVpHkq175WrqREh4Up3ZzlfLv9h4iA/HowoxyBe7PNs+qWF6UaufXNiDYSqqiUQh7FUL6FVSMWTRZrbS6Z9MpJCnFFvDEIGIBANm0xwDCOiYpRwvCHUZiOUjtW0Y3LjatNa3c29dPn8jgdz8Jazj13K8guLYuzDXY2lPbPTqoGlgVeb3I+02IOP5UCf83Yad7AIYiTf6u6FxEwPRNtG7PrcfnTPVHtz+9m100venfiuA7mnnJfNeqfdIWNVsTQYtHU80yzf/Q7b7ll2Z2GOuTABwX2lfFDOIk30WUSC8bSLmrE8xrQgV9RgxwBQhWNEpmpV1zbFZjay6EuguX4nYYoylwd8CnE8XgUo/b5EprvFPg+n8pef8sCqj6AMnAGjz5IH6LCg68GhbqLIf+hKIsM9U4ZmDcmaCaM2SA7GUW/vaVg4P0/vNWt2Vkt17gw8rwsRXbpGfJG7GTOPc44JcpieWDzMrEw2RyyOqKrhK56cVdXCZG7IS/lu+C1OvZ0karwYyQEjRZlJZXNDqI86Oy2J1tthh9jbJyvJewFdiJuZXIirmvdZj9VPYpolb8XpRbf9engJJWcCDyhv8qeK5w7Z2U3KheRZY1EAcZU9GQqZDJZQv3RbZkRs8H4h/T5DKuu1RFATiG0a7HsFZnYMwqezKVGOBna2bpbfLca9LsjXpix0H0BYw3zw8jbDAu7GjMEhBRN3aH7Ekx3dqIlSxvgJUNlq3jfBIiB8yZ2ym5XxdVyjZr++0zWRtjXV7wZthcLwwmo8nyhEsUGqmsaYq4YRCPGT9Gx83rJUZDK69t+inM2EJJcqcAqu/lfhHEiiEkktW0cXssSGET2ug9Fu54auh5J4grtB8Z4c6D1acIam8WL8kE3Ivmyawn2uey3dVn1yG8qbq6QHSGouPDSuLEjFyGhgdvCSV9RpisyCEqYY//AVsQUFFTl5YXjPIq0oWYZHzaHz8zeDcqRJajjv72esWXhJxDBceRSxwreWTAeY2K6JGP7VdK57+TEt3817UBtaNnWRNH/yIvasFjYMvrCK8L0u5n+HXaLJhevQP6F+pZ05q5O3FXmzK6R0cBGVu6LGGiEBcbVS/Po6RUfJ0flqycy6Rfrgl+QuBShPSP0YhsYuEojMtBHSdIu6bByB9zLD/avA8BKbCPfUn8LjgUwyPUEjxBnim9S1qdx2/LvGsHEnFnlHHxFbfl5sKyqEEdFAhFiiw6otAzBisHBAxUZ2HyajAR+G6qSmjLqNZ9N7G/bId/G+445yYArjqVp8h07nBBjEfokr3Z/0H2hoorKA9Med61B++6N0S/4pL6wUX/ErHjIMuSWZa4jhz6Im085l9dzv+DNvgLJbq7MHRmZpiBM35P2TnHyqC9rCQ/CBngaHvLVToL8kyAjILl3kb7bLA1kbRIddPptOea+N+968/x7D+jDI2ksXlPrA0zGkpai+WSILbWn521txeyoVyTreRNvqdGeAnr2SRTRRAgpQxPqM2Wwd1puCWu9UNQYwrWRVN+UZyJJTZF/Vu2ekA3NOwJfyhX/OIiGR9IdRqOmWRirh+brYHhV46EWiV/re4bAG6/SHCoNNNYkLu3+ew443tB3khjqYWajWOTv+zxxph89mUJQx5fGsWm3dE0OI744OMTpIgDwCeH9DLwQkUCGkU7+DzN0DOX0pgr7NRpSvtOBHVPMCHndmVKNndrnRXcnmp4vQrDKeGBkcSWEEykqS9cn+Wjp7X95UPFIOh1mcq/nCylLVSBh83oUkMnxAL7LcNBz83oTpN/qoOXkz8SLvin2qJt5jUtE/6N3fdGalcUAbXv8rR4j1t/NHw3YzoZ0MEUOkMPdUd3gQ2FiePh9nrCvYpuvTfO/fmymhaFK3SovKnHjrHhZUemS3R82VhW+QQCAlIVe0qN/lzwLaJIMmDJ/yJK7EYK6NTuzAIz3T3cyVMdtAXLKDjS+hmLobADGgiLSGu6+6esFKq+oOkZ91bGCbtwBFp+MpwfkGG/zCHmE8MH6b4GQGp2lyrmR+0ZseRaHU8zt+p9b4rMXKDdBFjytgJgfN2lXL3Vrz36Ka4GDfuupzRx6ArBgkXHi0NPnQbDJsTIaosiPnIlfI0Qkk0HMnFluG2+6AZE1utZfmyZzo0xY6OseUJtK3xmLdZdddR6+Sgk0r9fgUnM20LizLCBuE0j1qdMTn31dVC93tHQFwgp5euYRSf4YObn/CU4MgY73BvJRZHbKWbHHzGmOMUAHmabDEbiRNXW7+1xbhrSdU6wjrhRaEKkuW3o9pCfyjv+ZgCEXUVR3cVyPPMEj/OP+KODyqkTF2PrLdbSeWIPvHKb2VGtoSI0b5N4SFxwuYNtgWcg4hlETMGyjdY5AQXWZ0uOlVdJkhOXZVDa7Mu1Z38tmTaQTfF3vVQw7wp0yI1u6hr1SkBGrlocqh/pjJ6pk/QAeo2fFLDOqgvUPktd6vjALGX0diTUUHJlsqXQFXSEF2zhqYcpQVFuoXqSJKVrv2BJKbMUL2LZvjpbbj6MS/epEcecQz2Xo75h+mailGRNTKaePGda2W+3iOOK15P1M4Ig81in7/cj9wUP3nTnR37pkbYOcyOmIbQU06ldC7l2UiCwcm5GuVEBhKZYKTpNFvZ+C0DCUKv12vg3dJ2iB8j27yS5N6hicSWcv7jGI7D95/jxmxdx19IvRr/ekSTrx8+/yBHw8bQaYmch/wGkYwaBfkdaJoOxaRpdrrLA69dNBloP1HL7ifktp0Nx3ccMAhdjsQkqpMJ+olfz2LpCIjg7+KpbWOxaYnO5LKCR8TQcpjiOobCpcnlac0WuPoUzSf35/HtKtfI9RnUsHvlrqm/KB298t/Gzy1x2w3cvMppXCBCRxmkNBPzieM1aa9tD4l2jN8KVy/tsVJLlK00M9RpsDJlUXaHjMPUj9tZ22gVvQCwZCiY3XuQTlDXMOnMqbVUscSi7YJjv3e7V0C4z9KoqxUk6hGoaGhZIr89MbEaZtjcL6nJ4hJi99NPchiyvfXp2MSRtcO7rf1p4nYLpRVuv8k9srDJhc6STjQY6Pk7tZ4HAM0lE4nnZqxA0MkulfGxSBFnTOo8Efw51top7DtL9E+LVXR8
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-22T21:08:14Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ea0bec1-9598-455b-b114-49c4950d210f" ,
"created_by_ref" : "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f" ,
"created" : "2020-04-22T22:01:37.000Z" ,
"modified" : "2020-04-22T22:01:37.000Z" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' 48e81 f c 9 a 95 c 810651 d 1 b 5 a 45 f c 135 d 5 ' A N D f i l e : h a s h e s . S H A 1 = ' 982 f f 97 a 4325 f 1707815e6 c c b 6962 d e c d 2 d f 75 b e ' A N D f i l e : h a s h e s . S H A 256 = ' 926 f 8 c a b 4714 f d a 8068 d 877 c 2 d a a 79 c 2 b 8 e a 3 a 91 c d c 146 b d 3926 f 8 d f f 8 a 20 b 59 ' A N D f i l e : n a m e = ' C H x R r v e r ' A N D f i l e : s i z e = ' 827586 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A D O w l l A I D U 7 b g M 0 C A M K g D A A g A B w A N D h l O D F m Y z l h O T V j O D E w N j U x Z D F i N W E 0 N W Z j M T M 1 Z D V V V A k A A 8 G + o F 7 B v q B e d X g L A A E E I Q A A A A Q h A A A A q y c w B 1 P Q A B t L u 8 y K N 1 k g 7 s l / 4 Z w i S 4 W X p 6 W A 3 J m n 9 L R Y U c s 4 h o H C Y i A H z P Y x f i 8 L p h P 8 q t 5 f q I t p 6 U H g P n z 0 7 i a 1 O z K S Q 3 D r r m K H U D i f c A k 41 V t s j 1 Y s h W a L D s M T z O W q G C 7 P 0 U M 5 c w W Q T 5 c r Z c s 1 p o K i s W + F C B l Y m + w U f H 7 A D 3 R O d w / h n T / 7 r v m T X F v z S c v h N D g w G S 8 g g w / 0 b O 3 h B w H C t / 1 G x X 1 x i F 8 y W 0 r S G O V g 4 a i Q b Y w e 2 m / l P O R C k B J 7 r k m K F i L L m J C G l v X M j O / 7 b p 3 e C z x q J S 3 u Y F M x l r / 5 L A q i H E F x 8 H r Y c W a B 5 c t 0 G E Q m 3 j 1 r z 646 L B S 4 p 5 / 5 S v s e a E / 8 c A m k r a C C c b Y / j 9 n 1 T c 9 Y k 4 n 9 C 6 D 7 E v h n A L T f W R s q M 27 j 1 a 3 X J I 53 z O t 2 X 38 w / L 3 u C 9 m Q p I Y M y r S q i 4 n r a R m 5 v b / Y O u 3 z G J M Z y a u G I P X i x 9 f K W 7 v P T U S F u 7 Z k Y 3 v d N S 30095 V l c 3 l H A Y u G X b h A 4 E w z O 3 W 4 H t Y R 5 C I g Y 9 x w d h / Y m D I Y c 8 K j n R w h 0 o o 0 U Q 6 + H o U z F V p x 7 r 18 K z Z s x q Z 6 S Q P w G H N f h L E Z A u Z Q z g W 6 K k 4 j f B s 27 a J h C M z f U H l 8 d g n / s v s 1 C o X d g c N a R L o v C V r 34 a A e y Z W N x g W f y 6 h l w z e v X m X t K p k O T 2 O b T 5 s c 9 z X i r v t d s 6 B v M b 7 u 6 V 3 y q x J W 4 l j L Y 3 W v S B o 3 M b Q K K 6 n V k M d 5 t + C d b 7 T J 3 u 8 P T A N Q i o N M K o c a w v R W H M G E Q d a C S e c 9 S d O p u r i B l H D g q 8 x U m K / s o I q v 9 g N r K 8 m 8 R R o 5 P m 1 G i d w R 31 j Y p S z Z K H I G u X M x q 3 J T U S x j d a Z X 5 F Y P 3 j G l 3 q 0 B 1 a O Y j b 5 G 2 S l p W 0 P M 8 i j J 8 w V R 3 p E 9 Q U + D 8 w x 9 G t d b W x I 33 N 5 M Z 5 E t O g N A n X P P Y 0 a 1 h Q P K F 6 / Z X M x J e 2 E L v 1 U W a G V y 6 Z F 3 X p s 9 n 7 F e h Q c y V P D m U U w T G H L Z w P p w I 2 Q D b P r t i 7 d d U y l 6 d 1 p I A h U T y G K W / n h e w o g J g G X v T Y t X G 0 k Q e Z M r s E u 0 D K X A s d G P F l T o o 5 f 8 A m D J 30 t w D l C S P r G Z h q M W I V B B 1 m L l p 785 q z i x X f s e F b j o 5 B f 759 f O r g q w C 7 K Z Q g B E M 6 e V d 4 S 6 b T i J 8 J h O e W f J Z h D M p H l k U T s 5 N l F n S o 0 g t u n a C W J S / c 8 p n L s g 21 n X P B z M T G E A o D e B w r L L z / P K a J a b 2 V Y f p V 3 k z z b n E t i f 0 7 K O w L A O d K / h p W 0e9 C C L e r h / 4 c G T E h q E E p O F I 3 c e 8 f L 2 l 5 y W 1 T S T l l r 95 n O 8 H g q V N 2 J 75 T W 6 B 1 z + g 9 N Y W f T / b u m T / o u c f L B x 5 N 409 h F Y U I 7 J R E l 3 g Y L b L Y Q X g a H I 0 S l t r M j J W M E W a V H h c g i U P H F 0 o n R K 91 v 0 w g z H R w B + N r U 63 Y H o O a L f 7 J o / n v s o b + s E M 2 T Y w q 3 o x Y s F g i G 6 M h Z J k J 4 O L L 0 Q r 8 V O i w S C p X 93 O G I t 0 K S l 6 H 4 b D R Z d D u D e 70 U O 34 M Z 17 Q w D B 9 V t h c 1 / V W 0 H C 2 w C F b 6 t 1 q l i T U 71 d j n c 1 / R s m n X p j U 2 g 40 F R M W 7 z T M L I m N f q A 8 X t d R O I Q A g c N T Y S j u y 88 b Y r N f r e B / D V Z P A O S + 72 z j p K + L Q v t i i + y F C c H X + c J u k l Y x r 8 D 4 k O 72 Z O Z 6 U h d K J f v j 4 s 3 + M O e O K 7 b s 7 u v A K B + m i n S D I K 7 M b F k Z Q 9 l t D 5 G m l U C u Q O 3 k L 7 t H j 4 S V 2 s 7 o R j E K a + F L J b k U f 4 w Y Z h + 2 B l T r 8 i 1 n j 1 U q v h v W S F a g A Y w F 27 L i Q 4 i N u L n h G Q O B q a L E 5 x b t v 725 q C F d O Z k m U B D S K V L t Z w 3 D q Z 3 H j 2 Q T d m F 3 c F a 9 J t b 5 s i O 4 Z 4 v 6 e m A p T C a / b 8 D c 9 J / u w / t s H x k L 0 y x L E P O 9 J i c 0 s Y U e W W z q D t 46 G q 3 a l P u E / P s j 0 L W r / e Y R F X 1 p P n B A z 7 I p 1 N t E r 641 Y y J y O b d P o Z 10 U u P 5 K e o L i Y E U m + K H f 8 B + m L J 4 B L o 0 x 4 v g n k q t 9 / T K W 2 z 6 U 4 e q 4 + M Z i b q c 0 v 70 V p B F R J A x B 4 O W M 9 L I C J 1 x a v t m C n P / n P E b 5 d 44 h L b Y J M 7 R J V m W z k l O U 4 + c P w j / i 0 R X j + 5 f 1 g P + z V T M s E Q s 1 C E i o M r f m o M n n L k r 2 R u 7 X L M 1 x E O 1 j a w e C X G 3 v e + Z 45 x t / g Y R D a 9 + n k N L D 3 l B W 2 + t p 9 O m K 4 k i r W X 1 W p j F Y k c G l Q T D j v p 5 n l 3 i z Y B S n M 4 P r a 29 h c m r d K k 4 n / 8 J Y o w 7 u U R c n o / O 9 C j n h 7 C F B H z j b M J F f h E a q 7 A b w o F r c u o + + N E M D g 3 G r m 6 b Y 7 L 7 o o L J o 1 W M 6 V W E L f V t 15 d j w Z x K R J b d c z a 1 x 0 t r g x v j s n Z s 6 A 7 A o 43 k O A y V p + T j d S I S e R 2 G R c y K 5 z w Z x B 4 T b l I M r r B l N 5 K W w 7 t U G F O A 7 C Z 30 u 3 d T Y c N Y n U b D F g J a Y E H F N g H O + h I 5 k P m + 34 r x / 0 q Y Z Q x l 64 Z A H v w y z X G z i 9 E K P p A 66 M 5 S g + 9 r R h y z J 5 q X T Z A h J a F q / S D e s f 1 h g 3 u Z 4 g I b G Y I x l 0 M I i g e 5 z X 8 O r T 944 Z w 1 j q W g d x v m A D E E U Y L W y f K m l I O B x v h W z 0 J e z R 7 B l t y P d B R x u H + 9 n T H E i y X a e 9 n u m T g S Y N p b f A j r O s y D g 2 X j Z / N c / A U 3 J b B 5 I a X g 6 e h M J D D 5 J 2 r P U L T 3 / 2 C h Q z 2 G m g a a f G q V K d + V R 124 f 8 O N 8 i w 2 k U 1 Y x s P + j V k M 33 u x C n m A Y b Q W W J l c u 3 F r y W j 3 K 9 b b S N 7 y X X T C c I U 4 y f R S p b v F M 3 J 5 Y K d m U e I e W C J N u 6 u y F 1 S 7 Z l p N t I k s k g G i Q r M P 4 w t 10 L n 6 Y O m h b z C V h g v p V 5 k / X P p P V 3 S h J 7 q n b c H l y l / d 0 D h 9 I A l J 5 Z y a q 9 T K F E B u Z B f / N r s I V M j 7 q W W I D + O V y T U I F 5 L H v J A + D 7 V j 2 j n n c N f B + g 9 B n R l m y 6 W f p G X 6 W k S n x t C M 7 F 83 L I N b B H w T I h T 8E4 y A 2 c 4 b f 7 e T f 96 t t S n m j 25 J D 0 y g e T q f N 5 G m Z u q m j H v 11 h Y X Z 2 Z x 21 D k 4 v 5 b B 1 V u 9 j 4 E P s W P d Y K H 7 F h m W L A A h W 3 U b x p Q P T 6 c P m / G R R N c S J f z 29 y S + 6 P j W s C T P E r B 0 G k F 1 B / p h C S 6 D f A c c O V x j o w D F f q 8 l V v u n R + l H y i e 2 a U J 0 n Q 1 o 7 R + G f V q F U I k K K N f D v 5 u F m i 3 y B o 9 E h B 0 N E + h 7 X o j Z k q W Y R L D C E w V H / i 3 R b R 5 l H 0 c q p J m 3 g j r 96e7 J n n p u Q 8 b n y 90 c 8 B N b Y S 9 p q i x v e s + V y D Y j B 4 q x x N 0 g s Q 8 G U v Y Q A I I y Q u 5 E o 9 X N O p f 9 S w B o 7 P e d f n a / M 3 g O m I E m s j K / J Y R H G J F s 8 V O T G 0 + A 3 O H b S 3 W o W f n w C z E Q q v F 65 x z i P 2 L e r t S 3 r u U O 6 f 2 + k 83 k J Y E 9 u r o T 5 i a L 9 p r S F Q w Z + K / u M J T 7 l Q D 2 R 45 M G J b q g U 8 g 6 q 3 I J t X j E + 1 p H 2 y K x n S J K 0 B s t 1 H 2 M i 90 C P u A i b 3 O 9 o H 5 A 99 P u e y w 2 Z 4 r M M b p c D g 9 c W F B K a 7 n / 5 S z 9 K / K C D 5 H y O e y D R B F O 1 v g 7 E P 25 N W G B 4 K U M C W 911 K u O K a k e 799 E W C V S w O l d i R S g F v 0 3 L K i N Z l / m N + N O b e O 0 g 0 X g N Y S Q I 2 d 3 n N E l 3 g k C 8 I K K 3 a Y 7 D Y t P O t 9 N G 6 X D X f Z p 0 i / n N N T U M e f p L h b H A f n 12 d C u K j 18 Q s z l A 6 d a 0 l H 92 j 9 n k k r W 7 K h i H r 1 f B s D P j R 9 m G v V k a o y T o L c 70 N H b Z C 8 L A 8 S s a V m j 4 K t C E O W c M O Q i b o S 87 h I X n 2 T g b g N 6 g Z 9 m J o H P s t T B G s 0 4 W H k X k M j a o 6 N A g R F y 1 R + l f 4 m G b J L u c I T P O C i + F Q V j P P q F 4 S L J b 4 v O t h / h i 84 K C b N
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-04-22T22:01:37Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "marking-definition" ,
"spec_version" : "2.1" ,
"id" : "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ,
"created" : "2017-01-20T00:00:00.000Z" ,
"definition_type" : "tlp" ,
"name" : "TLP:WHITE" ,
"definition" : {
"tlp" : "white"
}
}
2023-04-21 13:25:09 +00:00
]
}
