misp-circl-feed/feeds/circl/misp/621f4e53-cd54-4194-8d8f-4a6e0abe1822.json

{
    "type": "bundle",
    "id": "bundle--621f4e53-cd54-4194-8d8f-4a6e0abe1822",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--56bdf779-46f8-4353-bdf9-2bb95bce2212",
            "created": "2022-10-04T10:50:55.000Z",
            "modified": "2022-10-04T10:50:55.000Z",
            "name": "CERT-FR_1510",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--621f4e53-cd54-4194-8d8f-4a6e0abe1822",
            "created_by_ref": "identity--56bdf779-46f8-4353-bdf9-2bb95bce2212",
            "created": "2022-10-04T10:50:55.000Z",
            "modified": "2022-10-04T10:50:55.000Z",
            "name": "[ESET] IsaacWiper and HermeticWizard: New wiper and worm targeting Ukraine",
            "published": "2022-03-03T09:40:22Z",
            "object_refs": [
                "x-misp-attribute--8ff8162a-1965-4bfb-bc15-d49b47d66c4d",
                "indicator--3d6dc0a1-13a0-4271-83e2-8a7f772feb8a",
                "indicator--e1aa2325-e0e4-46b3-ab9e-970f7e5913c7",
                "indicator--4a2b5c85-f132-4cb3-8416-657cfe948d39",
                "indicator--b14c46e5-412f-4630-99b6-4c69e850267d",
                "indicator--20e73d21-8aed-43e2-b5bb-1fb549206762",
                "indicator--e0bfa427-7b38-41bb-ae0a-80e4825e1f0e",
                "indicator--710d4708-ecbb-4073-a348-9a1824802410",
                "indicator--d26acfcb-6054-44d8-a31d-17e9551336b9"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "fr-classif:non-classifiees=\"NON-CLASSIFIEES\"",
                "cossi:TLP=\"white\"",
                "cossi:RechercheSourceOuverte=\"Autorisee\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "x-misp-attribute",
            "spec_version": "2.1",
            "id": "x-misp-attribute--8ff8162a-1965-4bfb-bc15-d49b47d66c4d",
            "created_by_ref": "identity--56bdf779-46f8-4353-bdf9-2bb95bce2212",
            "created": "2022-03-02T11:00:35.000Z",
            "modified": "2022-03-02T11:00:35.000Z",
            "labels": [
                "misp:type=\"comment\"",
                "misp:category=\"Other\"",
                "misp:to_ids=\"True\"",
                "DescriptionTechnique"
            ],
            "x_misp_category": "Other",
            "x_misp_type": "comment",
            "x_misp_value": "Marqueurs issus d'un blog post pr\u00e9sentant un maliciel destructeur, IsaacWiper, ainsi qu'un m\u00e9canisme de propagation utilis\u00e9 par HermeticWiper utilisant notamment du WMI et du SMB."
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--3d6dc0a1-13a0-4271-83e2-8a7f772feb8a",
            "created_by_ref": "identity--56bdf779-46f8-4353-bdf9-2bb95bce2212",
            "created": "2022-03-02T11:00:35.000Z",
            "modified": "2022-03-02T11:00:35.000Z",
            "description": "HermeticWizard",
            "pattern": "[file:hashes.SHA1 = '3c54c9a49a8ddca02189fe15fea52fe24f41a86f' AND file:name = 'c9EEAF78C9A12.dat']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2022-03-02T11:00:35Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--e1aa2325-e0e4-46b3-ab9e-970f7e5913c7",
            "created_by_ref": "identity--56bdf779-46f8-4353-bdf9-2bb95bce2212",
            "created": "2022-03-02T11:00:35.000Z",
            "modified": "2022-03-02T11:00:35.000Z",
            "description": "IsaacWiper",
            "pattern": "[file:hashes.SHA1 = 'ad602039c6f0237d4a997d5640e92ce5e2b3bba3' AND file:name = 'cl64.dll']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2022-03-02T11:00:35Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--4a2b5c85-f132-4cb3-8416-657cfe948d39",
            "created_by_ref": "identity--56bdf779-46f8-4353-bdf9-2bb95bce2212",
            "created": "2022-03-02T11:00:36.000Z",
            "modified": "2022-03-02T11:00:36.000Z",
            "description": "IsaacWiper",
            "pattern": "[file:hashes.SHA1 = '736a4cfad1ed83a6a0b75b0474d5e01a3a36f950' AND file:name = 'cld.dll']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2022-03-02T11:00:36Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--b14c46e5-412f-4630-99b6-4c69e850267d",
            "created_by_ref": "identity--56bdf779-46f8-4353-bdf9-2bb95bce2212",
            "created": "2022-03-02T11:00:36.000Z",
            "modified": "2022-03-02T11:00:36.000Z",
            "description": "IsaacWiper",
            "pattern": "[file:hashes.SHA1 = 'e9b96e9b86fad28d950ca428879168e0894d854f' AND file:name = 'clean.exe']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2022-03-02T11:00:36Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--20e73d21-8aed-43e2-b5bb-1fb549206762",
            "created_by_ref": "identity--56bdf779-46f8-4353-bdf9-2bb95bce2212",
            "created": "2022-03-02T11:01:23.000Z",
            "modified": "2022-03-02T11:01:23.000Z",
            "description": "HermeticRansom",
            "pattern": "[file:hashes.MD5 = 'd5d2c4ac6c724cd63b69ca054713e278' AND file:hashes.SHA1 = 'f32d791ec9e6385a91b45942c230f52aff1626df' AND file:hashes.SHA256 = '4dc13bb83a16d4ff9865a51b3e4d24112327c526c1392e14d56f20d6f4eaf382' AND file:hashes.SHA512 = '9c2e86ff9da4e8b8e7caa62cd298f5725a459151dc655845fe614bf33639ed975850b3e9ae204d8a9d145a86214c35a486c06787a7ad8a88a85d121d3ee50c91' AND file:name = 'cc2.exe' AND file:size = '3295232' AND file:x_misp_entropy = '5.9679556846481' AND file:x_misp_mimetype = 'PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2022-03-02T11:01:23Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--e0bfa427-7b38-41bb-ae0a-80e4825e1f0e",
            "created_by_ref": "identity--56bdf779-46f8-4353-bdf9-2bb95bce2212",
            "created": "2022-03-02T11:01:25.000Z",
            "modified": "2022-03-02T11:01:25.000Z",
            "description": "HermeticWiper",
            "pattern": "[file:hashes.MD5 = '3f4a16b29f2f0532b7ce3e7656799125' AND file:hashes.SHA1 = '61b25d11392172e587d8da3045812a66c3385451' AND file:hashes.SHA256 = '1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591' AND file:hashes.SHA512 = '32acaceda42128ef9e0a9f36ee2678d2fc296fda2df38629eb223939c8a9352b3bb2b7021bb84e9f223a4a26df57b528a711447b1451213a013fe00f9b971d80' AND file:name = 'conhosts.exe' AND file:size = '117000' AND file:x_misp_entropy = '6.3853905802374' AND file:x_misp_mimetype = 'PE32 executable (GUI) Intel 80386, for MS Windows']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2022-03-02T11:01:25Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--710d4708-ecbb-4073-a348-9a1824802410",
            "created_by_ref": "identity--56bdf779-46f8-4353-bdf9-2bb95bce2212",
            "created": "2022-03-02T11:01:26.000Z",
            "modified": "2022-03-02T11:01:26.000Z",
            "description": "HermeticWiper",
            "pattern": "[file:hashes.MD5 = '84ba0197920fd3e2b7dfa719fee09d2f' AND file:hashes.SHA1 = '912342f1c840a42f6b74132f8a7c4ffe7d40fb77' AND file:hashes.SHA256 = '0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da' AND file:hashes.SHA512 = 'bbd4f0263abc71311404c55cb3e4711b707a71e28dcc1f08abd533a4c7f151db9cc40697105d76f1c978000e8fa7aa219adb65b31fb196b08f1ae003e04b9d23' AND file:name = 'com.exe' AND file:size = '117000' AND file:x_misp_entropy = '6.3817850700557' AND file:x_misp_mimetype = 'PE32 executable (GUI) Intel 80386, for MS Windows']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2022-03-02T11:01:26Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--d26acfcb-6054-44d8-a31d-17e9551336b9",
            "created_by_ref": "identity--56bdf779-46f8-4353-bdf9-2bb95bce2212",
            "created": "2022-03-02T11:01:28.000Z",
            "modified": "2022-03-02T11:01:28.000Z",
            "description": "Legitimate RemCom remote access tool",
            "pattern": "[file:hashes.MD5 = '6983f7001de10f4d19fc2d794c3eb534' AND file:hashes.SHA1 = '23873bf2670cf64c2440058130548d4e4da412dd' AND file:hashes.SHA256 = '3c2fe308c0a563e06263bbacf793bbe9b2259d795fcc36b953793a7e499e7f71' AND file:hashes.SHA512 = '0b04be07d5b3a6b9526a4ae8050861d260bd5334b5320a6d7e6d0f7016199c98d82e5e520fe489e13b0db5146579037c24a22ae6674e9e7b6749b9bf90ad02aa' AND file:name = 'XqoYMlBX.exe' AND file:size = '56320' AND file:x_misp_entropy = '6.2650543077112' AND file:x_misp_mimetype = 'PE32 executable (console) Intel 80386, for MS Windows']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2022-03-02T11:01:28Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}