811 lines
34 KiB
JSON
811 lines
34 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--54cb3580-cde4-4b39-bf8c-443f950d210b",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-01-30T07:44:01.000Z",
|
||
|
|
"modified": "2015-01-30T07:44:01.000Z",
|
||
|
|
"name": "CthulhuSPRL.be",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--54cb3580-cde4-4b39-bf8c-443f950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-01-30T07:44:01.000Z",
|
||
|
|
"modified": "2015-01-30T07:44:01.000Z",
|
||
|
|
"name": "OSINT New 'f0xy' malware is intelligent - employs cunning stealth & trickery from Websense",
|
||
|
|
"published": "2016-02-22T14:40:25Z",
|
||
|
|
"object_refs": [
|
||
|
|
"x-misp-attribute--54cb358c-2360-4acd-ab3c-de9b950d210b",
|
||
|
|
"observed-data--54cb3594-3d30-40d0-a49f-cf08950d210b",
|
||
|
|
"url--54cb3594-3d30-40d0-a49f-cf08950d210b",
|
||
|
|
"indicator--54cb35c2-dc18-4a6f-88c0-05f5950d210b",
|
||
|
|
"indicator--54cb35c2-5204-42c6-b115-05f5950d210b",
|
||
|
|
"indicator--54cb35c3-c3e4-44be-b112-05f5950d210b",
|
||
|
|
"indicator--54cb35c3-b894-4128-8f54-05f5950d210b",
|
||
|
|
"indicator--54cb35c3-7d8c-484c-af92-05f5950d210b",
|
||
|
|
"indicator--54cb35c3-b0bc-4486-9a2b-05f5950d210b",
|
||
|
|
"indicator--54cb35c3-7f58-4d2c-9f87-05f5950d210b",
|
||
|
|
"indicator--54cb35c3-db14-4dcc-805a-05f5950d210b",
|
||
|
|
"indicator--54cb35c3-10dc-4465-a0cd-05f5950d210b",
|
||
|
|
"indicator--54cb35c3-ad38-4403-9de4-05f5950d210b",
|
||
|
|
"indicator--54cb35c3-8268-473b-b22a-05f5950d210b",
|
||
|
|
"indicator--54cb35c3-2828-425d-a232-05f5950d210b",
|
||
|
|
"indicator--54cb35d5-6090-4c3e-8660-c32e950d210b",
|
||
|
|
"indicator--54cb35eb-a9f0-4877-8ad1-4b9d950d210b",
|
||
|
|
"indicator--54cb35eb-bcb8-4b6a-8d62-49d9950d210b",
|
||
|
|
"indicator--54cb360e-7f00-4311-aed4-4505950d210b",
|
||
|
|
"indicator--54cb361c-7c88-4d35-b0e0-cf08950d210b",
|
||
|
|
"x-misp-attribute--54cb3641-6244-4691-98b0-8154950d210b",
|
||
|
|
"indicator--56c64ee5-9114-4be4-b1e4-4ebc950d210f",
|
||
|
|
"indicator--56c64ee7-05e8-4d4d-814e-59a0950d210f",
|
||
|
|
"indicator--56c64ee9-1378-4314-852a-c654950d210f",
|
||
|
|
"indicator--56c64eeb-a314-4f12-b561-4c62950d210f",
|
||
|
|
"indicator--56c64eec-6798-4b97-a239-5f51950d210f",
|
||
|
|
"indicator--56c64ef0-65e4-42d1-bcd9-599c950d210f",
|
||
|
|
"indicator--56c64ee6-e9f0-4c93-81f4-599e950d210f",
|
||
|
|
"indicator--56c64ee7-9ad4-4c88-a202-4028950d210f",
|
||
|
|
"indicator--56c64ee9-fd34-418d-979b-5ca1950d210f",
|
||
|
|
"indicator--56c64eeb-e2fc-420e-afe8-59a0950d210f",
|
||
|
|
"indicator--56c64eee-d864-4b3c-8999-59a4950d210f",
|
||
|
|
"indicator--56c64ef1-a8d8-4d2a-a63f-47c0950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"type:OSINT"
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--54cb358c-2360-4acd-ab3c-de9b950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-01-30T07:41:00.000Z",
|
||
|
|
"modified": "2015-01-30T07:41:00.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "External analysis",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "f0xy"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--54cb3594-3d30-40d0-a49f-cf08950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-01-30T07:41:08.000Z",
|
||
|
|
"modified": "2015-01-30T07:41:08.000Z",
|
||
|
|
"first_observed": "2015-01-30T07:41:08Z",
|
||
|
|
"last_observed": "2015-01-30T07:41:08Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--54cb3594-3d30-40d0-a49f-cf08950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--54cb3594-3d30-40d0-a49f-cf08950d210b",
|
||
|
|
"value": "http://community.websense.com/blogs/securitylabs/archive/2015/01/29/new-f0xy-malware-employs-cunning-stealth-amp-trickery.aspx"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--54cb35c2-dc18-4a6f-88c0-05f5950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-01-30T07:41:54.000Z",
|
||
|
|
"modified": "2015-01-30T07:41:54.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '080c61c9172cd49f6e4e7ef27285ccaaf6d5f0ac']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-01-30T07:41:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--54cb35c2-5204-42c6-b115-05f5950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-01-30T07:41:54.000Z",
|
||
|
|
"modified": "2015-01-30T07:41:54.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c25da337ec5ac041312b062e7fb697e4f01ca8d9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-01-30T07:41:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--54cb35c3-c3e4-44be-b112-05f5950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-01-30T07:41:55.000Z",
|
||
|
|
"modified": "2015-01-30T07:41:55.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'cd4e297928502dece4545acbe0b94dd1270f955c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-01-30T07:41:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--54cb35c3-b894-4128-8f54-05f5950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-01-30T07:41:55.000Z",
|
||
|
|
"modified": "2015-01-30T07:41:55.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'adbf0e4d37e381fe7599695561262d1a65205317']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-01-30T07:41:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--54cb35c3-7d8c-484c-af92-05f5950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-01-30T07:41:55.000Z",
|
||
|
|
"modified": "2015-01-30T07:41:55.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '54d2810aaae67da9fa24f4e11f4c2d5fe4d2b6d4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-01-30T07:41:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--54cb35c3-b0bc-4486-9a2b-05f5950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-01-30T07:41:55.000Z",
|
||
|
|
"modified": "2015-01-30T07:41:55.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '7de3ed8f751a528fde1688d35c6eb5533b09ae11']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-01-30T07:41:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--54cb35c3-7f58-4d2c-9f87-05f5950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-01-30T07:41:55.000Z",
|
||
|
|
"modified": "2015-01-30T07:41:55.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '812e453c22e1a9f70b605cd27d3f642c3778d96d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-01-30T07:41:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--54cb35c3-db14-4dcc-805a-05f5950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-01-30T07:41:55.000Z",
|
||
|
|
"modified": "2015-01-30T07:41:55.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '55c9d015b1f8d68e6b5ce150f2dbab2b621dac1c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-01-30T07:41:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--54cb35c3-10dc-4465-a0cd-05f5950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-01-30T07:41:55.000Z",
|
||
|
|
"modified": "2015-01-30T07:41:55.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'e80d7f27405ece2697a05d6c2612c63335851490']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-01-30T07:41:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--54cb35c3-ad38-4403-9de4-05f5950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-01-30T07:41:55.000Z",
|
||
|
|
"modified": "2015-01-30T07:41:55.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f4f1d8bceb62c72f2fe6713c5395555917fc40ad']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-01-30T07:41:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--54cb35c3-8268-473b-b22a-05f5950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-01-30T07:41:55.000Z",
|
||
|
|
"modified": "2015-01-30T07:41:55.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '2a4837fdb331f823ca474f521248b2cdb766528f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-01-30T07:41:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--54cb35c3-2828-425d-a232-05f5950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-01-30T07:41:55.000Z",
|
||
|
|
"modified": "2015-01-30T07:41:55.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f522e0893ec97438c6184e13adc48219f08b67d8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-01-30T07:41:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--54cb35d5-6090-4c3e-8660-c32e950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-01-30T07:42:13.000Z",
|
||
|
|
"modified": "2015-01-30T07:42:13.000Z",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.53.169.79']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-01-30T07:42:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--54cb35eb-a9f0-4877-8ad1-4b9d950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-01-30T07:42:35.000Z",
|
||
|
|
"modified": "2015-01-30T07:42:35.000Z",
|
||
|
|
"pattern": "[file:name = '\\\\%appdata\\\\%\\\\Microsoft\\\\svchost.exe']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-01-30T07:42:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--54cb35eb-bcb8-4b6a-8d62-49d9950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-01-30T07:42:35.000Z",
|
||
|
|
"modified": "2015-01-30T07:42:35.000Z",
|
||
|
|
"pattern": "[file:name = '\\\\%appdata\\\\%\\\\Microsoft\\\\f0xyupdate.exe']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-01-30T07:42:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--54cb360e-7f00-4311-aed4-4505950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-01-30T07:43:10.000Z",
|
||
|
|
"modified": "2015-01-30T07:43:10.000Z",
|
||
|
|
"pattern": "[windows-registry-key:key = 'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\f0xy']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-01-30T07:43:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"regkey\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--54cb361c-7c88-4d35-b0e0-cf08950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-01-30T07:43:24.000Z",
|
||
|
|
"modified": "2015-01-30T07:43:24.000Z",
|
||
|
|
"pattern": "[rule ws_f0xy_downloader {\r\n\r\n meta:\r\n\r\n description = \"f0xy malware downloader\"\r\n author = \"Nick Griffin (Websense)\"\r\n\r\n strings:\r\n\r\n $mz=\"MZ\"\r\n $string1=\"bitsadmin /transfer\"\r\n $string2=\"del rm.bat\"\r\n $string3=\"av_list=\"\r\n\r\n condition:\r\n\r\n ($mz at 0) and (all of ($string*))\r\n}]",
|
||
|
|
"pattern_type": "yara",
|
||
|
|
"valid_from": "2015-01-30T07:43:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"yara\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--54cb3641-6244-4691-98b0-8154950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-01-30T07:44:01.000Z",
|
||
|
|
"modified": "2015-01-30T07:44:01.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"comment\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "External analysis",
|
||
|
|
"x_misp_type": "comment",
|
||
|
|
"x_misp_value": "Data entered by David Andr\u00c3\u00a9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56c64ee5-9114-4be4-b1e4-4ebc950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-02-18T23:08:21.000Z",
|
||
|
|
"modified": "2016-02-18T23:08:21.000Z",
|
||
|
|
"description": "Automatically added (via 080c61c9172cd49f6e4e7ef27285ccaaf6d5f0ac)",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'f2eccbc5d545221c0d0906a5808f90c6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-02-18T23:08:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56c64ee7-05e8-4d4d-814e-59a0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-02-18T23:08:23.000Z",
|
||
|
|
"modified": "2016-02-18T23:08:23.000Z",
|
||
|
|
"description": "Automatically added (via c25da337ec5ac041312b062e7fb697e4f01ca8d9)",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd46d7edd10bbb3c2d2158606e329ea6d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-02-18T23:08:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56c64ee9-1378-4314-852a-c654950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-02-18T23:08:25.000Z",
|
||
|
|
"modified": "2016-02-18T23:08:25.000Z",
|
||
|
|
"description": "Automatically added (via 7de3ed8f751a528fde1688d35c6eb5533b09ae11)",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'f6ae08aba0a188963e8c299db6a14c0e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-02-18T23:08:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56c64eeb-a314-4f12-b561-4c62950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-02-18T23:08:27.000Z",
|
||
|
|
"modified": "2016-02-18T23:08:27.000Z",
|
||
|
|
"description": "Automatically added (via 812e453c22e1a9f70b605cd27d3f642c3778d96d)",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'dc645cf749611aca49a4e3e6a7c0eb49']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-02-18T23:08:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56c64eec-6798-4b97-a239-5f51950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-02-18T23:08:28.000Z",
|
||
|
|
"modified": "2016-02-18T23:08:28.000Z",
|
||
|
|
"description": "Automatically added (via 55c9d015b1f8d68e6b5ce150f2dbab2b621dac1c)",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'dc4345fe0a312b8b035daa9711b099a7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-02-18T23:08:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56c64ef0-65e4-42d1-bcd9-599c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-02-18T23:08:32.000Z",
|
||
|
|
"modified": "2016-02-18T23:08:32.000Z",
|
||
|
|
"description": "Automatically added (via f522e0893ec97438c6184e13adc48219f08b67d8)",
|
||
|
|
"pattern": "[file:hashes.MD5 = '160634d784c256d29563117554685c31']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-02-18T23:08:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56c64ee6-e9f0-4c93-81f4-599e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-02-18T23:08:22.000Z",
|
||
|
|
"modified": "2016-02-18T23:08:22.000Z",
|
||
|
|
"description": "Automatically added (via 080c61c9172cd49f6e4e7ef27285ccaaf6d5f0ac)",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0c4196bd5f2dea9ded5da5b23f081a713f6452e9a64f9e3898854a6c9d81e412']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-02-18T23:08:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56c64ee7-9ad4-4c88-a202-4028950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-02-18T23:08:23.000Z",
|
||
|
|
"modified": "2016-02-18T23:08:23.000Z",
|
||
|
|
"description": "Automatically added (via c25da337ec5ac041312b062e7fb697e4f01ca8d9)",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '21ed2d1ed704979292ccab5512244423b522fda486ef52fd73b6f851321affb9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-02-18T23:08:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56c64ee9-fd34-418d-979b-5ca1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-02-18T23:08:25.000Z",
|
||
|
|
"modified": "2016-02-18T23:08:25.000Z",
|
||
|
|
"description": "Automatically added (via 7de3ed8f751a528fde1688d35c6eb5533b09ae11)",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2e832777a77f5cc7cfa05183253440484c614733547a4ea0f2f75cfafc165e39']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-02-18T23:08:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56c64eeb-e2fc-420e-afe8-59a0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-02-18T23:08:27.000Z",
|
||
|
|
"modified": "2016-02-18T23:08:27.000Z",
|
||
|
|
"description": "Automatically added (via 812e453c22e1a9f70b605cd27d3f642c3778d96d)",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4d235e31ee278255918157b999fb5987a0cac95cf3ca231950a7adfe49ffc4d7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-02-18T23:08:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56c64eee-d864-4b3c-8999-59a4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-02-18T23:08:30.000Z",
|
||
|
|
"modified": "2016-02-18T23:08:30.000Z",
|
||
|
|
"description": "Automatically added (via 55c9d015b1f8d68e6b5ce150f2dbab2b621dac1c)",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8b62000e09a00755eb9e08523e07b9aef292c96a423d28c863bd018ebba3636d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-02-18T23:08:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56c64ef1-a8d8-4d2a-a63f-47c0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2016-02-18T23:08:33.000Z",
|
||
|
|
"modified": "2016-02-18T23:08:33.000Z",
|
||
|
|
"description": "Automatically added (via f522e0893ec97438c6184e13adc48219f08b67d8)",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c85940369a8028803460baf600203c435179611769a9850a2aef7fb45d2c86d7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-02-18T23:08:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:GREEN",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "green"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|