1154 lines
46 KiB
JSON
1154 lines
46 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--5a045167-9e00-4562-95ea-4f67950d210f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:53.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:53.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--5a045167-9e00-4562-95ea-4f67950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:53.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:53.000Z",
|
||
|
|
"name": "M2M - Locky 2017-11-07 : Affid=3, offline, \".asasin\" : \"Invoice #123456789,\" - \"987654321_11_07_2017_12_34_56.doc\"",
|
||
|
|
"published": "2017-11-09T21:16:04Z",
|
||
|
|
"object_refs": [
|
||
|
|
"indicator--5a045167-a8a4-4d58-a2c3-cd7d950d210f",
|
||
|
|
"indicator--5a045168-e9a4-4ac1-a456-cc6f950d210f",
|
||
|
|
"indicator--5a045168-4500-4189-91fb-cd7d950d210f",
|
||
|
|
"indicator--5a045168-a0e0-4af5-af18-20a6950d210f",
|
||
|
|
"observed-data--5a045169-618c-4b69-ae01-cc6f950d210f",
|
||
|
|
"network-traffic--5a045169-618c-4b69-ae01-cc6f950d210f",
|
||
|
|
"ipv4-addr--5a045169-618c-4b69-ae01-cc6f950d210f",
|
||
|
|
"indicator--5a045169-5560-4fe3-9128-4315950d210f",
|
||
|
|
"indicator--5a045169-b658-40e8-9ca3-cd7d950d210f",
|
||
|
|
"observed-data--5a045169-2a7c-4a2a-b450-20a6950d210f",
|
||
|
|
"network-traffic--5a045169-2a7c-4a2a-b450-20a6950d210f",
|
||
|
|
"ipv4-addr--5a045169-2a7c-4a2a-b450-20a6950d210f",
|
||
|
|
"indicator--5a045169-eda4-4983-bb25-cc6f950d210f",
|
||
|
|
"indicator--5a04516a-def4-4074-8f4b-4246950d210f",
|
||
|
|
"observed-data--5a04516a-eb1c-4f8a-aa33-75a9950d210f",
|
||
|
|
"network-traffic--5a04516a-eb1c-4f8a-aa33-75a9950d210f",
|
||
|
|
"ipv4-addr--5a04516a-eb1c-4f8a-aa33-75a9950d210f",
|
||
|
|
"indicator--5a04516a-5c68-4abb-a08b-cda3950d210f",
|
||
|
|
"indicator--5a04516a-a030-41b4-aacd-cc6f950d210f",
|
||
|
|
"observed-data--5a04516b-cb10-494d-9fca-75a9950d210f",
|
||
|
|
"network-traffic--5a04516b-cb10-494d-9fca-75a9950d210f",
|
||
|
|
"ipv4-addr--5a04516b-cb10-494d-9fca-75a9950d210f",
|
||
|
|
"indicator--5a04516b-6584-4610-9cd9-cda3950d210f",
|
||
|
|
"indicator--5a04516b-20a4-4618-9057-20a6950d210f",
|
||
|
|
"observed-data--5a04516c-3ab4-4fe8-bcf8-cdb1950d210f",
|
||
|
|
"network-traffic--5a04516c-3ab4-4fe8-bcf8-cdb1950d210f",
|
||
|
|
"ipv4-addr--5a04516c-3ab4-4fe8-bcf8-cdb1950d210f",
|
||
|
|
"indicator--5a04516c-4eac-4c79-a45c-20a6950d210f",
|
||
|
|
"indicator--5a04516c-5ea4-4eea-bb56-cc6f950d210f",
|
||
|
|
"observed-data--5a04516c-8030-4b0b-9937-cdb1950d210f",
|
||
|
|
"network-traffic--5a04516c-8030-4b0b-9937-cdb1950d210f",
|
||
|
|
"ipv4-addr--5a04516c-8030-4b0b-9937-cdb1950d210f",
|
||
|
|
"indicator--5a04516c-ed38-4f2f-9d4b-cda3950d210f",
|
||
|
|
"indicator--5a04516d-1c74-41bb-9966-cc6f950d210f",
|
||
|
|
"observed-data--5a04516d-9360-4210-a21e-cd7d950d210f",
|
||
|
|
"network-traffic--5a04516d-9360-4210-a21e-cd7d950d210f",
|
||
|
|
"ipv4-addr--5a04516d-9360-4210-a21e-cd7d950d210f",
|
||
|
|
"indicator--5a04516d-719c-4749-9186-20a6950d210f",
|
||
|
|
"indicator--5a04516d-84a0-4cc8-b7fe-cc6f950d210f",
|
||
|
|
"observed-data--5a04516d-2e10-4a7b-a9bb-75a9950d210f",
|
||
|
|
"network-traffic--5a04516d-2e10-4a7b-a9bb-75a9950d210f",
|
||
|
|
"ipv4-addr--5a04516d-2e10-4a7b-a9bb-75a9950d210f",
|
||
|
|
"indicator--5a04516e-6ab0-4855-81db-20a6950d210f",
|
||
|
|
"indicator--5a04516e-3d88-4077-9b82-cdb1950d210f",
|
||
|
|
"observed-data--5a04516e-2288-4505-8fa2-4ee1950d210f",
|
||
|
|
"network-traffic--5a04516e-2288-4505-8fa2-4ee1950d210f",
|
||
|
|
"ipv4-addr--5a04516e-2288-4505-8fa2-4ee1950d210f",
|
||
|
|
"indicator--5a04516e-e63c-4705-9380-75a9950d210f",
|
||
|
|
"indicator--5a04516e-ca4c-4cd8-be82-cdb1950d210f",
|
||
|
|
"observed-data--5a04516f-fd8c-436e-8b40-cc6f950d210f",
|
||
|
|
"network-traffic--5a04516f-fd8c-436e-8b40-cc6f950d210f",
|
||
|
|
"ipv4-addr--5a04516f-fd8c-436e-8b40-cc6f950d210f",
|
||
|
|
"indicator--5a04516f-7394-4834-923d-4172950d210f",
|
||
|
|
"indicator--5a04516f-f968-4fc6-bf01-cda3950d210f",
|
||
|
|
"observed-data--5a045170-8630-4cf2-80c9-cd7d950d210f",
|
||
|
|
"network-traffic--5a045170-8630-4cf2-80c9-cd7d950d210f",
|
||
|
|
"ipv4-addr--5a045170-8630-4cf2-80c9-cd7d950d210f",
|
||
|
|
"indicator--5a045170-0ae0-4d5e-92f4-4cbd950d210f",
|
||
|
|
"indicator--5a045170-837c-4fe2-be39-75a9950d210f",
|
||
|
|
"indicator--5a04c547-9944-4f2d-a279-f6f702de0b81",
|
||
|
|
"indicator--5a04c547-c77c-4644-a98e-f6f702de0b81",
|
||
|
|
"observed-data--5a04c547-c518-48f4-8c57-f6f702de0b81",
|
||
|
|
"url--5a04c547-c518-48f4-8c57-f6f702de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"ecsirt:malicious-code=\"ransomware\"",
|
||
|
|
"misp-galaxy:ransomware=\"Locky\""
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a045167-a8a4-4d58-a2c3-cd7d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:46.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:46.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '8ac7c66efdeefceea010123faa515cdf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-11-09T21:14:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a045168-e9a4-4ac1-a456-cc6f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:46.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:46.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'grhq.mycompany.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-11-09T21:14:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a045168-4500-4189-91fb-cd7d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:46.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:46.000Z",
|
||
|
|
"pattern": "[url:value = 'http://financeforautos.com/693']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-11-09T21:14:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a045168-a0e0-4af5-af18-20a6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:46.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:46.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'financeforautos.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-11-09T21:14:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5a045169-618c-4b69-ae01-cc6f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:46.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:46.000Z",
|
||
|
|
"first_observed": "2017-11-09T21:14:46Z",
|
||
|
|
"last_observed": "2017-11-09T21:14:46Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--5a045169-618c-4b69-ae01-cc6f950d210f",
|
||
|
|
"ipv4-addr--5a045169-618c-4b69-ae01-cc6f950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--5a045169-618c-4b69-ae01-cc6f950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--5a045169-618c-4b69-ae01-cc6f950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--5a045169-618c-4b69-ae01-cc6f950d210f",
|
||
|
|
"value": "72.4.145.228"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a045169-5560-4fe3-9128-4315950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:46.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:46.000Z",
|
||
|
|
"pattern": "[url:value = 'http://galeona.com/693']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-11-09T21:14:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a045169-b658-40e8-9ca3-cd7d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:46.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:46.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'galeona.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-11-09T21:14:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5a045169-2a7c-4a2a-b450-20a6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:46.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:46.000Z",
|
||
|
|
"first_observed": "2017-11-09T21:14:46Z",
|
||
|
|
"last_observed": "2017-11-09T21:14:46Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--5a045169-2a7c-4a2a-b450-20a6950d210f",
|
||
|
|
"ipv4-addr--5a045169-2a7c-4a2a-b450-20a6950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--5a045169-2a7c-4a2a-b450-20a6950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--5a045169-2a7c-4a2a-b450-20a6950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--5a045169-2a7c-4a2a-b450-20a6950d210f",
|
||
|
|
"value": "212.89.16.142"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a045169-eda4-4983-bb25-cc6f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:46.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:46.000Z",
|
||
|
|
"pattern": "[url:value = 'http://giancarlovaccari.com/693']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-11-09T21:14:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a04516a-def4-4074-8f4b-4246950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:46.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:46.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'giancarlovaccari.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-11-09T21:14:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5a04516a-eb1c-4f8a-aa33-75a9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:46.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:46.000Z",
|
||
|
|
"first_observed": "2017-11-09T21:14:46Z",
|
||
|
|
"last_observed": "2017-11-09T21:14:46Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--5a04516a-eb1c-4f8a-aa33-75a9950d210f",
|
||
|
|
"ipv4-addr--5a04516a-eb1c-4f8a-aa33-75a9950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--5a04516a-eb1c-4f8a-aa33-75a9950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--5a04516a-eb1c-4f8a-aa33-75a9950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--5a04516a-eb1c-4f8a-aa33-75a9950d210f",
|
||
|
|
"value": "95.110.147.134"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a04516a-5c68-4abb-a08b-cda3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:46.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:46.000Z",
|
||
|
|
"pattern": "[url:value = 'http://gotcaughtdui.com/693']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-11-09T21:14:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a04516a-a030-41b4-aacd-cc6f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:46.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:46.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'gotcaughtdui.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-11-09T21:14:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5a04516b-cb10-494d-9fca-75a9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:46.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:46.000Z",
|
||
|
|
"first_observed": "2017-11-09T21:14:46Z",
|
||
|
|
"last_observed": "2017-11-09T21:14:46Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--5a04516b-cb10-494d-9fca-75a9950d210f",
|
||
|
|
"ipv4-addr--5a04516b-cb10-494d-9fca-75a9950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--5a04516b-cb10-494d-9fca-75a9950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--5a04516b-cb10-494d-9fca-75a9950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--5a04516b-cb10-494d-9fca-75a9950d210f",
|
||
|
|
"value": "132.148.21.213"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a04516b-6584-4610-9cd9-cda3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:46.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:46.000Z",
|
||
|
|
"pattern": "[url:value = 'http://with-hair.co.jp/693']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-11-09T21:14:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a04516b-20a4-4618-9057-20a6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:46.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:46.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'with-hair.co.jp']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-11-09T21:14:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5a04516c-3ab4-4fe8-bcf8-cdb1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:46.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:46.000Z",
|
||
|
|
"first_observed": "2017-11-09T21:14:46Z",
|
||
|
|
"last_observed": "2017-11-09T21:14:46Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--5a04516c-3ab4-4fe8-bcf8-cdb1950d210f",
|
||
|
|
"ipv4-addr--5a04516c-3ab4-4fe8-bcf8-cdb1950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--5a04516c-3ab4-4fe8-bcf8-cdb1950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--5a04516c-3ab4-4fe8-bcf8-cdb1950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--5a04516c-3ab4-4fe8-bcf8-cdb1950d210f",
|
||
|
|
"value": "27.85.233.43"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a04516c-4eac-4c79-a45c-20a6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:46.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:46.000Z",
|
||
|
|
"pattern": "[url:value = 'http://www.test.doctorsordersltd.co.uk/693']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-11-09T21:14:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a04516c-5ea4-4eea-bb56-cc6f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:46.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:46.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'www.test.doctorsordersltd.co.uk']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-11-09T21:14:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5a04516c-8030-4b0b-9937-cdb1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:46.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:46.000Z",
|
||
|
|
"first_observed": "2017-11-09T21:14:46Z",
|
||
|
|
"last_observed": "2017-11-09T21:14:46Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--5a04516c-8030-4b0b-9937-cdb1950d210f",
|
||
|
|
"ipv4-addr--5a04516c-8030-4b0b-9937-cdb1950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--5a04516c-8030-4b0b-9937-cdb1950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--5a04516c-8030-4b0b-9937-cdb1950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--5a04516c-8030-4b0b-9937-cdb1950d210f",
|
||
|
|
"value": "46.32.236.13"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a04516c-ed38-4f2f-9d4b-cda3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:46.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:46.000Z",
|
||
|
|
"pattern": "[url:value = 'http://teesaddiction.com/JHgd3Dees']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-11-09T21:14:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a04516d-1c74-41bb-9966-cc6f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:46.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:46.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'teesaddiction.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-11-09T21:14:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5a04516d-9360-4210-a21e-cd7d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:46.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:46.000Z",
|
||
|
|
"first_observed": "2017-11-09T21:14:46Z",
|
||
|
|
"last_observed": "2017-11-09T21:14:46Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--5a04516d-9360-4210-a21e-cd7d950d210f",
|
||
|
|
"ipv4-addr--5a04516d-9360-4210-a21e-cd7d950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--5a04516d-9360-4210-a21e-cd7d950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--5a04516d-9360-4210-a21e-cd7d950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--5a04516d-9360-4210-a21e-cd7d950d210f",
|
||
|
|
"value": "217.73.227.10"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a04516d-719c-4749-9186-20a6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:46.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:46.000Z",
|
||
|
|
"pattern": "[url:value = 'http://christaminiatures.nl/JHgd3Dees']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-11-09T21:14:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a04516d-84a0-4cc8-b7fe-cc6f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:46.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:46.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'christaminiatures.nl']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-11-09T21:14:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5a04516d-2e10-4a7b-a9bb-75a9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:46.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:46.000Z",
|
||
|
|
"first_observed": "2017-11-09T21:14:46Z",
|
||
|
|
"last_observed": "2017-11-09T21:14:46Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--5a04516d-2e10-4a7b-a9bb-75a9950d210f",
|
||
|
|
"ipv4-addr--5a04516d-2e10-4a7b-a9bb-75a9950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--5a04516d-2e10-4a7b-a9bb-75a9950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--5a04516d-2e10-4a7b-a9bb-75a9950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--5a04516d-2e10-4a7b-a9bb-75a9950d210f",
|
||
|
|
"value": "37.97.139.59"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a04516e-6ab0-4855-81db-20a6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:46.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:46.000Z",
|
||
|
|
"pattern": "[url:value = 'http://336.linux1.testsider.dk/JHgd3Dees']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-11-09T21:14:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a04516e-3d88-4077-9b82-cdb1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:46.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:46.000Z",
|
||
|
|
"pattern": "[domain-name:value = '336.linux1.testsider.dk']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-11-09T21:14:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5a04516e-2288-4505-8fa2-4ee1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:46.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:46.000Z",
|
||
|
|
"first_observed": "2017-11-09T21:14:46Z",
|
||
|
|
"last_observed": "2017-11-09T21:14:46Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--5a04516e-2288-4505-8fa2-4ee1950d210f",
|
||
|
|
"ipv4-addr--5a04516e-2288-4505-8fa2-4ee1950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--5a04516e-2288-4505-8fa2-4ee1950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--5a04516e-2288-4505-8fa2-4ee1950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--5a04516e-2288-4505-8fa2-4ee1950d210f",
|
||
|
|
"value": "77.243.131.16"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a04516e-e63c-4705-9380-75a9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:46.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:46.000Z",
|
||
|
|
"pattern": "[url:value = 'http://florastor.net/JHgd3Dees']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-11-09T21:14:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a04516e-ca4c-4cd8-be82-cdb1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:47.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:47.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'florastor.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-11-09T21:14:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5a04516f-fd8c-436e-8b40-cc6f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:47.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:47.000Z",
|
||
|
|
"first_observed": "2017-11-09T21:14:47Z",
|
||
|
|
"last_observed": "2017-11-09T21:14:47Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--5a04516f-fd8c-436e-8b40-cc6f950d210f",
|
||
|
|
"ipv4-addr--5a04516f-fd8c-436e-8b40-cc6f950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--5a04516f-fd8c-436e-8b40-cc6f950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--5a04516f-fd8c-436e-8b40-cc6f950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--5a04516f-fd8c-436e-8b40-cc6f950d210f",
|
||
|
|
"value": "149.56.65.61"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a04516f-7394-4834-923d-4172950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:47.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:47.000Z",
|
||
|
|
"pattern": "[url:value = 'http://heinzig.info/JHgd3Dees']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-11-09T21:14:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a04516f-f968-4fc6-bf01-cda3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:47.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:47.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'heinzig.info']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-11-09T21:14:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5a045170-8630-4cf2-80c9-cd7d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:47.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:47.000Z",
|
||
|
|
"first_observed": "2017-11-09T21:14:47Z",
|
||
|
|
"last_observed": "2017-11-09T21:14:47Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--5a045170-8630-4cf2-80c9-cd7d950d210f",
|
||
|
|
"ipv4-addr--5a045170-8630-4cf2-80c9-cd7d950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--5a045170-8630-4cf2-80c9-cd7d950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--5a045170-8630-4cf2-80c9-cd7d950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--5a045170-8630-4cf2-80c9-cd7d950d210f",
|
||
|
|
"value": "46.4.156.11"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a045170-0ae0-4d5e-92f4-4cbd950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:47.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:47.000Z",
|
||
|
|
"pattern": "[url:value = 'http://muchinfaket.net/p66/JHgd3Dees']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-11-09T21:14:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a045170-837c-4fe2-be39-75a9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:47.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:47.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'muchinfaket.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-11-09T21:14:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a04c547-9944-4f2d-a279-f6f702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:47.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:47.000Z",
|
||
|
|
"description": "- Xchecked via VT: 8ac7c66efdeefceea010123faa515cdf",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-11-09T21:14:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a04c547-c77c-4644-a98e-f6f702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:47.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:47.000Z",
|
||
|
|
"description": "- Xchecked via VT: 8ac7c66efdeefceea010123faa515cdf",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '961c26caade6bb374efb19319411f04183af2cb0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-11-09T21:14:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5a04c547-c518-48f4-8c57-f6f702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-11-09T21:14:47.000Z",
|
||
|
|
"modified": "2017-11-09T21:14:47.000Z",
|
||
|
|
"first_observed": "2017-11-09T21:14:47Z",
|
||
|
|
"last_observed": "2017-11-09T21:14:47Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5a04c547-c518-48f4-8c57-f6f702de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5a04c547-c518-48f4-8c57-f6f702de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/28df46fe9876341394f8f0e4dcf17bd76f451ea8347104470acb59291f1735ce/analysis/1510127095/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|