1105 lines
44 KiB
JSON
1105 lines
44 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--55014406-fd90-4fc1-a814-4638950d210b",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T08:04:34.000Z",
|
||
|
|
"modified": "2015-03-12T08:04:34.000Z",
|
||
|
|
"name": "CthulhuSPRL.be",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--55014406-fd90-4fc1-a814-4638950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T08:04:34.000Z",
|
||
|
|
"modified": "2015-03-12T08:04:34.000Z",
|
||
|
|
"name": "OSINT Tibetan Uprising Day Malware Attacks by Citizen Labs",
|
||
|
|
"published": "2015-03-12T08:30:18Z",
|
||
|
|
"object_refs": [
|
||
|
|
"observed-data--55014411-d4cc-4047-bc11-4dd5950d210b",
|
||
|
|
"url--55014411-d4cc-4047-bc11-4dd5950d210b",
|
||
|
|
"indicator--5501442f-79a8-4594-a548-310e950d210b",
|
||
|
|
"vulnerability--55014445-9d54-4f18-a108-4f7f950d210b",
|
||
|
|
"indicator--5501445e-a540-44d5-801d-4c2c950d210b",
|
||
|
|
"indicator--55014472-b0d8-48fe-800e-ca98950d210b",
|
||
|
|
"indicator--55014472-1174-4e76-838f-ca98950d210b",
|
||
|
|
"indicator--5501448d-2ed8-43ef-8476-492b950d210b",
|
||
|
|
"indicator--550144a0-0f58-4165-94d0-48f2950d210b",
|
||
|
|
"x-misp-attribute--550144aa-d8d4-43f4-b4cc-45f2950d210b",
|
||
|
|
"indicator--550144c6-705c-4176-a9aa-9778950d210b",
|
||
|
|
"observed-data--550144d5-fc14-4bf8-a9af-4fe8950d210b",
|
||
|
|
"url--550144d5-fc14-4bf8-a9af-4fe8950d210b",
|
||
|
|
"indicator--550145af-46c8-4980-8fab-ca98950d210b",
|
||
|
|
"indicator--550145af-1cd8-4470-bddc-ca98950d210b",
|
||
|
|
"indicator--550145af-1448-4610-9e15-ca98950d210b",
|
||
|
|
"x-misp-attribute--550145c6-f97c-4ba4-aa09-9778950d210b",
|
||
|
|
"indicator--550145ec-ddf8-4a02-b69f-49fb950d210b",
|
||
|
|
"indicator--550145ed-a194-4be4-ae2d-49c2950d210b",
|
||
|
|
"indicator--550145ed-4940-425d-8b3d-4532950d210b",
|
||
|
|
"indicator--55014604-fde8-40d8-a01a-9778950d210b",
|
||
|
|
"indicator--5501461f-b418-4dc1-a388-ca98950d210b",
|
||
|
|
"observed-data--55014634-3e34-4ce2-94d9-4d15950d210b",
|
||
|
|
"autonomous-system--55014634-3e34-4ce2-94d9-4d15950d210b",
|
||
|
|
"x-misp-attribute--55014660-9d28-4cca-98bc-4cb7950d210b",
|
||
|
|
"indicator--5501466b-005c-467a-9862-47c4950d210b",
|
||
|
|
"indicator--5501468b-374c-4fec-a0d3-4a94950d210b",
|
||
|
|
"indicator--5501468b-2338-4833-bb8e-456d950d210b",
|
||
|
|
"indicator--5501468b-4f98-4f19-a158-435a950d210b",
|
||
|
|
"indicator--550146d0-f174-4578-a83d-ca98950d210b",
|
||
|
|
"indicator--5501471c-d41c-4568-91e3-41ad950d210b",
|
||
|
|
"indicator--5501471c-4798-4566-a48c-48ad950d210b",
|
||
|
|
"indicator--5501471c-1f40-458f-8f17-40f5950d210b",
|
||
|
|
"indicator--5501471c-58e8-47c0-9fe2-48dc950d210b",
|
||
|
|
"indicator--5501471c-f594-446e-9879-4b61950d210b",
|
||
|
|
"indicator--5501471c-51cc-4abf-b1d9-4f6e950d210b",
|
||
|
|
"indicator--55014746-35d0-487a-9f31-4410950d210b",
|
||
|
|
"indicator--55014746-0bb8-43fe-98a9-4058950d210b",
|
||
|
|
"indicator--55014746-1458-4bcd-aabf-4688950d210b",
|
||
|
|
"indicator--5501479d-ffe8-4bdf-b1ba-0959950d210b",
|
||
|
|
"indicator--5501479d-07b8-45b9-aaf3-0959950d210b",
|
||
|
|
"indicator--550147c2-aeb8-44cc-84eb-4c8f950d210b",
|
||
|
|
"indicator--550147c2-ef78-4730-9051-4e54950d210b",
|
||
|
|
"indicator--550147c2-f8e0-49e2-ac9f-4140950d210b",
|
||
|
|
"indicator--550147f4-84c0-4e82-bc24-0955950d210b",
|
||
|
|
"indicator--550147f5-6850-4f1d-9a7f-0955950d210b",
|
||
|
|
"indicator--550147f5-3fa4-48f9-ac44-0955950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"type:OSINT"
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--55014411-d4cc-4047-bc11-4dd5950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:45:21.000Z",
|
||
|
|
"modified": "2015-03-12T07:45:21.000Z",
|
||
|
|
"first_observed": "2015-03-12T07:45:21Z",
|
||
|
|
"last_observed": "2015-03-12T07:45:21Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--55014411-d4cc-4047-bc11-4dd5950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--55014411-d4cc-4047-bc11-4dd5950d210b",
|
||
|
|
"value": "https://citizenlab.org/2015/03/tibetan-uprising-day-malware-attacks/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5501442f-79a8-4594-a548-310e950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:45:51.000Z",
|
||
|
|
"modified": "2015-03-12T07:45:51.000Z",
|
||
|
|
"pattern": "[email-message:body_multipart[*].body_raw_ref.name = '10th March.doc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T07:45:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"email-attachment\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "vulnerability",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "vulnerability--55014445-9d54-4f18-a108-4f7f950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:46:13.000Z",
|
||
|
|
"modified": "2015-03-12T07:46:13.000Z",
|
||
|
|
"name": "CVE-2012-0158",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"vulnerability\"",
|
||
|
|
"misp:category=\"Payload delivery\""
|
||
|
|
],
|
||
|
|
"external_references": [
|
||
|
|
{
|
||
|
|
"source_name": "cve",
|
||
|
|
"external_id": "CVE-2012-0158"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5501445e-a540-44d5-801d-4c2c950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:59:57.000Z",
|
||
|
|
"modified": "2015-03-12T07:59:57.000Z",
|
||
|
|
"description": "MsAttacker",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '122.10.117.152']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T07:59:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55014472-b0d8-48fe-800e-ca98950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:46:58.000Z",
|
||
|
|
"modified": "2015-03-12T07:46:58.000Z",
|
||
|
|
"pattern": "[url:value = 'http://122.10.117.152/download/ms/MiniJs.dll']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T07:46:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55014472-1174-4e76-838f-ca98950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:46:58.000Z",
|
||
|
|
"modified": "2015-03-12T07:46:58.000Z",
|
||
|
|
"pattern": "[url:value = '/download/ms/MiniJs.dll']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T07:46:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5501448d-2ed8-43ef-8476-492b950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:47:25.000Z",
|
||
|
|
"modified": "2015-03-12T07:47:25.000Z",
|
||
|
|
"pattern": "[file:name = '\\\\%WINDIR\\\\%\\\\system32\\\\teamviewsvc.dll']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T07:47:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--550144a0-0f58-4165-94d0-48f2950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:59:57.000Z",
|
||
|
|
"modified": "2015-03-12T07:59:57.000Z",
|
||
|
|
"description": "MsAttacker",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '23.27.127.200']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T07:59:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--550144aa-d8d4-43f4-b4cc-45f2950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:47:54.000Z",
|
||
|
|
"modified": "2015-03-12T07:47:54.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "External analysis",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "MsAttacker"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--550144c6-705c-4176-a9aa-9778950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:48:22.000Z",
|
||
|
|
"modified": "2015-03-12T07:48:22.000Z",
|
||
|
|
"pattern": "[email-message:body_multipart[*].body_raw_ref.name = 'WTO. non-market status China _1_.doc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T07:48:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"email-attachment\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--550144d5-fc14-4bf8-a9af-4fe8950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:48:37.000Z",
|
||
|
|
"modified": "2015-03-12T07:48:37.000Z",
|
||
|
|
"first_observed": "2015-03-12T07:48:37Z",
|
||
|
|
"last_observed": "2015-03-12T07:48:37Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--550144d5-fc14-4bf8-a9af-4fe8950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--550144d5-fc14-4bf8-a9af-4fe8950d210b",
|
||
|
|
"value": "https://malwr.com/analysis/MDE4MDMzNGQ0MjY2NDY1OWE5ZTVhMDRmZjQzNTlkYWM/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--550145af-46c8-4980-8fab-ca98950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:52:15.000Z",
|
||
|
|
"modified": "2015-03-12T07:52:15.000Z",
|
||
|
|
"description": "MiniJS.dll",
|
||
|
|
"pattern": "[file:hashes.MD5 = '2782c233ddde25040fb1febf9b13611e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T07:52:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--550145af-1cd8-4470-bddc-ca98950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:52:15.000Z",
|
||
|
|
"modified": "2015-03-12T07:52:15.000Z",
|
||
|
|
"description": "MiniJS.dll",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'be50ef6c94f3b630886e1b337e89f4ea9d6e7649']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T07:52:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--550145af-1448-4610-9e15-ca98950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:52:15.000Z",
|
||
|
|
"modified": "2015-03-12T07:52:15.000Z",
|
||
|
|
"description": "MiniJS.dll",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '50aebd2a1e3b8917d6c2b5e88c2e2999b2368fca550c548d0836aa57e35c463f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T07:52:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--550145c6-f97c-4ba4-aa09-9778950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:52:38.000Z",
|
||
|
|
"modified": "2015-03-12T07:52:38.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "External analysis",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "ShadowNet"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--550145ec-ddf8-4a02-b69f-49fb950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:53:16.000Z",
|
||
|
|
"modified": "2015-03-12T07:53:16.000Z",
|
||
|
|
"pattern": "[url:value = 'http://johnsmith152.typepad.com/blog/rss.xml']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T07:53:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--550145ed-a194-4be4-ae2d-49c2950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:53:17.000Z",
|
||
|
|
"modified": "2015-03-12T07:53:17.000Z",
|
||
|
|
"pattern": "[url:value = 'http://mynewshemm.wordpress.com/feed/']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T07:53:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--550145ed-4940-425d-8b3d-4532950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:53:17.000Z",
|
||
|
|
"modified": "2015-03-12T07:53:17.000Z",
|
||
|
|
"pattern": "[url:value = 'http://johnsmith5382.thoughts.com/feed']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T07:53:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55014604-fde8-40d8-a01a-9778950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:53:40.000Z",
|
||
|
|
"modified": "2015-03-12T07:53:40.000Z",
|
||
|
|
"pattern": "[url:value = 'http://www.semamail.info/firex/test.php']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T07:53:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5501461f-b418-4dc1-a388-ca98950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:54:07.000Z",
|
||
|
|
"modified": "2015-03-12T07:54:07.000Z",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '122.10.117.5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T07:54:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--55014634-3e34-4ce2-94d9-4d15950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:54:28.000Z",
|
||
|
|
"modified": "2015-03-12T07:54:28.000Z",
|
||
|
|
"first_observed": "2015-03-12T07:54:28Z",
|
||
|
|
"last_observed": "2015-03-12T07:54:28Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"autonomous-system--55014634-3e34-4ce2-94d9-4d15950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"AS\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "autonomous-system",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "autonomous-system--55014634-3e34-4ce2-94d9-4d15950d210b",
|
||
|
|
"number": 24544
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--55014660-9d28-4cca-98bc-4cb7950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:55:12.000Z",
|
||
|
|
"modified": "2015-03-12T07:55:12.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Attribution\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Attribution",
|
||
|
|
"x_misp_comment": "Registrant of semamail.info",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "mike.fly@email.com"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5501466b-005c-467a-9862-47c4950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:55:23.000Z",
|
||
|
|
"modified": "2015-03-12T07:55:23.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'semamail.info']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T07:55:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5501468b-374c-4fec-a0d3-4a94950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:56:26.000Z",
|
||
|
|
"modified": "2015-03-12T07:56:26.000Z",
|
||
|
|
"description": "Same registrant as semamail.info",
|
||
|
|
"pattern": "[domain-name:value = 'conamail.info']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T07:56:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5501468b-2338-4833-bb8e-456d950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:56:26.000Z",
|
||
|
|
"modified": "2015-03-12T07:56:26.000Z",
|
||
|
|
"description": "Same registrant as semamail.info",
|
||
|
|
"pattern": "[domain-name:value = 'convmail.info']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T07:56:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5501468b-4f98-4f19-a158-435a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:56:26.000Z",
|
||
|
|
"modified": "2015-03-12T07:56:26.000Z",
|
||
|
|
"description": "Same registrant as semamail.info",
|
||
|
|
"pattern": "[domain-name:value = 'fifamp3.info']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T07:56:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--550146d0-f174-4578-a83d-ca98950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:57:04.000Z",
|
||
|
|
"modified": "2015-03-12T07:57:04.000Z",
|
||
|
|
"description": "Also resolved to 122.10.117.35",
|
||
|
|
"pattern": "[domain-name:value = 'rukiyeangel.dyndns.pro']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T07:57:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5501471c-d41c-4568-91e3-41ad950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:58:20.000Z",
|
||
|
|
"modified": "2015-03-12T07:58:20.000Z",
|
||
|
|
"description": "MsAttacker Stage 0",
|
||
|
|
"pattern": "[file:hashes.MD5 = '8346b50c3954b5c25bf13fcd281eb11a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T07:58:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5501471c-4798-4566-a48c-48ad950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:58:20.000Z",
|
||
|
|
"modified": "2015-03-12T07:58:20.000Z",
|
||
|
|
"description": "MsAttacker Stage 0",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'd9a74528bb56a841cea1fe5fa3e0c777a8e96402']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T07:58:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5501471c-1f40-458f-8f17-40f5950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:58:20.000Z",
|
||
|
|
"modified": "2015-03-12T07:58:20.000Z",
|
||
|
|
"description": "MsAttacker Stage 0",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'de7058700f06c5310c26944b28203bc82035f9ff74021649db39a24470517fd1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T07:58:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5501471c-58e8-47c0-9fe2-48dc950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:58:20.000Z",
|
||
|
|
"modified": "2015-03-12T07:58:20.000Z",
|
||
|
|
"description": "MsAttacker Stage 0",
|
||
|
|
"pattern": "[file:hashes.MD5 = '6fc909a57650daff9a8b9264f38444a7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T07:58:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5501471c-f594-446e-9879-4b61950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:58:20.000Z",
|
||
|
|
"modified": "2015-03-12T07:58:20.000Z",
|
||
|
|
"description": "MsAttacker Stage 0",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '2a2a1fae6be0468d388aa2c721a0edd93fb37649']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T07:58:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5501471c-51cc-4abf-b1d9-4f6e950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:58:20.000Z",
|
||
|
|
"modified": "2015-03-12T07:58:20.000Z",
|
||
|
|
"description": "MsAttacker Stage 0",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a264cec4096a04c47013d41dcddab9f99482f8f83d61e13be4bcf4614f79b7a0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T07:58:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55014746-35d0-487a-9f31-4410950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:59:02.000Z",
|
||
|
|
"modified": "2015-03-12T07:59:02.000Z",
|
||
|
|
"description": "MsAttacker Stage 1",
|
||
|
|
"pattern": "[file:hashes.MD5 = '69a0f490de6ae9fdde0ad9cc35305a7d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T07:59:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55014746-0bb8-43fe-98a9-4058950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:59:02.000Z",
|
||
|
|
"modified": "2015-03-12T07:59:02.000Z",
|
||
|
|
"description": "MsAttacker Stage 1",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'e3532fc890f659fb6afb9115b388e0024565888c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T07:59:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55014746-1458-4bcd-aabf-4688950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T07:59:02.000Z",
|
||
|
|
"modified": "2015-03-12T07:59:02.000Z",
|
||
|
|
"description": "MsAttacker Stage 1",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3de8fb09d79166f10f4a10aef1202c2cb45849943f224dc6c61df8d18435e064']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T07:59:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5501479d-ffe8-4bdf-b1ba-0959950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T08:00:29.000Z",
|
||
|
|
"modified": "2015-03-12T08:00:29.000Z",
|
||
|
|
"pattern": "[url:value = 'http://122.10.117.152/download/ms/CryptBase.32.cab']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T08:00:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5501479d-07b8-45b9-aaf3-0959950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T08:00:29.000Z",
|
||
|
|
"modified": "2015-03-12T08:00:29.000Z",
|
||
|
|
"pattern": "[url:value = 'http://122.10.117.152/download/ms/CryptBase.64.cab']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T08:00:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--550147c2-aeb8-44cc-84eb-4c8f950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T08:01:06.000Z",
|
||
|
|
"modified": "2015-03-12T08:01:06.000Z",
|
||
|
|
"description": "ShadowNet Stage 0",
|
||
|
|
"pattern": "[file:hashes.MD5 = '72707089512762fce576e29a0472eb16']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T08:01:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--550147c2-ef78-4730-9051-4e54950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T08:01:06.000Z",
|
||
|
|
"modified": "2015-03-12T08:01:06.000Z",
|
||
|
|
"description": "ShadowNet Stage 0",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '4ab039da14acf7d80fbb11034ef9ccc861c5ed24']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T08:01:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--550147c2-f8e0-49e2-ac9f-4140950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T08:01:06.000Z",
|
||
|
|
"modified": "2015-03-12T08:01:06.000Z",
|
||
|
|
"description": "ShadowNet Stage 0",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ddfa44ebb181282e815e965a1c531c7e145128aa7306b508a563e10d5f9f03fb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T08:01:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--550147f4-84c0-4e82-bc24-0955950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T08:01:56.000Z",
|
||
|
|
"modified": "2015-03-12T08:01:56.000Z",
|
||
|
|
"description": "ShadowNet Stage 1",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd8ae44cd65f97654f066edbcb501d999']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T08:01:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--550147f5-6850-4f1d-9a7f-0955950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T08:01:57.000Z",
|
||
|
|
"modified": "2015-03-12T08:01:57.000Z",
|
||
|
|
"description": "ShadowNet Stage 1",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '602a762dca46f7639210e60c59f89a6e7a16391b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T08:01:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--550147f5-3fa4-48f9-ac44-0955950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-03-12T08:01:57.000Z",
|
||
|
|
"modified": "2015-03-12T08:01:57.000Z",
|
||
|
|
"description": "ShadowNet Stage 1",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e8f36317e29206d48bd0e6dd6570872122be44f82ca1de01aef373b3cdb2c0e1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-03-12T08:01:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:GREEN",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "green"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|