13235 lines
555 KiB
JSON
13235 lines
555 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--580f62f3-271c-4ba1-8b07-4c0d950d210f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-04-24T09:04:19.000Z",
|
||
|
|
"modified": "2017-04-24T09:04:19.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--580f62f3-271c-4ba1-8b07-4c0d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-04-24T09:04:19.000Z",
|
||
|
|
"modified": "2017-04-24T09:04:19.000Z",
|
||
|
|
"name": "OSINT - Lifting the lid on Sednit: A closer look at the software it uses",
|
||
|
|
"published": "2017-04-24T12:02:27Z",
|
||
|
|
"object_refs": [
|
||
|
|
"observed-data--580f6308-9b08-47af-ac21-4063950d210f",
|
||
|
|
"url--580f6308-9b08-47af-ac21-4063950d210f",
|
||
|
|
"observed-data--580f6328-a250-4cfb-bd97-4b28950d210f",
|
||
|
|
"url--580f6328-a250-4cfb-bd97-4b28950d210f",
|
||
|
|
"observed-data--580f6342-65f8-42df-b1f5-4848950d210f",
|
||
|
|
"url--580f6342-65f8-42df-b1f5-4848950d210f",
|
||
|
|
"x-misp-attribute--580f6366-ff80-433d-b8e4-46ae950d210f",
|
||
|
|
"x-misp-attribute--580f638e-db24-4cd4-9159-4b5a950d210f",
|
||
|
|
"indicator--580f63cb-fcc4-431c-9921-4def950d210f",
|
||
|
|
"indicator--580f63cb-0848-4ecf-b8a3-4f80950d210f",
|
||
|
|
"indicator--580f63cc-b804-4d44-8f9b-4590950d210f",
|
||
|
|
"indicator--580f63cd-57ec-44c6-9402-4e5c950d210f",
|
||
|
|
"x-misp-attribute--580f63e2-8758-4684-918b-4d9f950d210f",
|
||
|
|
"x-misp-attribute--580f63e3-19a8-441e-8101-4e27950d210f",
|
||
|
|
"observed-data--580f640a-53c4-4df7-a3da-45bd950d210f",
|
||
|
|
"file--580f640a-53c4-4df7-a3da-45bd950d210f",
|
||
|
|
"observed-data--580f640b-c5f8-4b8f-b57c-4d27950d210f",
|
||
|
|
"file--580f640b-c5f8-4b8f-b57c-4d27950d210f",
|
||
|
|
"observed-data--580f640b-8830-47bb-9ed7-4315950d210f",
|
||
|
|
"file--580f640b-8830-47bb-9ed7-4315950d210f",
|
||
|
|
"observed-data--580f640c-c640-4acc-ad2a-4110950d210f",
|
||
|
|
"file--580f640c-c640-4acc-ad2a-4110950d210f",
|
||
|
|
"observed-data--580f640c-9ab4-4edc-9aff-465d950d210f",
|
||
|
|
"file--580f640c-9ab4-4edc-9aff-465d950d210f",
|
||
|
|
"indicator--580f6439-4ef4-4b99-8ce5-46c9950d210f",
|
||
|
|
"indicator--580f6439-1f20-4046-b962-4f1a950d210f",
|
||
|
|
"indicator--580f643a-f1d0-416c-9062-452e950d210f",
|
||
|
|
"indicator--580f643a-4e30-40a2-b007-41b3950d210f",
|
||
|
|
"indicator--580f643b-8940-4f4d-8568-42fa950d210f",
|
||
|
|
"indicator--580f643b-d6f4-4f8b-809e-4c8a950d210f",
|
||
|
|
"indicator--580f643c-afcc-49b9-a77d-4e39950d210f",
|
||
|
|
"indicator--580f643c-18ac-4864-86eb-40b0950d210f",
|
||
|
|
"indicator--580f643d-edec-4f14-ba9d-477e950d210f",
|
||
|
|
"indicator--580f643d-3d44-49eb-99a1-4e2c950d210f",
|
||
|
|
"indicator--580f643d-5184-4f05-915a-4b8f950d210f",
|
||
|
|
"indicator--580f643e-6dc0-4108-be3e-4f52950d210f",
|
||
|
|
"indicator--580f643e-548c-4b00-9dd1-4a91950d210f",
|
||
|
|
"indicator--580f643f-d954-474d-b7e3-4d35950d210f",
|
||
|
|
"indicator--580f643f-f960-4dd7-975a-4a86950d210f",
|
||
|
|
"indicator--580f6440-f734-4bdd-b170-4fa2950d210f",
|
||
|
|
"indicator--580f6440-3154-47a4-b4ae-4204950d210f",
|
||
|
|
"indicator--580f6441-cc08-4e00-ab4d-4127950d210f",
|
||
|
|
"indicator--580f6441-6cac-4da2-8af9-47db950d210f",
|
||
|
|
"indicator--580f6442-f2fc-4671-a5c7-4f99950d210f",
|
||
|
|
"indicator--580f6442-5d80-4acc-976d-4855950d210f",
|
||
|
|
"indicator--580f6443-1a20-4ec1-806b-466c950d210f",
|
||
|
|
"indicator--580f6443-f708-4d37-9cea-41b2950d210f",
|
||
|
|
"indicator--580f6444-3004-404d-a642-44bd950d210f",
|
||
|
|
"indicator--580f6444-c998-4bfb-9adc-4111950d210f",
|
||
|
|
"indicator--580f6445-f0e8-470d-8886-4132950d210f",
|
||
|
|
"indicator--580f6445-3be0-4ba9-8ec4-4501950d210f",
|
||
|
|
"indicator--580f6446-4478-4a9f-86f5-4d88950d210f",
|
||
|
|
"indicator--580f6446-ee74-424c-98c2-473e950d210f",
|
||
|
|
"indicator--580f6447-5cf0-459d-8107-4ecb950d210f",
|
||
|
|
"indicator--580f6447-33b8-40e2-bf6e-4fb2950d210f",
|
||
|
|
"indicator--580f6448-5b90-408f-8825-4911950d210f",
|
||
|
|
"indicator--580f6448-6a6c-4d3e-8e37-4cc8950d210f",
|
||
|
|
"indicator--580f6449-0e3c-426d-aaf8-4443950d210f",
|
||
|
|
"indicator--580f6449-c068-433d-b14c-4b6c950d210f",
|
||
|
|
"indicator--580f644a-96fc-4f9e-b153-4c4c950d210f",
|
||
|
|
"indicator--580f644a-4d6c-404a-9863-4899950d210f",
|
||
|
|
"x-misp-attribute--580f6479-1e0c-4e51-a4a4-4453950d210f",
|
||
|
|
"x-misp-attribute--580f647a-9b48-484b-979d-4485950d210f",
|
||
|
|
"x-misp-attribute--580f647a-8ff4-4b09-9610-441d950d210f",
|
||
|
|
"x-misp-attribute--580f647b-1398-4aef-a9e2-4513950d210f",
|
||
|
|
"x-misp-attribute--580f647b-7b48-405b-b843-45b8950d210f",
|
||
|
|
"x-misp-attribute--580f647c-73ec-4b4a-be66-4cc3950d210f",
|
||
|
|
"x-misp-attribute--580f647c-1ce0-4dc7-9ec7-45a5950d210f",
|
||
|
|
"x-misp-attribute--580f647d-96bc-45e6-9478-41c8950d210f",
|
||
|
|
"x-misp-attribute--580f647d-2bc8-410b-bc17-4220950d210f",
|
||
|
|
"x-misp-attribute--580f647e-6af0-4195-93e9-4290950d210f",
|
||
|
|
"x-misp-attribute--580f647e-7560-44af-8957-4448950d210f",
|
||
|
|
"x-misp-attribute--580f647f-0894-4838-96aa-429f950d210f",
|
||
|
|
"x-misp-attribute--580f647f-0770-4008-ab58-4532950d210f",
|
||
|
|
"x-misp-attribute--580f6480-fff0-4a5e-8677-47cb950d210f",
|
||
|
|
"x-misp-attribute--580f6480-c980-490e-8f9d-4f4d950d210f",
|
||
|
|
"x-misp-attribute--580f6480-7170-4b3a-afcf-4805950d210f",
|
||
|
|
"x-misp-attribute--580f6481-0bd8-4234-966e-4ee8950d210f",
|
||
|
|
"x-misp-attribute--580f6481-57f8-4d20-b4df-4bad950d210f",
|
||
|
|
"x-misp-attribute--580f6482-9060-4e52-85a3-449a950d210f",
|
||
|
|
"x-misp-attribute--580f6482-35d8-42ce-a2bf-4fa2950d210f",
|
||
|
|
"indicator--580f64cb-3274-41c0-b903-47f1950d210f",
|
||
|
|
"indicator--580f64cb-0054-4a81-afab-4438950d210f",
|
||
|
|
"indicator--580f64cc-f63c-42f3-ae89-438f950d210f",
|
||
|
|
"indicator--580f64cc-888c-4784-a364-45ea950d210f",
|
||
|
|
"indicator--580f64cd-d160-4be4-bfcd-4fd1950d210f",
|
||
|
|
"indicator--580f64cd-3ca8-4baa-b030-43e1950d210f",
|
||
|
|
"indicator--580f64ce-9818-4382-aed3-4c61950d210f",
|
||
|
|
"indicator--580f64ce-1830-4f2a-bfd4-415c950d210f",
|
||
|
|
"indicator--580f64cf-f474-496a-9bb8-43d8950d210f",
|
||
|
|
"indicator--580f64cf-1240-4dad-89f9-4f13950d210f",
|
||
|
|
"indicator--580f64d0-004c-4157-bebb-4cf2950d210f",
|
||
|
|
"indicator--580f64d0-c874-40ec-8fd0-439b950d210f",
|
||
|
|
"indicator--580f64d1-b3e8-4751-baa2-4a42950d210f",
|
||
|
|
"indicator--580f64d1-9450-4764-9d60-4a8b950d210f",
|
||
|
|
"indicator--580f64d2-39fc-48cf-9152-42dd950d210f",
|
||
|
|
"indicator--580f64d3-3914-4e9c-9c25-479f950d210f",
|
||
|
|
"indicator--580f64d3-c420-4559-91f2-400c950d210f",
|
||
|
|
"indicator--580f64d4-339c-41bc-9bc3-414b950d210f",
|
||
|
|
"indicator--580f64d4-1418-4f13-a3bc-40a6950d210f",
|
||
|
|
"indicator--580f64d5-b2d0-429f-90a6-4279950d210f",
|
||
|
|
"indicator--580f64d5-e254-4ae0-a057-484b950d210f",
|
||
|
|
"indicator--580f64d6-9fa8-4347-962f-4a38950d210f",
|
||
|
|
"indicator--580f64d6-a58c-44e9-b050-4882950d210f",
|
||
|
|
"indicator--580f64d7-9ce4-4706-9583-48d4950d210f",
|
||
|
|
"indicator--580f64d7-cc64-482d-8770-4e59950d210f",
|
||
|
|
"indicator--580f64d8-8b84-4ea5-bcbe-474d950d210f",
|
||
|
|
"indicator--580f64d8-a8dc-4c7a-a3e6-4220950d210f",
|
||
|
|
"indicator--580f64d9-36e0-4953-a888-4a1b950d210f",
|
||
|
|
"indicator--580f64da-23ec-492d-b77e-47d8950d210f",
|
||
|
|
"indicator--580f64da-2970-4010-a3bd-47d6950d210f",
|
||
|
|
"indicator--580f64db-0d88-4b3c-b617-42eb950d210f",
|
||
|
|
"indicator--580f64db-4594-4627-82ed-4b98950d210f",
|
||
|
|
"indicator--580f64dc-0ea0-4cde-92cb-4c4e950d210f",
|
||
|
|
"indicator--580f64dd-a1d4-46db-9486-46fd950d210f",
|
||
|
|
"indicator--580f64dd-9fc4-4fa2-9de7-4fe3950d210f",
|
||
|
|
"indicator--580f64de-8f28-4a1f-8cf9-4501950d210f",
|
||
|
|
"indicator--580f64de-2ecc-4ed1-98f5-432a950d210f",
|
||
|
|
"indicator--580f64df-8fd8-4fc0-b540-4bf8950d210f",
|
||
|
|
"indicator--580f64f9-2358-4efb-89fd-4c63950d210f",
|
||
|
|
"indicator--580f64fa-ba58-494b-8997-446c950d210f",
|
||
|
|
"indicator--580f64fa-832c-4f89-87ec-44b3950d210f",
|
||
|
|
"observed-data--580f6530-5160-4c00-9de8-4c3c950d210f",
|
||
|
|
"file--580f6530-5160-4c00-9de8-4c3c950d210f",
|
||
|
|
"observed-data--580f6531-43d8-428f-b605-425c950d210f",
|
||
|
|
"file--580f6531-43d8-428f-b605-425c950d210f",
|
||
|
|
"observed-data--580f6532-ebe8-4a16-a8ff-4d01950d210f",
|
||
|
|
"file--580f6532-ebe8-4a16-a8ff-4d01950d210f",
|
||
|
|
"observed-data--580f6532-8ddc-4167-8163-4d7a950d210f",
|
||
|
|
"file--580f6532-8ddc-4167-8163-4d7a950d210f",
|
||
|
|
"observed-data--580f6533-d314-48d0-9d8e-44cb950d210f",
|
||
|
|
"file--580f6533-d314-48d0-9d8e-44cb950d210f",
|
||
|
|
"observed-data--580f6533-4f7c-46dd-92fb-4a0d950d210f",
|
||
|
|
"file--580f6533-4f7c-46dd-92fb-4a0d950d210f",
|
||
|
|
"observed-data--580f6534-93f0-4a5d-bb87-4b45950d210f",
|
||
|
|
"file--580f6534-93f0-4a5d-bb87-4b45950d210f",
|
||
|
|
"observed-data--580f6535-0704-4901-bd24-453f950d210f",
|
||
|
|
"file--580f6535-0704-4901-bd24-453f950d210f",
|
||
|
|
"observed-data--580f6535-76f0-4997-9ede-44bf950d210f",
|
||
|
|
"file--580f6535-76f0-4997-9ede-44bf950d210f",
|
||
|
|
"observed-data--580f6536-f668-4fe9-8a9d-4071950d210f",
|
||
|
|
"file--580f6536-f668-4fe9-8a9d-4071950d210f",
|
||
|
|
"observed-data--580f6536-c2c4-420e-bd1e-4214950d210f",
|
||
|
|
"file--580f6536-c2c4-420e-bd1e-4214950d210f",
|
||
|
|
"observed-data--580f6537-f968-4a26-93b3-4780950d210f",
|
||
|
|
"file--580f6537-f968-4a26-93b3-4780950d210f",
|
||
|
|
"observed-data--580f6537-a3ac-4b46-8826-4937950d210f",
|
||
|
|
"file--580f6537-a3ac-4b46-8826-4937950d210f",
|
||
|
|
"observed-data--580f6538-274c-40eb-b631-45e8950d210f",
|
||
|
|
"file--580f6538-274c-40eb-b631-45e8950d210f",
|
||
|
|
"observed-data--580f6539-da20-4a44-bc2a-4d3f950d210f",
|
||
|
|
"file--580f6539-da20-4a44-bc2a-4d3f950d210f",
|
||
|
|
"observed-data--580f6539-1b48-497c-b728-4efc950d210f",
|
||
|
|
"file--580f6539-1b48-497c-b728-4efc950d210f",
|
||
|
|
"observed-data--580f653a-083c-4011-802d-49cb950d210f",
|
||
|
|
"file--580f653a-083c-4011-802d-49cb950d210f",
|
||
|
|
"observed-data--580f653a-1ac0-4c37-aa18-4999950d210f",
|
||
|
|
"file--580f653a-1ac0-4c37-aa18-4999950d210f",
|
||
|
|
"observed-data--580f653b-e310-47fe-bea1-454a950d210f",
|
||
|
|
"file--580f653b-e310-47fe-bea1-454a950d210f",
|
||
|
|
"indicator--580f6566-5284-486a-aec2-4032950d210f",
|
||
|
|
"indicator--580f6566-668c-498b-9f41-43fe950d210f",
|
||
|
|
"indicator--580f6567-e8e4-4952-9a45-4147950d210f",
|
||
|
|
"indicator--580f6567-7f5c-42f5-a0ea-4e7d950d210f",
|
||
|
|
"indicator--580f6568-5290-4008-ac07-4c66950d210f",
|
||
|
|
"indicator--580f6568-64a8-46a4-87a1-42fa950d210f",
|
||
|
|
"observed-data--580f65ad-ffd4-417f-8f00-4687950d210f",
|
||
|
|
"file--580f65ad-ffd4-417f-8f00-4687950d210f",
|
||
|
|
"observed-data--580f65ae-11e0-4513-956b-4b72950d210f",
|
||
|
|
"file--580f65ae-11e0-4513-956b-4b72950d210f",
|
||
|
|
"observed-data--580f65ae-6b2c-4248-8d6d-4570950d210f",
|
||
|
|
"file--580f65ae-6b2c-4248-8d6d-4570950d210f",
|
||
|
|
"indicator--580f65cb-dc7c-4363-9e7b-46c2950d210f",
|
||
|
|
"indicator--580f6610-b7b0-494c-857d-455a950d210f",
|
||
|
|
"indicator--580f6611-4fd8-4e2d-ab0e-4fcc950d210f",
|
||
|
|
"indicator--580f6611-3660-4797-8d50-4093950d210f",
|
||
|
|
"indicator--580f6612-a31c-456d-a57c-4caf950d210f",
|
||
|
|
"indicator--580f6612-d56c-423e-865c-42d3950d210f",
|
||
|
|
"indicator--580f6613-1a78-46ef-91c0-4674950d210f",
|
||
|
|
"indicator--580f6613-1ccc-40af-b832-4088950d210f",
|
||
|
|
"indicator--580f6614-594c-4df1-9b0f-4c9f950d210f",
|
||
|
|
"indicator--580f6614-25f8-4690-898c-40b4950d210f",
|
||
|
|
"indicator--580f6614-5a6c-429b-9253-459e950d210f",
|
||
|
|
"indicator--580f6615-b9dc-4980-9b03-445d950d210f",
|
||
|
|
"x-misp-attribute--580f6630-9c80-4690-9cc2-4f05950d210f",
|
||
|
|
"x-misp-attribute--580f666b-c91c-48b9-bd22-40a9950d210f",
|
||
|
|
"x-misp-attribute--580f666c-de3c-402b-b8fc-44fb950d210f",
|
||
|
|
"x-misp-attribute--580f666c-7404-446c-99b9-4c53950d210f",
|
||
|
|
"x-misp-attribute--580f666d-fb14-421d-9a4e-4a03950d210f",
|
||
|
|
"x-misp-attribute--580f666d-a150-4907-966d-42da950d210f",
|
||
|
|
"x-misp-attribute--580f666e-fd3c-42d0-85db-4e9f950d210f",
|
||
|
|
"x-misp-attribute--580f666e-1900-489d-abed-4f05950d210f",
|
||
|
|
"x-misp-attribute--580f666f-dacc-4fb3-ab95-4189950d210f",
|
||
|
|
"x-misp-attribute--580f666f-745c-42c6-91d5-4212950d210f",
|
||
|
|
"x-misp-attribute--580f6670-aa4c-484e-989d-4d52950d210f",
|
||
|
|
"x-misp-attribute--580f6670-0828-4d20-907e-4b0f950d210f",
|
||
|
|
"x-misp-attribute--580f6671-2f80-4fb6-83ba-45d0950d210f",
|
||
|
|
"x-misp-attribute--580f6671-797c-412f-bf4d-49cf950d210f",
|
||
|
|
"indicator--580f669c-b714-427c-88f3-4808950d210f",
|
||
|
|
"indicator--580f669d-bf18-479a-83cc-481d950d210f",
|
||
|
|
"indicator--580f669d-b2d4-479d-bcf4-4202950d210f",
|
||
|
|
"indicator--580f669d-8d3c-4ccb-83f2-40b5950d210f",
|
||
|
|
"indicator--580f669e-84a0-48e3-9dfc-4bc0950d210f",
|
||
|
|
"indicator--580f669e-72b0-4476-9eb7-4d60950d210f",
|
||
|
|
"indicator--580f669f-f16c-4068-8601-4af8950d210f",
|
||
|
|
"indicator--580f669f-4990-4144-85ee-43db950d210f",
|
||
|
|
"indicator--580f66a0-865c-4dff-849b-4f9d950d210f",
|
||
|
|
"indicator--580f66a0-3bfc-4b91-ac99-4eb6950d210f",
|
||
|
|
"indicator--580f66a1-a220-4502-a62f-40a0950d210f",
|
||
|
|
"indicator--580f66a1-2210-445c-a0e1-427c950d210f",
|
||
|
|
"indicator--580f66a2-5788-492a-9cf0-4b9f950d210f",
|
||
|
|
"indicator--580f66a2-50b0-4679-85ea-4671950d210f",
|
||
|
|
"indicator--580f66a2-45d4-4c96-a589-4135950d210f",
|
||
|
|
"indicator--580f66a3-964c-4f3c-a54b-437e950d210f",
|
||
|
|
"indicator--580f66a3-0fe0-4fd4-86e9-4dba950d210f",
|
||
|
|
"indicator--580f66a4-8a6c-42af-9f02-4714950d210f",
|
||
|
|
"indicator--580f66d0-7b2c-4995-8330-4a8e950d210f",
|
||
|
|
"indicator--580f66d1-ed10-4914-b5c4-436a950d210f",
|
||
|
|
"indicator--580f66d1-b814-4da4-8acf-477f950d210f",
|
||
|
|
"indicator--580f66d2-df78-485b-b847-4788950d210f",
|
||
|
|
"observed-data--580f671a-a06c-427c-9fed-4770950d210f",
|
||
|
|
"file--580f671a-a06c-427c-9fed-4770950d210f",
|
||
|
|
"observed-data--580f671b-c618-4858-8030-4f35950d210f",
|
||
|
|
"file--580f671b-c618-4858-8030-4f35950d210f",
|
||
|
|
"observed-data--580f671b-f288-4b0e-9bf1-4e69950d210f",
|
||
|
|
"file--580f671b-f288-4b0e-9bf1-4e69950d210f",
|
||
|
|
"indicator--580f674e-293c-45a4-b49e-4de9950d210f",
|
||
|
|
"indicator--580f674f-f488-480a-af78-4337950d210f",
|
||
|
|
"indicator--580f674f-6ce0-4d88-b32c-4a66950d210f",
|
||
|
|
"indicator--580f6750-6e94-4d4e-8bc6-4ad3950d210f",
|
||
|
|
"indicator--580f6750-4410-4e4f-8a66-4cb2950d210f",
|
||
|
|
"indicator--580f6780-d48c-4345-a967-4fb3950d210f",
|
||
|
|
"indicator--580f6781-fe44-4817-93b7-4cff950d210f",
|
||
|
|
"indicator--580f6781-c910-4a32-8522-4331950d210f",
|
||
|
|
"indicator--580f6782-f628-4544-9c9b-4cee950d210f",
|
||
|
|
"indicator--580f6782-e2e0-4e1d-ae26-4171950d210f",
|
||
|
|
"indicator--580f6783-9b78-481a-9d47-4304950d210f",
|
||
|
|
"indicator--580f6784-30fc-44cc-acb0-4fce950d210f",
|
||
|
|
"indicator--580f6784-3a20-47ec-9376-40de950d210f",
|
||
|
|
"indicator--580f67d6-9738-4e08-a049-4044950d210f",
|
||
|
|
"indicator--580f67d6-5ec4-43c9-a6d0-446a950d210f",
|
||
|
|
"indicator--580f67d7-af08-4180-9f0c-4b10950d210f",
|
||
|
|
"indicator--580f67d7-390c-46a3-821d-459d950d210f",
|
||
|
|
"indicator--580f67d8-3d38-45bd-a23a-4f57950d210f",
|
||
|
|
"indicator--580f67d8-1b6c-4f02-a63f-441e950d210f",
|
||
|
|
"indicator--580f67d9-e16c-4c3d-878a-4d36950d210f",
|
||
|
|
"indicator--580f6803-b188-42b3-9594-4b34950d210f",
|
||
|
|
"indicator--580f6803-bf38-498a-a1c9-43c0950d210f",
|
||
|
|
"indicator--580f6804-9d50-4ae9-92a2-4c24950d210f",
|
||
|
|
"observed-data--580f681d-f1dc-451f-a758-4eb7950d210f",
|
||
|
|
"file--580f681d-f1dc-451f-a758-4eb7950d210f",
|
||
|
|
"observed-data--580f681e-8bf0-49d9-a6bc-4ae1950d210f",
|
||
|
|
"file--580f681e-8bf0-49d9-a6bc-4ae1950d210f",
|
||
|
|
"observed-data--580f681e-92c8-4359-8fcf-49ef950d210f",
|
||
|
|
"file--580f681e-92c8-4359-8fcf-49ef950d210f",
|
||
|
|
"indicator--580f6850-bbdc-4c11-9947-4d20950d210f",
|
||
|
|
"indicator--580f6851-716c-453c-a1d5-48cf950d210f",
|
||
|
|
"observed-data--580f687c-ca08-47e0-877a-4f75950d210f",
|
||
|
|
"windows-registry-key--580f687c-ca08-47e0-877a-4f75950d210f",
|
||
|
|
"observed-data--580f687d-443c-4f4a-9224-433b950d210f",
|
||
|
|
"windows-registry-key--580f687d-443c-4f4a-9224-433b950d210f",
|
||
|
|
"indicator--580f68b3-52ec-4506-98c2-4c2d950d210f",
|
||
|
|
"indicator--580f68b4-f5d0-4579-9771-4e2d950d210f",
|
||
|
|
"indicator--580f68e6-cdb8-4d19-b67a-42f5950d210f",
|
||
|
|
"indicator--580f68e7-f054-4a7d-91ac-46a8950d210f",
|
||
|
|
"indicator--580f68e7-2538-4753-8d52-4d18950d210f",
|
||
|
|
"indicator--580f68e8-63b8-4cb8-b4a3-4df1950d210f",
|
||
|
|
"indicator--580f68e8-94dc-434e-8652-40d0950d210f",
|
||
|
|
"indicator--580f68e8-f510-40e5-a361-4436950d210f",
|
||
|
|
"indicator--580f68e9-feb4-40a6-b833-43e8950d210f",
|
||
|
|
"indicator--580f68e9-d294-467a-8ec8-4777950d210f",
|
||
|
|
"indicator--580f68ea-8f84-4f2e-bc03-4128950d210f",
|
||
|
|
"indicator--580f68ea-5c88-445d-911e-4e0b950d210f",
|
||
|
|
"indicator--580f68eb-c900-44d7-a00f-4ce8950d210f",
|
||
|
|
"indicator--580f68eb-1ba8-428e-b415-425f950d210f",
|
||
|
|
"indicator--580f68ec-c188-46d6-935d-4498950d210f",
|
||
|
|
"indicator--580f68ec-3db0-4fbb-be82-43ba950d210f",
|
||
|
|
"indicator--580f693e-fa84-4157-a425-458a950d210f",
|
||
|
|
"indicator--580f693e-03a0-4bc4-b079-4aa8950d210f",
|
||
|
|
"indicator--580f693f-f0dc-447e-aa0f-47c3950d210f",
|
||
|
|
"indicator--580f693f-3494-436a-b82b-4c40950d210f",
|
||
|
|
"indicator--580f6940-facc-44dc-a59c-443e950d210f",
|
||
|
|
"indicator--580f6940-cee0-4e32-a522-45b5950d210f",
|
||
|
|
"indicator--580f6941-a4f4-4648-b50a-46a0950d210f",
|
||
|
|
"indicator--580f6941-b984-405c-a208-400a950d210f",
|
||
|
|
"indicator--580f6942-d9c4-4d51-8b3a-41ec950d210f",
|
||
|
|
"indicator--580f6942-98c0-4638-9b80-4910950d210f",
|
||
|
|
"indicator--580f6943-0310-4463-8e4f-4d95950d210f",
|
||
|
|
"indicator--580f6943-079c-4145-9bc1-4073950d210f",
|
||
|
|
"indicator--580f6944-b4a0-46d3-a595-4441950d210f",
|
||
|
|
"indicator--580f6971-e804-4020-babf-4286950d210f",
|
||
|
|
"indicator--580f6972-c218-4e63-9426-41d7950d210f",
|
||
|
|
"indicator--580f6972-27e4-41c2-9c40-4e9a950d210f",
|
||
|
|
"indicator--580f6973-bdf0-4243-b58f-4fa4950d210f",
|
||
|
|
"indicator--580f6973-533c-471c-bfb7-40db950d210f",
|
||
|
|
"indicator--580f6974-efd8-45d1-9b8b-4d73950d210f",
|
||
|
|
"indicator--580f6974-c964-4a05-bd07-43f9950d210f",
|
||
|
|
"indicator--580f6975-d540-45da-87f9-469e950d210f",
|
||
|
|
"indicator--580f6975-01ec-4f19-919f-4eb1950d210f",
|
||
|
|
"indicator--580f6975-7714-468b-a655-4a3a950d210f",
|
||
|
|
"x-misp-attribute--580f69b8-e388-47c2-9e5e-41bd950d210f",
|
||
|
|
"x-misp-attribute--580f69b8-a6ec-424b-b1a7-4cd2950d210f",
|
||
|
|
"x-misp-attribute--580f69b9-d3e8-4760-ae64-4b36950d210f",
|
||
|
|
"x-misp-attribute--580f69b9-7684-4d05-913e-4d55950d210f",
|
||
|
|
"indicator--580f6a03-88dc-458a-b3bf-41a502de0b81",
|
||
|
|
"indicator--580f6a04-f51c-4651-b691-4f5602de0b81",
|
||
|
|
"observed-data--580f6a04-0918-40e9-a5a1-4d8602de0b81",
|
||
|
|
"url--580f6a04-0918-40e9-a5a1-4d8602de0b81",
|
||
|
|
"indicator--580f6a05-41b4-4705-9841-416202de0b81",
|
||
|
|
"indicator--580f6a05-cdbc-4642-80bd-430402de0b81",
|
||
|
|
"observed-data--580f6a06-36c0-4509-97db-4a7a02de0b81",
|
||
|
|
"url--580f6a06-36c0-4509-97db-4a7a02de0b81",
|
||
|
|
"indicator--580f6a06-4d34-4d09-ad8d-46a602de0b81",
|
||
|
|
"indicator--580f6a07-9630-464d-87ac-467202de0b81",
|
||
|
|
"observed-data--580f6a07-15f4-4055-9ab4-413302de0b81",
|
||
|
|
"url--580f6a07-15f4-4055-9ab4-413302de0b81",
|
||
|
|
"indicator--580f6a08-3138-4e0f-b30e-4aac02de0b81",
|
||
|
|
"indicator--580f6a08-b8bc-40ae-928f-42ab02de0b81",
|
||
|
|
"observed-data--580f6a09-ffcc-4793-89b3-4c4f02de0b81",
|
||
|
|
"url--580f6a09-ffcc-4793-89b3-4c4f02de0b81",
|
||
|
|
"indicator--580f6a09-925c-4d30-a0ee-4cf202de0b81",
|
||
|
|
"indicator--580f6a0a-c11c-402d-9ba0-43b002de0b81",
|
||
|
|
"observed-data--580f6a0a-1fcc-4fee-b2c1-4bab02de0b81",
|
||
|
|
"url--580f6a0a-1fcc-4fee-b2c1-4bab02de0b81",
|
||
|
|
"indicator--580f6a0b-ab80-4a1b-b559-425402de0b81",
|
||
|
|
"indicator--580f6a0c-22a8-4fde-8d9e-477802de0b81",
|
||
|
|
"observed-data--580f6a0c-1bb8-4b29-a441-4b1d02de0b81",
|
||
|
|
"url--580f6a0c-1bb8-4b29-a441-4b1d02de0b81",
|
||
|
|
"indicator--580f6a0d-61b0-4d62-bee0-4d6202de0b81",
|
||
|
|
"indicator--580f6a0d-ab78-4ce2-8fe3-4b4902de0b81",
|
||
|
|
"observed-data--580f6a0e-76f8-494f-b352-427302de0b81",
|
||
|
|
"url--580f6a0e-76f8-494f-b352-427302de0b81",
|
||
|
|
"indicator--580f6a0e-fadc-4250-96c4-404a02de0b81",
|
||
|
|
"indicator--580f6a0f-5fbc-4df8-8941-48d302de0b81",
|
||
|
|
"observed-data--580f6a0f-aa48-4db5-816d-4bef02de0b81",
|
||
|
|
"url--580f6a0f-aa48-4db5-816d-4bef02de0b81",
|
||
|
|
"indicator--580f6a0f-7158-4424-a1eb-4e9d02de0b81",
|
||
|
|
"indicator--580f6a10-8e74-4fa8-9c86-485e02de0b81",
|
||
|
|
"observed-data--580f6a10-6fa4-4196-b353-457f02de0b81",
|
||
|
|
"url--580f6a10-6fa4-4196-b353-457f02de0b81",
|
||
|
|
"indicator--580f6a11-c070-4e8e-a6bc-426002de0b81",
|
||
|
|
"indicator--580f6a11-5d44-4451-9c8f-4b3b02de0b81",
|
||
|
|
"observed-data--580f6a12-cca0-44b2-a7b1-4f4602de0b81",
|
||
|
|
"url--580f6a12-cca0-44b2-a7b1-4f4602de0b81",
|
||
|
|
"indicator--580f6a13-74e4-418e-a056-456302de0b81",
|
||
|
|
"indicator--580f6a13-5c34-489f-9e35-44c002de0b81",
|
||
|
|
"observed-data--580f6a14-3708-476f-acd2-4d8b02de0b81",
|
||
|
|
"url--580f6a14-3708-476f-acd2-4d8b02de0b81",
|
||
|
|
"indicator--580f6a14-2f38-48e0-8a81-410c02de0b81",
|
||
|
|
"indicator--580f6a15-90a8-4799-8138-4a4602de0b81",
|
||
|
|
"observed-data--580f6a15-941c-4ab7-a37b-445502de0b81",
|
||
|
|
"url--580f6a15-941c-4ab7-a37b-445502de0b81",
|
||
|
|
"indicator--580f6a16-1ff4-4821-9619-43e102de0b81",
|
||
|
|
"indicator--580f6a16-9148-4828-bb7f-478b02de0b81",
|
||
|
|
"observed-data--580f6a17-29f4-4b66-aa25-45d402de0b81",
|
||
|
|
"url--580f6a17-29f4-4b66-aa25-45d402de0b81",
|
||
|
|
"indicator--580f6a17-fe98-4e4a-96d6-443202de0b81",
|
||
|
|
"indicator--580f6a18-e17c-4898-912b-484502de0b81",
|
||
|
|
"observed-data--580f6a18-386c-44f4-b7f8-45a102de0b81",
|
||
|
|
"url--580f6a18-386c-44f4-b7f8-45a102de0b81",
|
||
|
|
"indicator--580f6a19-2fcc-4a83-86d1-4a9302de0b81",
|
||
|
|
"indicator--580f6a19-5810-4d97-b89b-401a02de0b81",
|
||
|
|
"observed-data--580f6a1a-6534-4cae-8b9a-4fe302de0b81",
|
||
|
|
"url--580f6a1a-6534-4cae-8b9a-4fe302de0b81",
|
||
|
|
"indicator--580f6a1a-048c-4481-a867-403902de0b81",
|
||
|
|
"indicator--580f6a1b-f974-412d-9147-405202de0b81",
|
||
|
|
"observed-data--580f6a1b-3058-4723-9059-4a0a02de0b81",
|
||
|
|
"url--580f6a1b-3058-4723-9059-4a0a02de0b81",
|
||
|
|
"indicator--580f6a1c-5374-490c-ac8d-476402de0b81",
|
||
|
|
"indicator--580f6a1c-d634-4310-a5cd-4db802de0b81",
|
||
|
|
"observed-data--580f6a1c-1088-4b57-8052-43d402de0b81",
|
||
|
|
"url--580f6a1c-1088-4b57-8052-43d402de0b81",
|
||
|
|
"indicator--580f6a1d-0230-43be-b514-452802de0b81",
|
||
|
|
"indicator--580f6a1d-d750-4259-87e3-45d902de0b81",
|
||
|
|
"observed-data--580f6a1e-9fc8-430b-b788-406902de0b81",
|
||
|
|
"url--580f6a1e-9fc8-430b-b788-406902de0b81",
|
||
|
|
"indicator--580f6a1e-7158-4e74-8e19-458202de0b81",
|
||
|
|
"indicator--580f6a1f-5c7c-4116-81d7-4dff02de0b81",
|
||
|
|
"observed-data--580f6a1f-5e40-4942-a74c-4cf302de0b81",
|
||
|
|
"url--580f6a1f-5e40-4942-a74c-4cf302de0b81",
|
||
|
|
"indicator--580f6a20-6030-43e1-b9e9-461702de0b81",
|
||
|
|
"indicator--580f6a20-430c-4bad-abf6-4b2702de0b81",
|
||
|
|
"observed-data--580f6a21-0b3c-471f-8328-42dd02de0b81",
|
||
|
|
"url--580f6a21-0b3c-471f-8328-42dd02de0b81",
|
||
|
|
"indicator--580f6a21-f370-4963-8926-493f02de0b81",
|
||
|
|
"indicator--580f6a22-e4c8-43c1-9558-4c6602de0b81",
|
||
|
|
"observed-data--580f6a22-ebfc-4f5d-857a-465002de0b81",
|
||
|
|
"url--580f6a22-ebfc-4f5d-857a-465002de0b81",
|
||
|
|
"indicator--580f6a23-aa00-46c9-9761-4ea602de0b81",
|
||
|
|
"indicator--580f6a23-0dc8-447c-8fac-480a02de0b81",
|
||
|
|
"observed-data--580f6a24-d6d0-4fb3-a0b3-4fd102de0b81",
|
||
|
|
"url--580f6a24-d6d0-4fb3-a0b3-4fd102de0b81",
|
||
|
|
"indicator--580f6a24-f608-4556-b070-4a8902de0b81",
|
||
|
|
"indicator--580f6a25-94f8-44ea-8d09-4f8d02de0b81",
|
||
|
|
"observed-data--580f6a25-ecc4-4932-8cc4-415102de0b81",
|
||
|
|
"url--580f6a25-ecc4-4932-8cc4-415102de0b81",
|
||
|
|
"indicator--580f6a26-e0b4-413c-8da8-47c902de0b81",
|
||
|
|
"indicator--580f6a26-27f4-461b-9108-43f702de0b81",
|
||
|
|
"observed-data--580f6a27-2d1c-48e0-a704-433702de0b81",
|
||
|
|
"url--580f6a27-2d1c-48e0-a704-433702de0b81",
|
||
|
|
"indicator--580f6a27-7094-4698-83d1-42cd02de0b81",
|
||
|
|
"indicator--580f6a28-b7dc-4862-bf73-4d9502de0b81",
|
||
|
|
"observed-data--580f6a28-7480-4668-9675-40e102de0b81",
|
||
|
|
"url--580f6a28-7480-4668-9675-40e102de0b81",
|
||
|
|
"indicator--580f6a29-0d68-448f-9ae2-499602de0b81",
|
||
|
|
"indicator--580f6a29-6e5c-4e07-b787-4e5f02de0b81",
|
||
|
|
"observed-data--580f6a2a-5f3c-4eb1-805a-487902de0b81",
|
||
|
|
"url--580f6a2a-5f3c-4eb1-805a-487902de0b81",
|
||
|
|
"indicator--580f6a2a-eeb8-4363-b0e1-484002de0b81",
|
||
|
|
"indicator--580f6a2b-34e4-4e68-8a31-464a02de0b81",
|
||
|
|
"observed-data--580f6a2b-2224-4c18-a841-4f9f02de0b81",
|
||
|
|
"url--580f6a2b-2224-4c18-a841-4f9f02de0b81",
|
||
|
|
"indicator--580f6a2c-1bf4-487a-8598-4c2102de0b81",
|
||
|
|
"indicator--580f6a2c-5248-4555-bef7-458e02de0b81",
|
||
|
|
"observed-data--580f6a2d-e858-46dc-a98a-4c4702de0b81",
|
||
|
|
"url--580f6a2d-e858-46dc-a98a-4c4702de0b81",
|
||
|
|
"indicator--580f6a2d-e89c-49af-9ac8-46ef02de0b81",
|
||
|
|
"indicator--580f6a2e-3ee4-48f3-9604-457f02de0b81",
|
||
|
|
"observed-data--580f6a2e-1334-4c0b-b6ae-421e02de0b81",
|
||
|
|
"url--580f6a2e-1334-4c0b-b6ae-421e02de0b81",
|
||
|
|
"indicator--580f6a2f-2664-40e9-a727-47a202de0b81",
|
||
|
|
"indicator--580f6a2f-f3c0-4e41-9303-43c102de0b81",
|
||
|
|
"observed-data--580f6a30-4838-4d58-a1ab-4c1f02de0b81",
|
||
|
|
"url--580f6a30-4838-4d58-a1ab-4c1f02de0b81",
|
||
|
|
"indicator--580f6a30-02c8-432c-8aba-4dd302de0b81",
|
||
|
|
"indicator--580f6a31-0948-4b85-84a5-480402de0b81",
|
||
|
|
"observed-data--580f6a31-fa64-4f22-8fbf-4f5a02de0b81",
|
||
|
|
"url--580f6a31-fa64-4f22-8fbf-4f5a02de0b81",
|
||
|
|
"indicator--580f6a32-dc94-4330-9e3d-46a102de0b81",
|
||
|
|
"indicator--580f6a32-49f0-405f-8a91-4e3102de0b81",
|
||
|
|
"observed-data--580f6a33-2fc0-4d9a-a9a1-4b0202de0b81",
|
||
|
|
"url--580f6a33-2fc0-4d9a-a9a1-4b0202de0b81",
|
||
|
|
"indicator--580f6a33-6cbc-46fd-b1cf-460602de0b81",
|
||
|
|
"indicator--580f6a34-dbb8-4a84-b7c0-41cf02de0b81",
|
||
|
|
"observed-data--580f6a34-2364-4e31-9972-485b02de0b81",
|
||
|
|
"url--580f6a34-2364-4e31-9972-485b02de0b81",
|
||
|
|
"indicator--580f6a35-8988-44cc-bc25-4c6a02de0b81",
|
||
|
|
"indicator--580f6a35-23ec-4682-8624-444102de0b81",
|
||
|
|
"observed-data--580f6a36-8a84-4f4f-9afd-481f02de0b81",
|
||
|
|
"url--580f6a36-8a84-4f4f-9afd-481f02de0b81",
|
||
|
|
"indicator--580f6a36-9cf8-4d40-aa34-494302de0b81",
|
||
|
|
"indicator--580f6a37-ed98-4ba9-8dc5-452f02de0b81",
|
||
|
|
"observed-data--580f6a37-007c-4a77-9f77-412902de0b81",
|
||
|
|
"url--580f6a37-007c-4a77-9f77-412902de0b81",
|
||
|
|
"indicator--580f6a38-27e4-47f2-8599-42eb02de0b81",
|
||
|
|
"indicator--580f6a38-9558-4f54-a889-4b6702de0b81",
|
||
|
|
"observed-data--580f6a39-8a9c-4ef0-bbdc-488102de0b81",
|
||
|
|
"url--580f6a39-8a9c-4ef0-bbdc-488102de0b81",
|
||
|
|
"indicator--580f6a39-5418-44e2-a0a8-4ae702de0b81",
|
||
|
|
"indicator--580f6a3a-a640-419e-abb6-424302de0b81",
|
||
|
|
"observed-data--580f6a3a-2048-4539-a3dd-4bf002de0b81",
|
||
|
|
"url--580f6a3a-2048-4539-a3dd-4bf002de0b81",
|
||
|
|
"indicator--580f6a3b-e768-4f62-8140-4e4d02de0b81",
|
||
|
|
"indicator--580f6a3b-8d58-4da9-a216-4c0702de0b81",
|
||
|
|
"observed-data--580f6a3c-59ac-4cda-a8c6-40b702de0b81",
|
||
|
|
"url--580f6a3c-59ac-4cda-a8c6-40b702de0b81",
|
||
|
|
"indicator--580f6a3c-109c-4fc7-b0cb-4fcc02de0b81",
|
||
|
|
"indicator--580f6a3d-0934-4d6a-9cdb-4be502de0b81",
|
||
|
|
"observed-data--580f6a3d-e2c0-4862-9daf-464002de0b81",
|
||
|
|
"url--580f6a3d-e2c0-4862-9daf-464002de0b81",
|
||
|
|
"indicator--580f6a3e-cbac-416f-a47d-48b002de0b81",
|
||
|
|
"indicator--580f6a3e-97b0-4b54-a991-495c02de0b81",
|
||
|
|
"observed-data--580f6a3f-ca4c-49a6-8e99-4fa702de0b81",
|
||
|
|
"url--580f6a3f-ca4c-49a6-8e99-4fa702de0b81",
|
||
|
|
"indicator--580f6a3f-e9ac-4599-938e-49d602de0b81",
|
||
|
|
"indicator--580f6a40-46d4-4dd1-81f7-4dd702de0b81",
|
||
|
|
"observed-data--580f6a41-e2e0-4e50-bc8d-46a302de0b81",
|
||
|
|
"url--580f6a41-e2e0-4e50-bc8d-46a302de0b81",
|
||
|
|
"indicator--580f6a41-f198-4a2c-bce8-4d8f02de0b81",
|
||
|
|
"indicator--580f6a42-42cc-4431-8cf1-449f02de0b81",
|
||
|
|
"observed-data--580f6a42-4558-482d-9015-4f4202de0b81",
|
||
|
|
"url--580f6a42-4558-482d-9015-4f4202de0b81",
|
||
|
|
"indicator--580f6a43-6c28-45a3-ba2a-444c02de0b81",
|
||
|
|
"indicator--580f6a43-981c-4540-86ae-4e8802de0b81",
|
||
|
|
"observed-data--580f6a44-f408-4d43-9ddf-484302de0b81",
|
||
|
|
"url--580f6a44-f408-4d43-9ddf-484302de0b81",
|
||
|
|
"indicator--580f6a44-c534-4431-88df-4c7002de0b81",
|
||
|
|
"indicator--580f6a45-8cb4-4eb0-a7da-48a502de0b81",
|
||
|
|
"observed-data--580f6a45-d268-47d5-b8be-4b7f02de0b81",
|
||
|
|
"url--580f6a45-d268-47d5-b8be-4b7f02de0b81",
|
||
|
|
"indicator--580f6a46-00cc-4eff-ac55-4e7c02de0b81",
|
||
|
|
"indicator--580f6a46-0b0c-4056-aae0-497602de0b81",
|
||
|
|
"observed-data--580f6a47-4370-462c-8954-4c9a02de0b81",
|
||
|
|
"url--580f6a47-4370-462c-8954-4c9a02de0b81",
|
||
|
|
"indicator--580f6a47-1850-4d64-8a75-40f102de0b81",
|
||
|
|
"indicator--580f6a48-29bc-496e-a0ef-448702de0b81",
|
||
|
|
"observed-data--580f6a48-dce8-4f83-babd-41f102de0b81",
|
||
|
|
"url--580f6a48-dce8-4f83-babd-41f102de0b81",
|
||
|
|
"indicator--580f6a49-5f58-4f8a-ad3c-466602de0b81",
|
||
|
|
"indicator--580f6a49-47c4-4461-a85a-43d002de0b81",
|
||
|
|
"observed-data--580f6a4a-55c0-4feb-8067-453a02de0b81",
|
||
|
|
"url--580f6a4a-55c0-4feb-8067-453a02de0b81",
|
||
|
|
"indicator--580f6a4b-04b0-4853-80cb-4b0502de0b81",
|
||
|
|
"indicator--580f6a4b-d614-43b4-b52e-457402de0b81",
|
||
|
|
"observed-data--580f6a4c-23b8-4304-b51d-469b02de0b81",
|
||
|
|
"url--580f6a4c-23b8-4304-b51d-469b02de0b81",
|
||
|
|
"indicator--580f6a4c-2e68-4342-97ea-46f602de0b81",
|
||
|
|
"indicator--580f6a4d-a310-4e9a-ac9e-49ec02de0b81",
|
||
|
|
"observed-data--580f6a4d-ba68-4bc1-b5ed-475d02de0b81",
|
||
|
|
"url--580f6a4d-ba68-4bc1-b5ed-475d02de0b81",
|
||
|
|
"indicator--580f6a4e-43ec-45f5-9baa-4d0502de0b81",
|
||
|
|
"indicator--580f6a4e-9508-4e69-98b2-4c5702de0b81",
|
||
|
|
"observed-data--580f6a4f-d7f8-474f-aa98-4c9d02de0b81",
|
||
|
|
"url--580f6a4f-d7f8-474f-aa98-4c9d02de0b81",
|
||
|
|
"indicator--580f6a4f-df0c-48d7-9826-4e9202de0b81",
|
||
|
|
"indicator--580f6a50-031c-44bb-8d6f-43cb02de0b81",
|
||
|
|
"observed-data--580f6a50-f218-41b8-9a16-458c02de0b81",
|
||
|
|
"url--580f6a50-f218-41b8-9a16-458c02de0b81",
|
||
|
|
"indicator--580f6a51-cd74-44a2-a3c2-4c4902de0b81",
|
||
|
|
"indicator--580f6a51-983c-48dd-add1-4bbb02de0b81",
|
||
|
|
"observed-data--580f6a52-02c8-4d4b-9d59-463402de0b81",
|
||
|
|
"url--580f6a52-02c8-4d4b-9d59-463402de0b81",
|
||
|
|
"indicator--580f6a52-f530-4370-8daf-49d202de0b81",
|
||
|
|
"indicator--580f6a53-ac44-4127-a3ed-482802de0b81",
|
||
|
|
"observed-data--580f6a53-4f60-4fb5-a485-422002de0b81",
|
||
|
|
"url--580f6a53-4f60-4fb5-a485-422002de0b81",
|
||
|
|
"indicator--580f6a54-2280-4d54-b288-428902de0b81",
|
||
|
|
"indicator--580f6a54-e8b0-4322-b0c4-41a602de0b81",
|
||
|
|
"observed-data--580f6a55-9c2c-4ff1-8cfc-4fc802de0b81",
|
||
|
|
"url--580f6a55-9c2c-4ff1-8cfc-4fc802de0b81",
|
||
|
|
"indicator--580f6a55-b40c-421d-939a-4f3302de0b81",
|
||
|
|
"indicator--580f6a56-39d0-47b1-a41a-4b7002de0b81",
|
||
|
|
"observed-data--580f6a56-e38c-4e95-a7e3-4d5902de0b81",
|
||
|
|
"url--580f6a56-e38c-4e95-a7e3-4d5902de0b81",
|
||
|
|
"indicator--580f6a57-f538-44a6-9e1b-489b02de0b81",
|
||
|
|
"indicator--580f6a57-e0ec-4406-87b1-4e4c02de0b81",
|
||
|
|
"observed-data--580f6a58-7908-49b4-8a05-47d702de0b81",
|
||
|
|
"url--580f6a58-7908-49b4-8a05-47d702de0b81",
|
||
|
|
"indicator--580f6a58-7824-4fd1-9d43-422f02de0b81",
|
||
|
|
"indicator--580f6a59-fad0-4211-b56d-438b02de0b81",
|
||
|
|
"observed-data--580f6a59-53b0-460e-993e-4dac02de0b81",
|
||
|
|
"url--580f6a59-53b0-460e-993e-4dac02de0b81",
|
||
|
|
"indicator--580f6a5a-6050-40bc-9d1c-460702de0b81",
|
||
|
|
"indicator--580f6a5a-b274-4349-886b-443302de0b81",
|
||
|
|
"observed-data--580f6a5b-4744-47d5-84b3-48ed02de0b81",
|
||
|
|
"url--580f6a5b-4744-47d5-84b3-48ed02de0b81",
|
||
|
|
"indicator--580f6a5b-866c-46a1-855c-44c802de0b81",
|
||
|
|
"indicator--580f6a5c-a83c-491c-8a6c-47db02de0b81",
|
||
|
|
"observed-data--580f6a5c-d178-436e-9682-41ef02de0b81",
|
||
|
|
"url--580f6a5c-d178-436e-9682-41ef02de0b81",
|
||
|
|
"indicator--580f6a5d-89f4-4e7c-b5ed-4de302de0b81",
|
||
|
|
"indicator--580f6a5d-acf4-4a4e-838f-4e8902de0b81",
|
||
|
|
"observed-data--580f6a5e-4f60-48ac-b4ff-43c702de0b81",
|
||
|
|
"url--580f6a5e-4f60-48ac-b4ff-43c702de0b81",
|
||
|
|
"indicator--580f6a5e-46f0-49fa-93f4-4d5202de0b81",
|
||
|
|
"indicator--580f6a5f-34d0-4137-b0c7-4b7702de0b81",
|
||
|
|
"observed-data--580f6a5f-a594-4519-bedb-4ec302de0b81",
|
||
|
|
"url--580f6a5f-a594-4519-bedb-4ec302de0b81",
|
||
|
|
"indicator--580f6a60-7e54-4e10-bbfc-48c202de0b81",
|
||
|
|
"indicator--580f6a60-e5c4-4053-9ba8-4e3b02de0b81",
|
||
|
|
"observed-data--580f6a61-4ecc-4c86-93ec-485602de0b81",
|
||
|
|
"url--580f6a61-4ecc-4c86-93ec-485602de0b81",
|
||
|
|
"indicator--580f6a61-18e0-4d98-856a-4e9302de0b81",
|
||
|
|
"indicator--580f6a62-ea70-4d01-b728-4c6c02de0b81",
|
||
|
|
"observed-data--580f6a62-582c-44a1-8c15-4ae802de0b81",
|
||
|
|
"url--580f6a62-582c-44a1-8c15-4ae802de0b81",
|
||
|
|
"indicator--580f6a63-0e64-478d-bc7c-42dc02de0b81",
|
||
|
|
"indicator--580f6a63-b21c-4e32-9e53-4e4a02de0b81",
|
||
|
|
"observed-data--580f6a64-90b8-460f-9914-439802de0b81",
|
||
|
|
"url--580f6a64-90b8-460f-9914-439802de0b81",
|
||
|
|
"indicator--580f6a64-7508-4597-be3b-4d1902de0b81",
|
||
|
|
"indicator--580f6a65-0464-4361-94df-4ef102de0b81",
|
||
|
|
"observed-data--580f6a65-5efc-4994-ab2c-4eae02de0b81",
|
||
|
|
"url--580f6a65-5efc-4994-ab2c-4eae02de0b81",
|
||
|
|
"indicator--580f6a65-c124-4a9c-b643-477e02de0b81",
|
||
|
|
"indicator--580f6a66-bb1c-4413-88e8-464302de0b81",
|
||
|
|
"observed-data--580f6a66-beb8-4e20-9207-449e02de0b81",
|
||
|
|
"url--580f6a66-beb8-4e20-9207-449e02de0b81",
|
||
|
|
"indicator--580f6a67-c6b0-4fe8-b945-49cb02de0b81",
|
||
|
|
"indicator--580f6a67-d770-4d8f-b68a-401902de0b81",
|
||
|
|
"observed-data--580f6a68-ff14-49d8-a8a3-419402de0b81",
|
||
|
|
"url--580f6a68-ff14-49d8-a8a3-419402de0b81",
|
||
|
|
"indicator--580f6a68-ed68-4686-832d-4d3f02de0b81",
|
||
|
|
"indicator--580f6a69-abf0-4e74-8dbf-4d9b02de0b81",
|
||
|
|
"observed-data--580f6a69-8024-4773-a6c4-4a8d02de0b81",
|
||
|
|
"url--580f6a69-8024-4773-a6c4-4a8d02de0b81",
|
||
|
|
"indicator--580f6a6a-8d48-463b-9576-439902de0b81",
|
||
|
|
"indicator--580f6a6a-efbc-4a34-8e2f-4cbb02de0b81",
|
||
|
|
"observed-data--580f6a6b-7054-41ea-975b-4a5802de0b81",
|
||
|
|
"url--580f6a6b-7054-41ea-975b-4a5802de0b81",
|
||
|
|
"indicator--580f6a6b-521c-4c14-951b-408402de0b81",
|
||
|
|
"indicator--580f6a6c-3ee8-414b-90ae-445202de0b81",
|
||
|
|
"observed-data--580f6a6c-37c0-4af2-a4ac-4d7c02de0b81",
|
||
|
|
"url--580f6a6c-37c0-4af2-a4ac-4d7c02de0b81",
|
||
|
|
"indicator--580f6a6d-0f84-4604-a677-4dbb02de0b81",
|
||
|
|
"indicator--580f6a6d-1b08-4dd8-9b9b-486d02de0b81",
|
||
|
|
"observed-data--580f6a6e-d8d0-4d19-89bb-401802de0b81",
|
||
|
|
"url--580f6a6e-d8d0-4d19-89bb-401802de0b81",
|
||
|
|
"indicator--580f6a6e-741c-4064-be98-43ba02de0b81",
|
||
|
|
"indicator--580f6a6f-9c94-4082-9d7a-4f9d02de0b81",
|
||
|
|
"observed-data--580f6a70-d184-4235-a617-491b02de0b81",
|
||
|
|
"url--580f6a70-d184-4235-a617-491b02de0b81",
|
||
|
|
"indicator--580f6a70-a090-45a2-8fa3-456702de0b81",
|
||
|
|
"indicator--580f6a71-e33c-4932-9aaa-424502de0b81",
|
||
|
|
"observed-data--580f6a71-2c1c-49d0-876f-409a02de0b81",
|
||
|
|
"url--580f6a71-2c1c-49d0-876f-409a02de0b81",
|
||
|
|
"indicator--580f6a72-5284-4b88-9174-4ff302de0b81",
|
||
|
|
"indicator--580f6a72-68a0-4ad2-a1e5-4bb202de0b81",
|
||
|
|
"observed-data--580f6a73-ad40-435a-94d6-453c02de0b81",
|
||
|
|
"url--580f6a73-ad40-435a-94d6-453c02de0b81",
|
||
|
|
"indicator--580f6a73-db68-4d35-a847-4a3a02de0b81",
|
||
|
|
"indicator--580f6a74-2700-40f1-80af-42c002de0b81",
|
||
|
|
"observed-data--580f6a75-571c-435e-b49c-4c2302de0b81",
|
||
|
|
"url--580f6a75-571c-435e-b49c-4c2302de0b81",
|
||
|
|
"indicator--580f6a75-d458-4610-bb8d-474d02de0b81",
|
||
|
|
"indicator--580f6a76-342c-49ef-8e66-43f502de0b81",
|
||
|
|
"observed-data--580f6a76-9664-4a78-b86b-402002de0b81",
|
||
|
|
"url--580f6a76-9664-4a78-b86b-402002de0b81",
|
||
|
|
"indicator--580f6a76-8b28-452d-ae52-47ae02de0b81",
|
||
|
|
"indicator--580f6a77-dc24-4887-b0ee-4e0702de0b81",
|
||
|
|
"observed-data--580f6a77-6f04-4ccf-b7d6-4b7002de0b81",
|
||
|
|
"url--580f6a77-6f04-4ccf-b7d6-4b7002de0b81",
|
||
|
|
"indicator--580f6a78-2508-4ae9-8ce6-44bf02de0b81",
|
||
|
|
"indicator--580f6a78-b594-4201-b6e5-415402de0b81",
|
||
|
|
"observed-data--580f6a79-7e84-4d0a-922b-48ca02de0b81",
|
||
|
|
"url--580f6a79-7e84-4d0a-922b-48ca02de0b81",
|
||
|
|
"indicator--580f6a79-abf4-4393-9066-486002de0b81",
|
||
|
|
"indicator--580f6a7a-21c0-4b71-abde-4bd702de0b81",
|
||
|
|
"observed-data--580f6a7a-6d94-41b8-a0ad-4e4002de0b81",
|
||
|
|
"url--580f6a7a-6d94-41b8-a0ad-4e4002de0b81",
|
||
|
|
"indicator--580f6a7b-31a0-4224-a5f7-403902de0b81",
|
||
|
|
"indicator--580f6a7b-76d0-4554-9926-494b02de0b81",
|
||
|
|
"observed-data--580f6a7c-2824-41e7-b52e-4c8902de0b81",
|
||
|
|
"url--580f6a7c-2824-41e7-b52e-4c8902de0b81",
|
||
|
|
"indicator--580f6a7c-e9b4-4264-9a43-4cef02de0b81",
|
||
|
|
"indicator--580f6a7d-9390-4d8c-aea6-456702de0b81",
|
||
|
|
"observed-data--580f6a7d-9278-4a02-8cb0-46b502de0b81",
|
||
|
|
"url--580f6a7d-9278-4a02-8cb0-46b502de0b81",
|
||
|
|
"indicator--580f6a7e-6308-4b9c-9ae0-48ff02de0b81",
|
||
|
|
"indicator--580f6a7e-df84-4491-8d0e-4bb902de0b81",
|
||
|
|
"observed-data--580f6a7f-2274-4975-b5b0-454a02de0b81",
|
||
|
|
"url--580f6a7f-2274-4975-b5b0-454a02de0b81",
|
||
|
|
"indicator--580f6a7f-1ca8-424d-a8f6-44f902de0b81",
|
||
|
|
"indicator--580f6a80-470c-419b-a603-484e02de0b81",
|
||
|
|
"observed-data--580f6a80-568c-4e05-be22-491102de0b81",
|
||
|
|
"url--580f6a80-568c-4e05-be22-491102de0b81",
|
||
|
|
"indicator--580f6a81-6830-43b7-8b67-4f0c02de0b81",
|
||
|
|
"indicator--580f6a81-69f8-4559-8627-4af202de0b81",
|
||
|
|
"observed-data--580f6a82-e84c-42ba-ac0f-4f8d02de0b81",
|
||
|
|
"url--580f6a82-e84c-42ba-ac0f-4f8d02de0b81",
|
||
|
|
"indicator--580f6a82-81c0-4bf3-8c20-4a7b02de0b81",
|
||
|
|
"indicator--580f6a83-9d00-4e2e-ab82-46df02de0b81",
|
||
|
|
"observed-data--580f6a83-a928-4a84-9984-4bee02de0b81",
|
||
|
|
"url--580f6a83-a928-4a84-9984-4bee02de0b81",
|
||
|
|
"indicator--580f6a84-2364-4e1c-b758-42d402de0b81",
|
||
|
|
"indicator--580f6a84-0f00-433c-a5a0-490302de0b81",
|
||
|
|
"observed-data--580f6a85-59ec-4b9a-8ff8-40e702de0b81",
|
||
|
|
"url--580f6a85-59ec-4b9a-8ff8-40e702de0b81",
|
||
|
|
"indicator--580f6a85-c57c-40b9-a3db-4c5202de0b81",
|
||
|
|
"indicator--580f6a86-5df0-451b-9764-46b802de0b81",
|
||
|
|
"observed-data--580f6a86-7804-4e22-9856-4b7302de0b81",
|
||
|
|
"url--580f6a86-7804-4e22-9856-4b7302de0b81",
|
||
|
|
"indicator--580f6a87-0028-4655-ab7d-445b02de0b81",
|
||
|
|
"indicator--580f6a87-0bf0-41f2-a7a4-4ee902de0b81",
|
||
|
|
"observed-data--580f6a88-fcd4-4069-b116-48c202de0b81",
|
||
|
|
"url--580f6a88-fcd4-4069-b116-48c202de0b81",
|
||
|
|
"indicator--580f6a88-a658-4e5a-81bb-473e02de0b81",
|
||
|
|
"indicator--580f6a89-4234-4a79-b4a1-4d8702de0b81",
|
||
|
|
"observed-data--580f6a89-bcfc-482a-ae07-4c7702de0b81",
|
||
|
|
"url--580f6a89-bcfc-482a-ae07-4c7702de0b81",
|
||
|
|
"indicator--580f6a8a-71d4-4c83-bb80-4b4a02de0b81",
|
||
|
|
"indicator--580f6a8a-5878-49da-8a9a-483802de0b81",
|
||
|
|
"observed-data--580f6a8b-bad8-48bf-b8a5-478802de0b81",
|
||
|
|
"url--580f6a8b-bad8-48bf-b8a5-478802de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"osint:source-type=\"technical-report\""
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6308-9b08-47af-ac21-4063950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:50:00.000Z",
|
||
|
|
"modified": "2016-10-25T13:50:00.000Z",
|
||
|
|
"first_observed": "2016-10-25T13:50:00Z",
|
||
|
|
"last_observed": "2016-10-25T13:50:00Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6308-9b08-47af-ac21-4063950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6308-9b08-47af-ac21-4063950d210f",
|
||
|
|
"value": "http://www.welivesecurity.com/2016/10/25/lifting-lid-sednit-closer-look-software-uses/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6328-a250-4cfb-bd97-4b28950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:50:32.000Z",
|
||
|
|
"modified": "2016-10-25T13:50:32.000Z",
|
||
|
|
"first_observed": "2016-10-25T13:50:32Z",
|
||
|
|
"last_observed": "2016-10-25T13:50:32Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6328-a250-4cfb-bd97-4b28950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6328-a250-4cfb-bd97-4b28950d210f",
|
||
|
|
"value": "http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part1.pdf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6342-65f8-42df-b1f5-4848950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:50:58.000Z",
|
||
|
|
"modified": "2016-10-25T13:50:58.000Z",
|
||
|
|
"first_observed": "2016-10-25T13:50:58Z",
|
||
|
|
"last_observed": "2016-10-25T13:50:58Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6342-65f8-42df-b1f5-4848950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6342-65f8-42df-b1f5-4848950d210f",
|
||
|
|
"value": "http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f6366-ff80-433d-b8e4-46ae950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:51:34.000Z",
|
||
|
|
"modified": "2016-10-25T13:51:34.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"comment\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "External analysis",
|
||
|
|
"x_misp_type": "comment",
|
||
|
|
"x_misp_value": "The Sednit group \r\n\u00e2\u20ac\u201d also known as \r\nAPT28, Fancy Bear and Sofacy \r\n\u00e2\u20ac\u201d is a group of attackers \r\noperating\r\n since 2004 if not earlier and whose main objective is to steal confidential information\r\nfrom specific targets.\r\nThis is the second part of our whitepaper \r\n\u00e2\u20ac\u0153En Route with Sednit\u00e2\u20ac\u009d,\r\n which covers the Sednit\u00e2\u20ac\u2122s group \r\nactivities since 2014.\r\n Here, we focus on Sednit\u00e2\u20ac\u2122s espionage toolkit,\r\n which is deployed on targets \r\ndeemed interesting after a reconnaissance phase (described in the first part of the whitepaper).\r\nThe key points described in this second installment are the following:\r\n\u00e2\u20ac\u00a2 The Sednit group developed two different spying backdoors for long term monitoring,\r\nnamed \r\nSedreco\r\n and \r\nXagent\r\n,\r\n in order to maximize the chance of avoiding detection\r\n\u00e2\u20ac\u00a2 \r\nThe \r\nXagent\r\n backdoor can communicate with its C&C server over email with a custom \r\nprotocol,\r\n which in some cases is based on Georgian words\r\n\u00e2\u20ac\u00a2 The Sednit group developed a network proxy tool,\r\n named \r\nXtunnel\r\n,\r\n to effectively transform \r\na compromised computer into a network pivot,\r\n in order to contact machines that are normally\r\nunreachable from the Internet\r\n\u00e2\u20ac\u00a2 \r\nThe \r\nXagent\r\n source code,\r\n the \r\nXagent\r\n C&C server configuration,\r\n and the \r\nXtunnel\r\n binaries \r\nall contain traces of Russian,\r\n strongly reinforcing the hypothesis that this is the language \r\nemployed by the Sednit group\u00e2\u20ac\u2122s members"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f638e-db24-4cd4-9159-4b5a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:52:14.000Z",
|
||
|
|
"modified": "2016-10-25T13:52:14.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"comment\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "External analysis",
|
||
|
|
"x_misp_comment": "Part 1",
|
||
|
|
"x_misp_type": "comment",
|
||
|
|
"x_misp_value": "The Sednit group \r\n\u00e2\u20ac\u201d also known as \r\nAPT28, Fancy Bear and Sofacy \r\n\u00e2\u20ac\u201d is a group of attackers \r\noperating since 2004 if not earlier and whose main objective is to steal confidential information \r\nfrom specific targets.\r\nThis is the first part of our whitepaper \r\n\u00e2\u20ac\u0153En Route with Sednit\u00e2\u20ac\u009d,\r\n which covers the Sednit\u00e2\u20ac\u2122s group \r\nactivities since 2014.\r\n Here, we focus on the methods used by the group to attack its targets,\r\nand on who these targets are.\r\nThe key points described in this first installment are the following:\r\n\u00e2\u20ac\u00a2 During the Sednit phishing campaigns more than 1,000 high-profile individuals involved \r\nin Eastern European politics were attacked,\r\n including some Ukrainian leaders,\r\n NATO officials,\r\nand Russian political dissidents\r\n\u00e2\u20ac\u00a2 The Sednit operators launched their phishing attacks on weekdays,\r\n and at times \r\ncorresponding to office hours in the time zone UTC+3\r\n\u00e2\u20ac\u00a2 The Sednit group developed its own exploit kit \r\n\u00e2\u20ac\u201d a first for an espionage group \u00e2\u20ac\u201d deploying \r\na surprisingly high number of 0-day exploits\r\n\u00e2\u20ac\u00a2 The Sednit group developed particular first-stage malware in order to bypass network \r\nsecurity measures implemented by compromised organizations"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f63cb-fcc4-431c-9921-4def950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:53:15.000Z",
|
||
|
|
"modified": "2016-10-25T13:53:15.000Z",
|
||
|
|
"description": "Email Attachments",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '76053b58643d0630b39d8c9d3080d7db5d017020']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:53:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f63cb-0848-4ecf-b8a3-4f80950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:53:15.000Z",
|
||
|
|
"modified": "2016-10-25T13:53:15.000Z",
|
||
|
|
"description": "Email Attachments",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '9b276a0f5fd824c3dff638c5c127567c65222230']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:53:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f63cc-b804-4d44-8f9b-4590950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:53:16.000Z",
|
||
|
|
"modified": "2016-10-25T13:53:16.000Z",
|
||
|
|
"description": "Email Attachments",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'e7f7f6caaede6cc29c2e7e4888019f2d1be37cef']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:53:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f63cd-57ec-44c6-9402-4e5c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:53:17.000Z",
|
||
|
|
"modified": "2016-10-25T13:53:17.000Z",
|
||
|
|
"description": "Email Attachments",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'ef755f3fa59960838fa2b37b7dedce83ce41f05c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:53:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f63e2-8758-4684-918b-4d9f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:53:38.000Z",
|
||
|
|
"modified": "2016-10-25T13:53:38.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Win32/Exploit.CVE-2015-1641.H"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f63e3-19a8-441e-8101-4e27950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:53:39.000Z",
|
||
|
|
"modified": "2016-10-25T13:53:39.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Win32/Exploit.CVE-2015-2424.A"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f640a-53c4-4df7-a3da-45bd950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:54:18.000Z",
|
||
|
|
"modified": "2016-10-25T13:54:18.000Z",
|
||
|
|
"first_observed": "2016-10-25T13:54:18Z",
|
||
|
|
"last_observed": "2016-10-25T13:54:18Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--580f640a-53c4-4df7-a3da-45bd950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--580f640a-53c4-4df7-a3da-45bd950d210f",
|
||
|
|
"name": "Exercise_Noble_Partner_16.rtf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f640b-c5f8-4b8f-b57c-4d27950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:54:19.000Z",
|
||
|
|
"modified": "2016-10-25T13:54:19.000Z",
|
||
|
|
"first_observed": "2016-10-25T13:54:19Z",
|
||
|
|
"last_observed": "2016-10-25T13:54:19Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--580f640b-c5f8-4b8f-b57c-4d27950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--580f640b-c5f8-4b8f-b57c-4d27950d210f",
|
||
|
|
"name": "Iran_nuclear_talks.rtf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f640b-8830-47bb-9ed7-4315950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:54:19.000Z",
|
||
|
|
"modified": "2016-10-25T13:54:19.000Z",
|
||
|
|
"first_observed": "2016-10-25T13:54:19Z",
|
||
|
|
"last_observed": "2016-10-25T13:54:19Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--580f640b-8830-47bb-9ed7-4315950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--580f640b-8830-47bb-9ed7-4315950d210f",
|
||
|
|
"name": "Putin_Is_Being_Pushed_to_Prepare_for_War.rtf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f640c-c640-4acc-ad2a-4110950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:54:20.000Z",
|
||
|
|
"modified": "2016-10-25T13:54:20.000Z",
|
||
|
|
"first_observed": "2016-10-25T13:54:20Z",
|
||
|
|
"last_observed": "2016-10-25T13:54:20Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--580f640c-c640-4acc-ad2a-4110950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--580f640c-c640-4acc-ad2a-4110950d210f",
|
||
|
|
"name": "Statement by the Spokesperson of European Union on the latest developments in eastern"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f640c-9ab4-4edc-9aff-465d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:54:20.000Z",
|
||
|
|
"modified": "2016-10-25T13:54:20.000Z",
|
||
|
|
"first_observed": "2016-10-25T13:54:20Z",
|
||
|
|
"last_observed": "2016-10-25T13:54:20Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--580f640c-9ab4-4edc-9aff-465d950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--580f640c-9ab4-4edc-9aff-465d950d210f",
|
||
|
|
"name": "Ukraine.rtf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6439-4ef4-4b99-8ce5-46c9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:05.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:05.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'aljazeera-news.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6439-1f20-4046-b962-4f1a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:05.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:05.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'ausameetings.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f643a-f1d0-416c-9062-452e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:06.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:06.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'bbc-press.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f643a-4e30-40a2-b007-41b3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:06.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:06.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'cnnpolitics.eu']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f643b-8940-4f4d-8568-42fa950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:07.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:07.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'dailyforeignnews.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f643b-d6f4-4f8b-809e-4c8a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:07.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:07.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'dailypoliticsnews.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f643c-afcc-49b9-a77d-4e39950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:08.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:08.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'defenceiq.us']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f643c-18ac-4864-86eb-40b0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:08.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:08.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'defencereview.eu']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f643d-edec-4f14-ba9d-477e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:09.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:09.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'diplomatnews.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f643d-3d44-49eb-99a1-4e2c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:09.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:09.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'euronews24.info']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f643d-5184-4f05-915a-4b8f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:09.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:09.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'euroreport24.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f643e-6dc0-4108-be3e-4f52950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:10.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:10.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'kg-news.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f643e-548c-4b00-9dd1-4a91950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:10.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:10.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'military-info.eu']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f643f-d954-474d-b7e3-4d35950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:11.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:11.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'militaryadviser.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f643f-f960-4dd7-975a-4a86950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:11.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:11.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'militaryobserver.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6440-f734-4bdd-b170-4fa2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:12.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:12.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'nato-hq.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6440-3154-47a4-b4ae-4204950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:12.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:12.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'nato-news.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6441-cc08-4e00-ab4d-4127950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:13.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:13.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'natoint.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6441-6cac-4da2-8af9-47db950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:13.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:13.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'natopress.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6442-f2fc-4671-a5c7-4f99950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:14.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:14.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'osce-info.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6442-5d80-4acc-976d-4855950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:14.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:14.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'osce-press.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6443-1a20-4ec1-806b-466c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:15.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:15.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'pakistan-mofa.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6443-f708-4d37-9cea-41b2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:15.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:15.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'politicalreview.eu']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6444-3004-404d-a642-44bd950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:16.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:16.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'politicsinform.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6444-c998-4bfb-9adc-4111950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:16.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:16.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'reuters-press.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6445-f0e8-470d-8886-4132950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:17.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:17.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'shurl.biz']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6445-3be0-4ba9-8ec4-4501950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:17.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:17.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'stratforglobal.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6446-4478-4a9f-86f5-4d88950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:18.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:18.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'thediplomat-press.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6446-ee74-424c-98c2-473e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:18.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:18.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'theguardiannews.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6447-5cf0-459d-8107-4ecb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:19.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:19.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'trend-news.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6447-33b8-40e2-bf6e-4fb2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:19.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:19.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'unian-news.info']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6448-5b90-408f-8825-4911950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:20.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:20.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'unitednationsnews.eu']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6448-6a6c-4d3e-8e37-4cc8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:20.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:20.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'virusdefender.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6449-0e3c-426d-aaf8-4443950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:21.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:21.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'worldmilitarynews.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6449-c068-433d-b14c-4b6c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:21.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:21.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'worldpoliticsnews.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f644a-96fc-4f9e-b153-4c4c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:22.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:22.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'worldpoliticsreviews.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f644a-4d6c-404a-9863-4899950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:55:22.000Z",
|
||
|
|
"modified": "2016-10-25T13:55:22.000Z",
|
||
|
|
"description": "Sedkit - Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'worldpostjournal.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:55:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f6479-1e0c-4e51-a4a4-4453950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:56:09.000Z",
|
||
|
|
"modified": "2016-10-25T13:56:09.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_comment": "Seduploader ESET Detection Names",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "OSX/Agent.AE"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f647a-9b48-484b-979d-4485950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:56:10.000Z",
|
||
|
|
"modified": "2016-10-25T13:56:10.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_comment": "Seduploader ESET Detection Names",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Win32/Agent.XBZ"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f647a-8ff4-4b09-9610-441d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:56:10.000Z",
|
||
|
|
"modified": "2016-10-25T13:56:10.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_comment": "Seduploader ESET Detection Names",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Win32/Agent.XIA"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f647b-1398-4aef-a9e2-4513950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:56:11.000Z",
|
||
|
|
"modified": "2016-10-25T13:56:11.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_comment": "Seduploader ESET Detection Names",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Win32/Agent.XIJ"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f647b-7b48-405b-b843-45b8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:56:11.000Z",
|
||
|
|
"modified": "2016-10-25T13:56:11.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_comment": "Seduploader ESET Detection Names",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Win32/Agent.XIO"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f647c-73ec-4b4a-be66-4cc3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:56:12.000Z",
|
||
|
|
"modified": "2016-10-25T13:56:12.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_comment": "Seduploader ESET Detection Names",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Win32/Agent.XFK"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f647c-1ce0-4dc7-9ec7-45a5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:56:12.000Z",
|
||
|
|
"modified": "2016-10-25T13:56:12.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_comment": "Seduploader ESET Detection Names",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Win32/Sednit.Z"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f647d-96bc-45e6-9478-41c8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:56:13.000Z",
|
||
|
|
"modified": "2016-10-25T13:56:13.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_comment": "Seduploader ESET Detection Names",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Win32/Sednit.AA"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f647d-2bc8-410b-bc17-4220950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:56:13.000Z",
|
||
|
|
"modified": "2016-10-25T13:56:13.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_comment": "Seduploader ESET Detection Names",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Win32/Sednit.AB"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f647e-6af0-4195-93e9-4290950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:56:14.000Z",
|
||
|
|
"modified": "2016-10-25T13:56:14.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_comment": "Seduploader ESET Detection Names",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Win32/Sednit.AC"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f647e-7560-44af-8957-4448950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:56:14.000Z",
|
||
|
|
"modified": "2016-10-25T13:56:14.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_comment": "Seduploader ESET Detection Names",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Win32/Sednit.AF"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f647f-0894-4838-96aa-429f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:56:15.000Z",
|
||
|
|
"modified": "2016-10-25T13:56:15.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_comment": "Seduploader ESET Detection Names",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Win32/Sednit.AG"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f647f-0770-4008-ab58-4532950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:56:15.000Z",
|
||
|
|
"modified": "2016-10-25T13:56:15.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_comment": "Seduploader ESET Detection Names",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Win32/Sednit.AR"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f6480-fff0-4a5e-8677-47cb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:56:16.000Z",
|
||
|
|
"modified": "2016-10-25T13:56:16.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_comment": "Seduploader ESET Detection Names",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Win32/Sednit.AS"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f6480-c980-490e-8f9d-4f4d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:56:16.000Z",
|
||
|
|
"modified": "2016-10-25T13:56:16.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_comment": "Seduploader ESET Detection Names",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Win32/Sednit.AT"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f6480-7170-4b3a-afcf-4805950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:56:16.000Z",
|
||
|
|
"modified": "2016-10-25T13:56:16.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_comment": "Seduploader ESET Detection Names",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Win32/Sednit.AU"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f6481-0bd8-4234-966e-4ee8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:56:17.000Z",
|
||
|
|
"modified": "2016-10-25T13:56:17.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_comment": "Seduploader ESET Detection Names",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Win32/Small.NNY"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f6481-57f8-4d20-b4df-4bad950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:56:17.000Z",
|
||
|
|
"modified": "2016-10-25T13:56:17.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_comment": "Seduploader ESET Detection Names",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Win64/TrojanDropper.Small.A"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f6482-9060-4e52-85a3-449a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:56:18.000Z",
|
||
|
|
"modified": "2016-10-25T13:56:18.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_comment": "Seduploader ESET Detection Names",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Win64/TrojanDropper.Small.B"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f6482-35d8-42ce-a2bf-4fa2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:56:18.000Z",
|
||
|
|
"modified": "2016-10-25T13:56:18.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_comment": "Seduploader ESET Detection Names",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Win64/Agent.DJ"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64cb-3274-41c0-b903-47f1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:31.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:31.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '015425010bd4cf9d511f7fcd0fc17fc17c23eec1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64cb-0054-4a81-afab-4438950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:31.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:31.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '0f7893e2647a7204dbf4b72e50678545573c3a10']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64cc-f63c-42f3-ae89-438f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:32.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:32.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '10686cc4e46cf3ffbdeb71dd565329a80787c439']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64cc-888c-4784-a364-45ea950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:32.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:32.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '17661a04b4b150a6f70afdabe3fd9839cc56bee8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64cd-d160-4be4-bfcd-4fd1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:33.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:33.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '21835aafe6d46840bb697e8b0d4aac06dec44f5b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64cd-3ca8-4baa-b030-43e1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:33.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:33.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '2663eb655918c598be1b2231d7c018d8350a0ef9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64ce-9818-4382-aed3-4c61950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:34.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:34.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '2c86a6d6e9915a7f38d119888ede60b38ab1d69d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64ce-1830-4f2a-bfd4-415c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:34.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:34.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '351c3762be9948d01034c69aced97628099a90b0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64cf-f474-496a-9bb8-43d8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:35.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:35.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '3956cfe34566ba8805f9b1fe0d2639606a404cd4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64cf-1240-4dad-89f9-4f13950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:35.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:35.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '4d5e923351f52a9d5c94ee90e6a00e6fced733ef']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64d0-004c-4157-bebb-4cf2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:36.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:36.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '4fae67d3988da117608a7548d9029caddbfb3ebf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64d0-c874-40ec-8fd0-439b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:36.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:36.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '51b0e3cd6360d50424bf776b3cd673dd45fd0f97']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64d1-b3e8-4751-baa2-4a42950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:37.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:37.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '51e42368639d593d0ae2968bd2849dc20735c071']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64d1-9450-4764-9d60-4a8b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:37.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:37.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '5c3e709517f41febf03109fa9d597f2ccc495956']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64d2-39fc-48cf-9152-42dd950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:38.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:38.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '63d1d33e7418daf200dc4660fc9a59492ddd50d9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64d3-3914-4e9c-9c25-479f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:39.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:39.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '69d8ca2a02241a1f88a525617cf18971c99fb63b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64d3-c420-4559-91f2-400c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:39.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:39.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '6fb3fd8c2580c84314b14510944700144a9e31df']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64d4-339c-41bc-9bc3-414b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:40.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:40.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '80dca565807fa69a75a7dd278cef1daaee34236e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64d4-1418-4f13-a3bc-40a6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:40.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:40.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '842b0759b5796979877a2bac82a33500163ded67']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64d5-b2d0-429f-90a6-4279950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:41.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:41.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '8f99774926b2e0bf85e5147aaca8bbbbcc5f1d48']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64d5-e254-4ae0-a057-484b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:41.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:41.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '90c3b756b1bb849cba80994d445e96a9872d0cf5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64d6-9fa8-4347-962f-4a38950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:42.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:42.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '99f927f97838eb47c1d59500ee9155adb55b806a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64d6-a58c-44e9-b050-4882950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:42.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:42.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '9fc43e32c887b7697bf6d6933e9859d29581ead0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64d7-9ce4-4706-9583-48d4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:43.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:43.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a43ef43f3c3db76a4a9ca8f40f7b2c89888f0399']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64d7-cc64-482d-8770-4e59950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:43.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:43.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a5fca59a2fae0a12512336ca1b78f857afc06445']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64d8-8b84-4ea5-bcbe-474d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:44.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:44.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a857bccf4cc5c15b60667ecd865112999e1e56ba']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64d8-a8dc-4c7a-a3e6-4220950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:44.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:44.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'b4a515ef9de037f18d96b9b0e48271180f5725b7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64d9-36e0-4953-a888-4a1b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:45.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:45.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'b7788af2ef073d7b3fb84086496896e7404e625e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64da-23ec-492d-b77e-47d8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:46.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:46.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'b8aabe12502f7d55ae332905acee80a10e3bc399']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64da-2970-4010-a3bd-47d6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:46.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:46.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c1eae93785c9cb917cfb260d3abf6432c6fdaf4d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64db-0d88-4b3c-b617-42eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:47.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:47.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c2e8c584d5401952af4f1db08cf4b6016874ddac']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64db-4594-4627-82ed-4b98950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:47.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:47.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c345a85c01360f2833752a253a5094ff421fc839']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64dc-0ea0-4cde-92cb-4c4e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:48.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:48.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'd3aa282b390a5cb29d15a97e0a046305038dbefe']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64dd-a1d4-46db-9486-46fd950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:49.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:49.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'd85e44d386315b0258847495be1711450ac02d9f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64dd-9fc4-4fa2-9de7-4fe3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:49.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:49.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'd9989a46d590ebc792f14aa6fec30560dfe931b1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64de-8f28-4a1f-8cf9-4501950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:50.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:50.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'e5fb715a1c70402774ee2c518fb0e4e9cd3fdcff']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64de-2ecc-4ed1-98f5-432a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:50.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:50.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'e742b917d3ef41992e67389cd2fe2aab0f9ace5b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64df-8fd8-4fc0-b540-4bf8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:57:51.000Z",
|
||
|
|
"modified": "2016-10-25T13:57:51.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'ed9f3e5e889d281437b945993c6c2a80c60fdedc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:57:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64f9-2358-4efb-89fd-4c63950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:58:17.000Z",
|
||
|
|
"modified": "2016-10-25T13:58:17.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f024dbab65198467c2b832de9724cb70e24af0dd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:58:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64fa-ba58-494b-8997-446c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:58:18.000Z",
|
||
|
|
"modified": "2016-10-25T13:58:18.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f3d50c1f7d5f322c1a1f9a72ff122cac990881ee']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:58:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f64fa-832c-4f89-87ec-44b3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:58:18.000Z",
|
||
|
|
"modified": "2016-10-25T13:58:18.000Z",
|
||
|
|
"description": "Seduploader",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f7608ef62a45822e9300d390064e667028b75dea']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T13:58:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6530-5160-4c00-9de8-4c3c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:59:12.000Z",
|
||
|
|
"modified": "2016-10-25T13:59:12.000Z",
|
||
|
|
"first_observed": "2016-10-25T13:59:12Z",
|
||
|
|
"last_observed": "2016-10-25T13:59:12Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--580f6530-5160-4c00-9de8-4c3c950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--580f6530-5160-4c00-9de8-4c3c950d210f",
|
||
|
|
"name": "amdcache.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6531-43d8-428f-b605-425c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:59:13.000Z",
|
||
|
|
"modified": "2016-10-25T13:59:13.000Z",
|
||
|
|
"first_observed": "2016-10-25T13:59:13Z",
|
||
|
|
"last_observed": "2016-10-25T13:59:13Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--580f6531-43d8-428f-b605-425c950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--580f6531-43d8-428f-b605-425c950d210f",
|
||
|
|
"name": "api-ms-win-core-advapi-l1-1-0.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6532-ebe8-4a16-a8ff-4d01950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:59:14.000Z",
|
||
|
|
"modified": "2016-10-25T13:59:14.000Z",
|
||
|
|
"first_observed": "2016-10-25T13:59:14Z",
|
||
|
|
"last_observed": "2016-10-25T13:59:14Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--580f6532-ebe8-4a16-a8ff-4d01950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--580f6532-ebe8-4a16-a8ff-4d01950d210f",
|
||
|
|
"name": "api-ms-win-downlevel-profile-l1-1-0.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6532-8ddc-4167-8163-4d7a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:59:14.000Z",
|
||
|
|
"modified": "2016-10-25T13:59:14.000Z",
|
||
|
|
"first_observed": "2016-10-25T13:59:14Z",
|
||
|
|
"last_observed": "2016-10-25T13:59:14Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--580f6532-8ddc-4167-8163-4d7a950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--580f6532-8ddc-4167-8163-4d7a950d210f",
|
||
|
|
"name": "api-ms-win-samcli-dnsapi-0-0-0.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6533-d314-48d0-9d8e-44cb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:59:15.000Z",
|
||
|
|
"modified": "2016-10-25T13:59:15.000Z",
|
||
|
|
"first_observed": "2016-10-25T13:59:15Z",
|
||
|
|
"last_observed": "2016-10-25T13:59:15Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--580f6533-d314-48d0-9d8e-44cb950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--580f6533-d314-48d0-9d8e-44cb950d210f",
|
||
|
|
"name": "apisvcd.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6533-4f7c-46dd-92fb-4a0d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:59:15.000Z",
|
||
|
|
"modified": "2016-10-25T13:59:15.000Z",
|
||
|
|
"first_observed": "2016-10-25T13:59:15Z",
|
||
|
|
"last_observed": "2016-10-25T13:59:15Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--580f6533-4f7c-46dd-92fb-4a0d950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--580f6533-4f7c-46dd-92fb-4a0d950d210f",
|
||
|
|
"name": "btecache.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6534-93f0-4a5d-bb87-4b45950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:59:16.000Z",
|
||
|
|
"modified": "2016-10-25T13:59:16.000Z",
|
||
|
|
"first_observed": "2016-10-25T13:59:16Z",
|
||
|
|
"last_observed": "2016-10-25T13:59:16Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--580f6534-93f0-4a5d-bb87-4b45950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--580f6534-93f0-4a5d-bb87-4b45950d210f",
|
||
|
|
"name": "cormac.mcr"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6535-0704-4901-bd24-453f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:59:17.000Z",
|
||
|
|
"modified": "2016-10-25T13:59:17.000Z",
|
||
|
|
"first_observed": "2016-10-25T13:59:17Z",
|
||
|
|
"last_observed": "2016-10-25T13:59:17Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--580f6535-0704-4901-bd24-453f950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--580f6535-0704-4901-bd24-453f950d210f",
|
||
|
|
"name": "csrs.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6535-76f0-4997-9ede-44bf950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:59:17.000Z",
|
||
|
|
"modified": "2016-10-25T13:59:17.000Z",
|
||
|
|
"first_observed": "2016-10-25T13:59:17Z",
|
||
|
|
"last_observed": "2016-10-25T13:59:17Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--580f6535-76f0-4997-9ede-44bf950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--580f6535-76f0-4997-9ede-44bf950d210f",
|
||
|
|
"name": "csrs.exe"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6536-f668-4fe9-8a9d-4071950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:59:18.000Z",
|
||
|
|
"modified": "2016-10-25T13:59:18.000Z",
|
||
|
|
"first_observed": "2016-10-25T13:59:18Z",
|
||
|
|
"last_observed": "2016-10-25T13:59:18Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--580f6536-f668-4fe9-8a9d-4071950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--580f6536-f668-4fe9-8a9d-4071950d210f",
|
||
|
|
"name": "decompbufferrawfix-0x624-1643712-1.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6536-c2c4-420e-bd1e-4214950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:59:18.000Z",
|
||
|
|
"modified": "2016-10-25T13:59:18.000Z",
|
||
|
|
"first_observed": "2016-10-25T13:59:18Z",
|
||
|
|
"last_observed": "2016-10-25T13:59:18Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--580f6536-c2c4-420e-bd1e-4214950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--580f6536-c2c4-420e-bd1e-4214950d210f",
|
||
|
|
"name": "decompbufferrawpe-0x7c4-1429488-1.bin"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6537-f968-4a26-93b3-4780950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:59:19.000Z",
|
||
|
|
"modified": "2016-10-25T13:59:19.000Z",
|
||
|
|
"first_observed": "2016-10-25T13:59:19Z",
|
||
|
|
"last_observed": "2016-10-25T13:59:19Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--580f6537-f968-4a26-93b3-4780950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--580f6537-f968-4a26-93b3-4780950d210f",
|
||
|
|
"name": "hazard.exe"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6537-a3ac-4b46-8826-4937950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:59:19.000Z",
|
||
|
|
"modified": "2016-10-25T13:59:19.000Z",
|
||
|
|
"first_observed": "2016-10-25T13:59:19Z",
|
||
|
|
"last_observed": "2016-10-25T13:59:19Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--580f6537-a3ac-4b46-8826-4937950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--580f6537-a3ac-4b46-8826-4937950d210f",
|
||
|
|
"name": "hello32.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6538-274c-40eb-b631-45e8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:59:20.000Z",
|
||
|
|
"modified": "2016-10-25T13:59:20.000Z",
|
||
|
|
"first_observed": "2016-10-25T13:59:20Z",
|
||
|
|
"last_observed": "2016-10-25T13:59:20Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--580f6538-274c-40eb-b631-45e8950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--580f6538-274c-40eb-b631-45e8950d210f",
|
||
|
|
"name": "hpinst.exe"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6539-da20-4a44-bc2a-4d3f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:59:21.000Z",
|
||
|
|
"modified": "2016-10-25T13:59:21.000Z",
|
||
|
|
"first_observed": "2016-10-25T13:59:21Z",
|
||
|
|
"last_observed": "2016-10-25T13:59:21Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--580f6539-da20-4a44-bc2a-4d3f950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--580f6539-da20-4a44-bc2a-4d3f950d210f",
|
||
|
|
"name": "iprpp.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6539-1b48-497c-b728-4efc950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:59:21.000Z",
|
||
|
|
"modified": "2016-10-25T13:59:21.000Z",
|
||
|
|
"first_observed": "2016-10-25T13:59:21Z",
|
||
|
|
"last_observed": "2016-10-25T13:59:21Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--580f6539-1b48-497c-b728-4efc950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--580f6539-1b48-497c-b728-4efc950d210f",
|
||
|
|
"name": "lsasrvi.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f653a-083c-4011-802d-49cb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:59:22.000Z",
|
||
|
|
"modified": "2016-10-25T13:59:22.000Z",
|
||
|
|
"first_observed": "2016-10-25T13:59:22Z",
|
||
|
|
"last_observed": "2016-10-25T13:59:22Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--580f653a-083c-4011-802d-49cb950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--580f653a-083c-4011-802d-49cb950d210f",
|
||
|
|
"name": "mgswizap.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f653a-1ac0-4c37-aa18-4999950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:59:22.000Z",
|
||
|
|
"modified": "2016-10-25T13:59:22.000Z",
|
||
|
|
"first_observed": "2016-10-25T13:59:22Z",
|
||
|
|
"last_observed": "2016-10-25T13:59:22Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--580f653a-1ac0-4c37-aa18-4999950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--580f653a-1ac0-4c37-aa18-4999950d210f",
|
||
|
|
"name": "runrun.exe"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f653b-e310-47fe-bea1-454a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T13:59:23.000Z",
|
||
|
|
"modified": "2016-10-25T13:59:23.000Z",
|
||
|
|
"first_observed": "2016-10-25T13:59:23Z",
|
||
|
|
"last_observed": "2016-10-25T13:59:23Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--580f653b-e310-47fe-bea1-454a950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--580f653b-e310-47fe-bea1-454a950d210f",
|
||
|
|
"name": "vmware_manager.exe"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6566-5284-486a-aec2-4032950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:00:06.000Z",
|
||
|
|
"modified": "2016-10-25T14:00:06.000Z",
|
||
|
|
"pattern": "[mutex:name = '//dfc01ell6zsq3-ufhhf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:00:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"mutex\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6566-668c-498b-9f41-43fe950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:00:06.000Z",
|
||
|
|
"modified": "2016-10-25T14:00:06.000Z",
|
||
|
|
"pattern": "[mutex:name = '\\\\BaseNamedObjects\\\\513AbTAsEpcq4mf6TEacB']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:00:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"mutex\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6567-e8e4-4952-9a45-4147950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:00:07.000Z",
|
||
|
|
"modified": "2016-10-25T14:00:07.000Z",
|
||
|
|
"pattern": "[mutex:name = '\\\\BaseNamedObjects\\\\ASLIiasiuqpssuqkl713h']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:00:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"mutex\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6567-7f5c-42f5-a0ea-4e7d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:00:07.000Z",
|
||
|
|
"modified": "2016-10-25T14:00:07.000Z",
|
||
|
|
"pattern": "[mutex:name = '\\\\BaseNamedObjects\\\\B5a20F03e6445A6987f8EC87913c9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:00:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"mutex\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6568-5290-4008-ac07-4c66950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:00:08.000Z",
|
||
|
|
"modified": "2016-10-25T14:00:08.000Z",
|
||
|
|
"pattern": "[mutex:name = '\\\\BaseNamedObjects\\\\sSbydFdIob6NrhNTJcF89uDqE2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:00:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"mutex\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6568-64a8-46a4-87a1-42fa950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:00:08.000Z",
|
||
|
|
"modified": "2016-10-25T14:00:08.000Z",
|
||
|
|
"pattern": "[mutex:name = 'ASijnoKGszdpodPPiaoaghj8127391']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:00:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"mutex\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f65ad-ffd4-417f-8f00-4687950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:01:17.000Z",
|
||
|
|
"modified": "2016-10-25T14:01:17.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:01:17Z",
|
||
|
|
"last_observed": "2016-10-25T14:01:17Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--580f65ad-ffd4-417f-8f00-4687950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--580f65ad-ffd4-417f-8f00-4687950d210f",
|
||
|
|
"name": "jhuhugit.temp"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f65ae-11e0-4513-956b-4b72950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:01:18.000Z",
|
||
|
|
"modified": "2016-10-25T14:01:18.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:01:18Z",
|
||
|
|
"last_observed": "2016-10-25T14:01:18Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--580f65ae-11e0-4513-956b-4b72950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--580f65ae-11e0-4513-956b-4b72950d210f",
|
||
|
|
"name": "jhuhugit.tmp"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f65ae-6b2c-4248-8d6d-4570950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:01:18.000Z",
|
||
|
|
"modified": "2016-10-25T14:01:18.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:01:18Z",
|
||
|
|
"last_observed": "2016-10-25T14:01:18Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--580f65ae-6b2c-4248-8d6d-4570950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--580f65ae-6b2c-4248-8d6d-4570950d210f",
|
||
|
|
"name": "jkeyskw.temp"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f65cb-dc7c-4363-9e7b-46c2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:01:47.000Z",
|
||
|
|
"modified": "2016-10-25T14:01:47.000Z",
|
||
|
|
"pattern": "[windows-registry-key:key = 'HKCU\\\\Software\\\\Microsoft\\\\Office test\\\\Special\\\\Perf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:01:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"regkey\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6610-b7b0-494c-857d-455a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:02:56.000Z",
|
||
|
|
"modified": "2016-10-25T14:02:56.000Z",
|
||
|
|
"description": "C&C Server Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'swsupporttools.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:02:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6611-4fd8-4e2d-ab0e-4fcc950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:02:57.000Z",
|
||
|
|
"modified": "2016-10-25T14:02:57.000Z",
|
||
|
|
"description": "C&C Server Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'www.capisp.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:02:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6611-3660-4797-8d50-4093950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:02:57.000Z",
|
||
|
|
"modified": "2016-10-25T14:02:57.000Z",
|
||
|
|
"description": "C&C Server Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'www.dataclen.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:02:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6612-a31c-456d-a57c-4caf950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:02:58.000Z",
|
||
|
|
"modified": "2016-10-25T14:02:58.000Z",
|
||
|
|
"description": "C&C Server Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'www.mscoresvw.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:02:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6612-d56c-423e-865c-42d3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:02:58.000Z",
|
||
|
|
"modified": "2016-10-25T14:02:58.000Z",
|
||
|
|
"description": "C&C Server Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'www.windowscheckupdater.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:02:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6613-1a78-46ef-91c0-4674950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:02:59.000Z",
|
||
|
|
"modified": "2016-10-25T14:02:59.000Z",
|
||
|
|
"description": "C&C Server Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'www.acledit.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:02:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6613-1ccc-40af-b832-4088950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:02:59.000Z",
|
||
|
|
"modified": "2016-10-25T14:02:59.000Z",
|
||
|
|
"description": "C&C Server Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'www.biocpl.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:02:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6614-594c-4df1-9b0f-4c9f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:03:00.000Z",
|
||
|
|
"modified": "2016-10-25T14:03:00.000Z",
|
||
|
|
"description": "C&C Server Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'www.wscapi.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:03:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6614-25f8-4690-898c-40b4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:03:00.000Z",
|
||
|
|
"modified": "2016-10-25T14:03:00.000Z",
|
||
|
|
"description": "C&C Server Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'www.tabsync.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:03:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6614-5a6c-429b-9253-459e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:03:00.000Z",
|
||
|
|
"modified": "2016-10-25T14:03:00.000Z",
|
||
|
|
"description": "C&C Server Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'www.storsvc.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:03:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6615-b9dc-4980-9b03-445d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:03:01.000Z",
|
||
|
|
"modified": "2016-10-25T14:03:01.000Z",
|
||
|
|
"description": "C&C Server Domain Names",
|
||
|
|
"pattern": "[domain-name:value = 'www.winupdatesysmic.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:03:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f6630-9c80-4690-9cc2-4f05950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:03:28.000Z",
|
||
|
|
"modified": "2016-10-25T14:03:28.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"pdb\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Artifacts dropped",
|
||
|
|
"x_misp_type": "pdb",
|
||
|
|
"x_misp_value": "D:\\REDMINE\\JOINER\\HEADER_PAYLOAD\\header_payload\\Uploader\\Release\\Uploader.pdb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f666b-c91c-48b9-bd22-40a9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:04:27.000Z",
|
||
|
|
"modified": "2016-10-25T14:04:27.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Linux/Fysbis"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f666c-de3c-402b-b8fc-44fb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:04:28.000Z",
|
||
|
|
"modified": "2016-10-25T14:04:28.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Win32/Agent.VQQ"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f666c-7404-446c-99b9-4c53950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:04:28.000Z",
|
||
|
|
"modified": "2016-10-25T14:04:28.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Win32/Agent.WGJ"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f666d-fb14-421d-9a4e-4a03950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:04:29.000Z",
|
||
|
|
"modified": "2016-10-25T14:04:29.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Win32/Agent.WLF"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f666d-a150-4907-966d-42da950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:04:29.000Z",
|
||
|
|
"modified": "2016-10-25T14:04:29.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Win32/Agent.XIP"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f666e-fd3c-42d0-85db-4e9f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:04:30.000Z",
|
||
|
|
"modified": "2016-10-25T14:04:30.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Win32/Agent.XPY"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f666e-1900-489d-abed-4f05950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:04:30.000Z",
|
||
|
|
"modified": "2016-10-25T14:04:30.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Win32/Agent.XPZ"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f666f-dacc-4fb3-ab95-4189950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:04:31.000Z",
|
||
|
|
"modified": "2016-10-25T14:04:31.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Win32/Agent.XVD"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f666f-745c-42c6-91d5-4212950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:04:31.000Z",
|
||
|
|
"modified": "2016-10-25T14:04:31.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Win32/Agent.XWX"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f6670-aa4c-484e-989d-4d52950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:04:32.000Z",
|
||
|
|
"modified": "2016-10-25T14:04:32.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Win64/Agent.ED"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f6670-0828-4d20-907e-4b0f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:04:32.000Z",
|
||
|
|
"modified": "2016-10-25T14:04:32.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "Win64/Agent.EZ"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f6671-2f80-4fb6-83ba-45d0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:04:33.000Z",
|
||
|
|
"modified": "2016-10-25T14:04:33.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "iOS/XAgent.A"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f6671-797c-412f-bf4d-49cf950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:04:33.000Z",
|
||
|
|
"modified": "2016-10-25T14:04:33.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"Antivirus detection\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Antivirus detection",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "iOS/XAgent.B"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f669c-b714-427c-88f3-4808950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:05:16.000Z",
|
||
|
|
"modified": "2016-10-25T14:05:16.000Z",
|
||
|
|
"description": "Xagent",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '072933fa35b585511003f36e3885563e1b55d55a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:05:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f669d-bf18-479a-83cc-481d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:05:17.000Z",
|
||
|
|
"modified": "2016-10-25T14:05:17.000Z",
|
||
|
|
"description": "Xagent",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '082141f1c24fb49981cc70a9ed50cda582ee04dd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:05:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f669d-b2d4-479d-bcf4-4202950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:05:17.000Z",
|
||
|
|
"modified": "2016-10-25T14:05:17.000Z",
|
||
|
|
"description": "Xagent",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '08c4d755f14fd6df76ec86da6eab1b5574dfbafd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:05:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f669d-8d3c-4ccb-83f2-40b5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:05:17.000Z",
|
||
|
|
"modified": "2016-10-25T14:05:17.000Z",
|
||
|
|
"description": "Xagent",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '0f04dad5194f97bb4f1808df19196b04b4aee1b8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:05:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f669e-84a0-48e3-9dfc-4bc0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:05:18.000Z",
|
||
|
|
"modified": "2016-10-25T14:05:18.000Z",
|
||
|
|
"description": "Xagent",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '3403519fa3ede4d07fb4c05d422a9f8c026cedbf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:05:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f669e-72b0-4476-9eb7-4d60950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:05:18.000Z",
|
||
|
|
"modified": "2016-10-25T14:05:18.000Z",
|
||
|
|
"description": "Xagent",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '499ff777c88aeacbbaa47edde183c944ac7e91d2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:05:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f669f-f16c-4068-8601-4af8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:05:19.000Z",
|
||
|
|
"modified": "2016-10-25T14:05:19.000Z",
|
||
|
|
"description": "Xagent",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '4b74c90c9d9ce7668aa9eb09978c1d8d4dfda24a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:05:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f669f-4990-4144-85ee-43db950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:05:19.000Z",
|
||
|
|
"modified": "2016-10-25T14:05:19.000Z",
|
||
|
|
"description": "Xagent",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '4bc32a3894f64b4be931ff20390712b4ec605488']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:05:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f66a0-865c-4dff-849b-4f9d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:05:20.000Z",
|
||
|
|
"modified": "2016-10-25T14:05:20.000Z",
|
||
|
|
"description": "Xagent",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '5f05a8cb6fef24a91b3bd6c137b23ab3166f39ae']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:05:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f66a0-3bfc-4b91-ac99-4eb6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:05:20.000Z",
|
||
|
|
"modified": "2016-10-25T14:05:20.000Z",
|
||
|
|
"description": "Xagent",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '71636e025fa308fc5b8065136f3dd692870cb8a4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:05:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f66a1-a220-4502-a62f-40a0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:05:21.000Z",
|
||
|
|
"modified": "2016-10-25T14:05:21.000Z",
|
||
|
|
"description": "Xagent",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '780aa72f0397cb6c2a78536201bd9db4818fa02a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:05:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f66a1-2210-445c-a0e1-427c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:05:21.000Z",
|
||
|
|
"modified": "2016-10-25T14:05:21.000Z",
|
||
|
|
"description": "Xagent",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a70ed3ae0bc3521e743191259753be945972118b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:05:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f66a2-5788-492a-9cf0-4b9f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:05:22.000Z",
|
||
|
|
"modified": "2016-10-25T14:05:22.000Z",
|
||
|
|
"description": "Xagent",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'baa4c177a53cfa5cc103296b07b62565e1c7799f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:05:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f66a2-50b0-4679-85ea-4671950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:05:22.000Z",
|
||
|
|
"modified": "2016-10-25T14:05:22.000Z",
|
||
|
|
"description": "Xagent",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c18edcba2c31533b7cdb6649a970dce397f4b13c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:05:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f66a2-45d4-4c96-a589-4135950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:05:22.000Z",
|
||
|
|
"modified": "2016-10-25T14:05:22.000Z",
|
||
|
|
"description": "Xagent",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'd00ac5498d0735d5ae0dea42a1f477cf8b8b0826']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:05:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f66a3-964c-4f3c-a54b-437e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:05:23.000Z",
|
||
|
|
"modified": "2016-10-25T14:05:23.000Z",
|
||
|
|
"description": "Xagent",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'd0db619a7a160949528d46d20fc0151bf9775c32']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:05:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f66a3-0fe0-4fd4-86e9-4dba950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:05:23.000Z",
|
||
|
|
"modified": "2016-10-25T14:05:23.000Z",
|
||
|
|
"description": "Xagent",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'e816ec78462b5925a1f3ef3cdb3cac6267222e72']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:05:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f66a4-8a6c-42af-9f02-4714950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:05:24.000Z",
|
||
|
|
"modified": "2016-10-25T14:05:24.000Z",
|
||
|
|
"description": "Xagent",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f1ee563d44e2b1020b7a556e080159f64f3fd699']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:05:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f66d0-7b2c-4995-8330-4a8e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:06:08.000Z",
|
||
|
|
"modified": "2016-10-25T14:06:08.000Z",
|
||
|
|
"description": "Linux Xagent",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '7e33a52e53e85ddb1dc8dc300e6558735acf10ce']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:06:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f66d1-ed10-4914-b5c4-436a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:06:09.000Z",
|
||
|
|
"modified": "2016-10-25T14:06:09.000Z",
|
||
|
|
"description": "Linux Xagent",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '9444d2b29c6401bc7c2d14f071b11ec9014ae040']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:06:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f66d1-b814-4da4-8acf-477f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:06:09.000Z",
|
||
|
|
"modified": "2016-10-25T14:06:09.000Z",
|
||
|
|
"description": "Linux Xagent",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'ecdda7aca5c805e5be6e0ab2017592439de7e32c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:06:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f66d2-df78-485b-b847-4788950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:06:10.000Z",
|
||
|
|
"modified": "2016-10-25T14:06:10.000Z",
|
||
|
|
"description": "Linux Xagent",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f080e509c988a9578862665b4fcf1e4bf8d77c3e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:06:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f671a-a06c-427c-9fed-4770950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:07:22.000Z",
|
||
|
|
"modified": "2016-10-25T14:07:22.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:07:22Z",
|
||
|
|
"last_observed": "2016-10-25T14:07:22Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--580f671a-a06c-427c-9fed-4770950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--580f671a-a06c-427c-9fed-4770950d210f",
|
||
|
|
"name": "rwte.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f671b-c618-4858-8030-4f35950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:07:23.000Z",
|
||
|
|
"modified": "2016-10-25T14:07:23.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:07:23Z",
|
||
|
|
"last_observed": "2016-10-25T14:07:23Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--580f671b-c618-4858-8030-4f35950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--580f671b-c618-4858-8030-4f35950d210f",
|
||
|
|
"name": "splm.dll"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f671b-f288-4b0e-9bf1-4e69950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:07:23.000Z",
|
||
|
|
"modified": "2016-10-25T14:07:23.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:07:23Z",
|
||
|
|
"last_observed": "2016-10-25T14:07:23Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--580f671b-f288-4b0e-9bf1-4e69950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--580f671b-f288-4b0e-9bf1-4e69950d210f",
|
||
|
|
"name": "lg3.exe"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f674e-293c-45a4-b49e-4de9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:08:14.000Z",
|
||
|
|
"modified": "2016-10-25T14:08:14.000Z",
|
||
|
|
"description": "C&C server Domain Names - Xagent",
|
||
|
|
"pattern": "[domain-name:value = 'ciscohelpcenter.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:08:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f674f-f488-480a-af78-4337950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:08:15.000Z",
|
||
|
|
"modified": "2016-10-25T14:08:15.000Z",
|
||
|
|
"description": "C&C server Domain Names - Xagent",
|
||
|
|
"pattern": "[domain-name:value = 'microsoftsupp.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:08:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f674f-6ce0-4d88-b32c-4a66950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:08:15.000Z",
|
||
|
|
"modified": "2016-10-25T14:08:15.000Z",
|
||
|
|
"description": "C&C server Domain Names - Xagent",
|
||
|
|
"pattern": "[domain-name:value = 'timezoneutc.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:08:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6750-6e94-4d4e-8bc6-4ad3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:08:16.000Z",
|
||
|
|
"modified": "2016-10-25T14:08:16.000Z",
|
||
|
|
"description": "C&C server Domain Names - Xagent",
|
||
|
|
"pattern": "[domain-name:value = 'inteldrv64.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:08:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6750-4410-4e4f-8a66-4cb2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:08:16.000Z",
|
||
|
|
"modified": "2016-10-25T14:08:16.000Z",
|
||
|
|
"description": "C&C server Domain Names - Xagent",
|
||
|
|
"pattern": "[domain-name:value = 'advpdxapi.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:08:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6780-d48c-4345-a967-4fb3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:09:04.000Z",
|
||
|
|
"modified": "2016-10-25T14:09:04.000Z",
|
||
|
|
"description": "Xagent C&C server IP Addresses",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.106.120.101']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:09:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6781-fe44-4817-93b7-4cff950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:09:05.000Z",
|
||
|
|
"modified": "2016-10-25T14:09:05.000Z",
|
||
|
|
"description": "Xagent C&C server IP Addresses",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.86.149.223']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:09:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6781-c910-4a32-8522-4331950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:09:05.000Z",
|
||
|
|
"modified": "2016-10-25T14:09:05.000Z",
|
||
|
|
"description": "Xagent C&C server IP Addresses",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '31.220.43.99']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:09:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6782-f628-4544-9c9b-4cee950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:09:06.000Z",
|
||
|
|
"modified": "2016-10-25T14:09:06.000Z",
|
||
|
|
"description": "Xagent C&C server IP Addresses",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.135.183.154']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:09:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6782-e2e0-4e1d-ae26-4171950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:09:06.000Z",
|
||
|
|
"modified": "2016-10-25T14:09:06.000Z",
|
||
|
|
"description": "Xagent C&C server IP Addresses",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '69.12.73.174']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:09:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6783-9b78-481a-9d47-4304950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:09:07.000Z",
|
||
|
|
"modified": "2016-10-25T14:09:07.000Z",
|
||
|
|
"description": "Xagent C&C server IP Addresses",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '89.32.40.4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:09:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6784-30fc-44cc-acb0-4fce950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:09:08.000Z",
|
||
|
|
"modified": "2016-10-25T14:09:08.000Z",
|
||
|
|
"description": "Xagent C&C server IP Addresses",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '92.114.92.125']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:09:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6784-3a20-47ec-9376-40de950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:09:08.000Z",
|
||
|
|
"modified": "2016-10-25T14:09:08.000Z",
|
||
|
|
"description": "Xagent C&C server IP Addresses",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '93.115.38.125']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:09:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f67d6-9738-4e08-a049-4044950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:10:30.000Z",
|
||
|
|
"modified": "2016-10-25T14:10:30.000Z",
|
||
|
|
"description": "Sedreco Dropper",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '4f895db287062a4ee1a2c5415900b56e2cf15842']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:10:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f67d6-5ec4-43c9-a6d0-446a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:10:30.000Z",
|
||
|
|
"modified": "2016-10-25T14:10:30.000Z",
|
||
|
|
"description": "Sedreco Dropper",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '87f45e82edd63ef05c41d18aeddeac00c49f1aee']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:10:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f67d7-af08-4180-9f0c-4b10950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:10:31.000Z",
|
||
|
|
"modified": "2016-10-25T14:10:31.000Z",
|
||
|
|
"description": "Sedreco Dropper",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '8ee6cec34070f20fd8ad4bb202a5b08aea22abfa']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:10:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f67d7-390c-46a3-821d-459d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:10:31.000Z",
|
||
|
|
"modified": "2016-10-25T14:10:31.000Z",
|
||
|
|
"description": "Sedreco Dropper",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '9e779c8b68780ac860920fcb4a8e700d97f084ef']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:10:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f67d8-3d38-45bd-a23a-4f57950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:10:32.000Z",
|
||
|
|
"modified": "2016-10-25T14:10:32.000Z",
|
||
|
|
"description": "Sedreco Dropper",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c23f18de9779c4f14a3655823f235f8e221d0f6a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:10:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f67d8-1b6c-4f02-a63f-441e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:10:32.000Z",
|
||
|
|
"modified": "2016-10-25T14:10:32.000Z",
|
||
|
|
"description": "Sedreco Dropper",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'e034e0d9ad069bab5a6e68c1517c15665abe67c9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:10:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f67d9-e16c-4c3d-878a-4d36950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:10:33.000Z",
|
||
|
|
"modified": "2016-10-25T14:10:33.000Z",
|
||
|
|
"description": "Sedreco Dropper",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'e17615331bdce4afa45e4912bdcc989eacf284bc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:10:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6803-b188-42b3-9594-4b34950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:11:15.000Z",
|
||
|
|
"modified": "2016-10-25T14:11:15.000Z",
|
||
|
|
"description": "Sedreco payload",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '04301b59c6eb71db2f701086b617a98c6e026872']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:11:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6803-bf38-498a-a1c9-43c0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:11:15.000Z",
|
||
|
|
"modified": "2016-10-25T14:11:15.000Z",
|
||
|
|
"description": "Sedreco payload",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '11af174294ee970ac7fd177746d23cdc8ffb92d7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:11:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6804-9d50-4ae9-92a2-4c24950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:11:16.000Z",
|
||
|
|
"modified": "2016-10-25T14:11:16.000Z",
|
||
|
|
"description": "Sedreco payload",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'e3b7704d4c887b40a9802e0695bae379358f3ba0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:11:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f681d-f1dc-451f-a758-4eb7950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:11:41.000Z",
|
||
|
|
"modified": "2016-10-25T14:11:41.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:11:41Z",
|
||
|
|
"last_observed": "2016-10-25T14:11:41Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--580f681d-f1dc-451f-a758-4eb7950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--580f681d-f1dc-451f-a758-4eb7950d210f",
|
||
|
|
"name": "%ALLUSERSPROFILE%\\msd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f681e-8bf0-49d9-a6bc-4ae1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:11:42.000Z",
|
||
|
|
"modified": "2016-10-25T14:11:42.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:11:42Z",
|
||
|
|
"last_observed": "2016-10-25T14:11:42Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--580f681e-8bf0-49d9-a6bc-4ae1950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--580f681e-8bf0-49d9-a6bc-4ae1950d210f",
|
||
|
|
"name": "%TEMP%\\__2315tmp.dat"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f681e-92c8-4359-8fcf-49ef950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:11:42.000Z",
|
||
|
|
"modified": "2016-10-25T14:11:42.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:11:42Z",
|
||
|
|
"last_observed": "2016-10-25T14:11:42Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--580f681e-92c8-4359-8fcf-49ef950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--580f681e-92c8-4359-8fcf-49ef950d210f",
|
||
|
|
"name": "%TEMP%\\__4964tmp.dat"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6850-bbdc-4c11-9947-4d20950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:12:32.000Z",
|
||
|
|
"modified": "2016-10-25T14:12:32.000Z",
|
||
|
|
"description": "Dropper Sedreco",
|
||
|
|
"pattern": "[file:name = 'scroll.dll']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:12:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6851-716c-453c-a1d5-48cf950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:12:33.000Z",
|
||
|
|
"modified": "2016-10-25T14:12:33.000Z",
|
||
|
|
"description": "Dropper Sedreco",
|
||
|
|
"pattern": "[file:name = 'wintraysys.exe']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:12:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f687c-ca08-47e0-877a-4f75950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:13:16.000Z",
|
||
|
|
"modified": "2016-10-25T14:13:16.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:13:16Z",
|
||
|
|
"last_observed": "2016-10-25T14:13:16Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"windows-registry-key--580f687c-ca08-47e0-877a-4f75950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"regkey\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "windows-registry-key",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "windows-registry-key--580f687c-ca08-47e0-877a-4f75950d210f",
|
||
|
|
"key": "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Path"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f687d-443c-4f4a-9224-433b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:13:17.000Z",
|
||
|
|
"modified": "2016-10-25T14:13:17.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:13:17Z",
|
||
|
|
"last_observed": "2016-10-25T14:13:17Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"windows-registry-key--580f687d-443c-4f4a-9224-433b950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"regkey\"",
|
||
|
|
"misp:category=\"Artifacts dropped\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "windows-registry-key",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "windows-registry-key--580f687d-443c-4f4a-9224-433b950d210f",
|
||
|
|
"key": "HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Path"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f68b3-52ec-4506-98c2-4c2d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:14:11.000Z",
|
||
|
|
"modified": "2016-10-25T14:14:11.000Z",
|
||
|
|
"description": "Sedreco",
|
||
|
|
"pattern": "[mutex:name = '\\\\BaseNamedObjects\\\\AZZYMTX']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:14:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"mutex\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f68b4-f5d0-4579-9771-4e2d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:14:12.000Z",
|
||
|
|
"modified": "2016-10-25T14:14:12.000Z",
|
||
|
|
"description": "Sedreco",
|
||
|
|
"pattern": "[mutex:name = '\\\\BaseNamedObjects\\\\MutYzAz']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:14:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"mutex\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f68e6-cdb8-4d19-b67a-42f5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:15:02.000Z",
|
||
|
|
"modified": "2016-10-25T14:15:02.000Z",
|
||
|
|
"description": "Sedreco - C&C",
|
||
|
|
"pattern": "[domain-name:value = '1oo7.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:15:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f68e7-f054-4a7d-91ac-46a8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:15:03.000Z",
|
||
|
|
"modified": "2016-10-25T14:15:03.000Z",
|
||
|
|
"description": "Sedreco - C&C",
|
||
|
|
"pattern": "[domain-name:value = 'akamaisoft.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:15:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f68e7-2538-4753-8d52-4d18950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:15:03.000Z",
|
||
|
|
"modified": "2016-10-25T14:15:03.000Z",
|
||
|
|
"description": "Sedreco - C&C",
|
||
|
|
"pattern": "[domain-name:value = 'cloudflarecdn.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:15:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f68e8-63b8-4cb8-b4a3-4df1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:15:04.000Z",
|
||
|
|
"modified": "2016-10-25T14:15:04.000Z",
|
||
|
|
"description": "Sedreco - C&C",
|
||
|
|
"pattern": "[domain-name:value = 'driversupdate.info']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:15:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f68e8-94dc-434e-8652-40d0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:15:04.000Z",
|
||
|
|
"modified": "2016-10-25T14:15:04.000Z",
|
||
|
|
"description": "Sedreco - C&C",
|
||
|
|
"pattern": "[domain-name:value = 'kenlynton.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:15:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f68e8-f510-40e5-a361-4436950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:15:04.000Z",
|
||
|
|
"modified": "2016-10-25T14:15:04.000Z",
|
||
|
|
"description": "Sedreco - C&C",
|
||
|
|
"pattern": "[domain-name:value = 'microsoftdriver.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:15:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f68e9-feb4-40a6-b833-43e8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:15:05.000Z",
|
||
|
|
"modified": "2016-10-25T14:15:05.000Z",
|
||
|
|
"description": "Sedreco - C&C",
|
||
|
|
"pattern": "[domain-name:value = 'microsofthelpcenter.info']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:15:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f68e9-d294-467a-8ec8-4777950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:15:05.000Z",
|
||
|
|
"modified": "2016-10-25T14:15:05.000Z",
|
||
|
|
"description": "Sedreco - C&C",
|
||
|
|
"pattern": "[domain-name:value = 'nortonupdate.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:15:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f68ea-8f84-4f2e-bc03-4128950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:15:06.000Z",
|
||
|
|
"modified": "2016-10-25T14:15:06.000Z",
|
||
|
|
"description": "Sedreco - C&C",
|
||
|
|
"pattern": "[domain-name:value = 'softwaresupportsv.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:15:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f68ea-5c88-445d-911e-4e0b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:15:06.000Z",
|
||
|
|
"modified": "2016-10-25T14:15:06.000Z",
|
||
|
|
"description": "Sedreco - C&C",
|
||
|
|
"pattern": "[domain-name:value = 'symantecsupport.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:15:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f68eb-c900-44d7-a00f-4ce8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:15:07.000Z",
|
||
|
|
"modified": "2016-10-25T14:15:07.000Z",
|
||
|
|
"description": "Sedreco - C&C",
|
||
|
|
"pattern": "[domain-name:value = 'updatecenter.name']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:15:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f68eb-1ba8-428e-b415-425f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:15:07.000Z",
|
||
|
|
"modified": "2016-10-25T14:15:07.000Z",
|
||
|
|
"description": "Sedreco - C&C",
|
||
|
|
"pattern": "[domain-name:value = 'updatesystems.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:15:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f68ec-c188-46d6-935d-4498950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:15:08.000Z",
|
||
|
|
"modified": "2016-10-25T14:15:08.000Z",
|
||
|
|
"description": "Sedreco - C&C",
|
||
|
|
"pattern": "[domain-name:value = 'updmanager.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:15:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f68ec-3db0-4fbb-be82-43ba950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:15:08.000Z",
|
||
|
|
"modified": "2016-10-25T14:15:08.000Z",
|
||
|
|
"description": "Sedreco - C&C",
|
||
|
|
"pattern": "[domain-name:value = 'windowsappstore.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:15:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f693e-fa84-4157-a425-458a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:16:30.000Z",
|
||
|
|
"modified": "2016-10-25T14:16:30.000Z",
|
||
|
|
"description": "Xtunnel",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '0450aaf8ed309ca6baf303837701b5b23aac6f05']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:16:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f693e-03a0-4bc4-b079-4aa8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:16:30.000Z",
|
||
|
|
"modified": "2016-10-25T14:16:30.000Z",
|
||
|
|
"description": "Xtunnel",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '067913b28840e926bf3b4bfac95291c9114d3787']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:16:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f693f-f0dc-447e-aa0f-47c3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:16:31.000Z",
|
||
|
|
"modified": "2016-10-25T14:16:31.000Z",
|
||
|
|
"description": "Xtunnel",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '1535d85bee8a9adb52e8179af20983fb0558ccb3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:16:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f693f-3494-436a-b82b-4c40950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:16:31.000Z",
|
||
|
|
"modified": "2016-10-25T14:16:31.000Z",
|
||
|
|
"description": "Xtunnel",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '42dee38929a93dfd45c39045708c57da15d7586c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:16:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6940-facc-44dc-a59c-443e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:16:32.000Z",
|
||
|
|
"modified": "2016-10-25T14:16:32.000Z",
|
||
|
|
"description": "Xtunnel",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '8f4f0edd5fb3737914180ff28ed0e9cca25bf4cc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:16:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6940-cee0-4e32-a522-45b5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:16:32.000Z",
|
||
|
|
"modified": "2016-10-25T14:16:32.000Z",
|
||
|
|
"description": "Xtunnel",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '982d9241147aaacf795174a9dab0e645cf56b922']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:16:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6941-a4f4-4648-b50a-46a0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:16:33.000Z",
|
||
|
|
"modified": "2016-10-25T14:16:33.000Z",
|
||
|
|
"description": "Xtunnel",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '99b454262dc26b081600e844371982a49d334e5e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:16:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6941-b984-405c-a208-400a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:16:33.000Z",
|
||
|
|
"modified": "2016-10-25T14:16:33.000Z",
|
||
|
|
"description": "Xtunnel",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c637e01f50f5fbd2160b191f6371c5de2ac56de4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:16:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6942-d9c4-4d51-8b3a-41ec950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:16:34.000Z",
|
||
|
|
"modified": "2016-10-25T14:16:34.000Z",
|
||
|
|
"description": "Xtunnel",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c91b192f4cd47ba0c8e49be438d035790ff85e70']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:16:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6942-98c0-4638-9b80-4910950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:16:34.000Z",
|
||
|
|
"modified": "2016-10-25T14:16:34.000Z",
|
||
|
|
"description": "Xtunnel",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'cdeea936331fcdd8158c876e9d23539f8976c305']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:16:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6943-0310-4463-8e4f-4d95950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:16:35.000Z",
|
||
|
|
"modified": "2016-10-25T14:16:35.000Z",
|
||
|
|
"description": "Xtunnel",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'db731119fca496064f8045061033a5976301770d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:16:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6943-079c-4145-9bc1-4073950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:16:35.000Z",
|
||
|
|
"modified": "2016-10-25T14:16:35.000Z",
|
||
|
|
"description": "Xtunnel",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'de3946b83411489797232560db838a802370ea71']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:16:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6944-b4a0-46d3-a595-4441950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:16:36.000Z",
|
||
|
|
"modified": "2016-10-25T14:16:36.000Z",
|
||
|
|
"description": "Xtunnel",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'e945de27ebfd1baf8e8d2a81f4fb0d4523d85d6a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:16:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6971-e804-4020-babf-4286950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:17:21.000Z",
|
||
|
|
"modified": "2016-10-25T14:17:21.000Z",
|
||
|
|
"description": "Xtunnel",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '131.72.136.165']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:17:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6972-c218-4e63-9426-41d7950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:17:22.000Z",
|
||
|
|
"modified": "2016-10-25T14:17:22.000Z",
|
||
|
|
"description": "Xtunnel",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '167.114.214.63']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:17:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6972-27e4-41c2-9c40-4e9a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:17:22.000Z",
|
||
|
|
"modified": "2016-10-25T14:17:22.000Z",
|
||
|
|
"description": "Xtunnel",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '176.31.112.10']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:17:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6973-bdf0-4243-b58f-4fa4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:17:23.000Z",
|
||
|
|
"modified": "2016-10-25T14:17:23.000Z",
|
||
|
|
"description": "Xtunnel",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '176.31.96.178']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:17:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6973-533c-471c-bfb7-40db950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:17:23.000Z",
|
||
|
|
"modified": "2016-10-25T14:17:23.000Z",
|
||
|
|
"description": "Xtunnel",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '192.95.12.5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:17:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6974-efd8-45d1-9b8b-4d73950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:17:24.000Z",
|
||
|
|
"modified": "2016-10-25T14:17:24.000Z",
|
||
|
|
"description": "Xtunnel",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '46.183.216.209']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:17:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6974-c964-4a05-bd07-43f9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:17:24.000Z",
|
||
|
|
"modified": "2016-10-25T14:17:24.000Z",
|
||
|
|
"description": "Xtunnel",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '80.255.10.236']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:17:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6975-d540-45da-87f9-469e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:17:25.000Z",
|
||
|
|
"modified": "2016-10-25T14:17:25.000Z",
|
||
|
|
"description": "Xtunnel",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '80.255.3.93']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:17:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6975-01ec-4f19-919f-4eb1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:17:25.000Z",
|
||
|
|
"modified": "2016-10-25T14:17:25.000Z",
|
||
|
|
"description": "Xtunnel",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '81.17.30.29']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:17:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6975-7714-468b-a655-4a3a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:17:25.000Z",
|
||
|
|
"modified": "2016-10-25T14:17:25.000Z",
|
||
|
|
"description": "Xtunnel",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '95.215.46.27']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:17:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f69b8-e388-47c2-9e5e-41bd950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-04-24T09:03:29.000Z",
|
||
|
|
"modified": "2017-04-24T09:03:29.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"pdb\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Artifacts dropped",
|
||
|
|
"x_misp_type": "pdb",
|
||
|
|
"x_misp_value": "H:\\last version 23.04\\UNvisible crypt version XAPS select - \u00d0\u00ba\u00d0\u00be\u00d0\u00bf\u00d0\u00b8\u00d1\u008f\\XAPS_OBJECTIVE\\Release\\XAPS_OBJECTIVE.pdb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f69b8-a6ec-424b-b1a7-4cd2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-04-24T09:03:37.000Z",
|
||
|
|
"modified": "2017-04-24T09:03:37.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"pdb\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Artifacts dropped",
|
||
|
|
"x_misp_type": "pdb",
|
||
|
|
"x_misp_value": "%USERPROFILE%\\Desktop\\xaps_through_squid_default_proxy\\Release\\XAPS_OBJECTIVE.pdb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f69b9-d3e8-4760-ae64-4b36950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-04-24T09:03:56.000Z",
|
||
|
|
"modified": "2017-04-24T09:03:56.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"pdb\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Artifacts dropped",
|
||
|
|
"x_misp_type": "pdb",
|
||
|
|
"x_misp_value": "%USERPROFILE%\\Documents\\\u00d0\u009d\u00d0\u00be\u00d0\u00b2\u00d0\u00b0\u00d1\u008f \u00d0\u00bf\u00d0\u00b0\u00d0\u00bf\u00d0\u00ba\\XAPS_OBJECTIVE\\Release\\XAPS_OBJECTIVE.pdb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--580f69b9-7684-4d05-913e-4d55950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-04-24T09:03:44.000Z",
|
||
|
|
"modified": "2017-04-24T09:03:44.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"pdb\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Artifacts dropped",
|
||
|
|
"x_misp_type": "pdb",
|
||
|
|
"x_misp_value": "E:\\PROJECT\\XAPS_OBJECTIVE_DLL\\Release\\XAPS_OBJECTIVE.pdb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a03-88dc-458a-b3bf-41a502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:19:47.000Z",
|
||
|
|
"modified": "2016-10-25T14:19:47.000Z",
|
||
|
|
"description": "Xtunnel - Xchecked via VT: e945de27ebfd1baf8e8d2a81f4fb0d4523d85d6a",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd2e947a39714478983764b270985d2529ff682ffec9ebac792158353caf90ed3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:19:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a04-f51c-4651-b691-4f5602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:19:48.000Z",
|
||
|
|
"modified": "2016-10-25T14:19:48.000Z",
|
||
|
|
"description": "Xtunnel - Xchecked via VT: e945de27ebfd1baf8e8d2a81f4fb0d4523d85d6a",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'cd1c521b6ae08fc97e3d69f242f00f9e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:19:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a04-0918-40e9-a5a1-4d8602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:19:48.000Z",
|
||
|
|
"modified": "2016-10-25T14:19:48.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:19:48Z",
|
||
|
|
"last_observed": "2016-10-25T14:19:48Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a04-0918-40e9-a5a1-4d8602de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a04-0918-40e9-a5a1-4d8602de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/d2e947a39714478983764b270985d2529ff682ffec9ebac792158353caf90ed3/analysis/1477363909/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a05-41b4-4705-9841-416202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:19:49.000Z",
|
||
|
|
"modified": "2016-10-25T14:19:49.000Z",
|
||
|
|
"description": "Xtunnel - Xchecked via VT: de3946b83411489797232560db838a802370ea71",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4dd8ab2471337a56b431433b7e8db2a659dc5d9dc5481b4209c4cddd07d6dc2b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:19:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a05-cdbc-4642-80bd-430402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:19:49.000Z",
|
||
|
|
"modified": "2016-10-25T14:19:49.000Z",
|
||
|
|
"description": "Xtunnel - Xchecked via VT: de3946b83411489797232560db838a802370ea71",
|
||
|
|
"pattern": "[file:hashes.MD5 = '1d1287d4a3ba5d02cca91f51863db738']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:19:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a06-36c0-4509-97db-4a7a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:19:50.000Z",
|
||
|
|
"modified": "2016-10-25T14:19:50.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:19:50Z",
|
||
|
|
"last_observed": "2016-10-25T14:19:50Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a06-36c0-4509-97db-4a7a02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a06-36c0-4509-97db-4a7a02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/4dd8ab2471337a56b431433b7e8db2a659dc5d9dc5481b4209c4cddd07d6dc2b/analysis/1471465605/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a06-4d34-4d09-ad8d-46a602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:19:50.000Z",
|
||
|
|
"modified": "2016-10-25T14:19:50.000Z",
|
||
|
|
"description": "Xtunnel - Xchecked via VT: db731119fca496064f8045061033a5976301770d",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '60ee6fdca66444bdc2e4b00dc67a1b0fdee5a3cd9979815e0aab9ce6435262c6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:19:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a07-9630-464d-87ac-467202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:19:51.000Z",
|
||
|
|
"modified": "2016-10-25T14:19:51.000Z",
|
||
|
|
"description": "Xtunnel - Xchecked via VT: db731119fca496064f8045061033a5976301770d",
|
||
|
|
"pattern": "[file:hashes.MD5 = '34651f2df01b956f1989da4b3ea40338']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:19:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a07-15f4-4055-9ab4-413302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:19:51.000Z",
|
||
|
|
"modified": "2016-10-25T14:19:51.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:19:51Z",
|
||
|
|
"last_observed": "2016-10-25T14:19:51Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a07-15f4-4055-9ab4-413302de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a07-15f4-4055-9ab4-413302de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/60ee6fdca66444bdc2e4b00dc67a1b0fdee5a3cd9979815e0aab9ce6435262c6/analysis/1477363770/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a08-3138-4e0f-b30e-4aac02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:19:52.000Z",
|
||
|
|
"modified": "2016-10-25T14:19:52.000Z",
|
||
|
|
"description": "Xtunnel - Xchecked via VT: cdeea936331fcdd8158c876e9d23539f8976c305",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '730a0e3daf0b54f065bdd2ca427fbe10e8d4e28646a5dc40cbcfb15e1702ed9a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:19:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a08-b8bc-40ae-928f-42ab02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:19:52.000Z",
|
||
|
|
"modified": "2016-10-25T14:19:52.000Z",
|
||
|
|
"description": "Xtunnel - Xchecked via VT: cdeea936331fcdd8158c876e9d23539f8976c305",
|
||
|
|
"pattern": "[file:hashes.MD5 = '5e70a5c47c6b59dae7faf0f2d62b28b3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:19:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a09-ffcc-4793-89b3-4c4f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:19:53.000Z",
|
||
|
|
"modified": "2016-10-25T14:19:53.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:19:53Z",
|
||
|
|
"last_observed": "2016-10-25T14:19:53Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a09-ffcc-4793-89b3-4c4f02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a09-ffcc-4793-89b3-4c4f02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/730a0e3daf0b54f065bdd2ca427fbe10e8d4e28646a5dc40cbcfb15e1702ed9a/analysis/1464765930/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a09-925c-4d30-a0ee-4cf202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:19:53.000Z",
|
||
|
|
"modified": "2016-10-25T14:19:53.000Z",
|
||
|
|
"description": "Xtunnel - Xchecked via VT: c91b192f4cd47ba0c8e49be438d035790ff85e70",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1c8869abf756e77e1b6d7d0ad5ca8f1cdce1a111315c3703e212fb3db174a6d5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:19:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a0a-c11c-402d-9ba0-43b002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:19:54.000Z",
|
||
|
|
"modified": "2016-10-25T14:19:54.000Z",
|
||
|
|
"description": "Xtunnel - Xchecked via VT: c91b192f4cd47ba0c8e49be438d035790ff85e70",
|
||
|
|
"pattern": "[file:hashes.MD5 = '672b8d14d1d3e97c24baf69d50937afc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:19:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a0a-1fcc-4fee-b2c1-4bab02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:19:54.000Z",
|
||
|
|
"modified": "2016-10-25T14:19:54.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:19:54Z",
|
||
|
|
"last_observed": "2016-10-25T14:19:54Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a0a-1fcc-4fee-b2c1-4bab02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a0a-1fcc-4fee-b2c1-4bab02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/1c8869abf756e77e1b6d7d0ad5ca8f1cdce1a111315c3703e212fb3db174a6d5/analysis/1477363730/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a0b-ab80-4a1b-b559-425402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:19:55.000Z",
|
||
|
|
"modified": "2016-10-25T14:19:55.000Z",
|
||
|
|
"description": "Xtunnel - Xchecked via VT: c637e01f50f5fbd2160b191f6371c5de2ac56de4",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c6a9db52a3855d980a7f383dbe2fb70300a12b7a3a4f0a995e2ebdef769eaaca']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:19:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a0c-22a8-4fde-8d9e-477802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:19:56.000Z",
|
||
|
|
"modified": "2016-10-25T14:19:56.000Z",
|
||
|
|
"description": "Xtunnel - Xchecked via VT: c637e01f50f5fbd2160b191f6371c5de2ac56de4",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'b2dc7c29cbf8d71d1dd57b474f1e04b9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:19:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a0c-1bb8-4b29-a441-4b1d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:19:56.000Z",
|
||
|
|
"modified": "2016-10-25T14:19:56.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:19:56Z",
|
||
|
|
"last_observed": "2016-10-25T14:19:56Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a0c-1bb8-4b29-a441-4b1d02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a0c-1bb8-4b29-a441-4b1d02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/c6a9db52a3855d980a7f383dbe2fb70300a12b7a3a4f0a995e2ebdef769eaaca/analysis/1471465607/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a0d-61b0-4d62-bee0-4d6202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:19:57.000Z",
|
||
|
|
"modified": "2016-10-25T14:19:57.000Z",
|
||
|
|
"description": "Xtunnel - Xchecked via VT: 99b454262dc26b081600e844371982a49d334e5e",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a979c5094f75548043a22b174aa10e1f2025371bd9e1249679f052b168e194b3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:19:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a0d-ab78-4ce2-8fe3-4b4902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:19:57.000Z",
|
||
|
|
"modified": "2016-10-25T14:19:57.000Z",
|
||
|
|
"description": "Xtunnel - Xchecked via VT: 99b454262dc26b081600e844371982a49d334e5e",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ac3e087e43be67bdc674747c665b46c2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:19:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a0e-76f8-494f-b352-427302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:19:58.000Z",
|
||
|
|
"modified": "2016-10-25T14:19:58.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:19:58Z",
|
||
|
|
"last_observed": "2016-10-25T14:19:58Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a0e-76f8-494f-b352-427302de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a0e-76f8-494f-b352-427302de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/a979c5094f75548043a22b174aa10e1f2025371bd9e1249679f052b168e194b3/analysis/1466592617/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a0e-fadc-4250-96c4-404a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:19:58.000Z",
|
||
|
|
"modified": "2016-10-25T14:19:58.000Z",
|
||
|
|
"description": "Xtunnel - Xchecked via VT: 982d9241147aaacf795174a9dab0e645cf56b922",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c9ef265fc0a174f3033ff21b8f0274224eb7154dca97f15cba598952be2fbace']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:19:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a0f-5fbc-4df8-8941-48d302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:19:59.000Z",
|
||
|
|
"modified": "2016-10-25T14:19:59.000Z",
|
||
|
|
"description": "Xtunnel - Xchecked via VT: 982d9241147aaacf795174a9dab0e645cf56b922",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0ebfac6dba63ff8b35cbd374ef33323a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:19:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a0f-aa48-4db5-816d-4bef02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:19:59.000Z",
|
||
|
|
"modified": "2016-10-25T14:19:59.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:19:59Z",
|
||
|
|
"last_observed": "2016-10-25T14:19:59Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a0f-aa48-4db5-816d-4bef02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a0f-aa48-4db5-816d-4bef02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/c9ef265fc0a174f3033ff21b8f0274224eb7154dca97f15cba598952be2fbace/analysis/1477361174/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a0f-7158-4424-a1eb-4e9d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:19:59.000Z",
|
||
|
|
"modified": "2016-10-25T14:19:59.000Z",
|
||
|
|
"description": "Xtunnel - Xchecked via VT: 8f4f0edd5fb3737914180ff28ed0e9cca25bf4cc",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1289ee3d29967f491542c0bdeff6974aad6b37932e91ff9c746fb220d5edb407']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:19:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a10-8e74-4fa8-9c86-485e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:00.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:00.000Z",
|
||
|
|
"description": "Xtunnel - Xchecked via VT: 8f4f0edd5fb3737914180ff28ed0e9cca25bf4cc",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'e766e048bd222cfd2b9cc1bf24125dac']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a10-6fa4-4196-b353-457f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:00.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:00.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:00Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:00Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a10-6fa4-4196-b353-457f02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a10-6fa4-4196-b353-457f02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/1289ee3d29967f491542c0bdeff6974aad6b37932e91ff9c746fb220d5edb407/analysis/1477361026/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a11-c070-4e8e-a6bc-426002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:01.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:01.000Z",
|
||
|
|
"description": "Xtunnel - Xchecked via VT: 42dee38929a93dfd45c39045708c57da15d7586c",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a2c9041ee1918523e67dbaf1c514f98609d4dbe451ba08657653bb41946fc89d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a11-5d44-4451-9c8f-4b3b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:01.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:01.000Z",
|
||
|
|
"description": "Xtunnel - Xchecked via VT: 42dee38929a93dfd45c39045708c57da15d7586c",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ae4ded48da0766d237ce2262202c3c96']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a12-cca0-44b2-a7b1-4f4602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:02.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:02.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:02Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:02Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a12-cca0-44b2-a7b1-4f4602de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a12-cca0-44b2-a7b1-4f4602de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/a2c9041ee1918523e67dbaf1c514f98609d4dbe451ba08657653bb41946fc89d/analysis/1477361078/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a13-74e4-418e-a056-456302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:03.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:03.000Z",
|
||
|
|
"description": "Xtunnel - Xchecked via VT: 1535d85bee8a9adb52e8179af20983fb0558ccb3",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8c488b029188e3280ed3614346575a4a390e0dda002bca08c0335210a6202949']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a13-5c34-489f-9e35-44c002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:03.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:03.000Z",
|
||
|
|
"description": "Xtunnel - Xchecked via VT: 1535d85bee8a9adb52e8179af20983fb0558ccb3",
|
||
|
|
"pattern": "[file:hashes.MD5 = '4ac8d16ff796e825625ad1861546e2e8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a14-3708-476f-acd2-4d8b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:04.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:04.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:04Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:04Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a14-3708-476f-acd2-4d8b02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a14-3708-476f-acd2-4d8b02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/8c488b029188e3280ed3614346575a4a390e0dda002bca08c0335210a6202949/analysis/1477361177/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a14-2f38-48e0-8a81-410c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:04.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:04.000Z",
|
||
|
|
"description": "Xtunnel - Xchecked via VT: 067913b28840e926bf3b4bfac95291c9114d3787",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd2a6064429754571682f475b6b67f36526f1573d846182aab3516c2637fa1e81']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a15-90a8-4799-8138-4a4602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:05.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:05.000Z",
|
||
|
|
"description": "Xtunnel - Xchecked via VT: 067913b28840e926bf3b4bfac95291c9114d3787",
|
||
|
|
"pattern": "[file:hashes.MD5 = '02522ce47a8db9544f8877dace7e0833']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a15-941c-4ab7-a37b-445502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:05.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:05.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:05Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:05Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a15-941c-4ab7-a37b-445502de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a15-941c-4ab7-a37b-445502de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/d2a6064429754571682f475b6b67f36526f1573d846182aab3516c2637fa1e81/analysis/1477363422/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a16-1ff4-4821-9619-43e102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:06.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:06.000Z",
|
||
|
|
"description": "Xtunnel - Xchecked via VT: 0450aaf8ed309ca6baf303837701b5b23aac6f05",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '566ab945f61be016bfd9e83cc1b64f783b9b8deb891e6d504d3442bc8281b092']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a16-9148-4828-bb7f-478b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:06.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:06.000Z",
|
||
|
|
"description": "Xtunnel - Xchecked via VT: 0450aaf8ed309ca6baf303837701b5b23aac6f05",
|
||
|
|
"pattern": "[file:hashes.MD5 = '800af1c9d341b846a856a1e686be6a3e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a17-29f4-4b66-aa25-45d402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:07.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:07.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:07Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:07Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a17-29f4-4b66-aa25-45d402de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a17-29f4-4b66-aa25-45d402de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/566ab945f61be016bfd9e83cc1b64f783b9b8deb891e6d504d3442bc8281b092/analysis/1472528633/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a17-fe98-4e4a-96d6-443202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:07.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:07.000Z",
|
||
|
|
"description": "Sedreco payload - Xchecked via VT: e3b7704d4c887b40a9802e0695bae379358f3ba0",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a9dc96d45702538c2086a749ba2fb467ba8d8b603e513bdef62a024dfeb124cb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a18-e17c-4898-912b-484502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:08.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:08.000Z",
|
||
|
|
"description": "Sedreco payload - Xchecked via VT: e3b7704d4c887b40a9802e0695bae379358f3ba0",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'a96f4b8ac7aa9dbf4624424b7602d4f7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a18-386c-44f4-b7f8-45a102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:08.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:08.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:08Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:08Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a18-386c-44f4-b7f8-45a102de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a18-386c-44f4-b7f8-45a102de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/a9dc96d45702538c2086a749ba2fb467ba8d8b603e513bdef62a024dfeb124cb/analysis/1475067319/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a19-2fcc-4a83-86d1-4a9302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:09.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:09.000Z",
|
||
|
|
"description": "Sedreco payload - Xchecked via VT: 11af174294ee970ac7fd177746d23cdc8ffb92d7",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ba1c02aa6c12794a33c4742e62cbda3c17def08732f3fbaeb801f1806770b9a0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a19-5810-4d97-b89b-401a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:09.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:09.000Z",
|
||
|
|
"description": "Sedreco payload - Xchecked via VT: 11af174294ee970ac7fd177746d23cdc8ffb92d7",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9422ca55f7fca4449259d8878ede5e47']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a1a-6534-4cae-8b9a-4fe302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:10.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:10.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:10Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:10Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a1a-6534-4cae-8b9a-4fe302de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a1a-6534-4cae-8b9a-4fe302de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/ba1c02aa6c12794a33c4742e62cbda3c17def08732f3fbaeb801f1806770b9a0/analysis/1461305062/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a1a-048c-4481-a867-403902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:10.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:10.000Z",
|
||
|
|
"description": "Sedreco payload - Xchecked via VT: 04301b59c6eb71db2f701086b617a98c6e026872",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '37bf2c811842972314956434449fd294e793b43c1a7b37cfe41af4fcc07d329d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a1b-f974-412d-9147-405202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:11.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:11.000Z",
|
||
|
|
"description": "Sedreco payload - Xchecked via VT: 04301b59c6eb71db2f701086b617a98c6e026872",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'cf30b7550f04a9372c3257c9b5cff3e9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a1b-3058-4723-9059-4a0a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:11.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:11.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:11Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:11Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a1b-3058-4723-9059-4a0a02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a1b-3058-4723-9059-4a0a02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/37bf2c811842972314956434449fd294e793b43c1a7b37cfe41af4fcc07d329d/analysis/1461069059/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a1c-5374-490c-ac8d-476402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:11.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:11.000Z",
|
||
|
|
"description": "Sedreco Dropper - Xchecked via VT: e17615331bdce4afa45e4912bdcc989eacf284bc",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6bbec6b2927325891cc008d3378d30941fe9d21e5c9bd6459e8e3ba8c78833c2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a1c-d634-4310-a5cd-4db802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:12.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:12.000Z",
|
||
|
|
"description": "Sedreco Dropper - Xchecked via VT: e17615331bdce4afa45e4912bdcc989eacf284bc",
|
||
|
|
"pattern": "[file:hashes.MD5 = '5e93cf87040cf225ab5b5b9f9f0a0d03']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a1c-1088-4b57-8052-43d402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:12.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:12.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:12Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:12Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a1c-1088-4b57-8052-43d402de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a1c-1088-4b57-8052-43d402de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/6bbec6b2927325891cc008d3378d30941fe9d21e5c9bd6459e8e3ba8c78833c2/analysis/1466540502/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a1d-0230-43be-b514-452802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:13.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:13.000Z",
|
||
|
|
"description": "Sedreco Dropper - Xchecked via VT: e034e0d9ad069bab5a6e68c1517c15665abe67c9",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'fb3a3339e2ba82cb3dcdc43d0e49e7b8a26ced3a587f5ee15a256aee062e6e05']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a1d-d750-4259-87e3-45d902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:13.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:13.000Z",
|
||
|
|
"description": "Sedreco Dropper - Xchecked via VT: e034e0d9ad069bab5a6e68c1517c15665abe67c9",
|
||
|
|
"pattern": "[file:hashes.MD5 = '6a24be8f61bcd789622dc55ebb7db90b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a1e-9fc8-430b-b788-406902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:14.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:14.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:14Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:14Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a1e-9fc8-430b-b788-406902de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a1e-9fc8-430b-b788-406902de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/fb3a3339e2ba82cb3dcdc43d0e49e7b8a26ced3a587f5ee15a256aee062e6e05/analysis/1436404088/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a1e-7158-4e74-8e19-458202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:14.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:14.000Z",
|
||
|
|
"description": "Sedreco Dropper - Xchecked via VT: c23f18de9779c4f14a3655823f235f8e221d0f6a",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ec2f14916e0b52fb727111962dff9846839137968e32269a82288aee9f227bd4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a1f-5c7c-4116-81d7-4dff02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:15.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:15.000Z",
|
||
|
|
"description": "Sedreco Dropper - Xchecked via VT: c23f18de9779c4f14a3655823f235f8e221d0f6a",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9f82abbaebc1093a187f1887df2cf926']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a1f-5e40-4942-a74c-4cf302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:15.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:15.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:15Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:15Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a1f-5e40-4942-a74c-4cf302de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a1f-5e40-4942-a74c-4cf302de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/ec2f14916e0b52fb727111962dff9846839137968e32269a82288aee9f227bd4/analysis/1445274531/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a20-6030-43e1-b9e9-461702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:16.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:16.000Z",
|
||
|
|
"description": "Sedreco Dropper - Xchecked via VT: 9e779c8b68780ac860920fcb4a8e700d97f084ef",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2c81023a146d2b5003d2b0c617ebf2eb1501dc6e55fc6326e834f05f5558c0ec']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a20-430c-4bad-abf6-4b2702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:16.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:16.000Z",
|
||
|
|
"description": "Sedreco Dropper - Xchecked via VT: 9e779c8b68780ac860920fcb4a8e700d97f084ef",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'f686304cff9b35ea0d7647820ab525ba']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a21-0b3c-471f-8328-42dd02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:17.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:17.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:17Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:17Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a21-0b3c-471f-8328-42dd02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a21-0b3c-471f-8328-42dd02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/2c81023a146d2b5003d2b0c617ebf2eb1501dc6e55fc6326e834f05f5558c0ec/analysis/1466631008/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a21-f370-4963-8926-493f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:17.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:17.000Z",
|
||
|
|
"description": "Sedreco Dropper - Xchecked via VT: 8ee6cec34070f20fd8ad4bb202a5b08aea22abfa",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '20ac1420eade0bdb464cd9f6d26a84094271b252c0650a7853721d8e928f6e6c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a22-e4c8-43c1-9558-4c6602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:18.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:18.000Z",
|
||
|
|
"description": "Sedreco Dropper - Xchecked via VT: 8ee6cec34070f20fd8ad4bb202a5b08aea22abfa",
|
||
|
|
"pattern": "[file:hashes.MD5 = '30cda69cf82637dfa2ffdc803bf2aead']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a22-ebfc-4f5d-857a-465002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:18.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:18.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:18Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:18Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a22-ebfc-4f5d-857a-465002de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a22-ebfc-4f5d-857a-465002de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/20ac1420eade0bdb464cd9f6d26a84094271b252c0650a7853721d8e928f6e6c/analysis/1440551349/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a23-aa00-46c9-9761-4ea602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:19.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:19.000Z",
|
||
|
|
"description": "Sedreco Dropper - Xchecked via VT: 87f45e82edd63ef05c41d18aeddeac00c49f1aee",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '378ef276eeaa4a29dab46d114710fc14ba0a9f964f6d949bcbc5ed3267579892']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a23-0dc8-447c-8fac-480a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:19.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:19.000Z",
|
||
|
|
"description": "Sedreco Dropper - Xchecked via VT: 87f45e82edd63ef05c41d18aeddeac00c49f1aee",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9617f3948b1886ebc95689c02d2cf264']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a24-d6d0-4fb3-a0b3-4fd102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:20.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:20.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:20Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:20Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a24-d6d0-4fb3-a0b3-4fd102de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a24-d6d0-4fb3-a0b3-4fd102de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/378ef276eeaa4a29dab46d114710fc14ba0a9f964f6d949bcbc5ed3267579892/analysis/1438176380/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a24-f608-4556-b070-4a8902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:20.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:20.000Z",
|
||
|
|
"description": "Sedreco Dropper - Xchecked via VT: 4f895db287062a4ee1a2c5415900b56e2cf15842",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd403ded7c4acfffe8dc2a3ad8fb848f08388b4c3452104f6970835913d92166c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a25-94f8-44ea-8d09-4f8d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:21.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:21.000Z",
|
||
|
|
"description": "Sedreco Dropper - Xchecked via VT: 4f895db287062a4ee1a2c5415900b56e2cf15842",
|
||
|
|
"pattern": "[file:hashes.MD5 = '5363e5cc28687b7dd71f1e257eab2d5d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a25-ecc4-4932-8cc4-415102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:21.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:21.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:21Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:21Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a25-ecc4-4932-8cc4-415102de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a25-ecc4-4932-8cc4-415102de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/d403ded7c4acfffe8dc2a3ad8fb848f08388b4c3452104f6970835913d92166c/analysis/1477360977/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a26-e0b4-413c-8da8-47c902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:22.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:22.000Z",
|
||
|
|
"description": "Linux Xagent - Xchecked via VT: f080e509c988a9578862665b4fcf1e4bf8d77c3e",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '02c7cf55fd5c5809ce2dce56085ba43795f2480423a4256537bfdfda0df85592']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a26-27f4-461b-9108-43f702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:22.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:22.000Z",
|
||
|
|
"description": "Linux Xagent - Xchecked via VT: f080e509c988a9578862665b4fcf1e4bf8d77c3e",
|
||
|
|
"pattern": "[file:hashes.MD5 = '075b6695ab63f36af65f7ffd45cccd39']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a27-2d1c-48e0-a704-433702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:23.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:23.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:23Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:23Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a27-2d1c-48e0-a704-433702de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a27-2d1c-48e0-a704-433702de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/02c7cf55fd5c5809ce2dce56085ba43795f2480423a4256537bfdfda0df85592/analysis/1466540604/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a27-7094-4698-83d1-42cd02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:23.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:23.000Z",
|
||
|
|
"description": "Linux Xagent - Xchecked via VT: ecdda7aca5c805e5be6e0ab2017592439de7e32c",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'fd8b2ea9a2e8a67e4cb3904b49c789d57ed9b1ce5bebfe54fe3d98214d6a0f61']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a28-b7dc-4862-bf73-4d9502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:24.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:24.000Z",
|
||
|
|
"description": "Linux Xagent - Xchecked via VT: ecdda7aca5c805e5be6e0ab2017592439de7e32c",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'e107c5c84ded6cd9391aede7f04d64c8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a28-7480-4668-9675-40e102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:24.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:24.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:24Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:24Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a28-7480-4668-9675-40e102de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a28-7480-4668-9675-40e102de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/fd8b2ea9a2e8a67e4cb3904b49c789d57ed9b1ce5bebfe54fe3d98214d6a0f61/analysis/1466540634/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a29-0d68-448f-9ae2-499602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:25.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:25.000Z",
|
||
|
|
"description": "Linux Xagent - Xchecked via VT: 9444d2b29c6401bc7c2d14f071b11ec9014ae040",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8bca0031f3b691421cb15f9c6e71ce193355d2d8cf2b190438b6962761d0c6bb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a29-6e5c-4e07-b787-4e5f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:25.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:25.000Z",
|
||
|
|
"description": "Linux Xagent - Xchecked via VT: 9444d2b29c6401bc7c2d14f071b11ec9014ae040",
|
||
|
|
"pattern": "[file:hashes.MD5 = '364ff454dcf00420cff13a57bcb78467']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a2a-5f3c-4eb1-805a-487902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:26.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:26.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:26Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:26Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a2a-5f3c-4eb1-805a-487902de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a2a-5f3c-4eb1-805a-487902de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/8bca0031f3b691421cb15f9c6e71ce193355d2d8cf2b190438b6962761d0c6bb/analysis/1466540613/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a2a-eeb8-4363-b0e1-484002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:26.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:26.000Z",
|
||
|
|
"description": "Linux Xagent - Xchecked via VT: 7e33a52e53e85ddb1dc8dc300e6558735acf10ce",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'dd8facad6c0626b6c94e1cc891698d4982782a5564aae696a218c940b7b8d084']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a2b-34e4-4e68-8a31-464a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:27.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:27.000Z",
|
||
|
|
"description": "Linux Xagent - Xchecked via VT: 7e33a52e53e85ddb1dc8dc300e6558735acf10ce",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'fd8d1b48f91864dc5acb429a49932ca3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a2b-2224-4c18-a841-4f9f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:27.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:27.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:27Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:27Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a2b-2224-4c18-a841-4f9f02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a2b-2224-4c18-a841-4f9f02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/dd8facad6c0626b6c94e1cc891698d4982782a5564aae696a218c940b7b8d084/analysis/1462371180/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a2c-1bf4-487a-8598-4c2102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:28.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:28.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: f1ee563d44e2b1020b7a556e080159f64f3fd699",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'bebe0be0cf8349706b2feb789572e035955209d5bf5d5fea0e5d29a7fbfdc7c4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a2c-5248-4555-bef7-458e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:28.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:28.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: f1ee563d44e2b1020b7a556e080159f64f3fd699",
|
||
|
|
"pattern": "[file:hashes.MD5 = '58ca9243d35e529499dd17d27642b419']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a2d-e858-46dc-a98a-4c4702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:29.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:29.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:29Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:29Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a2d-e858-46dc-a98a-4c4702de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a2d-e858-46dc-a98a-4c4702de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/bebe0be0cf8349706b2feb789572e035955209d5bf5d5fea0e5d29a7fbfdc7c4/analysis/1461076577/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a2d-e89c-49af-9ac8-46ef02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:29.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:29.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: e816ec78462b5925a1f3ef3cdb3cac6267222e72",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '94c220653ea7421c60e3eafd753a9ae9d69b475d61230f2f403789d326309c24']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a2e-3ee4-48f3-9604-457f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:30.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:30.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: e816ec78462b5925a1f3ef3cdb3cac6267222e72",
|
||
|
|
"pattern": "[file:hashes.MD5 = '404eb3f7554392e85e56aed414db8455']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a2e-1334-4c0b-b6ae-421e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:30.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:30.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:30Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:30Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a2e-1334-4c0b-b6ae-421e02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a2e-1334-4c0b-b6ae-421e02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/94c220653ea7421c60e3eafd753a9ae9d69b475d61230f2f403789d326309c24/analysis/1477363908/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a2f-2664-40e9-a727-47a202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:31.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:31.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: d0db619a7a160949528d46d20fc0151bf9775c32",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e031299fa1381b40c660b8cd831bb861654f900a1e2952b1a76bedf140972a81']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a2f-f3c0-4e41-9303-43c102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:31.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:31.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: d0db619a7a160949528d46d20fc0151bf9775c32",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ee64d3273f9b4d80020c24edcbbf961e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a30-4838-4d58-a1ab-4c1f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:32.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:32.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:32Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:32Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a30-4838-4d58-a1ab-4c1f02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a30-4838-4d58-a1ab-4c1f02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/e031299fa1381b40c660b8cd831bb861654f900a1e2952b1a76bedf140972a81/analysis/1475067327/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a30-02c8-432c-8aba-4dd302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:32.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:32.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: d00ac5498d0735d5ae0dea42a1f477cf8b8b0826",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '68065abd6482405614d245537600ea60857c6ec9febac4870486b5227589d35c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a31-0948-4b85-84a5-480402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:33.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:33.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: d00ac5498d0735d5ae0dea42a1f477cf8b8b0826",
|
||
|
|
"pattern": "[file:hashes.MD5 = '12a9fff59de1663dec1b45ea2ede22f5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a31-fa64-4f22-8fbf-4f5a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:33.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:33.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:33Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:33Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a31-fa64-4f22-8fbf-4f5a02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a31-fa64-4f22-8fbf-4f5a02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/68065abd6482405614d245537600ea60857c6ec9febac4870486b5227589d35c/analysis/1477363734/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a32-dc94-4330-9e3d-46a102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:34.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:34.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: c18edcba2c31533b7cdb6649a970dce397f4b13c",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'fc2dbfda41860b2385314c87e81f1ebb4f9ae1106b697e019841d8c3bf402570']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a32-49f0-405f-8a91-4e3102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:34.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:34.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: c18edcba2c31533b7cdb6649a970dce397f4b13c",
|
||
|
|
"pattern": "[file:hashes.MD5 = '4265f6e8cc545b925912867ec8af2f11']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a33-2fc0-4d9a-a9a1-4b0202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:35.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:35.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:35Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:35Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a33-2fc0-4d9a-a9a1-4b0202de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a33-2fc0-4d9a-a9a1-4b0202de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/fc2dbfda41860b2385314c87e81f1ebb4f9ae1106b697e019841d8c3bf402570/analysis/1477363566/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a33-6cbc-46fd-b1cf-460602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:35.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:35.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: baa4c177a53cfa5cc103296b07b62565e1c7799f",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'dea4e560017b4da05e8fd0a03ba74239723349934ee8fbd201a79be1ecf1c32d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a34-dbb8-4a84-b7c0-41cf02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:36.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:36.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: baa4c177a53cfa5cc103296b07b62565e1c7799f",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9d1a09bb98bf1ee31f390b60b0cf724d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a34-2364-4e31-9972-485b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:36.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:36.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:36Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:36Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a34-2364-4e31-9972-485b02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a34-2364-4e31-9972-485b02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/dea4e560017b4da05e8fd0a03ba74239723349934ee8fbd201a79be1ecf1c32d/analysis/1477363563/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a35-8988-44cc-bc25-4c6a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:37.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:37.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: a70ed3ae0bc3521e743191259753be945972118b",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '715f69916db9ff8fedf6630307f4ebb84aae6653fd0e593036517c5040d84dbe']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a35-23ec-4682-8624-444102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:37.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:37.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: a70ed3ae0bc3521e743191259753be945972118b",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9a66142acfc7739f78c23ab1252db45b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a36-8a84-4f4f-9afd-481f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:38.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:38.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:38Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:38Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a36-8a84-4f4f-9afd-481f02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a36-8a84-4f4f-9afd-481f02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/715f69916db9ff8fedf6630307f4ebb84aae6653fd0e593036517c5040d84dbe/analysis/1477363561/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a36-9cf8-4d40-aa34-494302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:38.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:38.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: 780aa72f0397cb6c2a78536201bd9db4818fa02a",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd0e019229493a1cfb3ffc918a2d8ffcbaee31f9132293c95b1f8c1fd6d595054']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a37-ed98-4ba9-8dc5-452f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:39.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:39.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: 780aa72f0397cb6c2a78536201bd9db4818fa02a",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'effd7b2411975447fd36603445b380c7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a37-007c-4a77-9f77-412902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:39.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:39.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:39Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:39Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a37-007c-4a77-9f77-412902de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a37-007c-4a77-9f77-412902de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/d0e019229493a1cfb3ffc918a2d8ffcbaee31f9132293c95b1f8c1fd6d595054/analysis/1444926033/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a38-27e4-47f2-8599-42eb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:40.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:40.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: 71636e025fa308fc5b8065136f3dd692870cb8a4",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ea957d663dbc0b28844f6aa7dfdc5ac0110a4004ac46c87d0f1aa943ef253cfe']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a38-9558-4f54-a889-4b6702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:40.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:40.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: 71636e025fa308fc5b8065136f3dd692870cb8a4",
|
||
|
|
"pattern": "[file:hashes.MD5 = '96ed0a7976e57ae0bb79dcbd67e39743']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a39-8a9c-4ef0-bbdc-488102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:41.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:41.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:41Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:41Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a39-8a9c-4ef0-bbdc-488102de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a39-8a9c-4ef0-bbdc-488102de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/ea957d663dbc0b28844f6aa7dfdc5ac0110a4004ac46c87d0f1aa943ef253cfe/analysis/1477363424/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a39-5418-44e2-a0a8-4ae702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:41.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:41.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: 5f05a8cb6fef24a91b3bd6c137b23ab3166f39ae",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '07393ac2e890772f70adf9e8d3aa07ab2f98e2726e3be275276dadd00daf5fc6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a3a-a640-419e-abb6-424302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:42.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:42.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: 5f05a8cb6fef24a91b3bd6c137b23ab3166f39ae",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9ca6ead1384953d787487d399c23cb41']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a3a-2048-4539-a3dd-4bf002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:42.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:42.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:42Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:42Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a3a-2048-4539-a3dd-4bf002de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a3a-2048-4539-a3dd-4bf002de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/07393ac2e890772f70adf9e8d3aa07ab2f98e2726e3be275276dadd00daf5fc6/analysis/1477360979/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a3b-e768-4f62-8140-4e4d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:43.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:43.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: 4bc32a3894f64b4be931ff20390712b4ec605488",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b23193bff95c4e65af0c9848036eb80ef006503a78be842e921035f8d77eb5de']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a3b-8d58-4da9-a216-4c0702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:43.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:43.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: 4bc32a3894f64b4be931ff20390712b4ec605488",
|
||
|
|
"pattern": "[file:hashes.MD5 = '57cc08213ab8b6d4a538e4568d00a123']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a3c-59ac-4cda-a8c6-40b702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:44.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:44.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:44Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:44Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a3c-59ac-4cda-a8c6-40b702de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a3c-59ac-4cda-a8c6-40b702de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/b23193bff95c4e65af0c9848036eb80ef006503a78be842e921035f8d77eb5de/analysis/1463722857/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a3c-109c-4fc7-b0cb-4fcc02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:44.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:44.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: 4b74c90c9d9ce7668aa9eb09978c1d8d4dfda24a",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '24e11c80f1d4c1e9db654d54cc784db6b5f4a126f9fe5e26c269fdc4009c8f29']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a3d-0934-4d6a-9cdb-4be502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:45.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:45.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: 4b74c90c9d9ce7668aa9eb09978c1d8d4dfda24a",
|
||
|
|
"pattern": "[file:hashes.MD5 = '409848dabfd110f4d373dd0a97ff708e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a3d-e2c0-4862-9daf-464002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:45.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:45.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:45Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:45Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a3d-e2c0-4862-9daf-464002de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a3d-e2c0-4862-9daf-464002de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/24e11c80f1d4c1e9db654d54cc784db6b5f4a126f9fe5e26c269fdc4009c8f29/analysis/1477360974/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a3e-cbac-416f-a47d-48b002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:46.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:46.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: 499ff777c88aeacbbaa47edde183c944ac7e91d2",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '82c4e9bc100533482a15a1d756d55e1a604d330eff8fbc0e13c4b166ac2c9bd3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a3e-97b0-4b54-a991-495c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:46.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:46.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: 499ff777c88aeacbbaa47edde183c944ac7e91d2",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ea726d3e8f6516807366584f3c5b5e2a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a3f-ca4c-49a6-8e99-4fa702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:47.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:47.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:47Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:47Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a3f-ca4c-49a6-8e99-4fa702de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a3f-ca4c-49a6-8e99-4fa702de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/82c4e9bc100533482a15a1d756d55e1a604d330eff8fbc0e13c4b166ac2c9bd3/analysis/1477361169/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a3f-e9ac-4599-938e-49d602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:47.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:47.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: 3403519fa3ede4d07fb4c05d422a9f8c026cedbf",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ddab96e4a8e909065e05c4b6a73ba351ea45ad4806258f41ac3cecbcae8671a6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a40-46d4-4dd1-81f7-4dd702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:48.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:48.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: 3403519fa3ede4d07fb4c05d422a9f8c026cedbf",
|
||
|
|
"pattern": "[file:hashes.MD5 = '113cc4a88fd28ea4398e312093a6a4d5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a41-e2e0-4e50-bc8d-46a302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:49.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:49.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:49Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:49Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a41-e2e0-4e50-bc8d-46a302de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a41-e2e0-4e50-bc8d-46a302de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/ddab96e4a8e909065e05c4b6a73ba351ea45ad4806258f41ac3cecbcae8671a6/analysis/1471786112/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a41-f198-4a2c-bce8-4d8f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:49.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:49.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: 0f04dad5194f97bb4f1808df19196b04b4aee1b8",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '972e907a901a7716f3b8f9651eadd65a0ce09bbc78a1ceacff6f52056af8e8f4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a42-42cc-4431-8cf1-449f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:50.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:50.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: 0f04dad5194f97bb4f1808df19196b04b4aee1b8",
|
||
|
|
"pattern": "[file:hashes.MD5 = '8b6d824619e993f74973eedfaf18be78']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a42-4558-482d-9015-4f4202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:50.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:50.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:50Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:50Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a42-4558-482d-9015-4f4202de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a42-4558-482d-9015-4f4202de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/972e907a901a7716f3b8f9651eadd65a0ce09bbc78a1ceacff6f52056af8e8f4/analysis/1477360971/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a43-6c28-45a3-ba2a-444c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:51.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:51.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: 08c4d755f14fd6df76ec86da6eab1b5574dfbafd",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5f6b2a0d1d966fc4f1ed292b46240767f4acb06c13512b0061b434ae2a692fa1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a43-981c-4540-86ae-4e8802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:51.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:51.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: 08c4d755f14fd6df76ec86da6eab1b5574dfbafd",
|
||
|
|
"pattern": "[file:hashes.MD5 = '26ac59dab32f6246e1ce3da7506d48fa']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a44-f408-4d43-9ddf-484302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:52.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:52.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:52Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:52Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a44-f408-4d43-9ddf-484302de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a44-f408-4d43-9ddf-484302de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/5f6b2a0d1d966fc4f1ed292b46240767f4acb06c13512b0061b434ae2a692fa1/analysis/1477381025/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a44-c534-4431-88df-4c7002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:52.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:52.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: 082141f1c24fb49981cc70a9ed50cda582ee04dd",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '99d3f03fc6f048c74e58da6fb7ea1e831ba31d58194ad2463a7a6cd55da5f96b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a45-8cb4-4eb0-a7da-48a502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:53.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:53.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: 082141f1c24fb49981cc70a9ed50cda582ee04dd",
|
||
|
|
"pattern": "[file:hashes.MD5 = '7a055cbe6672f77b2271c1cb8e2670b8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a45-d268-47d5-b8be-4b7f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:53.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:53.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:53Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:53Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a45-d268-47d5-b8be-4b7f02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a45-d268-47d5-b8be-4b7f02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/99d3f03fc6f048c74e58da6fb7ea1e831ba31d58194ad2463a7a6cd55da5f96b/analysis/1458043424/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a46-00cc-4eff-ac55-4e7c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:54.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:54.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: 072933fa35b585511003f36e3885563e1b55d55a",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c19d266af9e33dae096e45e7624ab3a3f642c8de580e902fec9dac11bcb8d3fd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a46-0b0c-4056-aae0-497602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:54.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:54.000Z",
|
||
|
|
"description": "Xagent - Xchecked via VT: 072933fa35b585511003f36e3885563e1b55d55a",
|
||
|
|
"pattern": "[file:hashes.MD5 = '99b93cfcff258eb49e7af603d779a146']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a47-4370-462c-8954-4c9a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:55.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:55.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:55Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:55Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a47-4370-462c-8954-4c9a02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a47-4370-462c-8954-4c9a02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/c19d266af9e33dae096e45e7624ab3a3f642c8de580e902fec9dac11bcb8d3fd/analysis/1443782586/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a47-1850-4d64-8a75-40f102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:55.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:55.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: f7608ef62a45822e9300d390064e667028b75dea",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b6fff95a74f9847f1a4282b38f148d80e4684d9c35d9ae79fad813d5dc0fd7a9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a48-29bc-496e-a0ef-448702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:56.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:56.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: f7608ef62a45822e9300d390064e667028b75dea",
|
||
|
|
"pattern": "[file:hashes.MD5 = '75f71713a429589e87cf2656107d2bfc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a48-dce8-4f83-babd-41f102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:56.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:56.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:56Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:56Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a48-dce8-4f83-babd-41f102de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a48-dce8-4f83-babd-41f102de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/b6fff95a74f9847f1a4282b38f148d80e4684d9c35d9ae79fad813d5dc0fd7a9/analysis/1466540589/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a49-5f58-4f8a-ad3c-466602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:57.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:57.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: f3d50c1f7d5f322c1a1f9a72ff122cac990881ee",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'eb6620442c3ab327f3ccff1cc6d63d6ffe7729186f7e8ac1dbbbfddd971528f0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a49-47c4-4461-a85a-43d002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:57.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:57.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: f3d50c1f7d5f322c1a1f9a72ff122cac990881ee",
|
||
|
|
"pattern": "[file:hashes.MD5 = '77089c094c0f2c15898ff0f021945148']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a4a-55c0-4feb-8067-453a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:58.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:58.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:20:58Z",
|
||
|
|
"last_observed": "2016-10-25T14:20:58Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a4a-55c0-4feb-8067-453a02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a4a-55c0-4feb-8067-453a02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/eb6620442c3ab327f3ccff1cc6d63d6ffe7729186f7e8ac1dbbbfddd971528f0/analysis/1466540604/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a4b-04b0-4853-80cb-4b0502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:59.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:59.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: f024dbab65198467c2b832de9724cb70e24af0dd",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'df47a939809f925475bc19804319652635848b8f346fb7dfd8c95c620595fe9f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a4b-d614-43b4-b52e-457402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:20:59.000Z",
|
||
|
|
"modified": "2016-10-25T14:20:59.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: f024dbab65198467c2b832de9724cb70e24af0dd",
|
||
|
|
"pattern": "[file:hashes.MD5 = '7b1bfd7c1866040e8f618fe67b93bea5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:20:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a4c-23b8-4304-b51d-469b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:00.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:00.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:00Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:00Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a4c-23b8-4304-b51d-469b02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a4c-23b8-4304-b51d-469b02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/df47a939809f925475bc19804319652635848b8f346fb7dfd8c95c620595fe9f/analysis/1477392037/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a4c-2e68-4342-97ea-46f602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:00.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:00.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: ed9f3e5e889d281437b945993c6c2a80c60fdedc",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '261b0a5912965ea95b8ae02aae1e761a61f9ad3a9fb85ef781e62013d6a21368']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a4d-a310-4e9a-ac9e-49ec02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:01.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:01.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: ed9f3e5e889d281437b945993c6c2a80c60fdedc",
|
||
|
|
"pattern": "[file:hashes.MD5 = '2dfc90375a09459033d430d046216d22']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a4d-ba68-4bc1-b5ed-475d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:01.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:01.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:01Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:01Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a4d-ba68-4bc1-b5ed-475d02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a4d-ba68-4bc1-b5ed-475d02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/261b0a5912965ea95b8ae02aae1e761a61f9ad3a9fb85ef781e62013d6a21368/analysis/1466540615/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a4e-43ec-45f5-9baa-4d0502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:02.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:02.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: e742b917d3ef41992e67389cd2fe2aab0f9ace5b",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '63047199037892f66dc083420e2fc60655a770756848c1f07adc2eb7d4a385d0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a4e-9508-4e69-98b2-4c5702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:02.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:02.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: e742b917d3ef41992e67389cd2fe2aab0f9ace5b",
|
||
|
|
"pattern": "[file:hashes.MD5 = '7764499bb1c4720d0f1d302f15be792c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a4f-d7f8-474f-aa98-4c9d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:03.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:03.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:03Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:03Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a4f-d7f8-474f-aa98-4c9d02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a4f-d7f8-474f-aa98-4c9d02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/63047199037892f66dc083420e2fc60655a770756848c1f07adc2eb7d4a385d0/analysis/1477391697/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a4f-df0c-48d7-9826-4e9202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:03.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:03.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: e5fb715a1c70402774ee2c518fb0e4e9cd3fdcff",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c431ae04c79ade56e1902094acf51e5bf6b54d65363dfa239d59f31c27989fde']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a50-031c-44bb-8d6f-43cb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:04.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:04.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: e5fb715a1c70402774ee2c518fb0e4e9cd3fdcff",
|
||
|
|
"pattern": "[file:hashes.MD5 = '072c692783c67ea56da9de0a53a60d11']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a50-f218-41b8-9a16-458c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:04.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:04.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:04Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:04Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a50-f218-41b8-9a16-458c02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a50-f218-41b8-9a16-458c02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/c431ae04c79ade56e1902094acf51e5bf6b54d65363dfa239d59f31c27989fde/analysis/1477391617/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a51-cd74-44a2-a3c2-4c4902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:05.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:05.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: d9989a46d590ebc792f14aa6fec30560dfe931b1",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4bcd11142d5b9f96730715905152a645a1bf487921dd65618c354281512a4ae7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a51-983c-48dd-add1-4bbb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:05.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:05.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: d9989a46d590ebc792f14aa6fec30560dfe931b1",
|
||
|
|
"pattern": "[file:hashes.MD5 = '8b031fce1d0c38d6b4c68d52b2764c7e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a52-02c8-4d4b-9d59-463402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:06.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:06.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:06Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:06Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a52-02c8-4d4b-9d59-463402de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a52-02c8-4d4b-9d59-463402de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/4bcd11142d5b9f96730715905152a645a1bf487921dd65618c354281512a4ae7/analysis/1477391375/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a52-f530-4370-8daf-49d202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:06.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:06.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: d85e44d386315b0258847495be1711450ac02d9f",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '500fa112a204b6abb365101013a17749ce83403c30cd37f7c6f94e693c2d492f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a53-ac44-4127-a3ed-482802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:07.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:07.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: d85e44d386315b0258847495be1711450ac02d9f",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c4ffab85d84b494e1c450819a0e9c7db']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a53-4f60-4fb5-a485-422002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:07.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:07.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:07Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:07Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a53-4f60-4fb5-a485-422002de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a53-4f60-4fb5-a485-422002de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/500fa112a204b6abb365101013a17749ce83403c30cd37f7c6f94e693c2d492f/analysis/1466540502/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a54-2280-4d54-b288-428902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:08.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:08.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: d3aa282b390a5cb29d15a97e0a046305038dbefe",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'eae782130b06d95f3373ff7d5c0977a8019960bdf80614c1aa7e324dc350428a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a54-e8b0-4322-b0c4-41a602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:08.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:08.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: d3aa282b390a5cb29d15a97e0a046305038dbefe",
|
||
|
|
"pattern": "[file:hashes.MD5 = '18efc091b431c39d3e59be445429a7bc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a55-9c2c-4ff1-8cfc-4fc802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:09.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:09.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:09Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:09Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a55-9c2c-4ff1-8cfc-4fc802de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a55-9c2c-4ff1-8cfc-4fc802de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/eae782130b06d95f3373ff7d5c0977a8019960bdf80614c1aa7e324dc350428a/analysis/1463562733/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a55-b40c-421d-939a-4f3302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:09.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:09.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: c345a85c01360f2833752a253a5094ff421fc839",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'fbd5c2cf1c1f17402cc313fe3266b097a46e08f48b971570ef4667fbfd6b7301']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a56-39d0-47b1-a41a-4b7002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:10.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:10.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: c345a85c01360f2833752a253a5094ff421fc839",
|
||
|
|
"pattern": "[file:hashes.MD5 = '1219318522fa28252368f58f36820ac2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a56-e38c-4e95-a7e3-4d5902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:10.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:10.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:10Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:10Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a56-e38c-4e95-a7e3-4d5902de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a56-e38c-4e95-a7e3-4d5902de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/fbd5c2cf1c1f17402cc313fe3266b097a46e08f48b971570ef4667fbfd6b7301/analysis/1467376373/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a57-f538-44a6-9e1b-489b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:11.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:11.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: c2e8c584d5401952af4f1db08cf4b6016874ddac",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '54c4ce98970a44f92be748ebda9fcfb7b30e08d98491e7735be6dd287189cea3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a57-e0ec-4406-87b1-4e4c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:11.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:11.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: c2e8c584d5401952af4f1db08cf4b6016874ddac",
|
||
|
|
"pattern": "[file:hashes.MD5 = '078755389b98d17788eb5148e23109a6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a58-7908-49b4-8a05-47d702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:12.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:12.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:12Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:12Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a58-7908-49b4-8a05-47d702de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a58-7908-49b4-8a05-47d702de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/54c4ce98970a44f92be748ebda9fcfb7b30e08d98491e7735be6dd287189cea3/analysis/1477391056/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a58-7824-4fd1-9d43-422f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:12.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:12.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: c1eae93785c9cb917cfb260d3abf6432c6fdaf4d",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6236a1bdd76ed90659a36f58b3e073623c34c6436d26413c8eca95f3266cc6fc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a59-fad0-4211-b56d-438b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:13.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:13.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: c1eae93785c9cb917cfb260d3abf6432c6fdaf4d",
|
||
|
|
"pattern": "[file:hashes.MD5 = '732fbf0a4ceb10e9a2254af59ae4f880']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a59-53b0-460e-993e-4dac02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:13.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:13.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:13Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:13Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a59-53b0-460e-993e-4dac02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a59-53b0-460e-993e-4dac02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/6236a1bdd76ed90659a36f58b3e073623c34c6436d26413c8eca95f3266cc6fc/analysis/1477391033/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a5a-6050-40bc-9d1c-460702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:14.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:14.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: b8aabe12502f7d55ae332905acee80a10e3bc399",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1a09ce8a9210d2530d6ce1d59bfae2ac617ac89558cdcdcac15392d176e70c8d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a5a-b274-4349-886b-443302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:14.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:14.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: b8aabe12502f7d55ae332905acee80a10e3bc399",
|
||
|
|
"pattern": "[file:hashes.MD5 = '91381cd82cdd5f52bbc7b30d34cb8d83']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a5b-4744-47d5-84b3-48ed02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:15.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:15.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:15Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:15Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a5b-4744-47d5-84b3-48ed02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a5b-4744-47d5-84b3-48ed02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/1a09ce8a9210d2530d6ce1d59bfae2ac617ac89558cdcdcac15392d176e70c8d/analysis/1469601528/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a5b-866c-46a1-855c-44c802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:15.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:15.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: b7788af2ef073d7b3fb84086496896e7404e625e",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b1800cb1d4b755e05b0fca251b8c6da96bb85f8042f2d755b7f607cbeef58db8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a5c-a83c-491c-8a6c-47db02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:16.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:16.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: b7788af2ef073d7b3fb84086496896e7404e625e",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'eda061c497ba73441994a30e36f55b1d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a5c-d178-436e-9682-41ef02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:16.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:16.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:16Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:16Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a5c-d178-436e-9682-41ef02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a5c-d178-436e-9682-41ef02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/b1800cb1d4b755e05b0fca251b8c6da96bb85f8042f2d755b7f607cbeef58db8/analysis/1467632921/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a5d-89f4-4e7c-b5ed-4de302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:17.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:17.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: b4a515ef9de037f18d96b9b0e48271180f5725b7",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd93f22d46090bfc19ef51963a781eeb864390c66d9347e86e03bba25a1fc29c5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a5d-acf4-4a4e-838f-4e8902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:17.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:17.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: b4a515ef9de037f18d96b9b0e48271180f5725b7",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'afe09fb5a2b97f9e119f70292092604e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a5e-4f60-48ac-b4ff-43c702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:18.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:18.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:18Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:18Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a5e-4f60-48ac-b4ff-43c702de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a5e-4f60-48ac-b4ff-43c702de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/d93f22d46090bfc19ef51963a781eeb864390c66d9347e86e03bba25a1fc29c5/analysis/1477032096/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a5e-46f0-49fa-93f4-4d5202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:18.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:18.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: a857bccf4cc5c15b60667ecd865112999e1e56ba",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e1b1143c0003c6905227df37d40aacbaecc2be8b9d86547650fe11bd47ca6989']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a5f-34d0-4137-b0c7-4b7702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:19.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:19.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: a857bccf4cc5c15b60667ecd865112999e1e56ba",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0c334645a4c12513020aaabc3b78ef9f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a5f-a594-4519-bedb-4ec302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:19.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:19.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:19Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:19Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a5f-a594-4519-bedb-4ec302de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a5f-a594-4519-bedb-4ec302de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/e1b1143c0003c6905227df37d40aacbaecc2be8b9d86547650fe11bd47ca6989/analysis/1477390867/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a60-7e54-4e10-bbfc-48c202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:20.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:20.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: a5fca59a2fae0a12512336ca1b78f857afc06445",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5a414a39851c4e22d4f9383211dfc080e16e2caffd90fa06dcbe51d11fdb0d6c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a60-e5c4-4053-9ba8-4e3b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:20.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:20.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: a5fca59a2fae0a12512336ca1b78f857afc06445",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'f1d3447a2bff56646478b0adb7d0451c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a61-4ecc-4c86-93ec-485602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:21.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:21.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:21Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:21Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a61-4ecc-4c86-93ec-485602de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a61-4ecc-4c86-93ec-485602de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/5a414a39851c4e22d4f9383211dfc080e16e2caffd90fa06dcbe51d11fdb0d6c/analysis/1477390649/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a61-18e0-4d98-856a-4e9302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:21.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:21.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: a43ef43f3c3db76a4a9ca8f40f7b2c89888f0399",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c2551c4e6521ac72982cb952503a2e6f016356e02ee31dea36c713141d4f3785']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a62-ea70-4d01-b728-4c6c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:22.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:22.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: a43ef43f3c3db76a4a9ca8f40f7b2c89888f0399",
|
||
|
|
"pattern": "[file:hashes.MD5 = '7c2b1de614a9664103b6ff7f3d73f83d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a62-582c-44a1-8c15-4ae802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:22.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:22.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:22Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:22Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a62-582c-44a1-8c15-4ae802de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a62-582c-44a1-8c15-4ae802de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/c2551c4e6521ac72982cb952503a2e6f016356e02ee31dea36c713141d4f3785/analysis/1476924167/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a63-0e64-478d-bc7c-42dc02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:23.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:23.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 9fc43e32c887b7697bf6d6933e9859d29581ead0",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'bf28267386a010197a50b65f24e815aa527f2adbc53c609d2b2a4f999a639413']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a63-b21c-4e32-9e53-4e4a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:23.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:23.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 9fc43e32c887b7697bf6d6933e9859d29581ead0",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'a3c757af9e7a9a60e235d08d54740fbc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a64-90b8-460f-9914-439802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:24.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:24.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:24Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:24Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a64-90b8-460f-9914-439802de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a64-90b8-460f-9914-439802de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/bf28267386a010197a50b65f24e815aa527f2adbc53c609d2b2a4f999a639413/analysis/1466540588/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a64-7508-4597-be3b-4d1902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:24.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:24.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 99f927f97838eb47c1d59500ee9155adb55b806a",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8f0674cb85f28b2619a6e0ddc74ce71e92ce4c3162056ef65ff2777104d20109']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a65-0464-4361-94df-4ef102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:25.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:25.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 99f927f97838eb47c1d59500ee9155adb55b806a",
|
||
|
|
"pattern": "[file:hashes.MD5 = '07c8a0a792a5447daf08ac32d1e283e8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a65-5efc-4994-ab2c-4eae02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:25.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:25.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:25Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:25Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a65-5efc-4994-ab2c-4eae02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a65-5efc-4994-ab2c-4eae02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/8f0674cb85f28b2619a6e0ddc74ce71e92ce4c3162056ef65ff2777104d20109/analysis/1477031153/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a65-c124-4a9c-b643-477e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:25.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:25.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 90c3b756b1bb849cba80994d445e96a9872d0cf5",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'dfa8a85e26c07a348a854130c652dcc6d29b203ee230ce0603c83d9f11bbcacc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a66-bb1c-4413-88e8-464302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:26.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:26.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 90c3b756b1bb849cba80994d445e96a9872d0cf5",
|
||
|
|
"pattern": "[file:hashes.MD5 = '21d63e99ed7dcd8baec74e6ce65c9ef3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a66-beb8-4e20-9207-449e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:26.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:26.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:26Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:26Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a66-beb8-4e20-9207-449e02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a66-beb8-4e20-9207-449e02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/dfa8a85e26c07a348a854130c652dcc6d29b203ee230ce0603c83d9f11bbcacc/analysis/1477031337/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a67-c6b0-4fe8-b945-49cb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:27.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:27.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 8f99774926b2e0bf85e5147aaca8bbbbcc5f1d48",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '69940a20ab9abb31a03fcefe6de92a16ed474bbdff3288498851afc12a834261']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a67-d770-4d8f-b68a-401902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:27.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:27.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 8f99774926b2e0bf85e5147aaca8bbbbcc5f1d48",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c2988e3e4f70d5901b234ff1c1363dcc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a68-ff14-49d8-a8a3-419402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:28.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:28.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:28Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:28Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a68-ff14-49d8-a8a3-419402de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a68-ff14-49d8-a8a3-419402de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/69940a20ab9abb31a03fcefe6de92a16ed474bbdff3288498851afc12a834261/analysis/1475067309/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a68-ed68-4686-832d-4d3f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:28.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:28.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 842b0759b5796979877a2bac82a33500163ded67",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f50791f9909c542e4abb5e3f760c896995758a832b0699c23ca54b579a9f2108']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a69-abf0-4e74-8dbf-4d9b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:29.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:29.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 842b0759b5796979877a2bac82a33500163ded67",
|
||
|
|
"pattern": "[file:hashes.MD5 = '291af793767f5c5f2dc9c6d44f1bfb59']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a69-8024-4773-a6c4-4a8d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:29.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:29.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:29Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:29Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a69-8024-4773-a6c4-4a8d02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a69-8024-4773-a6c4-4a8d02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/f50791f9909c542e4abb5e3f760c896995758a832b0699c23ca54b579a9f2108/analysis/1477031375/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a6a-8d48-463b-9576-439902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:30.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:30.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 80dca565807fa69a75a7dd278cef1daaee34236e",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0abda721c4f1ca626f5d8bd2ce186aa98b197ca68d53e81cf152c32230345071']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a6a-efbc-4a34-8e2f-4cbb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:30.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:30.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 80dca565807fa69a75a7dd278cef1daaee34236e",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9863f1efc5274b3d449b5b7467819d28']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a6b-7054-41ea-975b-4a5802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:31.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:31.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:31Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:31Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a6b-7054-41ea-975b-4a5802de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a6b-7054-41ea-975b-4a5802de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/0abda721c4f1ca626f5d8bd2ce186aa98b197ca68d53e81cf152c32230345071/analysis/1477390219/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a6b-521c-4c14-951b-408402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:31.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:31.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 6fb3fd8c2580c84314b14510944700144a9e31df",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '63911ebce691c4b7c9582f37f63f6f439d2ce56e992bfbdcf812132512e753eb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a6c-3ee8-414b-90ae-445202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:32.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:32.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 6fb3fd8c2580c84314b14510944700144a9e31df",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'f7ee38ca49cd4ae35824ce5738b6e587']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a6c-37c0-4af2-a4ac-4d7c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:32.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:32.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:32Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:32Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a6c-37c0-4af2-a4ac-4d7c02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a6c-37c0-4af2-a4ac-4d7c02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/63911ebce691c4b7c9582f37f63f6f439d2ce56e992bfbdcf812132512e753eb/analysis/1477390189/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a6d-0f84-4604-a677-4dbb02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:33.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:33.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 69d8ca2a02241a1f88a525617cf18971c99fb63b",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4c52957270e63efa4b81a1c6551c706b82951f019b682219096e67182a727eab']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a6d-1b08-4dd8-9b9b-486d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:33.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:33.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 69d8ca2a02241a1f88a525617cf18971c99fb63b",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ed601bbd4dd0e267afb0be840cb27c90']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a6e-d8d0-4d19-89bb-401802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:34.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:34.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:34Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:34Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a6e-d8d0-4d19-89bb-401802de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a6e-d8d0-4d19-89bb-401802de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/4c52957270e63efa4b81a1c6551c706b82951f019b682219096e67182a727eab/analysis/1477390146/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a6e-741c-4064-be98-43ba02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:34.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:34.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 63d1d33e7418daf200dc4660fc9a59492ddd50d9",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b4f755c91c2790f4ab9bac4ee60725132323e13a2688f3d8939ae9ed4793d014']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a6f-9c94-4082-9d7a-4f9d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:35.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:35.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 63d1d33e7418daf200dc4660fc9a59492ddd50d9",
|
||
|
|
"pattern": "[file:hashes.MD5 = '2d4eaa0331abbc6d867f5f979b2c890d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a70-d184-4235-a617-491b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:36.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:36.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:36Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:36Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a70-d184-4235-a617-491b02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a70-d184-4235-a617-491b02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/b4f755c91c2790f4ab9bac4ee60725132323e13a2688f3d8939ae9ed4793d014/analysis/1469601172/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a70-a090-45a2-8fa3-456702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:36.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:36.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 5c3e709517f41febf03109fa9d597f2ccc495956",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0ac7b666814fd016b3d21d7812f4a272104511f90ca666fa13e9fb6cefa603c7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a71-e33c-4932-9aaa-424502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:37.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:37.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 5c3e709517f41febf03109fa9d597f2ccc495956",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ac75fd7d79e64384b9c4053b37e5623f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a71-2c1c-49d0-876f-409a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:37.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:37.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:37Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:37Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a71-2c1c-49d0-876f-409a02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a71-2c1c-49d0-876f-409a02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/0ac7b666814fd016b3d21d7812f4a272104511f90ca666fa13e9fb6cefa603c7/analysis/1466540502/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a72-5284-4b88-9174-4ff302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:38.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:38.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 51e42368639d593d0ae2968bd2849dc20735c071",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '13468ebe5d47d57d62777043c80784cbf475fb2de1df4546a307807bd2376b45']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a72-68a0-4ad2-a1e5-4bb202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:38.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:38.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 51e42368639d593d0ae2968bd2849dc20735c071",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'dfc836e035cb6c43ce26ed870f61d7e8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a73-ad40-435a-94d6-453c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:39.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:39.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:39Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:39Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a73-ad40-435a-94d6-453c02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a73-ad40-435a-94d6-453c02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/13468ebe5d47d57d62777043c80784cbf475fb2de1df4546a307807bd2376b45/analysis/1477390032/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a73-db68-4d35-a847-4a3a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:39.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:39.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 51b0e3cd6360d50424bf776b3cd673dd45fd0f97",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7c4101caf833aa9025fec4f04a637c049c929459ad3e4023ba27ac72bde7638d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a74-2700-40f1-80af-42c002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:40.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:40.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 51b0e3cd6360d50424bf776b3cd673dd45fd0f97",
|
||
|
|
"pattern": "[file:hashes.MD5 = '973e0c922eb07aad530d8a1de19c7755']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a75-571c-435e-b49c-4c2302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:40.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:40.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:40Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:40Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a75-571c-435e-b49c-4c2302de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a75-571c-435e-b49c-4c2302de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/7c4101caf833aa9025fec4f04a637c049c929459ad3e4023ba27ac72bde7638d/analysis/1466540626/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a75-d458-4610-bb8d-474d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:41.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:41.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 4fae67d3988da117608a7548d9029caddbfb3ebf",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b0b3f0d6e6c593e2a2046833080574f98566c48a1eda865b2e110cd41bf31a31']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a76-342c-49ef-8e66-43f502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:42.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:42.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 4fae67d3988da117608a7548d9029caddbfb3ebf",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c6a80316ea97218df11e11125337233a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a76-9664-4a78-b86b-402002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:42.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:42.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:42Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:42Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a76-9664-4a78-b86b-402002de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a76-9664-4a78-b86b-402002de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/b0b3f0d6e6c593e2a2046833080574f98566c48a1eda865b2e110cd41bf31a31/analysis/1466540590/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a76-8b28-452d-ae52-47ae02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:42.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:42.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 4d5e923351f52a9d5c94ee90e6a00e6fced733ef",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e00eaf295a28f5497dbb5cb8f647537b6e55dd66613505389c24e658d150972c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a77-dc24-4887-b0ee-4e0702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:43.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:43.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 4d5e923351f52a9d5c94ee90e6a00e6fced733ef",
|
||
|
|
"pattern": "[file:hashes.MD5 = '6159c094a663a171efd531b23a46716d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a77-6f04-4ccf-b7d6-4b7002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:43.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:43.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:43Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:43Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a77-6f04-4ccf-b7d6-4b7002de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a77-6f04-4ccf-b7d6-4b7002de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/e00eaf295a28f5497dbb5cb8f647537b6e55dd66613505389c24e658d150972c/analysis/1477389749/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a78-2508-4ae9-8ce6-44bf02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:44.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:44.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 3956cfe34566ba8805f9b1fe0d2639606a404cd4",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0356f5fa9907ea060a7d6964e65f019896deb1c7e303b7ba04da1458dc73a842']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a78-b594-4201-b6e5-415402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:44.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:44.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 3956cfe34566ba8805f9b1fe0d2639606a404cd4",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'dffb22a1a6a757443ab403d61e760f0c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a79-7e84-4d0a-922b-48ca02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:45.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:45.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:45Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:45Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a79-7e84-4d0a-922b-48ca02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a79-7e84-4d0a-922b-48ca02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/0356f5fa9907ea060a7d6964e65f019896deb1c7e303b7ba04da1458dc73a842/analysis/1477388926/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a79-abf4-4393-9066-486002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:45.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:45.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 351c3762be9948d01034c69aced97628099a90b0",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '853dbbba09e2463c45c0ad913d15d67d15792d888f81b4908b2216859342aa04']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a7a-21c0-4b71-abde-4bd702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:46.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:46.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 351c3762be9948d01034c69aced97628099a90b0",
|
||
|
|
"pattern": "[file:hashes.MD5 = '83cf67a5d2e68f9c00fbbe6d7d9203bf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a7a-6d94-41b8-a0ad-4e4002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:46.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:46.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:46Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:46Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a7a-6d94-41b8-a0ad-4e4002de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a7a-6d94-41b8-a0ad-4e4002de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/853dbbba09e2463c45c0ad913d15d67d15792d888f81b4908b2216859342aa04/analysis/1477388900/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a7b-31a0-4224-a5f7-403902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:47.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:47.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 2c86a6d6e9915a7f38d119888ede60b38ab1d69d",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '69d5123a277dc1f618be5edcc95938a0df148c856d2e1231a07e2743bd683e01']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a7b-76d0-4554-9926-494b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:47.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:47.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 2c86a6d6e9915a7f38d119888ede60b38ab1d69d",
|
||
|
|
"pattern": "[file:hashes.MD5 = '56e011137b9678f1fcc54f9372198bae']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a7c-2824-41e7-b52e-4c8902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:48.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:48.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:48Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:48Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a7c-2824-41e7-b52e-4c8902de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a7c-2824-41e7-b52e-4c8902de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/69d5123a277dc1f618be5edcc95938a0df148c856d2e1231a07e2743bd683e01/analysis/1477388789/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a7c-e9b4-4264-9a43-4cef02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:48.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:48.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 2663eb655918c598be1b2231d7c018d8350a0ef9",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '31dd3e3c05fabbfeafbcb7f5616dba30bbb2b1fc77dba6f0250a2c3270c0dd6b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a7d-9390-4d8c-aea6-456702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:49.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:49.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 2663eb655918c598be1b2231d7c018d8350a0ef9",
|
||
|
|
"pattern": "[file:hashes.MD5 = '540e4a7a28ca1514e53c2564993d8d87']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a7d-9278-4a02-8cb0-46b502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:49.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:49.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:49Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:49Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a7d-9278-4a02-8cb0-46b502de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a7d-9278-4a02-8cb0-46b502de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/31dd3e3c05fabbfeafbcb7f5616dba30bbb2b1fc77dba6f0250a2c3270c0dd6b/analysis/1477388767/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a7e-6308-4b9c-9ae0-48ff02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:50.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:50.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 21835aafe6d46840bb697e8b0d4aac06dec44f5b",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3d13f2e5b241168005425b15410556bcf26d04078da6b2ef42bc0c2be7654bf8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a7e-df84-4491-8d0e-4bb902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:50.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:50.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 21835aafe6d46840bb697e8b0d4aac06dec44f5b",
|
||
|
|
"pattern": "[file:hashes.MD5 = '211b7100fd799e9eaabeb13cfa446231']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a7f-2274-4975-b5b0-454a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:51.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:51.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:51Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:51Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a7f-2274-4975-b5b0-454a02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a7f-2274-4975-b5b0-454a02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/3d13f2e5b241168005425b15410556bcf26d04078da6b2ef42bc0c2be7654bf8/analysis/1466540603/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a7f-1ca8-424d-a8f6-44f902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:51.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:51.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 17661a04b4b150a6f70afdabe3fd9839cc56bee8",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a80-470c-419b-a603-484e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:52.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:52.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 17661a04b4b150a6f70afdabe3fd9839cc56bee8",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'a579d53a1d29684de6d2c0cbabd525c5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a80-568c-4e05-be22-491102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:52.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:52.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:52Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:52Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a80-568c-4e05-be22-491102de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a80-568c-4e05-be22-491102de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82/analysis/1477388713/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a81-6830-43b7-8b67-4f0c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:53.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:53.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 10686cc4e46cf3ffbdeb71dd565329a80787c439",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'bc8fec92eee715e77c762693f1ae2bbcd6a3f3127f1226a847a8efdc272e2cbc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a81-69f8-4559-8627-4af202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:53.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:53.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 10686cc4e46cf3ffbdeb71dd565329a80787c439",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd7c471729bc124babf32945eb5706eb6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a82-e84c-42ba-ac0f-4f8d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:54.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:54.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:54Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:54Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a82-e84c-42ba-ac0f-4f8d02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a82-e84c-42ba-ac0f-4f8d02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/bc8fec92eee715e77c762693f1ae2bbcd6a3f3127f1226a847a8efdc272e2cbc/analysis/1477388693/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a82-81c0-4bf3-8c20-4a7b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:54.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:54.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 0f7893e2647a7204dbf4b72e50678545573c3a10",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'da43d39c749c121e99bba00ce809ca63794df3f704e7ad4077094abde4cf2a73']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a83-9d00-4e2e-ab82-46df02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:55.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:55.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 0f7893e2647a7204dbf4b72e50678545573c3a10",
|
||
|
|
"pattern": "[file:hashes.MD5 = '35283c2e60a3cba6734f4f98c443d11f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a83-a928-4a84-9984-4bee02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:55.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:55.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:55Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:55Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a83-a928-4a84-9984-4bee02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a83-a928-4a84-9984-4bee02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/da43d39c749c121e99bba00ce809ca63794df3f704e7ad4077094abde4cf2a73/analysis/1476967118/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a84-2364-4e1c-b758-42d402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:56.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:56.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 015425010bd4cf9d511f7fcd0fc17fc17c23eec1",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '63d0b28114f6277b901132bc1cc1f541a594ee72f27d95653c54e1b73382a5f6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a84-0f00-433c-a5a0-490302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:56.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:56.000Z",
|
||
|
|
"description": "Seduploader - Xchecked via VT: 015425010bd4cf9d511f7fcd0fc17fc17c23eec1",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c2a0344a2bbb29d9b56d378386afcbed']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a85-59ec-4b9a-8ff8-40e702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:57.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:57.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:57Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:57Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a85-59ec-4b9a-8ff8-40e702de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a85-59ec-4b9a-8ff8-40e702de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/63d0b28114f6277b901132bc1cc1f541a594ee72f27d95653c54e1b73382a5f6/analysis/1466540615/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a85-c57c-40b9-a3db-4c5202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:57.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:57.000Z",
|
||
|
|
"description": "Email Attachments - Xchecked via VT: ef755f3fa59960838fa2b37b7dedce83ce41f05c",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '03cb76bdc619fac422d2b954adfa511e7ecabc106adce804b1834581b5913bca']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a86-5df0-451b-9764-46b802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:58.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:58.000Z",
|
||
|
|
"description": "Email Attachments - Xchecked via VT: ef755f3fa59960838fa2b37b7dedce83ce41f05c",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c13655fee08417cffa04d1bf71af4ad1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a86-7804-4e22-9856-4b7302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:58.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:58.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:21:58Z",
|
||
|
|
"last_observed": "2016-10-25T14:21:58Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a86-7804-4e22-9856-4b7302de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a86-7804-4e22-9856-4b7302de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/03cb76bdc619fac422d2b954adfa511e7ecabc106adce804b1834581b5913bca/analysis/1469690600/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a87-0028-4655-ab7d-445b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:59.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:59.000Z",
|
||
|
|
"description": "Email Attachments - Xchecked via VT: e7f7f6caaede6cc29c2e7e4888019f2d1be37cef",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9e5fbd79d8febe7a162cd5200041772db60dc83244605b1ff37ef8d14334f512']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a87-0bf0-41f2-a7a4-4ee902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:21:59.000Z",
|
||
|
|
"modified": "2016-10-25T14:21:59.000Z",
|
||
|
|
"description": "Email Attachments - Xchecked via VT: e7f7f6caaede6cc29c2e7e4888019f2d1be37cef",
|
||
|
|
"pattern": "[file:hashes.MD5 = '112c64f7c07a959a1cbff6621850a4ad']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:21:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a88-fcd4-4069-b116-48c202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:22:00.000Z",
|
||
|
|
"modified": "2016-10-25T14:22:00.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:22:00Z",
|
||
|
|
"last_observed": "2016-10-25T14:22:00Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a88-fcd4-4069-b116-48c202de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a88-fcd4-4069-b116-48c202de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/9e5fbd79d8febe7a162cd5200041772db60dc83244605b1ff37ef8d14334f512/analysis/1476924238/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a88-a658-4e5a-81bb-473e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:22:00.000Z",
|
||
|
|
"modified": "2016-10-25T14:22:00.000Z",
|
||
|
|
"description": "Email Attachments - Xchecked via VT: 9b276a0f5fd824c3dff638c5c127567c65222230",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '12572c2fc2b0298ffd4305ca532317dc8b97ddfd0a05671066fe594997ec38f5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:22:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a89-4234-4a79-b4a1-4d8702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:22:01.000Z",
|
||
|
|
"modified": "2016-10-25T14:22:01.000Z",
|
||
|
|
"description": "Email Attachments - Xchecked via VT: 9b276a0f5fd824c3dff638c5c127567c65222230",
|
||
|
|
"pattern": "[file:hashes.MD5 = '3f44a0f1d746cb99ab0321e73133ecae']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:22:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a89-bcfc-482a-ae07-4c7702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:22:01.000Z",
|
||
|
|
"modified": "2016-10-25T14:22:01.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:22:01Z",
|
||
|
|
"last_observed": "2016-10-25T14:22:01Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a89-bcfc-482a-ae07-4c7702de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a89-bcfc-482a-ae07-4c7702de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/12572c2fc2b0298ffd4305ca532317dc8b97ddfd0a05671066fe594997ec38f5/analysis/1476925033/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a8a-71d4-4c83-bb80-4b4a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:22:02.000Z",
|
||
|
|
"modified": "2016-10-25T14:22:02.000Z",
|
||
|
|
"description": "Email Attachments - Xchecked via VT: 76053b58643d0630b39d8c9d3080d7db5d017020",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '50539deb509814d4f5c5fe98aedb6f49d5b2f4c495e5e086dac8556c2e47b8e8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:22:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--580f6a8a-5878-49da-8a9a-483802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:22:02.000Z",
|
||
|
|
"modified": "2016-10-25T14:22:02.000Z",
|
||
|
|
"description": "Email Attachments - Xchecked via VT: 76053b58643d0630b39d8c9d3080d7db5d017020",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'bc7d13043fd9cdc65b5e70b1662f40d3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-10-25T14:22:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--580f6a8b-bad8-48bf-b8a5-478802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-10-25T14:22:03.000Z",
|
||
|
|
"modified": "2016-10-25T14:22:03.000Z",
|
||
|
|
"first_observed": "2016-10-25T14:22:03Z",
|
||
|
|
"last_observed": "2016-10-25T14:22:03Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--580f6a8b-bad8-48bf-b8a5-478802de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--580f6a8b-bad8-48bf-b8a5-478802de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/50539deb509814d4f5c5fe98aedb6f49d5b2f4c495e5e086dac8556c2e47b8e8/analysis/1477388139/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|