305 lines
331 KiB
JSON
305 lines
331 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--5c5b1d6e-d824-4fbe-969b-3aea950d210f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-06T18:06:02.000Z",
|
||
|
|
"modified": "2019-02-06T18:06:02.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--5c5b1d6e-d824-4fbe-969b-3aea950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-06T18:06:02.000Z",
|
||
|
|
"modified": "2019-02-06T18:06:02.000Z",
|
||
|
|
"name": "Malicious XLS claiming to be from Deloitte",
|
||
|
|
"published": "2019-02-06T20:05:22Z",
|
||
|
|
"object_refs": [
|
||
|
|
"observed-data--5c5b2105-4abc-486b-b212-cb89950d210f",
|
||
|
|
"file--5c5b2105-4abc-486b-b212-cb89950d210f",
|
||
|
|
"artifact--5c5b2105-4abc-486b-b212-cb89950d210f",
|
||
|
|
"indicator--5c5b2140-e72c-496a-85a8-d0a9950d210f",
|
||
|
|
"indicator--5c5b21f4-5cc8-4fa6-9ce6-4731950d210f",
|
||
|
|
"indicator--5c5b2209-a91c-4c59-b6b9-4c62950d210f",
|
||
|
|
"indicator--5c5b220a-f3cc-47e2-af51-435e950d210f",
|
||
|
|
"indicator--5c5b220a-f484-4dfe-96f1-4c98950d210f",
|
||
|
|
"indicator--5c5b220a-c5d8-438d-ad6a-4051950d210f",
|
||
|
|
"indicator--5c5b1d9a-4b6c-4631-972a-81b0950d210f",
|
||
|
|
"x-misp-object--0a0f1632-6e99-446c-b282-62e5e71d9795",
|
||
|
|
"relationship--3d4906b3-ac96-4d22-825f-0802891c40f2"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"type:OSINT",
|
||
|
|
"osint:lifetime=\"perpetual\"",
|
||
|
|
"osint:certainty=\"50\"",
|
||
|
|
"misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Spearphishing Attachment - T1193\"",
|
||
|
|
"misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Scripting - T1064\""
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5c5b2105-4abc-486b-b212-cb89950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-06T18:01:41.000Z",
|
||
|
|
"modified": "2019-02-06T18:01:41.000Z",
|
||
|
|
"first_observed": "2019-02-06T18:01:41Z",
|
||
|
|
"last_observed": "2019-02-06T18:01:41Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--5c5b2105-4abc-486b-b212-cb89950d210f",
|
||
|
|
"artifact--5c5b2105-4abc-486b-b212-cb89950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"attachment\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--5c5b2105-4abc-486b-b212-cb89950d210f",
|
||
|
|
"name": "index.jpeg",
|
||
|
|
"content_ref": "artifact--5c5b2105-4abc-486b-b212-cb89950d210f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "artifact",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "artifact--5c5b2105-4abc-486b-b212-cb89950d210f",
|
||
|
|
"payload_bin": "/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/2wBDAQkJCQwLDBgNDRgyIRwhMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjL/wAARCAOwBzQDASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwCHwn4M1LxJokWpWlymTkMjKPlwSOpPPStw/D/xNB9wxN/wJR/WmeAjE/w2uEeCeeSKRTCkELSned+MqoPy8nPt0wcVDZ3g/wCEt0samtwoEqJFbzs0ckTbgE4I3GMHkAAAnGeNwr0MZnGMp4idNT0Ta2Xe3Y8dYSg0m47+ZzNxqd1BM8RlyyEgkCoDrV1n/WH8hWv4TtRf+PtPVs7ReeZx/sEt/wCy11V5oFlF4f8AFVxFKSNTjF/ZEEfNboY5SV4+7ukCn6fjX0lPMIQpUvaK8pRi/vaX/BOGOCdRycXom19yv/wDzz+2rr/nofyo/tq6/wCeh/Kuw1zRbBrMare3GozWdlodhJFbiSISAzSOiR7wgG1cckqSc57YrIsNI8PXGm6/q0v9q/YdPe2WBFeMSsJX2HdwR1x0xxXTDG0pQcuXbR6dW7W9SZYOSklffz8rmN/bV1/z0P5Uf21df89D+VdGfCOlrpDq1xdjU00Ma0z/AC+QEyf3eMbs4B5z/hWi/gDSrrVNJt9Nub2WyvJirX/mRSRMBGXKgDBV/lYYIPr7UPH4Zb+fTtf/ACdvTYPqVX+n/Xc4v+2rr/nofyo/tq6/56H8q7jwnouiL4m8K6laJdSWuqR3MsMN2yFonhz8zYXBHQgDGDg5OMVh3k1rqPw2Gsy208upXeteWbm4uBJJt8ouAW8sZUIANowNwyMD5alY6m6ijGOjt97bW3lYr6k1FtvXX8Fcw/7auv8Anofyo/tq6/56H8q6LwtP9j8D+K5vtt7ZYayHn2QzKuZSML86dc4PzDgnr0p3hjwvp3iPRrnVL251NZrSR5b45MrSoVLZQ7Sd+eoJb171c8VCnKfPGyi0r2vur/8AAIjhXOMeV6yv+Bzf9tXX/PQ/lR/bV1/z0P5Vq6tpWh6TZ2ccyak19e6ct/GUkjMcXmE+WjfKC2Ap3MMdBgc4F3xR4V0PQbO8hXVQNUszADFLdQk3JcDdsiU70xuB+bt6jmmsZQvFW+J2Wny/PQPqdTXy8znf7auv+eh/Kj+2rr/nofyrX+IwLfEXWh2V4QB6DyI6566s2tJzC81tI4GT9nuY5gOSMEoxAPB4PNbUKkatOE7W5lexnVo+znKO9i1/bV1/z0P5Uf21df8APQ/lXTTa1rI+GMVwNY1IXL68YzMLyTzNn2ctt3bs7cjOOmaS+8H6dpfh29ubqSZdS0z7L9qtY7oSYErBcE+UAjckgZfAwTnIzzrFwi2qkUteVW1108lpqjZ4S6Tg76X7d/8AJnNf21df89D+VH9tXX/PQ/lXReLPCmmeHtKtru2kvp3v3DWvmDYIotoJ8z5OXycAAjjnsai+Gi4+IOln/rr/AOinrRYmnKhKvBXSv0tt/VjN4ZxqRpyert+Jhf21df8APQ/lR/bV1/z0P5V3VhNb6p4X8JznUdQv5DrqQG9uwqXMbMpKhc+YCudr4JbOMcdnQKyQWsbSPKR4+MbSSY3SbQwycADnGeABXJ/aMVvDX/g+h0fUNdJHB/21df8APQ/lR/bV1/z0P5V2d/p8WpQNDJcXaxXXjSa0miDptOS/zr8m4ELhcEkcZx2DYvBGh391BHa3d9boNal0mY3DI24xo7krgDGdmBnPX8KuOY0LXmrfK/YmWAne0dTjv7auv+eh/Kj+2rr/AJ6H8q1vFnh6z0O30p4I723nvEleW1vHRpIQrALnaAOck1zOyu6hOnWgqkFp6HNVpOlLlluaH9tXX/PQ/lR/bV1/z0P5Vn7KNla8i7GdkaH9tXX/AD0P5Uf21df89D+VZ+yjZRyLsFkaH9tXX/PQ/lR/bV1/z0P5Vn7KNlHIuwWRof21df8APQ/lR/bV1/z0P5Vn7KNlHIuwWRof21df89D+VH9tXX/PQ/lWfso2Uci7BZGh/bV1/wA9D+VH9tXX/PQ/lWfso2Uci7BZGh/bV1/z0P5Uf21df89D+VZ+yjZRyLsFkaH9tXX/AD0P5Uf21df89D+VZ+yjZRyLsFkaH9tXX/PQ/lR/bV1/z0P5Vn7KNlHIuwWRof21df8APQ/lR/bV1/z0P5Vn7KNlHIuwWRof21df89D+VH9tXX/PQ/lWfso2Uci7BZGh/bV1/wA9D+VH9tXX/PQ/lWfso2Uci7BZGh/bV1/z0P5Uf21df89D+VZ+yjZRyLsFkaH9tXX/AD0P5Uf21df89D+VZ+yjZRyLsFkaH9tXX/PQ/lR/bV1/z0P5Vn7KNlHIuwWRof21df8APQ/lR/bV1/z0P5Vn7KNlHIuwWRof21df89D+VH9tXX/PQ/lWfso2Uci7BZGh/bV1/wA9D+VH9tXX/PQ/lWfso2Uci7BZGh/bV1/z0P5Uf21df89D+VZ+yjZRyLsFkaH9tXX/AD0P5Uf21df89D+VZ+yjZRyLsFkaH9tXX/PQ/lR/bV1/z0P5Vn7KNlHIuwWRof21df8APQ/lR/bV1/z0P5Vn7KNlHIuwWRof21df89D+VH9tXX/PQ/lWfso2Uci7BZGh/bV1/wA9D+VH9tXX/PQ/lWfso2Uci7BZGh/bV1/z0P5Uf21df89D+VZ+yjZRyLsFkaH9tXX/AD0P5Uf21df89D+VZ+yjYaORdgsjQ/tq6/56Gj+2rr/noaz9p9KNp9KPZrsFkaH9tXX/AD0NH9tXX/PQ1n7T6UbT6UezXYLI0P7auv8AnoaP7auv+ehrP2n0o2n0o9muwWRof21df89DR/bV1/z0NZ+0+lG0+lHs12CyND+2rr/noaP7auv+ehrP2n0o2n0o9muwWRof21df89DR/bV1/wA9DWftPpRtPpR7NdgsjQ/tq6/56Gj+2rr/AJ6Gs/afSjafSj2a7BZGh/bV1/z0NH9tXX/PQ1n7T6UbT6UezXYLI0P7auv+eho/tq6/56Gs/afSjafSj2a7BZGh/bV1/wA9DR/bV1/z0NZ+0+lG0+lHs12CyND+2rr/AJ6Gj+2rr/noaz9p9KNp9KPZrsFkaH9tXX/PQ0f21df89DWftPpRtPpR7NdgsjQ/tq6/56Gj+2rr/noaz9p9KNp9KPZrsFkaH9tXX/PQ0f21df8APQ1n7T6UbT6UezXYLI0P7auv+eho/tq6/wCehrP2n0o2n0o9muwWRof21df89DR/bV1/z0NZ+0+lG0+lHs12CyND+2rr/noaP7auv+ehrP2n0o2n0o9muwWRof21df8APQ0f21df89DWftPpRtPpR7NdgsjQ/tq6/wCeho/tq6/
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c5b2140-e72c-496a-85a8-d0a9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-06T18:02:40.000Z",
|
||
|
|
"modified": "2019-02-06T18:02:40.000Z",
|
||
|
|
"description": "Spoofed email - Pierre.Laporte@deloitte-canada.com via MTA",
|
||
|
|
"pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '95.211.163.26']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-06T18:02:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-src\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c5b21f4-5cc8-4fa6-9ce6-4731950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-06T18:05:40.000Z",
|
||
|
|
"modified": "2019-02-06T18:05:40.000Z",
|
||
|
|
"description": "Spoofed domain",
|
||
|
|
"pattern": "[domain-name:value = 'deloitte-canada.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-06T18:05:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c5b2209-a91c-4c59-b6b9-4c62950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-06T18:06:01.000Z",
|
||
|
|
"modified": "2019-02-06T18:06:01.000Z",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '95.211.163.26']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-06T18:06:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c5b220a-f3cc-47e2-af51-435e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-06T18:06:02.000Z",
|
||
|
|
"modified": "2019-02-06T18:06:02.000Z",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '95.211.242.210']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-06T18:06:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c5b220a-f484-4dfe-96f1-4c98950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-06T18:06:02.000Z",
|
||
|
|
"modified": "2019-02-06T18:06:02.000Z",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '95.211.143.214']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-06T18:06:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c5b220a-c5d8-438d-ad6a-4051950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-06T18:06:02.000Z",
|
||
|
|
"modified": "2019-02-06T18:06:02.000Z",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '134.19.181.154']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-06T18:06:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c5b1d9a-4b6c-4631-972a-81b0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-06T17:48:32.000Z",
|
||
|
|
"modified": "2019-02-06T17:48:32.000Z",
|
||
|
|
"description": "Spoofed email - Pierre.Laporte@deloitte-canada.com",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'bdc928e2064faf3950aef955c1c9fa8c' AND file:hashes.SHA1 = '9f9d41aabb5e58d765f5ff4d930e6dab5fa2a613' AND file:hashes.SHA256 = '2f00e0bb89d863ee7834ae9cb69d98f8e826e6d328fcdd833d91d62634f675ce' AND file:name = 'Tax_Billing.xls' AND file:size = '58880' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIAOONRk7+6a/TdloAAADmAAAgABwAYmRjOTI4ZTIwNjRmYWYzOTUwYWVmOTU1YzFjOWZhOGNVVAkAA5odW1yaHVtcdXgLAAEEIQAAAAQhAAAAlvcvCzkV9fnMIkuIzLMjMAwFiA/r5wPuavqaI2FO3KaIzaTAPoVknmUzv8sKEs+gG1YsOY8ZWw3ZFfk3j3uqnViRmHhjj+HB2mMPx+NY68+t5mYhvXf61/HZqWve336qOlG8OWG0FbaVYKWGSLfuD81mH1vdXTAfNoBSptszZpABVfOc6vJ1gW2DUsuSgpQUQSaiC6nuX4SZN1uNvOxySwgSLic8wN6/p0TbWc11L7MmpXFqtU2jzP7VJdCJnlppX4VM4qcWH5GDGlSHL0hZuwBZv4oMc67tQ0fzD8BDoXM/yrd2osINOtK3cZ0R7hEVxRdcdlquAkdF0fS9ZzT0TvKZbJVjrseBlybd3LvXC5lXqB24fGaNGo+xRy9g9wi9Eee3fyhXQs9tsTTnR/5ztzVaaF/r/PETvlOLyPSweEWQMWZO1qcjjCKqttDyJknzqFcZNEftPkX8fEYKRUio0MRISbg/zApAFza0xoVDsqDuLkRoMsCokE6+RUxlbQf/MqAk5BfsJZdzcXn0QMWmeC6I+YjxdZ5eIp0IPPEffGGSiJt6sxkjPtNptuPtr5iqDW1+9UfxO4DWFyAwndLTTFFKZ6QTVR78ITdRggdBeBSdzrj2A08Xf6RUlkraw5XdD22ieCHUzIzjJIb9oHNQh+EDkq2gNc3Dv0IlaJNoCVGycEmoRGivUwEn+MxPEyCoirZcs8r+R+O88hB9P3lZJST36d4wP0N2JRLXYDo54SR/Sv+wq1xD4wS0lca0X4I6LcJ7jve6DQXwxwLnjVa3B0Y529b7Aw1zxrdnDSq60wpVn7Xw14+JvCQYp0mrJ/Y/gtR+bUCDkZxjYmksUwVH9uTdmp092cFDPZf9kYBthFzNfFHG9rI2WlaJS3aKmybKuwhi+kZOs2lMjihkIwTolLD6E0lF5yFOXRtwcW4NrIPjwkqWJ2+sopW95xiijUAAIh+GXFuPKBCJdolSlZLxTKptYfBA75EQH1ATGGCm8TUFYLdq2sIE8kWwp5kanyr2kJgtJc7jgXDxRAZC64WQOdW3OIjGmjKRK4s6VV/4dWjAJRrcBjRFF8GqIbnYygr1DRiQ5XlNVtFZ58AbSZ55ZyXySTtfXuLyDwYBhBFmKUjqr25qyRJA2egTAmkYpPQuknMjGqlAlC1RwQX44z1+qNM/1i0A0SofjAjqb38Sz/QFqF0e0bAspxa1tEym/9S9+esPfn7njHSvdOX3ApN8ELbUtLMGwUfpncJt3LZaqWwL8Nie52xbjR72rIlFHLriL9Dcbr49t5BGHfAUM8f2iHDPiaS3kCCDxCCgnbeZbv2vul1pcRl6hiS4/gbLCdVLOhrJJ/eAVs4hqdgki3gtwiiy6BeZ0lquzu6E9ABJ7a9NMXUKZATUjwR78OGhVpGIxGv4n1PvzK4fzPZhDhqJHRpiKzLvg5P2ALIbuWuPDwfN85FdfdWzjqA64mW7lrmxFn2W/CQBlRUJ2mBnBgGiiADG2GK4gpyic8KZBg9/bJKqp6z958+cpKpfCxX5j/OGYRm85kuqRvfD2TLL73sVteoSUSGlE8tP5NxFfToafhmlFDQcOaXr0s/m01QRN1NHmVPJpLPuZa/8M+F2ZS9XerbBMav++la64VT6wn9A/+NllQEe1uhqxZP0M/cDsWp1XxmCuMcgLdhNzUO9zeDCA6rV9qHPRQ53LCgejoCIFHbyjUv06qJg9wquttkPjaXnl7xUdd/z6pKnmVlwxD7mjbqGRC0KqYWB0lI3EQ4WUQIVI+9GoSsWdHvbNX2rib1fMHyamp4MCZBX2qQSozH77qDkSEDxdQWRYG/PSDEI7Y12ApvaILIXO/JfvQ3eQU0d28VQJetAvFg7HlBcJnCjMWhoXUDUc3ERvS98y+Yn2qns4zUy+pfzgBQjmdVNG6zZDthWTYOggGlkFRLwzvelvIce79mhrPqJVxltniXma0e5wbMmsbO70vH8T2YYm+QDh5YMFOWqwqDRHc2C6DFVuZmD5jhrY6z8A4eOsIb71YzJEchOxMIQZ5+ZHtkgzOhMAFBjMYeQIT/SNrLP3TEibvDL8g0IG/Fl6SdbN1B61xsLVV+Ew2xVwIBl9wUua4OBYo6RN79SQa6AUweuipIPIAlfancikVdY2zCSB6ZNcJqhqPTR6Kdp0/yLD6Sks9b3v4f4Le88H7YZh+BgDqWVBocSDrapbos9av5A+sLbfQWedH6Xy2u9HAA0X5IQAfYWd8FIpWf5KQhzUEWozLEKmOdQ1F2D0mEXs7Rvgyr39SkA+6kDyvunEQ/zZyxObzghitovljjJowLZ+UukRtlVXyHlRaegoqMKWU66ZItca/EHfU0tp8rY0gngW20C0orQJmjF3G4H921i8z243S9gtotDpZditNSgnuwMLf9lOIH5plTw4jbYq5Rdf1aFXLjyXBxrms5keU9iG/rXQIV8wRrzDSyWoI9kBXJfpVbSlv1ha/Bh3z9652yOskn+6riNGAV1UV3n08RloxBDCpRcd+j7ptIHmFdrSo8ZsMBgt/s2vhyaOHbtkzbsnSRvusIYOHkp97RsqgwsNEedW1pQW2auSYTO7Vo0GZdKEFUSIToN5c4aXlnrGQHsoGtay6FwbsoGNZWyjEhZRy1aIsTBXy4kQRp1ndgmORmad1s5d8eRfZ4eNDTTePdIwQxM/SSaLlC65/wJQ5EZRM9jut16JwlQG5qAzSFzXoNKIGTbLj45PnrHxC+S4WjgO32+mavI1SZzzB6e1rfF4Tvss+vf3dUm+sJXjOpk8pmecFKdtFW5aFXuTqsOGDYyWsmbm5ORi4PR9iUuaXpxeIJmSKnFcKpqvktoMsiopo2np4x3WLPw2eDikz8uofFMRiLWMFuS34oom9SQQKY1jvQYZh9Cz4m7UjRQ2w1hsQmWB5GxYKgsa8vK9hV2g5Rg6cq+XcQ4g50f18fHiNJqQ7PWmockdTn80sknDWl+UICJpHyJ1gGWibEsdtoI8zsRZoJvwhnTl94gY+cZrZVxzfbGRtH5SI5iNrKR7mH98v7yLUex5bHlXQe/duBCDUDcZv4OMSL7LFsGq2H0ang02bt66LM6LOX2KFz34UqIbdusElyb6l7wa6lJkyB7+zmZEu900hRhqucfWPAmdTw7Nt6fAGn7tq1bDJ22um52kUKjSCHcnjWWQChhlzCFywCVF4Pfg7f0/RwpJHYQv2mhBI5c32IOkTHNxO5/GS9ls6M7E326rY/YCi5R7C2hQ2tO3f0pL1VbM2wcov1nKQP4fRgXmelFweicBrlWRDojH3UVOMBTCJfQMFYQzsTlz8tbc0basqT7VsGcGu55hqDAfIIpfGHNBmv16IiuIpFURIPS5UL3Z/MZBKxeMBAR/ycdlu0h5LB0G+2Agyy3w3ri5pMqHmVTTBezRgYHnO8fDGF1kcFoL6MXkKkXSGmlXlSFyXyqqI03gui1c2JCPVqLa+h/joFqBd6u+Ec+7tSgckgnNy+jhOjdNpovC14fhF+aSXDaXxswyk8KGHAT6xT5eoS0fYripVfUuYwM9hikFgrl63cHCkx69V8W9dpt6fINEpt4F/UQHkc2ArbQJyefKXKF3cV1Its0FhVIwtbNoGg6UFb9Z/RZXyz20qXaBxR4P5/3
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-06T17:48:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--0a0f1632-6e99-446c-b282-62e5e71d9795",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-06T17:48:32.000Z",
|
||
|
|
"modified": "2019-02-06T17:48:32.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2019-02-06T17:35:34",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b9506ea8-26cc-4d66-8391-4ba4c520d28f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/2f00e0bb89d863ee7834ae9cb69d98f8e826e6d328fcdd833d91d62634f675ce/analysis/1549474534/",
|
||
|
|
"category": "External analysis",
|
||
|
|
"uuid": "67dc6c75-2606-4f36-ae58-03d54e2161a1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "10/59",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "46f85060-e7ce-48bf-853f-286855dbc63b"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--3d4906b3-ac96-4d22-825f-0802891c40f2",
|
||
|
|
"created": "2019-02-06T17:48:32.000Z",
|
||
|
|
"modified": "2019-02-06T17:48:32.000Z",
|
||
|
|
"relationship_type": "analysed-with",
|
||
|
|
"source_ref": "indicator--5c5b1d9a-4b6c-4631-972a-81b0950d210f",
|
||
|
|
"target_ref": "x-misp-object--0a0f1632-6e99-446c-b282-62e5e71d9795"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|