8785 lines
1.4 MiB
JSON
8785 lines
1.4 MiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--de6bc50b-dfc7-4938-a0f0-2305f9e4d2b8",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:57:14.000Z",
|
||
|
|
"modified": "2022-03-07T07:57:14.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--de6bc50b-dfc7-4938-a0f0-2305f9e4d2b8",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:57:14.000Z",
|
||
|
|
"modified": "2022-03-07T07:57:14.000Z",
|
||
|
|
"name": "Nvidia leak - abused certificate for signing malicious code and tools such as mimikatz",
|
||
|
|
"published": "2022-03-07T07:57:22Z",
|
||
|
|
"object_refs": [
|
||
|
|
"indicator--fbd02e8a-e056-4997-bb91-993e8eb46dd9",
|
||
|
|
"indicator--d43a685c-be11-4d6d-bacd-14d307a658ab",
|
||
|
|
"indicator--9a5faab9-e80a-45b5-9be7-3f8b89c2e933",
|
||
|
|
"indicator--d5bac5dc-2cec-4581-9f5b-fcc20bffb34f",
|
||
|
|
"indicator--72de4681-c538-4035-adc1-6616770e5cb9",
|
||
|
|
"indicator--728742f4-5a0c-4aa5-97a1-c3c376975b95",
|
||
|
|
"indicator--98864332-38bd-4cc4-be78-7f771192613e",
|
||
|
|
"indicator--468c5325-b81c-4b6b-8edf-ffab23ac82a6",
|
||
|
|
"indicator--4d56e4fe-f521-43af-92e9-a2ae90979d32",
|
||
|
|
"indicator--df9cbd45-1f81-4c3c-8e8c-c16744af9e10",
|
||
|
|
"indicator--7ef07827-afcb-4b67-9061-d5de3ca84cfc",
|
||
|
|
"indicator--ad2bbb2b-d99a-4e79-8345-4a356eb8f001",
|
||
|
|
"indicator--4ddae871-b956-496e-8b95-4060df7d3243",
|
||
|
|
"indicator--34126408-0d70-41b7-b6f2-c5125725a3b3",
|
||
|
|
"indicator--729cbc5a-c9ac-4fe9-80dc-bc6504f8b4d4",
|
||
|
|
"indicator--45176f72-71fe-4913-ad7c-d1f4a3601994",
|
||
|
|
"indicator--a7431089-a730-4c28-b470-027cd5a09439",
|
||
|
|
"indicator--1db0fafc-14f7-497f-a3cb-b0cd08c111b7",
|
||
|
|
"indicator--5f1a4895-1018-4c50-81e1-73b34623e3d9",
|
||
|
|
"indicator--ffa40f70-69da-46e3-97ff-00ed20543beb",
|
||
|
|
"indicator--da780a2b-9e71-4dd5-b508-1ef72cb7ccd2",
|
||
|
|
"indicator--7d6b07f8-1fd4-4c02-ab8a-23db4d70e634",
|
||
|
|
"indicator--e06b48b8-2869-4241-a627-fa2b44333efb",
|
||
|
|
"indicator--1b06f316-8823-4a6a-b232-f1fff4f90ff3",
|
||
|
|
"indicator--d01f1610-5aa0-420e-bdf8-3513c5217ab6",
|
||
|
|
"indicator--ae1dc9f2-06f4-4c3c-a793-5d0f8d3f5b32",
|
||
|
|
"indicator--52bb2346-2890-4770-95fc-f50dfc5a2f3a",
|
||
|
|
"indicator--04ed5798-7785-47cb-88ea-c6f7a3b43365",
|
||
|
|
"indicator--991c24f5-a93c-4687-82ea-b1c1bdfb48a8",
|
||
|
|
"indicator--bb2b82bb-81b8-4f9d-aa2b-1caa8d839558",
|
||
|
|
"indicator--72fdef6d-4cfb-4dd8-916b-1cd82d05eaff",
|
||
|
|
"indicator--c4eb5ed3-fabd-4fac-9bef-09f174988b49",
|
||
|
|
"indicator--eaa5fb46-9f13-475a-8bb2-12366a486448",
|
||
|
|
"indicator--837622e3-49bc-48df-a9f8-c5edd9acd9eb",
|
||
|
|
"indicator--77b670c1-17bf-4860-969e-fd9c3fad18b9",
|
||
|
|
"indicator--433614cc-f300-4909-a133-a6541ab9a7aa",
|
||
|
|
"indicator--93cf1e36-32cf-46d9-8720-081e2885e654",
|
||
|
|
"indicator--d77b5766-7d78-4a62-834e-d3653e4a5545",
|
||
|
|
"indicator--866158c6-dbe2-45b8-be60-e71727633ca4",
|
||
|
|
"indicator--2e11aef4-709c-4047-a7b9-d42d24caff80",
|
||
|
|
"indicator--df26a25c-21de-4329-a1e6-222f3f90a768",
|
||
|
|
"indicator--42301740-1460-4294-83fa-b1b309b16b8d",
|
||
|
|
"indicator--e48d11cc-42c5-4457-9236-f2848af17df1",
|
||
|
|
"indicator--931d4e0a-6f15-468a-8f41-ffa19277a7ae",
|
||
|
|
"indicator--3dd35274-e0dc-44a9-9b3e-deb8bd5ee6e4",
|
||
|
|
"indicator--4e5d822b-6f58-4e36-bea5-109344bef7bc",
|
||
|
|
"indicator--f0550ece-389f-4313-a621-dd5d77448146",
|
||
|
|
"indicator--a984b6d1-c542-49fe-9aad-f62552124c36",
|
||
|
|
"indicator--02296fd1-69e5-4e2a-b33a-42ac8d74e044",
|
||
|
|
"indicator--eeee7093-3d0a-409f-b278-80a4eaf13633",
|
||
|
|
"indicator--c23e2ac8-6bcb-4680-80cc-b51516758d35",
|
||
|
|
"indicator--d20450fb-1c01-4bda-a2f9-7a53fe728a59",
|
||
|
|
"indicator--39c981f8-6ac6-402f-91bb-d68c0d52d4cc",
|
||
|
|
"indicator--7072c12d-b217-4291-8613-e480a9c58543",
|
||
|
|
"indicator--bc86baf0-a9a3-443d-9ae3-287e9bc06b8c",
|
||
|
|
"indicator--38014cc1-e7fc-4f64-b1ca-7601c2c44226",
|
||
|
|
"indicator--e577dcdf-b5d0-409c-8993-02f5e4fee09d",
|
||
|
|
"indicator--7de19c8a-5971-43ee-9195-519ea5d64f09",
|
||
|
|
"indicator--d78eb638-33c4-45e2-bacb-f064d75eadb8",
|
||
|
|
"indicator--765f8139-c6ce-4242-a82b-ff531784b0ab",
|
||
|
|
"indicator--72a39535-7aa5-4863-a227-16c89b11204b",
|
||
|
|
"indicator--5bac6387-bb42-431a-abb0-9782f71081ef",
|
||
|
|
"indicator--76010167-d214-486c-a001-b82078bab4a2",
|
||
|
|
"indicator--6877c9aa-3394-4c2f-9dc8-5ac073ec8420",
|
||
|
|
"indicator--db345180-2f84-4d37-b8e9-638b10e1ed66",
|
||
|
|
"indicator--4645d92d-7c53-48ac-be0d-fef1f51500f8",
|
||
|
|
"indicator--7df10f36-f63f-4945-8927-fb3381ea6d0b",
|
||
|
|
"indicator--71f50822-822e-4275-a99f-5aecbe73e4cd",
|
||
|
|
"indicator--72e9d5be-13ee-45e4-bcca-5f1790f12ec7",
|
||
|
|
"indicator--f76abded-4e36-4ee3-804b-5787be608de3",
|
||
|
|
"indicator--f0daf6da-ae05-41d8-b2e3-76bec9452b24",
|
||
|
|
"indicator--8447f2cb-ebb0-4ccc-ab9a-1f650796efd5",
|
||
|
|
"indicator--2e533235-93ae-44ce-a715-8f5f258c5643",
|
||
|
|
"indicator--fb8098fd-18f8-457e-a69b-272547907f7e",
|
||
|
|
"indicator--816f243d-fd1d-4a4b-a65b-e6e510aad265",
|
||
|
|
"indicator--cc7ee77e-860e-4808-999a-6e47c1a959a6",
|
||
|
|
"indicator--87f6eb41-5239-4875-a820-714c64c3b852",
|
||
|
|
"indicator--ede72a3a-85c4-4841-9a46-419ca4e200e9",
|
||
|
|
"indicator--6d0df349-997b-4567-8d49-f6db0f336563",
|
||
|
|
"indicator--c94077b7-93a6-4585-a1e3-a4728fe8c4ae",
|
||
|
|
"indicator--9ab6cefa-0d45-4636-872a-c1503da8296e",
|
||
|
|
"indicator--1f38fa73-c7a9-4588-a53e-7d51e64786f4",
|
||
|
|
"indicator--321c121a-8076-450a-978b-62564290e32c",
|
||
|
|
"indicator--cc5ed150-1ecf-4655-a4ef-e11bebe85bd9",
|
||
|
|
"indicator--55272813-1710-4646-96e8-4eb2a996de15",
|
||
|
|
"indicator--192f7042-397e-4a6a-a4ec-43ffbda0bbf4",
|
||
|
|
"indicator--e8699a03-5bf8-4d97-8f7f-9847512b2c0a",
|
||
|
|
"indicator--bc125b2e-eec6-4731-a5e1-b91517013231",
|
||
|
|
"indicator--a5dbdf3e-df58-424a-afca-957dadd9f8e4",
|
||
|
|
"indicator--bab29105-e585-4806-ac82-7ca08a1caab5",
|
||
|
|
"indicator--2d204cd7-881f-4e1d-a812-fa2cf011fd8c",
|
||
|
|
"indicator--26686687-d818-4fb5-91cc-c7d6fe8e96a5",
|
||
|
|
"indicator--89f2b4b2-5d6b-4682-bd81-f79dd1d4061e",
|
||
|
|
"indicator--f847f1e3-280d-4349-b0af-020b84fcc7e6",
|
||
|
|
"indicator--98858b43-d45e-4162-8d17-032f315e2332",
|
||
|
|
"indicator--231cbaf3-6cc1-4314-820c-5f2e2d5276cc",
|
||
|
|
"indicator--1fa51375-30e3-4774-ad53-74c1e97ad122",
|
||
|
|
"indicator--956a36c8-c653-4bc2-950c-8f40cb9e9b10",
|
||
|
|
"indicator--dad59b04-8802-4947-be2a-6b1f5505ab33",
|
||
|
|
"indicator--52c4c62c-bb36-4238-80ff-2aeac511a519",
|
||
|
|
"indicator--4a296fa2-d094-4bf4-82c3-522d2f1996ce",
|
||
|
|
"indicator--d5fd6e34-8d5f-4bc9-94b1-f3a812cde688",
|
||
|
|
"indicator--742b7244-95c2-4149-a029-0e19f3972b4c",
|
||
|
|
"indicator--708dc6d8-eff1-4e79-b9ab-9f487baa0ea0",
|
||
|
|
"indicator--bcdfd47b-3bd5-477a-9f6b-c882d5285456",
|
||
|
|
"indicator--c52eac6e-d650-4bbd-9044-f8d7923d4246",
|
||
|
|
"indicator--21e007de-1212-4eac-bb3a-63ce2e6f44a0",
|
||
|
|
"indicator--11999b24-e9a5-4947-9082-f2c90e4514ca",
|
||
|
|
"indicator--4db7fd29-db36-4644-a12b-b97d56dc83c4",
|
||
|
|
"indicator--61888948-c36f-4132-85c4-5df1f4c92b73",
|
||
|
|
"indicator--1bbb562e-726d-461b-b1e7-78cbe34c4f97",
|
||
|
|
"indicator--9eb18fcc-8902-4254-b77b-f698a98f3783",
|
||
|
|
"indicator--ba54cd5b-a317-4bcf-877a-47e74b566291",
|
||
|
|
"indicator--ec2b9c06-0d7a-4d95-862f-9f8dc87abd1b",
|
||
|
|
"indicator--64a92494-fd19-458e-9784-6d837fac26ca",
|
||
|
|
"indicator--be8ee22d-a1a6-4e91-82ee-4e95f961c8ea",
|
||
|
|
"indicator--01b395ad-bb94-4373-89b4-a9919588bc12",
|
||
|
|
"indicator--585f2a63-5329-40f1-b933-cdc1d06fabd5",
|
||
|
|
"indicator--473289c3-a726-4b91-aed2-37e0e1294406",
|
||
|
|
"indicator--6d401bc8-2ca1-4b05-94b8-58df0660c99b",
|
||
|
|
"indicator--c4af6882-b837-4fd0-a450-8b67a9584629",
|
||
|
|
"indicator--53017921-25d5-44dc-b4ca-06b1c6b07347",
|
||
|
|
"indicator--7758c370-76b4-4155-8a81-c927fe15d5c9",
|
||
|
|
"indicator--c19d4afd-ad53-42a2-9e23-e0b26c0e110f",
|
||
|
|
"indicator--5847d7ea-8e52-4384-a834-db802f12d680",
|
||
|
|
"indicator--674e2345-4ca0-47cc-befc-dca3759f5231",
|
||
|
|
"indicator--8c60df1d-84fc-42c0-9eea-b65b609bee90",
|
||
|
|
"indicator--67e6c349-1a52-4f13-aa4a-93087ff79f7b",
|
||
|
|
"indicator--9cad061c-7b5f-4489-b795-ce2fde7f2438",
|
||
|
|
"indicator--b56341b1-3bac-4473-8744-4651dd18dd60",
|
||
|
|
"indicator--7e677401-da8f-4fdf-b8ac-848c9e36cf2e",
|
||
|
|
"indicator--79fb428c-0478-458c-99ae-4e1bff9556bd",
|
||
|
|
"indicator--91d250eb-f6f7-4b14-baa0-5f5d191f51a2",
|
||
|
|
"indicator--3c4017a5-4e13-45b0-95ae-c73d500accde",
|
||
|
|
"indicator--86565320-ee24-4146-b8a6-0c738c4e2c2b",
|
||
|
|
"indicator--634256c1-47e1-4154-9280-bae90f6af4fa",
|
||
|
|
"indicator--f6f3dd31-cb1e-4e26-bab2-2611a9d1baf7",
|
||
|
|
"indicator--c8359d87-6ff5-463c-b9c0-dc3b5bc21acd",
|
||
|
|
"indicator--d262a13c-4629-43ca-8120-2217b815cc36",
|
||
|
|
"indicator--649ff317-32aa-4ba2-ac2c-e2d6205e11fd",
|
||
|
|
"indicator--6a247d7c-1721-4ed1-9842-5c5054892b9b",
|
||
|
|
"indicator--7ff8be98-6a85-44fa-a77a-b187b7bf4c33",
|
||
|
|
"indicator--994e7140-9fb3-4698-8cd0-5af31563b565",
|
||
|
|
"indicator--734c7c77-9066-47b1-bf05-6ca0afde754d",
|
||
|
|
"indicator--650459a7-b150-4b43-ae4f-ab199a6ca7f7",
|
||
|
|
"indicator--e9fb5e62-4894-4ab7-b834-f49a77353267",
|
||
|
|
"indicator--96dab097-43ab-48d6-a693-ae91d4fcbce0",
|
||
|
|
"indicator--ea7bd56e-f0e3-4696-a673-c50ab3cfce9e",
|
||
|
|
"indicator--e470b6c1-8589-4b3f-80c9-d02a754c3618",
|
||
|
|
"indicator--6807c104-a877-4509-83d1-67f0e3319e3c",
|
||
|
|
"indicator--8cc658e5-6f62-4963-9cd6-e603fdd951a0",
|
||
|
|
"indicator--348e9959-337a-4e7b-a96a-b0a5f8e86a3f",
|
||
|
|
"indicator--0d72776a-357c-4e81-82ea-7abea49b05c0",
|
||
|
|
"indicator--d1827142-0d9e-43b4-8db2-d7a7fee61746",
|
||
|
|
"indicator--6029a744-5909-47e2-bf6e-4538489e3b95",
|
||
|
|
"indicator--3efc4c9c-5e73-4b61-a8e0-5ba408b3ff63",
|
||
|
|
"indicator--aec6cca0-5f30-4f56-8b1e-1637a6ffce7e",
|
||
|
|
"indicator--ff1fd09c-086a-4fd2-907c-e8fb132f9ad1",
|
||
|
|
"indicator--ddf58281-6385-4ca8-aa18-d49692b94b5c",
|
||
|
|
"indicator--e6f8c491-669b-4d03-b88a-13fc6bef866d",
|
||
|
|
"indicator--b8de6f4c-d0ec-4e01-8023-ec5ff1939844",
|
||
|
|
"indicator--e91b6725-9e34-4943-a4c0-9b9bc5b16a50",
|
||
|
|
"indicator--cd3eaf00-ac73-492f-8593-6cf8fe4d14aa",
|
||
|
|
"indicator--22832e8a-0183-4398-bc63-c7940e6dcf76",
|
||
|
|
"indicator--6a196768-a8e8-41b7-b346-3235e91a7907",
|
||
|
|
"indicator--998ba2ad-d2f5-4bf1-bbf0-0706d6535a74",
|
||
|
|
"indicator--064f2e03-a486-477f-bc65-f067c58ef402",
|
||
|
|
"indicator--8c15320a-f5b7-473c-882c-1437c9d0d1f3",
|
||
|
|
"indicator--654b072c-7b63-4cf1-b3ac-e58cb06e4cab",
|
||
|
|
"indicator--111f372e-9abd-49fd-8d70-fc48a3aeeced",
|
||
|
|
"indicator--b4c7c756-6a07-4b9d-94a8-8a1a0904d96b",
|
||
|
|
"indicator--cd4bd011-b36c-4f41-ab84-e01433fd073a",
|
||
|
|
"indicator--8c53240a-5ad2-48e1-9e8c-ab58512ba282",
|
||
|
|
"indicator--d2cb2a5f-d1ed-4f6b-a906-78fac522f634",
|
||
|
|
"indicator--ef6b09fd-713d-4bd3-a984-7062eb087ffe",
|
||
|
|
"indicator--d62ae56c-57b7-449a-bd37-eecde2a695e1",
|
||
|
|
"indicator--1b16256f-d498-4f10-b552-093721de445a",
|
||
|
|
"indicator--787ce7ac-c353-4aa3-b186-0d4116356c32",
|
||
|
|
"indicator--98303af5-dca7-41dd-aff2-3181f3c27541",
|
||
|
|
"indicator--d25fba34-d24d-4f3a-9f04-72144022fc43",
|
||
|
|
"indicator--5fae54a4-53ff-4a24-b5dc-926db741fd17",
|
||
|
|
"indicator--7597c3b3-04fe-43a6-8b9a-145ba0b6308c",
|
||
|
|
"indicator--7566f537-7af7-4b65-bd97-9b46a5db1ec8",
|
||
|
|
"indicator--d3d28ccf-73fa-402c-bbc8-07b5a5815b8d",
|
||
|
|
"indicator--1239a003-4da1-4285-9fbb-c202988b4e8b",
|
||
|
|
"indicator--c9640f90-fa75-4d5b-940d-751e998c2ff2",
|
||
|
|
"indicator--cbdf683b-c35d-4530-8b2a-c1b241613010",
|
||
|
|
"indicator--84dd03d2-9861-49b9-8656-d5c7a75b9417",
|
||
|
|
"indicator--568017c1-23ba-49cd-a1b0-ae868f340990",
|
||
|
|
"indicator--ebf51b1f-9da2-4805-85df-bb738126de39",
|
||
|
|
"indicator--1d7c2747-1057-4d5d-8fc8-f7b06203af09",
|
||
|
|
"indicator--8d662ff0-1226-4d15-a088-2492144ecae7",
|
||
|
|
"indicator--d7339a52-e31c-46e2-807e-c55b6b5ee29a",
|
||
|
|
"indicator--0a0b59c9-bfa4-4fdf-86bc-c0708161ff92",
|
||
|
|
"indicator--881912c8-0ac0-4304-99a6-17b97a2fa590",
|
||
|
|
"indicator--f9f0aef5-fca2-4d62-8a2d-75cc9fd7d8e7",
|
||
|
|
"indicator--69804039-165a-4dd3-857a-bc045136b05e",
|
||
|
|
"indicator--e71de35f-e81d-420a-b875-3878d3a58534",
|
||
|
|
"indicator--8510b1eb-31d7-404e-bc51-2ad8cdb36a55",
|
||
|
|
"indicator--ec3bcf04-fe24-477a-8689-728e3c296c1a",
|
||
|
|
"indicator--bdbb8420-c3ce-4dd1-be7f-db97b004313c",
|
||
|
|
"indicator--7644029b-5da6-4dad-83de-727b5883566e",
|
||
|
|
"indicator--99a4dfd8-b6f3-416b-8c25-0a2111419ebf",
|
||
|
|
"indicator--f259774e-c6ec-4c61-87af-f1d4a81ad956",
|
||
|
|
"indicator--69a500e4-2780-409f-a247-e7a1fc4a211b",
|
||
|
|
"indicator--3caca8ee-234d-489e-a1ea-f884645fa14b",
|
||
|
|
"indicator--c7e7a832-1f3e-439f-9322-4f381fabf57a",
|
||
|
|
"indicator--d9495704-a5f1-41ed-89e3-9fdb84e23612",
|
||
|
|
"indicator--e4713b48-7de6-43dd-89d7-12b9ec7788d4",
|
||
|
|
"indicator--ae3e09b0-6322-4a4c-955b-86d72779211e",
|
||
|
|
"indicator--f5489ed6-a4c4-4a85-be6c-9cbfed8f4114",
|
||
|
|
"indicator--155f1ebb-04c1-484e-b0be-d24d0436afd0",
|
||
|
|
"indicator--cf81ca3d-94c3-4c80-86e5-c8fd37f191aa",
|
||
|
|
"indicator--f1cdf9a0-5aaf-43b6-81b7-48047b78ab3c",
|
||
|
|
"indicator--a789d1d5-cf40-4617-a155-877946bf0247",
|
||
|
|
"indicator--393ef78d-f287-473d-ab6e-1e6b3608348b",
|
||
|
|
"indicator--183d363f-a857-45e9-be65-39ba2f50dfe2",
|
||
|
|
"indicator--fc0afb69-f8ac-4851-93fa-6248188280b5",
|
||
|
|
"indicator--ea8a4853-4429-414e-bf79-b17637578bd4",
|
||
|
|
"indicator--b5b724d7-2a65-4557-a729-aa400389e240",
|
||
|
|
"indicator--a28bbd01-f8f8-4239-acb9-e66cc0eed4d6",
|
||
|
|
"indicator--767b701a-b0e0-46cc-901b-36537309f001",
|
||
|
|
"indicator--f2c6cb08-bf17-4bf9-b5ba-be15373c2b34",
|
||
|
|
"indicator--233d8f0b-fbae-4ef0-884c-411add668865",
|
||
|
|
"indicator--06257491-a7f9-43d9-89c3-be55861df3da",
|
||
|
|
"indicator--ae5188f9-6da5-4f93-bf59-c86442170f24",
|
||
|
|
"indicator--99156bfd-2c7f-4e41-8573-55c2d5d25639",
|
||
|
|
"indicator--845a7dad-6067-49c3-a267-8b59e15f840e",
|
||
|
|
"indicator--dc505650-c9c1-4cc3-8404-261e5d468d1e",
|
||
|
|
"indicator--07385e0c-7b5d-4445-ba89-e1e87d09e7c5",
|
||
|
|
"indicator--e0f7e3c3-7d74-4da6-9805-496653647642",
|
||
|
|
"indicator--3907c569-37bd-4dbd-9660-a8bcc13b12ac",
|
||
|
|
"indicator--4768ff61-76b0-4771-8cf0-c5594bcebcba",
|
||
|
|
"indicator--b4225247-7d34-4366-b455-9b77c2e97165",
|
||
|
|
"indicator--d63d4208-c2a8-4838-98a2-3de5582fd761",
|
||
|
|
"indicator--af55ce12-4961-40a7-b3b2-627e90c37491",
|
||
|
|
"indicator--5f2815b9-35c1-432d-be41-618f6d7c7861",
|
||
|
|
"indicator--921dee96-2b36-4716-9e82-8dd9ee8892a0",
|
||
|
|
"indicator--8a177eb1-04b4-41ed-a65f-0a16eeb5af11",
|
||
|
|
"indicator--e6f27b8c-a39b-436c-9f9a-2ab7b431ce98",
|
||
|
|
"indicator--1ceaebbb-19a9-430d-9d8a-2b7e159fc3bc",
|
||
|
|
"indicator--2a900208-51ed-4c47-b9d2-b9eabf71dcd8",
|
||
|
|
"indicator--8b0d5fb6-4e26-4137-ac14-79a25193b7cb",
|
||
|
|
"indicator--7348c48d-0a96-4794-bd84-017007f189c7",
|
||
|
|
"indicator--14b260e9-3b60-4df1-bcff-ea0dada2107b",
|
||
|
|
"indicator--d4c68ea5-bee1-4286-9355-e03a3926ef0c",
|
||
|
|
"indicator--c6906a85-9282-416c-b30f-af80e7a3b5d1",
|
||
|
|
"indicator--2d9edd4f-ee5f-4118-be80-e5e1ca3697df",
|
||
|
|
"indicator--743c92ff-38a9-4e94-9e87-2b071e2b0131",
|
||
|
|
"indicator--9916651c-4792-4a76-b43e-f276daaee7a6",
|
||
|
|
"indicator--acec9f8b-843c-41f8-90dd-7f163b3fba56",
|
||
|
|
"indicator--8db0b118-31ea-43b8-9deb-57be04d70b31",
|
||
|
|
"indicator--bbb26bc6-17c8-4501-b367-eefa3b8f2f2d",
|
||
|
|
"indicator--c6bc771a-a7b7-4e6a-acf3-cf9da02129ce",
|
||
|
|
"indicator--c93985a4-2f01-4151-9c71-1f2eccd9c447",
|
||
|
|
"indicator--2a82fb8b-fc5c-4723-b2f8-1603207c0e15",
|
||
|
|
"indicator--66d266ca-4a72-4ad8-bd67-c82ed7aeea4e",
|
||
|
|
"indicator--36b88384-85b4-4874-8927-d405af612d42",
|
||
|
|
"indicator--16069e44-2f4e-4543-aa12-8b2378103e6e",
|
||
|
|
"indicator--f795e57e-b763-494f-9feb-27a262642f76",
|
||
|
|
"indicator--3c6cee81-c2d1-470b-aeb5-b90e189ec2fd",
|
||
|
|
"indicator--8491b2b1-a960-45ce-90f1-bcce8a8e3097",
|
||
|
|
"indicator--f96038d8-9c5f-4795-aa9f-f78c4b125389",
|
||
|
|
"indicator--8fe43778-9ee2-4e65-820b-3dc911a336ca",
|
||
|
|
"indicator--818a2e36-a1f5-43b5-b7e2-02566d40e323",
|
||
|
|
"indicator--d25818f9-aaf0-483f-8fe4-a0f9373ea7fa",
|
||
|
|
"indicator--48e9b9ed-aedd-4096-9fa6-bba86d2be412",
|
||
|
|
"indicator--1d77fca5-7dae-48c0-a079-548dc83d9e96",
|
||
|
|
"indicator--8e4e9026-7d5c-419c-bde6-ef554b8384da",
|
||
|
|
"indicator--73e53ff3-2753-4ab3-b499-abf52f304447",
|
||
|
|
"indicator--a792c20d-c688-4b68-ba94-79fac6b2336b",
|
||
|
|
"indicator--b00e0cd8-dbe5-4995-8ef2-96c601a5cb3c",
|
||
|
|
"indicator--a745813d-af25-4837-a765-e07782131439",
|
||
|
|
"indicator--2f5844c5-0570-4179-8351-fff578942cc3",
|
||
|
|
"indicator--7fdb018c-2714-4d2f-b3c6-d81f9619fc88",
|
||
|
|
"indicator--90ee3cbe-c163-47d3-9ec7-088a5cd0c80c",
|
||
|
|
"indicator--33ada685-fb52-408f-8389-c240b7638bb9",
|
||
|
|
"indicator--d901e97d-6053-4666-8c15-5e9321f159f4",
|
||
|
|
"indicator--f3342206-5508-4229-b82e-d9649457f73d",
|
||
|
|
"indicator--d5c4524f-7e43-4166-97f4-0f1e754dacfb",
|
||
|
|
"indicator--13ac06bc-8f67-4b62-8bc7-44bb4ca98c87",
|
||
|
|
"indicator--9b06be9a-2dcd-4ba5-b8a7-6fea4f29baa1",
|
||
|
|
"indicator--8d3879b0-97ce-48b9-853e-01f25750ec65",
|
||
|
|
"indicator--9a3b7f64-f368-41f9-ab43-b16eebf9b71b",
|
||
|
|
"indicator--66d0852e-fdb7-45d4-b707-b92950e4647c",
|
||
|
|
"indicator--f62dc848-59b8-43ab-a6b0-3ee0f4efa0a7",
|
||
|
|
"indicator--973a1f2b-90bd-44d1-9d76-118952a1203e",
|
||
|
|
"indicator--e5e0e709-9b88-4062-b33b-4e8716872a42",
|
||
|
|
"indicator--9d356428-f136-4dd7-bce7-1951166e2bb4",
|
||
|
|
"indicator--4abf968f-a93d-49ba-a942-af3784c93c35",
|
||
|
|
"indicator--a7e0ef50-76ab-4a5f-af2d-91ca99612af9",
|
||
|
|
"indicator--cc1af7fa-7487-43c4-85cb-15a12a958c78",
|
||
|
|
"indicator--c7bd1609-1e5c-42b5-9893-01aa459a8b3a",
|
||
|
|
"indicator--6f8d24e4-ee76-49d2-9e28-7cb5afc60cdb",
|
||
|
|
"indicator--3fbc0932-a03b-4e55-a58c-ca81592cd10a",
|
||
|
|
"indicator--a0b205eb-aa8a-4dff-8898-4c0f54b62be0",
|
||
|
|
"indicator--a450d46a-0e32-4fd2-b8cb-3d6ebcf19de2",
|
||
|
|
"indicator--134880ab-e112-47a0-8946-f3c3a1eaeb28",
|
||
|
|
"indicator--3a455b2e-3f2c-47c8-b1ff-8a28960c53f1",
|
||
|
|
"indicator--53d1ad70-86bf-43d7-8923-63de5d69a1ba",
|
||
|
|
"observed-data--b6d65822-b473-4c63-8cc1-46411d0afddf",
|
||
|
|
"x509-certificate--b6d65822-b473-4c63-8cc1-46411d0afddf",
|
||
|
|
"observed-data--dffb8017-a867-4f90-8bee-b12a8af9601e",
|
||
|
|
"x509-certificate--dffb8017-a867-4f90-8bee-b12a8af9601e",
|
||
|
|
"indicator--6d362e71-48a6-4d5e-8ab2-9612b39b4fa8",
|
||
|
|
"indicator--02a8f00c-0e82-4745-89f9-65d97cfb2dd4",
|
||
|
|
"indicator--3d9a86f4-8fae-4f23-8e73-79d81723bee3",
|
||
|
|
"x-misp-object--33fa49e6-b824-4bca-bf34-40d5f3337d32",
|
||
|
|
"indicator--7b35a34b-1cbe-476d-8897-4c85932981c0",
|
||
|
|
"indicator--dd7d9fd7-261d-4a13-adc4-74783b9d4174",
|
||
|
|
"x-misp-object--07c2b4fb-e9fa-406d-ab22-73500f42ad62",
|
||
|
|
"x-misp-object--2860e27b-7f9e-4990-a6b1-a346e01febcd",
|
||
|
|
"x-misp-object--12a41e75-3b1c-47b1-96be-8b682d1ab61d",
|
||
|
|
"x-misp-object--bb8398ca-cc8b-49ae-90af-4bd656a42d62",
|
||
|
|
"x-misp-object--9c105266-e7ea-4c0e-9808-131fdb64a474",
|
||
|
|
"x-misp-object--a965524e-c2c3-460d-83c5-a17c02d908a1",
|
||
|
|
"x-misp-object--5d1dd2a7-a140-49ca-8ba0-bca1be214c3b",
|
||
|
|
"x-misp-object--749085c8-ef1d-4a2a-a8e2-596a8686b76c",
|
||
|
|
"x-misp-object--53b00fee-f304-4f36-b433-52960f0aacee",
|
||
|
|
"x-misp-object--619bb4a2-cc96-465c-aa93-73343347555c",
|
||
|
|
"x-misp-object--dd44833d-e39b-4c7a-9a5d-620cd2f0a3f1",
|
||
|
|
"x-misp-object--cc41003e-3856-44c0-aa7d-2286fbd94b05",
|
||
|
|
"x-misp-object--74b68823-451d-4d5f-be76-2a5401c527e5"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"type:OSINT",
|
||
|
|
"osint:lifetime=\"perpetual\"",
|
||
|
|
"misp-galaxy:mitre-attack-pattern=\"Code Signing - T1553.002\""
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--fbd02e8a-e056-4997-bb91-993e8eb46dd9",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '05702651317bf6fae257404a5c038ee3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--d43a685c-be11-4d6d-bacd-14d307a658ab",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '82f6e323940227b1f081f66a53811a315643fbca']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--9a5faab9-e80a-45b5-9be7-3f8b89c2e933",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '209e3972d776e794edc5fcb6c582b14fec5a04ed3c4bda19df0ce4b44062e35e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--d5bac5dc-2cec-4581-9f5b-fcc20bffb34f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '47506e81a931712c01a53405ab8b8378']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--72de4681-c538-4035-adc1-6616770e5cb9",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c206db80f2fffc2bb57299b0b128ad4cc6d509f5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--728742f4-5a0c-4aa5-97a1-c3c376975b95",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e617910f761d6629eb2b68a011e80e3e867edd29dc9664972db17854824a4dae']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--98864332-38bd-4cc4-be78-7f771192613e",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'fec5267228be7e328d6bc71bef622526']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--468c5325-b81c-4b6b-8edf-ffab23ac82a6",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '8b1bf595d16440eedae9865ed106a0e2351b31a3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--4d56e4fe-f521-43af-92e9-a2ae90979d32",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e21085553be3e83f3ef0e21cdb25b75b61e1b45f15fdf3a01d26a6e3407e5de0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--df9cbd45-1f81-4c3c-8e8c-c16744af9e10",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '49a5353d5f6975e302b612bdc02c287a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--7ef07827-afcb-4b67-9061-d5de3ca84cfc",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'cc10b9140b6b39ac88823d9c399164eb2fa76aed']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--ad2bbb2b-d99a-4e79-8345-4a356eb8f001",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd161c537ab0b22bfb14876e4000aaba9ec175fd904e5be295ee017eb49dbc9e3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--4ddae871-b956-496e-8b95-4060df7d3243",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '3e87597e474483fe8658b76c22c5c4f6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--34126408-0d70-41b7-b6f2-c5125725a3b3",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '14a7d81dbaaa7ffbdb2a4bc7bcac92f04ce64d2d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--729cbc5a-c9ac-4fe9-80dc-bc6504f8b4d4",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '64c932fdc81dc33d9932cd47c8f7ff703877283e4cf438445ec5bdc89ca7a433']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--45176f72-71fe-4913-ad7c-d1f4a3601994",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd237e9161fa0566d6c2593e50f3703ce']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--a7431089-a730-4c28-b470-027cd5a09439",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '36b0abf192005c8c5a586745cb5cc57bcbd6d2c9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--1db0fafc-14f7-497f-a3cb-b0cd08c111b7",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7e414e667aa84c6dff60bc5329c81d889d9fc029cde8530e152a259feb27d141']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5f1a4895-1018-4c50-81e1-73b34623e3d9",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '41084089d5432ebcd2433d5a3bccc497']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--ffa40f70-69da-46e3-97ff-00ed20543beb",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f8933b53c5daa47eecac684d5daa45d25da1f61d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--da780a2b-9e71-4dd5-b508-1ef72cb7ccd2",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1c2d6eff8067f8d98b9fd494f2690249c82bc38efa578de87bd0d0ceb3145d30']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--7d6b07f8-1fd4-4c02-ab8a-23db4d70e634",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '3664013017b10f011c8542452eed3f69']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--e06b48b8-2869-4241-a627-fa2b44333efb",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '73b99e5ce00deb99aedcb67c78526e9380ff800e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--1b06f316-8823-4a6a-b232-f1fff4f90ff3",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3b8eb47c18d2d930608cfa29d36458dd1767790cf2699fb91319893adf118f5d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--d01f1610-5aa0-420e-bdf8-3513c5217ab6",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'e37fee9317b13115f1c35100dcd0d277']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--ae1dc9f2-06f4-4c3c-a793-5d0f8d3f5b32",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '66f69bef1bcc54ff8bea2bf7a84ea1dab5320f6b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--52bb2346-2890-4770-95fc-f50dfc5a2f3a",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9939dcc9658226e51e72f356000fcbc36d6f1193accb63ec5e69df38bccf66b5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--04ed5798-7785-47cb-88ea-c6f7a3b43365",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ee57d31693383b097cc4045e69fab785']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--991c24f5-a93c-4687-82ea-b1c1bdfb48a8",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '0acc3bc8c054966a393f9960087de4899d27ed13']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--bb2b82bb-81b8-4f9d-aa2b-1caa8d839558",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7e8ba9d8352073d0fc0958ad128d226a6a902625d4294bfcb44292dd8b4ce547']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--72fdef6d-4cfb-4dd8-916b-1cd82d05eaff",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '15e4e6eefba37ed2284259ba389a085f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--c4eb5ed3-fabd-4fac-9bef-09f174988b49",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '5872baf48422cf13e210cf972c3cfa6a659c92e7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--eaa5fb46-9f13-475a-8bb2-12366a486448",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ea81a02e4148a8fc37040a46d5576812e02bbf2ee81a05090a205d9b4c862a69']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--837622e3-49bc-48df-a9f8-c5edd9acd9eb",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '91496e20c66acff10bd63f3ef7f2275a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--77b670c1-17bf-4860-969e-fd9c3fad18b9",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'd467d025f44c1fafeb259cd2bc8969cf51b6f56b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--433614cc-f300-4909-a133-a6541ab9a7aa",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2e84bd0d6ea996bef585e1301cad86ed09e1c5241c580d51e61b005574acd0ee']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--93cf1e36-32cf-46d9-8720-081e2885e654",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:37.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '1047c3a8d1fc9384709e6af1a4b1a465']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--d77b5766-7d78-4a62-834e-d3653e4a5545",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'aed8bda46b4d7ed58fa8ee2b9c396f935a0f6fbb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--866158c6-dbe2-45b8-be60-e71727633ca4",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5225a72bd02d1564c5996e692ecef2ef2565b154512697be4399bf5fe66c150b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--2e11aef4-709c-4047-a7b9-d42d24caff80",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'e6133044d743e1a54075938487208d74']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--df26a25c-21de-4329-a1e6-222f3f90a768",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '550ca963c7b03fa3bbe19043f9e641341730ffa7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--42301740-1460-4294-83fa-b1b309b16b8d",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '00ab2c91c2b11c95776b602c499c51a92901d84834ff70790e4807431ac8a14d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--e48d11cc-42c5-4457-9236-f2848af17df1",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '06d2af152d01a54489706b36e5311e6e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--931d4e0a-6f15-468a-8f41-ffa19277a7ae",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '1cfdace76cd09e3b24912fd26c8d120bb819ff59']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--3dd35274-e0dc-44a9-9b3e-deb8bd5ee6e4",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5b36d9743cb3cd45e1e1937e2c181d530362c2847397b14a8f1b5ff3d7d03907']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--4e5d822b-6f58-4e36-bea5-109344bef7bc",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'cae5aefca53b10a8184ee36d6a1f0073']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--f0550ece-389f-4313-a621-dd5d77448146",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '8ad44f4d0f5aff773137ca54cebfdc16023de9c3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--a984b6d1-c542-49fe-9aad-f62552124c36",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0c3e0684911c9470ae4b049f08bd6adc5ec3e26633712c2017564009f6941302']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--02296fd1-69e5-4e2a-b33a-42ac8d74e044",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '2fdd15d7c2760895caace455fe40e17c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--eeee7093-3d0a-409f-b278-80a4eaf13633",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c204163c64637996b4cdfb4ce96d113cfc7f55db']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--c23e2ac8-6bcb-4680-80cc-b51516758d35",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'bfe369bd0505438602f1737cdd6bcceb9dd0e30b6f3f1887959162bae1b26d33']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--d20450fb-1c01-4bda-a2f9-7a53fe728a59",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '855923987dc161b425b20854dada63e0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--39c981f8-6ac6-402f-91bb-d68c0d52d4cc",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'd0d4c4aefd1a097fabc6f0ae2d6a7d4e1238cb81']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--7072c12d-b217-4291-8613-e480a9c58543",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8173ed5fab1a9cba435cdff7e1607aca2b77538abc55882a325075f38920f6fe']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--bc86baf0-a9a3-443d-9ae3-287e9bc06b8c",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd33117d407506fc1c98f966cec739db3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--38014cc1-e7fc-4f64-b1ca-7601c2c44226",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'd8e456b05214e33811a28edfa60291adf12d8fe3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--e577dcdf-b5d0-409c-8993-02f5e4fee09d",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4a1552ac82cef02b233a127f49cad6dfd66496840a6a98f87d259725924cf7df']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--7de19c8a-5971-43ee-9195-519ea5d64f09",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c790f23d515719c33eb60b15e26eefa3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--d78eb638-33c4-45e2-bacb-f064d75eadb8",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '03eb899c0561872628b2bfd9a8a5fa25b0626881']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--765f8139-c6ce-4242-a82b-ff531784b0ab",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '24f52e6e0ca82e4d70016c047cef45ce9d361821e81d91f53558a01fc7c0fbf4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--72a39535-7aa5-4863-a227-16c89b11204b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9b2caf9ebabbb66d36445ab7f039981b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5bac6387-bb42-431a-abb0-9782f71081ef",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f6d8dfe25b746495ca50506e2c498078e8f23b48']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--76010167-d214-486c-a001-b82078bab4a2",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0ae64d6be050e6b4a2149dbbad3cb4409d58b1568f5d76636367112511afe78b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--6877c9aa-3394-4c2f-9dc8-5ac073ec8420",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '32488f899972b1eeb2ceca945bed6ebb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--db345180-2f84-4d37-b8e9-638b10e1ed66",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '41e03488507a6b0ab4bad0ad80e6862e0d61a455']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--4645d92d-7c53-48ac-be0d-fef1f51500f8",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a797f33b6e963027fcaab61e5599fc7e5e74a0f81d88280f4969e8fbe8588d91']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--7df10f36-f63f-4945-8927-fb3381ea6d0b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'b7d3c9f292d1d30962aad053074fb3fe']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--71f50822-822e-4275-a99f-5aecbe73e4cd",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '689f864ec66a3af90a6df5b304011a36d94058f7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--72e9d5be-13ee-45e4-bcca-5f1790f12ec7",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a2e2c8c6f5b813d2b1fe45ab11145750e48a47e451db4f1a4f1840dbf1698852']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--f76abded-4e36-4ee3-804b-5787be608de3",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'fb9935eac0da8fe7d6a3ce68b7f5deb0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--f0daf6da-ae05-41d8-b2e3-76bec9452b24",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '5c38bd09a256398361aa68acce291faaac2456e7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--8447f2cb-ebb0-4ccc-ab9a-1f650796efd5",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5c1239215b1663682727b5b333a393cf1fe7ed025c9ab643cb9cfaa9515227ee']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--2e533235-93ae-44ce-a715-8f5f258c5643",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'f0e86731b67486d74546b67f7fed1dc0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--fb8098fd-18f8-457e-a69b-272547907f7e",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c8ac2d7e1facd1bb7735a54d25d1a8f4a333305c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--816f243d-fd1d-4a4b-a65b-e6e510aad265",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9c03bd8bdc7cc3ab8455b5ef8f621a6c134b3a511db6b9aadf3353300ef3ea9a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--cc7ee77e-860e-4808-999a-6e47c1a959a6",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '6d94828874a7b412e3091f1569882e56']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--87f6eb41-5239-4875-a820-714c64c3b852",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'd81eec6874d688d34c49ac5e2e9b6c05163578f2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--ede72a3a-85c4-4841-9a46-419ca4e200e9",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '72c6e353dfd8c22b58f8f51a5afdaf4f60bfc0eac296aa057aeaddc4e4c08308']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--6d0df349-997b-4567-8d49-f6db0f336563",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9dd2995169dd9786c5423d0f11df8acc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--c94077b7-93a6-4585-a1e3-a4728fe8c4ae",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '0026e5363792a0cfe43e4ec0bb044121c9cbbbdb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--9ab6cefa-0d45-4636-872a-c1503da8296e",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '06156e11e9e6d07670de6b2e247a57aa84a1f050ad9d5a0b4071f29ad8103acc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--1f38fa73-c7a9-4588-a53e-7d51e64786f4",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '96e232f65947849e320a9c298b1bc7ec']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--321c121a-8076-450a-978b-62564290e32c",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'd967c4f506de490b88929adf06f922f3e54db1e3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--cc5ed150-1ecf-4655-a4ef-e11bebe85bd9",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '80e8d33175aaadd4d40f1bc323dc370ea90c5c05ee09cf3f833c45de5e6c98cf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--55272813-1710-4646-96e8-4eb2a996de15",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '1e350897d2b07f36d02518ee63f13f55']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--192f7042-397e-4a6a-a4ec-43ffbda0bbf4",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'cff941405b63f8e6dd2419965e89ee216fccc425']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--e8699a03-5bf8-4d97-8f7f-9847512b2c0a",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b1efb69178dc258d9caa7bdf4b4faeac9841abf46b21660c18e5d8163f8dcaca']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--bc125b2e-eec6-4731-a5e1-b91517013231",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '1d0aba89fd0f128280af4a098a70ca6e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--a5dbdf3e-df58-424a-afca-957dadd9f8e4",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '1dc4c351d7292a15c2e515ac5e2ef1cb8fc2e9d2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--bab29105-e585-4806-ac82-7ca08a1caab5",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1c3a34ed9129c3065316d14dcc22ba4f3d8cabd8f62b59bac36848056251670c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--2d204cd7-881f-4e1d-a812-fa2cf011fd8c",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9a646972747009de1d654d0b39905f5b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--26686687-d818-4fb5-91cc-c7d6fe8e96a5",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '64fca043e23ae13aeaf94e033c94fa18ca7c8d7c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--89f2b4b2-5d6b-4682-bd81-f79dd1d4061e",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '789daafab5b85a1d1038ff484b7acdd14e1a548d0224f3a723b52d2227534d23']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--f847f1e3-280d-4349-b0af-020b84fcc7e6",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'f24b438308fd1d9fd2dd193f608702ff']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--98858b43-d45e-4162-8d17-032f315e2332",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'ac59ca5facd4b3b35fb2b8a6c100e4a9e99203c9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--231cbaf3-6cc1-4314-820c-5f2e2d5276cc",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '99f20d8f944d2f03fbe1198e30bd9380b1cf644b8fee1b6d856debfc62585eaf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--1fa51375-30e3-4774-ad53-74c1e97ad122",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '04d63945de33984758b4941fb0152c49']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--956a36c8-c653-4bc2-950c-8f40cb9e9b10",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '24886fc93ad70b76993f93577222a5d356458a16']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--dad59b04-8802-4947-be2a-6b1f5505ab33",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6391ef608f639ec28a52b3063c45f2834fe8dfa668a7ed27ca1b91ec2e771a40']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--52c4c62c-bb36-4238-80ff-2aeac511a519",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:38.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:38.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '6eeb84f8766f4afa7d0751c1ed379580']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--4a296fa2-d094-4bf4-82c3-522d2f1996ce",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '806de96ef89ea05f571ec58bca3f244951f0e95a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--d5fd6e34-8d5f-4bc9-94b1-f3a812cde688",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4880fe56c299754f37bebe214fe49b803a9c4b4c74b79b261f72c20980ccd12f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--742b7244-95c2-4149-a029-0e19f3972b4c",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '86528f18ebd46d1e7588f4d50503136f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--708dc6d8-eff1-4e79-b9ab-9f487baa0ea0",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a9fafae07e1c0102268e8e35b7b5d5639aeccebe']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--bcdfd47b-3bd5-477a-9f6b-c882d5285456",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9942e5320b02e30e0e311f55343f6370a109ba9876ade08bcfba5cdd6fbd3ea9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--c52eac6e-d650-4bbd-9044-f8d7923d4246",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9c107d1d8315a742f6d65da3fdca9988']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--21e007de-1212-4eac-bb3a-63ce2e6f44a0",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '4e1f1adcc8d8e6553b74b023cb432a0d852cb4ca']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--11999b24-e9a5-4947-9082-f2c90e4514ca",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5e1ff7ae123131cc9ff1311bbf1e2fdc85672e74f7a6dd8fa42a901f75d33f71']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--4db7fd29-db36-4644-a12b-b97d56dc83c4",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '3d4a46c098b9a75a5967586701e4e139']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--61888948-c36f-4132-85c4-5df1f4c92b73",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '562feb9bf632f8267e5515c157a0bc5cbc2dedfc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--1bbb562e-726d-461b-b1e7-78cbe34c4f97",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'feca6686e8c5438ed0b3e1885eba3c2638d8efdfaf01421954d70f8acca4bcc7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--9eb18fcc-8902-4254-b77b-f698a98f3783",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '109abee33c4cbbfcae4a821062aa7d9a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--ba54cd5b-a317-4bcf-877a-47e74b566291",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'bf215d34bcbabfb83a054f34ca0b77491a9b41f2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--ec2b9c06-0d7a-4d95-862f-9f8dc87abd1b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd7f66d9fde9804a6aba52f43e0496dd4b79c60c07a605855d04a151c964f5e89']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--64a92494-fd19-458e-9784-6d837fac26ca",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'dec0a7dedb470b177ea6e7e0463c099b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--be8ee22d-a1a6-4e91-82ee-4e95f961c8ea",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '6faf49ab963460a39bcf79837e777a4cdec1f415']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--01b395ad-bb94-4373-89b4-a9919588bc12",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3a871d3c8189bab532b60f669a70882bc266b94552bc423349675c4b154f4a8b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--585f2a63-5329-40f1-b933-cdc1d06fabd5",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '252f3b742f7517874a156fce8092f2ef']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--473289c3-a726-4b91-aed2-37e0e1294406",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '196ba54ceffab10cb7dbdf883c5cedcd4658cf75']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--6d401bc8-2ca1-4b05-94b8-58df0660c99b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8845f667640138203e7cca5b8eceee3db249f796ad2d27c2d47c01c10155aaec']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--c4af6882-b837-4fd0-a450-8b67a9584629",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '28e10dabbdc0e39d3ca93613c4a8cedb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--53017921-25d5-44dc-b4ca-06b1c6b07347",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '2859aaa25554e147f9ded8b9f379f9c23af21992']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--7758c370-76b4-4155-8a81-c927fe15d5c9",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3f525252462f335576f1af8b8f18accd82263cea7de09153ae554fa5e3f2969b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--c19d4afd-ad53-42a2-9e23-e0b26c0e110f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '853aa83e547d591c34ab1c266b0f0239']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5847d7ea-8e52-4384-a834-db802f12d680",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '5dba55a1ce3b204c6c31d0645815899ba2af78b5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--674e2345-4ca0-47cc-befc-dca3759f5231",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a9bf82507a849f7d1faea6773965970e263c532cd3d0da2795c68b33fb7c57de']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--8c60df1d-84fc-42c0-9eea-b65b609bee90",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '742042616341e2f6e5aa5e503e33a844']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--67e6c349-1a52-4f13-aa4a-93087ff79f7b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '363ac5ff71875451c544b566988fe8aaf79019eb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--9cad061c-7b5f-4489-b795-ce2fde7f2438",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c938421f625927269a60efbbb697f0a9871ff13f5677fd2c2b133d0dec639d7d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--b56341b1-3bac-4473-8744-4651dd18dd60",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'fd54cddc9aebc9bdc912e248a11b1e7a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--7e677401-da8f-4fdf-b8ac-848c9e36cf2e",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '30cf7b12ab005fa41942efec8b655b140e668ce1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--79fb428c-0478-458c-99ae-4e1bff9556bd",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3d3fa2cbeda66cfbefb9f38007eb35a8c13acc9e2feed5e98c66b4eb987c4822']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--91d250eb-f6f7-4b14-baa0-5f5d191f51a2",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'bf2a68203af83e916cb9996c73794a31']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--3c4017a5-4e13-45b0-95ae-c73d500accde",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c6f8f021757cc17e8681d28b3cef9a46b38874b4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--86565320-ee24-4146-b8a6-0c738c4e2c2b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd667e250aa26fd86110bcf6c44a8d897bae69a2bb26da9de5920bcc90de3579c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--634256c1-47e1-4154-9280-bae90f6af4fa",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '80ad6c1724bae12198102572ec13273a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--f6f3dd31-cb1e-4e26-bab2-2611a9d1baf7",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a72164e6bfb7fd8e23fc3c6c28ae129d71866cf1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--c8359d87-6ff5-463c-b9c0-dc3b5bc21acd",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8f372cff7fefc38c06cf2c3b02996211ee3bf2a623d0f17103f2f0951f80be19']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--d262a13c-4629-43ca-8120-2217b815cc36",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '27b0f3eb28656657e48a64cdbe12fee1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--649ff317-32aa-4ba2-ac2c-e2d6205e11fd",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '719d5feecd85fd84c1cc1ab252afec953452a7bd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--6a247d7c-1721-4ed1-9842-5c5054892b9b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5150fd1d2fb2334f036c9b5b8cc00339706815d5eb811849c263873388a879b3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--7ff8be98-6a85-44fa-a77a-b187b7bf4c33",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'f9fab3ded5d5f44f87411a2adf9b0f16']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--994e7140-9fb3-4698-8cd0-5af31563b565",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '30ab591592d02d7ada3b94c3820ff320c1f343e8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--734c7c77-9066-47b1-bf05-6ca0afde754d",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f37e6bfeb905399493274707a3e244922649617115d20ab0a61999a452469df5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--650459a7-b150-4b43-ae4f-ab199a6ca7f7",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '01bb67548dbbf6227e1fad8170ef4825']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--e9fb5e62-4894-4ab7-b834-f49a77353267",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '3959f0462090d27354b2fed939b09ded26c76696']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--96dab097-43ab-48d6-a693-ae91d4fcbce0",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '51b010d8dc63626f4edb917fc6e0e653f83ed75ab305b67e821a0ad69ea230d7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--ea7bd56e-f0e3-4696-a673-c50ab3cfce9e",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '8461a4a8a97483b4c5821d13460fda19']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--e470b6c1-8589-4b3f-80c9-d02a754c3618",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '5f43a6871bc91c3961bb57eae599fce3ef838d00']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--6807c104-a877-4509-83d1-67f0e3319e3c",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '20c498e0155da1d417b73b85e74df176271f1aabdc5a40a4e10cab7f9683c4b9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--8cc658e5-6f62-4963-9cd6-e603fdd951a0",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'fea083501907ca649fef26d5aa44a533']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--348e9959-337a-4e7b-a96a-b0a5f8e86a3f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '7519ae8d01be4b26e64799e3206700f5f187ead6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--0d72776a-357c-4e81-82ea-7abea49b05c0",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '76e56f9e605ca42c5d4e7b600739db938a3c1225fa2ba91b5913166b48af91ef']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--d1827142-0d9e-43b4-8db2-d7a7fee61746",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '4bd0da68ae035e5d91b3a9961d8f8a83']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--6029a744-5909-47e2-bf6e-4538489e3b95",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '0631b9b70828038194cd1658f7d79f73af6c5cca']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--3efc4c9c-5e73-4b61-a8e0-5ba408b3ff63",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '54ed5a7092bbd2fc0878919eae0393226a424ef71c7128b6233f61d5c462c407']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--aec6cca0-5f30-4f56-8b1e-1637a6ffce7e",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '28d29c49ef05cc1e28f6be8551817631']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--ff1fd09c-086a-4fd2-907c-e8fb132f9ad1",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f6ff7c537718f9dbcbb04c0b127b3e62ba2bdfe9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--ddf58281-6385-4ca8-aa18-d49692b94b5c",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8f08a1d5a8a8bf79e909ee854f991ec58d39419bd40ed9cb4f906eee57f7130d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--e6f8c491-669b-4d03-b88a-13fc6bef866d",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '56f4ccd0e41b266660a4fe57c17492ad']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--b8de6f4c-d0ec-4e01-8023-ec5ff1939844",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '3486fa46061689feb393aae942c119778de3529b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--e91b6725-9e34-4943-a4c0-9b9bc5b16a50",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6f1c577f5c1babb1af7531de78725e56b8ad327fbe239de6be3f3021e74e0925']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--cd3eaf00-ac73-492f-8593-6cf8fe4d14aa",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'bea5149b3474d97fce2a8e2ccfebf538']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--22832e8a-0183-4398-bc63-c7940e6dcf76",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '04a15d21869e63e9dc090d522ea3de05fafb4104']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--6a196768-a8e8-41b7-b346-3235e91a7907",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'bf26fb4d54b2eeec9cfc4b2380d6c8332be086d6b70141d6b7fddab84488127b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--998ba2ad-d2f5-4bf1-bbf0-0706d6535a74",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '07b7da86d2f548d18462f8d6d869052a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--064f2e03-a486-477f-bc65-f067c58ef402",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f9153289b209929130f897ee47710b4c94aa6453']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--8c15320a-f5b7-473c-882c-1437c9d0d1f3",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2f578cb0d97498b3482876c2f356035e3365e2c492e10513ff4e4159eebc44b8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--654b072c-7b63-4cf1-b3ac-e58cb06e4cab",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '521ceeb7f28d79041f7a40211b9d449b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--111f372e-9abd-49fd-8d70-fc48a3aeeced",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '4a2deb334844248fedf1096e5c60403d3c051e68']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--b4c7c756-6a07-4b9d-94a8-8a1a0904d96b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '63480567ae0e726c296eea1ce67bf954bbef26e4d240be3be399d50249fa496d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--cd4bd011-b36c-4f41-ab84-e01433fd073a",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9a6855e90788a87ae5011e6a49c03c97']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--8c53240a-5ad2-48e1-9e8c-ab58512ba282",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '0ec0ac816046165280f7421680d2c6512ecb0082']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--d2cb2a5f-d1ed-4f6b-a906-78fac522f634",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'fc33d0b16986f5db371061041fb8020336f8acb140b2b78109d2499ddcbfecbf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--ef6b09fd-713d-4bd3-a984-7062eb087ffe",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '5cde8d972457f64972076ac3aedb4f5b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--d62ae56c-57b7-449a-bd37-eecde2a695e1",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '7987de800dde487b1678ae53eb0898fe77fbc1d5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--1b16256f-d498-4f10-b552-093721de445a",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5c80e45555802a0074492df26555a438fae50eae55c781dce56fd2dea41d811c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--787ce7ac-c353-4aa3-b186-0d4116356c32",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9e63578df72af11586360e96e65b0ca0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--98303af5-dca7-41dd-aff2-3181f3c27541",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'ba2084afa6825ca41698375a4529d57f24bff7ab']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--d25fba34-d24d-4f3a-9f04-72144022fc43",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '11b58f78eba6d2474179ff79c54678d6c2b1a9811cd1b479ec9e2044ac0cb04a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5fae54a4-53ff-4a24-b5dc-926db741fd17",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'e45dc291484fcb1ff7f180521bc498a1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--7597c3b3-04fe-43a6-8b9a-145ba0b6308c",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '50f30d9cb917c00332dfbd41fde519f8272d1749']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--7566f537-7af7-4b65-bd97-9b46a5db1ec8",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:39.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:39.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd46d2eb0aed018e3cd3e2a86af70e576b46c845f76b5e700566c33b3cd03bb38']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--d3d28ccf-73fa-402c-bbc8-07b5a5815b8d",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '2fea6b9a5f506d4da0496017f8e24b44']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--1239a003-4da1-4285-9fbb-c202988b4e8b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '4f099c816d219596486d1fb3f60476bb20f3e451']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--c9640f90-fa75-4d5b-940d-751e998c2ff2",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '69a905b8768bc00f24076f0baa0845036b2fce519cf8fe72b952a711ad0a5bf0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--cbdf683b-c35d-4530-8b2a-c1b241613010",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '5cd2322f923c18b1aa7a6adb19369d9c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--84dd03d2-9861-49b9-8656-d5c7a75b9417",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '473406f03d0ec1862ec1f1a16e471c1672b79b47']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--568017c1-23ba-49cd-a1b0-ae868f340990",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'da74a8ad5367c24530c162184d7bbb327f3ca415cc5d7fb630ef54f9190ba551']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--ebf51b1f-9da2-4805-85df-bb738126de39",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '30ddb950e896c3f576d2b5fb9c9cb16c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--1d7c2747-1057-4d5d-8fc8-f7b06203af09",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '493aa4118a431b7a25344053fd136b87a3007e06']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--8d662ff0-1226-4d15-a088-2492144ecae7",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ed042baf8f73f631159026ed9bb1369905a7d52fff3cc31918257daee49f6129']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--d7339a52-e31c-46e2-807e-c55b6b5ee29a",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '237dc13ec8ff0fdaaea67d4f43645908']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--0a0b59c9-bfa4-4fdf-86bc-c0708161ff92",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '3b6f650b1b58f48858f7970711868c35052e5480']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--881912c8-0ac0-4304-99a6-17b97a2fa590",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '297b0daab65fb2846095ef82eca7bd5b34b9c759fa58b76c8777a4f6789abdc3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--f9f0aef5-fca2-4d62-8a2d-75cc9fd7d8e7",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '82366db26b8208d923f478090873daa3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--69804039-165a-4dd3-857a-bc045136b05e",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '7d75f820d51ee19c56efa9f0bb9ca025fee0cc0b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--e71de35f-e81d-420a-b875-3878d3a58534",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a0aa66f6639e2b54a908115571c85285598845d3e52888fe27c6b35f6900fe56']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--8510b1eb-31d7-404e-bc51-2ad8cdb36a55",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9b9abffee28e770986521a7393345f45']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--ec3bcf04-fe24-477a-8689-728e3c296c1a",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '30fe9475a0f058ad7e504955794d5c2446680b2c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--bdbb8420-c3ce-4dd1-be7f-db97b004313c",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '997f9d7fb8b5bab8a56a49fcfc9a969e7dcf7c675f08ab21bd99d279ede98d5b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--7644029b-5da6-4dad-83de-727b5883566e",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'bc37863a409ddffdf36937dd4e536aad']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--99a4dfd8-b6f3-416b-8c25-0a2111419ebf",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'b65f8a804d3e87e1ca21ca781f1a0585acab6959']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--f259774e-c6ec-4c61-87af-f1d4a81ad956",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9d123f8ca1a24ba215deb9968483d40b5d7a69feee7342562407c42ed4e09cf7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--69a500e4-2780-409f-a247-e7a1fc4a211b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'f87e162be844afe5c2f859242dc584b0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--3caca8ee-234d-489e-a1ea-f884645fa14b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '3ed80153ed5089deedc935116854f94553bbff30']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--c7e7a832-1f3e-439f-9322-4f381fabf57a",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '55d20e7cdd67a6c8fb4ab813c2c8f799f661df8b099970cab63a0ab9da684b54']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--d9495704-a5f1-41ed-89e3-9fdb84e23612",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0c0a44522c115ca1e0c1b9d966ca7ea1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--e4713b48-7de6-43dd-89d7-12b9ec7788d4",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '81cf3f9280bdcdafd14d31475670261d583ff33c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--ae3e09b0-6322-4a4c-955b-86d72779211e",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'aa9417f58c29e1274f4264819b1af821c02c271117d2fed3293d75d15063775e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--f5489ed6-a4c4-4a85-be6c-9cbfed8f4114",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '7d4cd357dbbc85b0d15d432862cf8ac9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--155f1ebb-04c1-484e-b0be-d24d0436afd0",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c646501127c7ed4e109e6c2b3be0cec9d8574987']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--cf81ca3d-94c3-4c80-86e5-c8fd37f191aa",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '00cb4ba80f7976196a026bee77642020f6384bc61fa7358580431a1c980bec54']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--f1cdf9a0-5aaf-43b6-81b7-48047b78ab3c",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '1bffa320e972102d55652cbf07ab0da0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--a789d1d5-cf40-4617-a155-877946bf0247",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '806cd5fd419239f2f1a635274b1a5b0708431fd2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--393ef78d-f287-473d-ab6e-1e6b3608348b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd5942a7797078d1e822d0ba8b03c110d5b1c6fcad1df0e54f51fc39929cfd9d4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--183d363f-a857-45e9-be65-39ba2f50dfe2",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '7fdfadbbc6bdb4d46373376594fcc65a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--fc0afb69-f8ac-4851-93fa-6248188280b5",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'adb5745282567d8518f59071226aefaeacb9c5a9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--ea8a4853-4429-414e-bf79-b17637578bd4",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0e1638b37df11845253ee8b2188fdb199abe06bb768220c25c30e6a8ef4f9dee']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--b5b724d7-2a65-4557-a729-aa400389e240",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'b2298db0fa50b7e703d3bf4706d88315']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--a28bbd01-f8f8-4239-acb9-e66cc0eed4d6",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '793f1921b6ccf9a7bcfd930bbb762157ee5238be']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--767b701a-b0e0-46cc-901b-36537309f001",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a96b12c1b49a6272041a9ca308b534952c180903da3a8a4444ff8b421b06d983']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--f2c6cb08-bf17-4bf9-b5ba-be15373c2b34",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '24ad69d5a93289c2bc261d2fd551548c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--233d8f0b-fbae-4ef0-884c-411add668865",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '4490133b9f5052448310433d0fe7e5f1a8e70cae']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--06257491-a7f9-43d9-89c3-be55861df3da",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '44a25c84ce4f77bf5d917c8a7db1078b32252c03c70b8e390987eeb368cfc314']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--ae5188f9-6da5-4f93-bf59-c86442170f24",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'af938e54a4992c0f8b3f0c3294470156']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--99156bfd-2c7f-4e41-8573-55c2d5d25639",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'b5397660b28dcec220c0a99f37a17c5fafd109f7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--845a7dad-6067-49c3-a267-8b59e15f840e",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ee57fac3b3d95c4750ffd4e1c4c67ad8dd624bb0ac56304081bc89c7918dfddf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--dc505650-c9c1-4cc3-8404-261e5d468d1e",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '04178f6175ab85b6e9222d866745ebe6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--07385e0c-7b5d-4445-ba89-e1e87d09e7c5",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'ba3d0409653b173e0a24ca1b6d21ca4df9197bc8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--e0f7e3c3-7d74-4da6-9805-496653647642",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '65b397e07a1618b7690e2cb39809ef40dfb7c0f10871e75b69c4669689b19cba']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--3907c569-37bd-4dbd-9660-a8bcc13b12ac",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0ee8ec9652cf49ad5f0090cf3f53bf41']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--4768ff61-76b0-4771-8cf0-c5594bcebcba",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '1cb1a49110df5f962f9f188210686f8ea4a2b98f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--b4225247-7d34-4366-b455-9b77c2e97165",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '481100afc812259da68ba5aa42a92977b2c044175848d8be9f053458658a9e4d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--d63d4208-c2a8-4838-98a2-3de5582fd761",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '61089a51d3be666631053d516ad9b827']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--af55ce12-4961-40a7-b3b2-627e90c37491",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '91b88d281ef983296157f8ebfc73958036148194']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5f2815b9-35c1-432d-be41-618f6d7c7861",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '065077fa74c211adf9563f00e57b5daf9594e72cea15b1c470d41b756c3b87e1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--921dee96-2b36-4716-9e82-8dd9ee8892a0",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ee9554dfb03b3beb7103f4c0429a1c45']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--8a177eb1-04b4-41ed-a65f-0a16eeb5af11",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '14d751e0f3abe7ee56b71ead38a848968026fba0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--e6f27b8c-a39b-436c-9f9a-2ab7b431ce98",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0210a766da3e6d0cecbf166437a254c8ad6b380b077355a027fd0b7e3c2ccc9f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--1ceaebbb-19a9-430d-9d8a-2b7e159fc3bc",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ccbd3a1acdf662c4c556fceada101b84']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--2a900208-51ed-4c47-b9d2-b9eabf71dcd8",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c39214bdc7709bccdb1b08d8379a28023786a1ec']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--8b0d5fb6-4e26-4137-ac14-79a25193b7cb",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a7c3ce181e5c3956bb6b9b92e862b6fea6d6d3be1a38321ebb84428dde127677']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--7348c48d-0a96-4794-bd84-017007f189c7",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '378f73a637d817b4cdd54117454e1f86']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--14b260e9-3b60-4df1-bcff-ea0dada2107b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'b79cc30b4d7ab5de33829187b9a5a02921c0a08e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--d4c68ea5-bee1-4286-9355-e03a3926ef0c",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '26683864b9c90e43de444ca09d5b2806c26dd9402c2010d0799f1963fd584c23']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--c6906a85-9282-416c-b30f-af80e7a3b5d1",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '17c065dc9dbac2ae6ac9ffebcc459299']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--2d9edd4f-ee5f-4118-be80-e5e1ca3697df",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:40.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:40.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '58da844e9fb55bf3540c38b127a0b80726eb26e8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--743c92ff-38a9-4e94-9e87-2b071e2b0131",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:41.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:41.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '36fec39a0f826fccca47e1997239c510ba93861faadbe8292053287ba5ab991a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--9916651c-4792-4a76-b43e-f276daaee7a6",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:41.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:41.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'eb78d87468626115b5e113c042d71cfd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--acec9f8b-843c-41f8-90dd-7f163b3fba56",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:41.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:41.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c38101889356164f60bcfeec7bd6f96c545a92a5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--8db0b118-31ea-43b8-9deb-57be04d70b31",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:41.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:41.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '939294c6593f8339609c4db3b4861289c0612851f1ff43573c03af2e108221d0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--bbb26bc6-17c8-4501-b367-eefa3b8f2f2d",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:41.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:41.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0a8ec56e7131dccb30845dfcec2b2d71']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--c6bc771a-a7b7-4e6a-acf3-cf9da02129ce",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:41.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:41.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'bf9835bd0bcfbd49a100362bafbd530fa58475cf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--c93985a4-2f01-4151-9c71-1f2eccd9c447",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:41.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:41.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '07ffa010ee48af8671fe74245bdfb54d9267aef748d9dc1fc8ca8df4966b871a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--2a82fb8b-fc5c-4723-b2f8-1603207c0e15",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:41.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:41.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '7c13e429c66d923cfcb4b566cac6902a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--66d266ca-4a72-4ad8-bd67-c82ed7aeea4e",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:41.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:41.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '6fdc7e845d597519704aeb78519ec173a6222360']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--36b88384-85b4-4874-8927-d405af612d42",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:41.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:41.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'bcb1d8872831e54a3989d283bcd27560cc12f54f831874162a80dc9dcddf0b39']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--16069e44-2f4e-4543-aa12-8b2378103e6e",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:41.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:41.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '874f08466bb968fbae6d5a628fdb68a5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--f795e57e-b763-494f-9feb-27a262642f76",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:41.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:41.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'e93546c050a53d4a4110d5363de4706230b6ff91']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--3c6cee81-c2d1-470b-aeb5-b90e189ec2fd",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:41.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:41.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'fd9d9624b57c09a3d541e3fb45d5ec95c40276cf5b679980d22c1fd413d8276b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--8491b2b1-a960-45ce-90f1-bcce8a8e3097",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:41.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:41.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '99399d6a9fd3776b0e31fec526ed1e8f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--f96038d8-9c5f-4795-aa9f-f78c4b125389",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:41.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:41.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'e33e91a27de2ab3bcace5fb67c18b037d616c5f3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--8fe43778-9ee2-4e65-820b-3dc911a336ca",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:41.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:41.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7abddcb73af4cc1f3507b9cc87f27c9f0a1000a757f8edf5edf382ebccd6aa7c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--818a2e36-a1f5-43b5-b7e2-02566d40e323",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:41.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:41.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '5f6ae7f3b1878a503e1275088d8695f1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--d25818f9-aaf0-483f-8fe4-a0f9373ea7fa",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:41.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:41.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '1ba228197bef9311df336ab7d698d817e15b0350']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--48e9b9ed-aedd-4096-9fa6-bba86d2be412",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:41.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:41.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '00a2feacd4a14aef32b3c932ab615744ee9ddeb14778ad4fc2377f7fbde621af']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--1d77fca5-7dae-48c0-a079-548dc83d9e96",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:41.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:41.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '22b200bfe65eaaea4ad0430d62a33640']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--8e4e9026-7d5c-419c-bde6-ef554b8384da",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:41.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:41.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '1fa99d49363363255152f6732de4840777204629']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--73e53ff3-2753-4ab3-b499-abf52f304447",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:27:41.000Z",
|
||
|
|
"modified": "2022-03-07T07:27:41.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:43BB437D609866286DD839E1D00309F5 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0d83e654675bd04e92cbaca2086c71d7fe913d230153314f1b3efa695ade77c4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:27:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--a792c20d-c688-4b68-ba94-79fac6b2336b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:31:01.000Z",
|
||
|
|
"modified": "2022-03-07T07:31:01.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:14781bc862e8dc503a559346f5dcc518 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '6773d678404e9bb1a5ee327d949d0e54']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:31:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--b00e0cd8-dbe5-4995-8ef2-96c601a5cb3c",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:31:01.000Z",
|
||
|
|
"modified": "2022-03-07T07:31:01.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:14781bc862e8dc503a559346f5dcc518 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '060e0fcf5b6ad80a19a6b313a3bbea0a15a95c6a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:31:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--a745813d-af25-4837-a765-e07782131439",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:31:01.000Z",
|
||
|
|
"modified": "2022-03-07T07:31:01.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:14781bc862e8dc503a559346f5dcc518 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '064f7feca0f273dd0ee53aa28ad13113a881df8ca4ceab38a32bb80ecc2de699']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:31:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--2f5844c5-0570-4179-8351-fff578942cc3",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:31:01.000Z",
|
||
|
|
"modified": "2022-03-07T07:31:01.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:14781bc862e8dc503a559346f5dcc518 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'a245fd98e41fea0c4d5aab9b81692562']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:31:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--7fdb018c-2714-4d2f-b3c6-d81f9619fc88",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:31:01.000Z",
|
||
|
|
"modified": "2022-03-07T07:31:01.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:14781bc862e8dc503a559346f5dcc518 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '8cb789ded7aff307dfdead1188b385b3616eb248']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:31:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--90ee3cbe-c163-47d3-9ec7-088a5cd0c80c",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:31:01.000Z",
|
||
|
|
"modified": "2022-03-07T07:31:01.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:14781bc862e8dc503a559346f5dcc518 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ae73f41385412f7067c983779695b8ae0e6dbd115eda86f0ebab0a4eebb0b6c2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:31:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--33ada685-fb52-408f-8389-c240b7638bb9",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:31:01.000Z",
|
||
|
|
"modified": "2022-03-07T07:31:01.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:14781bc862e8dc503a559346f5dcc518 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ef2f6cebda2bc246a5a7b1f075202a12']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:31:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--d901e97d-6053-4666-8c15-5e9321f159f4",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:31:01.000Z",
|
||
|
|
"modified": "2022-03-07T07:31:01.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:14781bc862e8dc503a559346f5dcc518 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'd9e0333870206ccc3df48286dc68bf5a35629071']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:31:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--f3342206-5508-4229-b82e-d9649457f73d",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:31:01.000Z",
|
||
|
|
"modified": "2022-03-07T07:31:01.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:14781bc862e8dc503a559346f5dcc518 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '282ae076a8acf28f603170f4fadb5cd91b6554f3a7f85d51337c867bffcaa08a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:31:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--d5c4524f-7e43-4166-97f4-0f1e754dacfb",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:31:01.000Z",
|
||
|
|
"modified": "2022-03-07T07:31:01.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:14781bc862e8dc503a559346f5dcc518 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0258babfdc378c4b5b1953314b0c3c74']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:31:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--13ac06bc-8f67-4b62-8bc7-44bb4ca98c87",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:31:01.000Z",
|
||
|
|
"modified": "2022-03-07T07:31:01.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:14781bc862e8dc503a559346f5dcc518 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '5440caef02e6876be10870c3e8eb51c28d977548']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:31:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--9b06be9a-2dcd-4ba5-b8a7-6fea4f29baa1",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:31:01.000Z",
|
||
|
|
"modified": "2022-03-07T07:31:01.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:14781bc862e8dc503a559346f5dcc518 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd2a88eb450c069e60383427aedd2838fe89cdd317bf7b31f0bb53b07d5813b6c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:31:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--8d3879b0-97ce-48b9-853e-01f25750ec65",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:31:01.000Z",
|
||
|
|
"modified": "2022-03-07T07:31:01.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:14781bc862e8dc503a559346f5dcc518 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '72590816aebb600a08e948873fe8c293']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:31:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--9a3b7f64-f368-41f9-ab43-b16eebf9b71b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:31:01.000Z",
|
||
|
|
"modified": "2022-03-07T07:31:01.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:14781bc862e8dc503a559346f5dcc518 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '84c424fcf6f479dc636c440c37dc6f38a4f7c62e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:31:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--66d0852e-fdb7-45d4-b707-b92950e4647c",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:31:01.000Z",
|
||
|
|
"modified": "2022-03-07T07:31:01.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:14781bc862e8dc503a559346f5dcc518 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f6ccbf0bdec9bd9d18703559d73a3a3610aefc567fdd36294ea91877e7d9b6c4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:31:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--f62dc848-59b8-43ab-a6b0-3ee0f4efa0a7",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:31:01.000Z",
|
||
|
|
"modified": "2022-03-07T07:31:01.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:14781bc862e8dc503a559346f5dcc518 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '24266aca5f80be63b8ea577febf9bc61']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:31:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--973a1f2b-90bd-44d1-9d76-118952a1203e",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:31:01.000Z",
|
||
|
|
"modified": "2022-03-07T07:31:01.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:14781bc862e8dc503a559346f5dcc518 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '6772f18e306f7b948d5875e6704c07c8461389b8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:31:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--e5e0e709-9b88-4062-b33b-4e8716872a42",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:31:01.000Z",
|
||
|
|
"modified": "2022-03-07T07:31:01.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:14781bc862e8dc503a559346f5dcc518 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8080eb57245d7528f7bc41dc2d383fe3b4c3ef97243f8a34a3beba3e1de162c9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:31:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--9d356428-f136-4dd7-bce7-1951166e2bb4",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:31:01.000Z",
|
||
|
|
"modified": "2022-03-07T07:31:01.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:14781bc862e8dc503a559346f5dcc518 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'f05397feba4e5439026ba5b855a149c0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:31:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--4abf968f-a93d-49ba-a942-af3784c93c35",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:31:01.000Z",
|
||
|
|
"modified": "2022-03-07T07:31:01.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:14781bc862e8dc503a559346f5dcc518 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '76068600ea0c1603eb08747150016e805ce74c8e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:31:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--a7e0ef50-76ab-4a5f-af2d-91ca99612af9",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:31:01.000Z",
|
||
|
|
"modified": "2022-03-07T07:31:01.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:14781bc862e8dc503a559346f5dcc518 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '073708f0b80f7921f906876efcd6839cbdb1b81203edc82a5ccbb1fd551e0bd6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:31:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--cc1af7fa-7487-43c4-85cb-15a12a958c78",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:31:01.000Z",
|
||
|
|
"modified": "2022-03-07T07:31:01.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:14781bc862e8dc503a559346f5dcc518 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'f6c28c8fb453d17c857dc5cb3e4db3e2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:31:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--c7bd1609-1e5c-42b5-9893-01aa459a8b3a",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:31:01.000Z",
|
||
|
|
"modified": "2022-03-07T07:31:01.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:14781bc862e8dc503a559346f5dcc518 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a0baf434ea5fca14c4700cf46054b5eef4569871']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:31:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--6f8d24e4-ee76-49d2-9e28-7cb5afc60cdb",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:31:01.000Z",
|
||
|
|
"modified": "2022-03-07T07:31:01.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:14781bc862e8dc503a559346f5dcc518 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '54b4caff62886937e507d84e15a909386e54197eba93fa092fd4da72e2c4fab0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:31:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--3fbc0932-a03b-4e55-a58c-ca81592cd10a",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:31:01.000Z",
|
||
|
|
"modified": "2022-03-07T07:31:01.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:14781bc862e8dc503a559346f5dcc518 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '6200dcb8b83d8c8e548c5488b19f2639']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:31:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--a0b205eb-aa8a-4dff-8898-4c0f54b62be0",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:31:01.000Z",
|
||
|
|
"modified": "2022-03-07T07:31:01.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:14781bc862e8dc503a559346f5dcc518 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '89c7053d6e65309235aa09a397040b8fb2dd9f85']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:31:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--a450d46a-0e32-4fd2-b8cb-3d6ebcf19de2",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:31:01.000Z",
|
||
|
|
"modified": "2022-03-07T07:31:01.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:14781bc862e8dc503a559346f5dcc518 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6d16badf04ffd8f6086b7832bfb54337679ebad0d92a7f0c65ddb7d2263a517c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:31:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--134880ab-e112-47a0-8946-f3c3a1eaeb28",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:31:01.000Z",
|
||
|
|
"modified": "2022-03-07T07:31:01.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:14781bc862e8dc503a559346f5dcc518 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.MD5 = '153153eb15c76db8a0f181ce2c0e16aa']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:31:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--3a455b2e-3f2c-47c8-b1ff-8a28960c53f1",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:31:01.000Z",
|
||
|
|
"modified": "2022-03-07T07:31:01.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:14781bc862e8dc503a559346f5dcc518 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'ecbb6b9c310d7b7ed63ab07d769427407a67a827']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:31:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--53d1ad70-86bf-43d7-8923-63de5d69a1ba",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:31:01.000Z",
|
||
|
|
"modified": "2022-03-07T07:31:01.000Z",
|
||
|
|
"description": "ls:\"2022-03-01T00:00:00+\" signature:14781bc862e8dc503a559346f5dcc518 p:1+ tag:signed",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8828709250b722762b77fcfcc4fd764a546a1b15f1ad7e166047657693fcaf3b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:31:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--b6d65822-b473-4c63-8cc1-46411d0afddf",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:52:28.000Z",
|
||
|
|
"modified": "2022-03-07T07:52:28.000Z",
|
||
|
|
"first_observed": "2022-03-07T07:52:28Z",
|
||
|
|
"last_observed": "2022-03-07T07:52:28Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"x509-certificate--b6d65822-b473-4c63-8cc1-46411d0afddf"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"x509-fingerprint-md5\"",
|
||
|
|
"misp:category=\"Payload delivery\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x509-certificate",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x509-certificate--b6d65822-b473-4c63-8cc1-46411d0afddf",
|
||
|
|
"hashes": {
|
||
|
|
"MD5": "14781bc862e8dc503a559346f5dcc518"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--dffb8017-a867-4f90-8bee-b12a8af9601e",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:52:28.000Z",
|
||
|
|
"modified": "2022-03-07T07:52:28.000Z",
|
||
|
|
"first_observed": "2022-03-07T07:52:28Z",
|
||
|
|
"last_observed": "2022-03-07T07:52:28Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"x509-certificate--dffb8017-a867-4f90-8bee-b12a8af9601e"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"x509-fingerprint-md5\"",
|
||
|
|
"misp:category=\"Payload delivery\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x509-certificate",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x509-certificate--dffb8017-a867-4f90-8bee-b12a8af9601e",
|
||
|
|
"hashes": {
|
||
|
|
"MD5": "43bb437d609866286dd839e1d00309f5"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--6d362e71-48a6-4d5e-8ab2-9612b39b4fa8",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:20:25.000Z",
|
||
|
|
"modified": "2022-03-07T07:20:25.000Z",
|
||
|
|
"name": "gen_nvidia_leaked_cert",
|
||
|
|
"description": "https://raw.githubusercontent.com/Neo23x0/signature-base/master/yara/gen_nvidia_leaked_cert.yar",
|
||
|
|
"pattern": "import \\\\\"pe\\\\\"\r\n\r\nrule SUSP_NVIDIA_LAPSUS_Leak_Compromised_Cert_Mar22_1 {\r\n meta:\r\n description = \\\\\"Detects a binary signed with the leaked NVIDIA certifcate and compiled after March 1st 2022\\\\\"\r\n author = \\\\\"Florian Roth\\\\\"\r\n date = \\\\\"2022-03-03\\\\\"\r\n modified = \\\\\"2022-03-04\\\\\"\r\n score = 70\r\n reference = \\\\\"https://twitter.com/cyb3rops/status/1499514240008437762\\\\\"\r\n condition:\r\n uint16(0) == 0x5a4d and filesize < 100MB and\r\n pe.timestamp > 1646092800 and // comment out to find all files signed with that certificate\r\n for any i in (0 .. pe.number_of_signatures) : (\r\n pe.signatures[i].issuer contains \\\\\"VeriSign Class 3 Code Signing 2010 CA\\\\\" and (\r\n pe.signatures[i].serial == \\\\\"43:bb:43:7d:60:98:66:28:6d:d8:39:e1:d0:03:09:f5\\\\\" or\r\n pe.signatures[i].serial == \\\\\"14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18\\\\\"\r\n )\r\n )\r\n}",
|
||
|
|
"pattern_type": "yara",
|
||
|
|
"valid_from": "2022-03-07T07:20:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "misc"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"yara\"",
|
||
|
|
"misp:meta-category=\"misc\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_context": "all"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--02a8f00c-0e82-4745-89f9-65d97cfb2dd4",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:23:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:23:37.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'bc37863a409ddffdf36937dd4e536aad' AND file:hashes.SHA1 = 'b65f8a804d3e87e1ca21ca781f1a0585acab6959' AND file:hashes.SHA256 = '9d123f8ca1a24ba215deb9968483d40b5d7a69feee7342562407c42ed4e09cf7' AND file:hashes.SHA512 = '21dfed093d416f7272126bcab30e96f9f2534330fbcfeecf5975ba7c8da84ec155fa8b8b0ee14849af55811e6d932225c8137f8aaad74d8f41fce18673067fcd' AND file:hashes.SSDEEP = '24576:fLEFifQAdvYAy9r3OM6wQOSb3p48ZDuZpa2NLGBrOIPUcE:fL94F3YBnpxZuZp7Ny9o' AND file:name = '9d123f8ca1a24ba215deb9968483d40b5d7a69feee7342562407c42ed4e09cf7' AND file:size = '1332768' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIAPM6Z1SzSJZQu2sJACBWFAAgABwAYmMzNzg2M2E0MDlkZGZmZGYzNjkzN2RkNGU1MzZhYWRVVAkAA/myJWL5siVidXgLAAEEIQAAAAQhAAAAdVizDfimwti3UHQQv8dRSRIuaCuOipq3QdNWB/v5gcMbLUTFLdtJW89L1avByY5FAKsg+gNz1wg+5dvXafs7EUCMJqSYYYla84/m83VrjvD7T6YoVwpX+1WXJoJVyW7fXG3ZZds3MonTM+kz4nFFgk7zgVjEQtmNrPvOQS1kx8Btlh3/jwRl3KJqsmmEgi+MvZTTeTf6060F4UmNUIBp6VpWUoRrEjKK4qdIfw71ykkpJT0mQErfnW9q0hV2qoTcSHh9sRoloUMHHC9H0FnUEv0IqLviOGWwK3VtnjeMpYqwqFSmY+kELo+FjLTr3B483Mn34jN9MKUM+Rx2AAMpuzb4gOditmZVtrX3wQOicz+7ASIay/JSYWymLZshk++78H3x2EdwSuGbMMDXKQ1gwZwV1DnhJDOIv27niaMmdquIscHHEJjfV3r/y42gGMAhfnwpLMfpPBP39vGcQ2PMH8eu8ktnwWhhteps+ffQ4Tma57ZrzojGg+Op9Xk7gpYdLfRm9EtO3I3qdHVZznBQbYGmfAAkxDnqEcrnUL/jdbvGfQO8waivxJ5hGY73mUkb6g+B+zX0Q0Ow9JLc+ITOT6yk/frTEktGzDp4AYd1u+F4+gZfPhd7GlzXD2rE5M6FEdJAULfXQqddRh7LrObb9g4YzXxifQpdI1Dfjz+jlLmiip+ExcnQUnuxXj6nWYFeZYR3WyjGE30D3PXsHWoWRCDsZ6lZLOAt2W3s/USi3oO1G/oVMN5NpKBs018VoM1UEl38A6gMycIHhFoOZRY4AaWCNCmC2d2QM8vcPMcO55CkKt8DA0mrZ3voweQuF2IgYzV0DXlCQ8NFQseCwZPm4TDNqaBsA6vnSGi2It8lh350rkYZSWg2jmw55gsNNfjn73i91F43/XzUVh5c94SdzdY3H8QNq54K8ji9N7sTstoSMej8VoWzPd2KzYLUmCF+pshw7U/mVZyGpOpHDUoPsyTUFSfM63uj5rIGgVbC47a/B9IwBzTtbSKFuoQ/giJRLBB0ds3zdY5+7Zjn0ukMZxU1ah0rH98HPe5K3vs303OAf41W98r8/iuKtck7AxNh/na+Qd6mTbXOabDoHp/9Pyn2j9LXPMKFj555WZDkDy1DkFsfqxd/9ENGaruFs8c33LlyEEj7Q6pD3/d0hdy0ignEtRWHmpGg5kEID1OzuuaTHGBg6JSph92lF040ZoUOSFD26Dpk2W7uH+7yClfQR+W+/954VmiKbv8yE2RAY97Cb6LF3n8HUJZhJNF2WLZPzGmJF9tuQm6jsbFQMj/nFvPoKNzB4Y8xCUxwKjGqfDLZT7EKYdv1Tp7aBMMiKCWFYxXIghri3T53oFzmFtEa6ScmCGBTy9FO48+mtckz/5QrBKyWGo+SCm4CmSUJC9WJBw3jUjCiTXG4KdD3pfMOcoHMHIyHPGfi+mgPk2ly6LFUDUSocRMMJeEc87u2MVp9TG1EGstwpUBKE9g4SXhE8NeLZAWCvXN9Ttj5cc1heAsHJ03RPAsHGqFM8dnRF4Top/5975RE3W8es0O/Ol+SzJ588TJNoltwePwcRBaQJfeaAkdm1UqMYbUJaK8F/RLW3yGpVFQ9TIXbxhwBBnZWwuZA5XamcUb1NQ62QiDQG9A458Z3ktbZDN8l1CU1BmiWnNdECupjXxoz6urFGooNUDNcCd25WsgSFKd3I9Kl2MJhKaUHe3r1v+GMi3fkm5YK6jIG9rZdXZUk8OUP7ZQ/qJsZRRwco/kzHa0gOoYU4HBnaZGJvbbANkAltTop135x/u0ZfZ5TUcIvXu6xyIAXO38meLPCX3nzDV8RfzNIzCY1q6p2Gv6BDYJG5mQJH1exUh9zJ78Jf5RcqcFXGI1LItRFSFHMKb2x9x8y1U9sM/+1w1+CydVpJTfMmgWevCn++BH5mkv8FpiFOqKHTBHDG+pRQMnh2WsUe96IbWd35GE92PPfEOwZlAQz/RCvrtrzv2974DVxfbCnFN23PEmOuY4tMf8eUGGw57hRIajz9e8JPoBPS6d347dU9YRcuN0lqi82XhLZ1qRnVUlGMNqmOcx7z/jXHJA+1hiU1AUh8+7NisY6xHNhs84On4qryLbLIQAfsaa0Nt0jhEKd4CZmilDhpPx6G7bQGXWCpnzfDiV2F3qaQiZjkS9RNT2/dLIxDThOlN0olKRwP/vY12lL80QwZNnzdobf7X/LKLfyOn4W6fmbrGEyO4WwvhbNQsSFAIiiiDsKL+eOaUo4pl9c886ETCVm/JC9mjiJ0YqBeQQFCENIancpYfldAYq2MlhGzPKFuYPOGKvKzGxryutgfDDr105i7GlM1QDtYuHh4A64w4OMcI/M12k5l/5A9OY6lboQwjhyG1oHmXOvFkFULzou96D7LMQdx3zWzPFdc4D4f8QqWUIjZD1XpNFXt/GSPZ+JpAmmgSa/MLQQBuDMTDI/1MqNAksqGkD/vMKoZlRtYgi8esgM21wR4svpA95Q63FyuqXyx6BhdjeCbilEwHXjJn4avf49WJB2hnrhVPgzYQtdF6eJGJfmzBuQLJvrgZz6ZKGInjMp3DTcWpbbTsOGVQYEf09+8T3397ndv5J9HbNft6TDrxUKUqBKQDx1+oy/MSGN171Pu6KZC/crIb/kCnVRASdDA0giQ7ssxkhptDCvtnG3v9NvCD0GXscdkaeSVYNhNTxCpN/FHUZeAhJrHPAsl+MMXL9wLKUeaBkZI3k/yOcS9ZbtRTuUprhsLtw8qnC1WzbZwsXX7JhUhwXgjbFaokKlG1dxScJBEajBPk7gZFqHCOjDe9eAtqmvvUZipEBKwlxFI+K3AVjGNLuSqk92QcvmV3P4EvKPQ5vXp4SjcTpGHJtSzwgu2XPlacWjdBmO22/bwH2v1oHGN95PzFniull0aEB0Jcv0O5fFOCYo5PcLpBu6U7rVlrYghQD1+zp+fngYbTEG8P0xycm19UNVzDe8eG4JWZOVOoarJDn2rFSugf3fgQDsNUtx5t5JeI6lt6lDIydPdfmQcoVeUTH57IH2pmxRPv6JaD9L2wh7RNE4jYNzSy+VPHovtdNfxgxiwYZt9ezLMJdBc4rUBwe7OKffgbbC9nhmB91Pu1xq+zsjl21JnBpB60OnfOmnszOez7w9BtQJeIrSCywIIG6l4M40ouoh9I+FD+GcsYAM8bEtTUy1ZFoXukD73BdbP8MvHDT057hbqaAzLpjZz64uSjTlXWrbmeHiRe/YUVwniHehZhtp+xcUQfr7DimqCmzZ8zHWMl6FyUnCAgJsUJffD6sXsopmUCm1B4HOSLEH+xJsifCDPu75ayoNZhsuztKB
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:23:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--3d9a86f4-8fae-4f23-8e73-79d81723bee3",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:25:25.000Z",
|
||
|
|
"modified": "2022-03-07T07:25:25.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '7fdfadbbc6bdb4d46373376594fcc65a' AND file:hashes.SHA1 = 'adb5745282567d8518f59071226aefaeacb9c5a9' AND file:hashes.SHA256 = '0e1638b37df11845253ee8b2188fdb199abe06bb768220c25c30e6a8ef4f9dee' AND file:hashes.SHA512 = '0baa6d9645eabbc1f22929eb870da33715e302aba0fec37a8be36df1276c769548274d5173c5ce79587654957d1490f3141931f616e72f4b90026327d95bbb39' AND file:hashes.SSDEEP = '6144:vHAEBjU34yaI5GO6pHOCsEfOjXZpZKrGfjb5bmRHj:PAP34yaI5GO69lsfZRrtCRHj' AND file:name = '0e1638b37df11845253ee8b2188fdb199abe06bb768220c25c30e6a8ef4f9dee' AND file:size = '309280' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIAC07Z1SiD+W12MsCACC4BAAgABwAN2ZkZmFkYmJjNmJkYjRkNDYzNzMzNzY1OTRmY2M2NWFVVAkAA2WzJWJlsyVidXgLAAEEIQAAAAQhAAAAZJmyMsVN3bFWfvD8LhzXtGgNcmCrxfqngYi64z9RjRXno2TtO+nPQ9MC0fYnnlRbxT3xrrA2NeRo+nY0B8YDMk31BQsR9f1Af0MI4j2odYwPWD77QAnEelw6gvxdjmHVk185VKTBUpWrC5QXr9mIAuV/Oc31xhvqFNWAzDxUxx7bsb3h04bQe06xMIyCtAJJpE+WJOoLTLuYceRn6YiOFXsAJ9+5beDjcxvJx5JLw2wdkfIfKzGHR9Rc30aOO9N8yPoKpLDW66DfDT4oCP76g9pQGt3WQ8+THLPBEeMUHH18pLuV5+R989a2dypRaqWktjIUeQMhpiVhFclzrb1pq7fW0c2v39FuF99ikhIep5PkxFbYM0sapDfFMfQEC/ERxORIsFb3KYtLGTaom/AxZoAFz82gOBq4KI9EanDKoDYZGlDWWxrPI8DNPt/SdIsOXsDZoJmTLqRBqLS9PTAp3Oe97eDYG9DD/reEK6YmKquri1LBJdn3/vQZ8cNaLn1RDkCKYMYZrEZKSAS6IatRrmzA16Ws9SpCgFsP8era1QD+qmwtBIn7HJmVVvHsjhe07vwXC3svlGIFpeihWxxXeweHHew6DlvOWoHCzP7RAslFxEncH+iBpFqmSvHKX3+EESgeZ+mKHu34bJct8D7ebwcvrvHoJP330GsDShvfnJavD8mPVquyrIUqG1NnAmEtoTWnPaRlE3UROwOZfFjU7JpaQRhlKbaKoQw8MuDqrHVeQ4lAxSY+OOxJ/Qaocq6czrxP7N9TyWSeGYfjy9tJ3JZw8bT1AoMcYCbiVgOJ08REJhIMZbi/EYuRxpHfgMqt8w5J0kUNr5+yq3T6t0Zo/cGR7UNq63WBcEdvBrDHzNShQOc+iwCdz8QtJnMS+5tl7Q9JFTRxSGknAG4h6SdRz5NOo8PSvga1IRLJVW+ygHml8TOpFOaQsp6xzH9rEm0cZ6jQ394yABD9iYIsgcUdEYnMOXUzeWdtoF4CbIi3keOy14cHo4+iO4qoxRMnUr6VIk+I/BfFMa9uxm8HKLbCybyT8645enKBhbufvmyVo3p+9uJI5FqOkDPqYiIwXhppCQdEP8i5HcvU4iilSZfIdXasTEZaA0Qu/EqVIrw+lOJT0O4fyxx8YYP/e8sT+iPVCt8vV0IRU4JXsc0f0KiXUnXDsVZey5pYwCIluuBRk4mkaChCaCLSyFeFS8YJVCSUK/Q7TJOEaaQx2V/9vzx6ULwDmS8xzeLfzNcoKFXatyU/lECjxAWOppUbDb9NdBrstUGRz0EmOSQ97tOQWjJbEFlwgFci4mxiE6xhHEf250FH3g+0mS6nCt63xspSyVCDqbt/yPRUO7Joz3OIBpeIRcUkLoX8DW5QF7PQcl//4PshvB/6lgOl+QhCFrcjTxcPgn1MbPMv8zrxbNE5BAIrlwP+6M4NeByLtPIQfqptoHPrvms21Ab9+i96nSWMha4fmyBSrLCP4cqXZHcBL0iRNUK/a7YGMfHAZFSnEtAZXBlz3tD51z/tYXah2s+sxCxsRWHMzgFpwcrkSstOfDub4xcmQ/0EB79tCyqyDMEhqkVoCwdxdpu5GrJ1RMA5jAE4eWL49XMLFuhmQ4kP56jla+vJb29l5Jel//5K7vTQEBKXto3Z+AcJpSk7Yb9xc3CZndEgXG5dhnp3ZHspI+HmDH7FMWQusNCgcAkeg3FZo4bhbDiA+kUsMsrs5bEOMiZ+TavhHPQ1q2i3B0VhUk3OpOEgYcCB0GaNnropA/K7d+3724L2/p8lN4BSXMium1vd3AxHHksweVKLdrVweXhtq8nhMwhT5tX3+7H8Wt2lJ0AdoiGWvfOzh9lBFyhlIUywHfaDkPjUNuhH/KF45kHDWz5AF7m8CuQuNkVeg3J6guYLrhQLEMcWFFFwroIKQ6/xjcapPyGu7wSHX+MS+QtbCuCJ361nf1c3vEKNIc7JK4IDLuxs/J/mvewxVmzGrBhPhAw0bTMoUhwxejwomel9FJrRvgr12ZIg/s/CIDmzn9ZZiuV71GlGwWe8pzYDnvJ60jsInTrjY5vKdELfI95D+5Vxe4y8dpfORnxmq9I0MP6DfsBVbd4OCdbY4JN2BHzFu37Oh8gZa0+0xc/JpUy/FHvv9eRIpu4wP6LVEQDVSfhCfBP6OJfaoWlozxgHM+U6Os7KFs+LOjv9yW3k2VbGutwM/oJF23DrVfMglOWLmPhpaJTkuxDSlEgjW+Hr0XZEd3ODqEL5FJjXQCsvX1U4PqlREHd+o3udLDXQmy9NbaelG1zleJwZ+4w2e01iR13IFTTdXkF5w1EIiXXgD/GKK8iBFUaqQ4wPc190oqXVA1owD7WX/yX2oYP6KCkqNYEEnjjKyU81toopj+EknozhkvPCCEYQ/Glb2elDqbtDz+AVpAbJIwwXMVY1gBpgvYOciWMhq5kRv0aFW7Z69LYbllbL7M4p4vD2F3M5K3oWlQAZP24a6LDKkxfw5+9joJFOp8ayhNVv6Pipivc4pr7/ODa8Zr7B1rhnhUESQX2ShyIsO0haCGlrdBzbRFpeAkscniUE86QiwX7Q9h1tyVd/JoIC/jgD7W0rb1vrqW1WIrGEHiT6/Sul8khYYTA89nQJXGqC5QMHk58OHWfnsUNc/UELDNOUifvmLOYGYxOuVG0vZvQjclTqP6uUfzFPj9Giag+s7Ir9s4pJeUgVqIooRR8tf6prgqpjxVsQ+ZuhhEKCNzU8SUHCcG+kmn47VBJHn4tXnF2vidM3VQOZ6eGkmHalQ9MmegCGzmXojCkC3QShtmj3SfiDB/JhcLVF030h+Lk7GMQQr2CUERPmINDudft3VuznqKKUOdO7ViqfTtS/cCCL1U09KJJwKQaOJu2Svr+mupgOI4tJ2Z5z9u3m2eVt811blhYQMKnkKPIlF7UJyvfM89wLvzrfJUh25DYwmuXVHRKg9Qbss5IP+aT+Li7EQLYpffzbFrakeYaPASBUgA+2QVu62fxmf1q06tUJUgHkVtQc6jPh57tT4m6eD8uwRaNWe2wOOlYLoniRzjH2jmRfUYEygDykK/GMXLmyLnBn06rI7cM4LlXBajO+F/XPz7Z9uIs8gkZ1c+vwH6oH7qtiC1FPmfJwEBJ+kEVOeFh7rSGXczQZG8IejZ1e/DLqlSWH94HvOqaHKSIQhNxZdv8jN0xM5d9QHHBBSaIrf7BBQLC0I9IyDNY9TwamUAd6KlFUBlNRFkyDuojziHr5zDLcRoGkOddjZGQKc8ZacUIuJebNM0aK7oPrNrQM/j/R6qMsTlSsB+eLqJ12l/GDwWfNALBHzYOGxNWPydzWAP6i/HAaaCM
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:25:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--33fa49e6-b824-4bca-bf34-40d5f3337d32",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:57:14.000Z",
|
||
|
|
"modified": "2022-03-07T07:57:14.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"microblog\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"object_relation": "url",
|
||
|
|
"value": "https://twitter.com/cyb3rops/status/1499514240008437762",
|
||
|
|
"category": "Network activity",
|
||
|
|
"uuid": "cc4b1d39-e452-46c0-9f3a-22e24d77e067"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "Twitter",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "51645cdb-8cc6-408b-90b2-9aab5ca6cf3d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "post",
|
||
|
|
"value": "That escalated quickly #Lapsus\r\n #Nvidia #LeakedCertificate \r\n\r\nMimikatz\r\nhttps://virustotal.com/gui/file/9d123f8ca1a24ba215deb9968483d40b5d7a69feee7342562407c42ed4e09cf7/detection\r\n\r\nKDU\r\nhttps://virustotal.com/gui/file/0e1638b37df11845253ee8b2188fdb199abe06bb768220c25c30e6a8ef4f9dee/details",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "bfe73e6b-ada1-4be7-a265-1167c9d0701e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "state",
|
||
|
|
"value": "Informative",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a3847dd2-a8d2-4960-aa36-af1d84e72c33"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "microblog"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--7b35a34b-1cbe-476d-8897-4c85932981c0",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:23:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:23:37.000Z",
|
||
|
|
"pattern": "[file:extensions.'windows-pebinary-ext'.number_of_sections = '6' AND file:extensions.'windows-pebinary-ext'.pe_type = 'exe' AND file:extensions.'windows-pebinary-ext'.optional_header.address_of_entry_point = '5369522152' AND file:extensions.'windows-pebinary-ext'.x_misp_compilation_timestamp = '2021-07-09T21:00:37+00:00' AND file:extensions.'windows-pebinary-ext'.x_misp_original_filename = 'mimikatz.exe' AND file:extensions.'windows-pebinary-ext'.x_misp_internal_filename = 'mimikatz' AND file:extensions.'windows-pebinary-ext'.x_misp_file_description = 'mimikatz for Windows' AND file:extensions.'windows-pebinary-ext'.x_misp_file_version = '2.2.0.0' AND file:extensions.'windows-pebinary-ext'.x_misp_lang_id = '040904b0' AND file:extensions.'windows-pebinary-ext'.x_misp_product_name = 'mimikatz' AND file:extensions.'windows-pebinary-ext'.x_misp_product_version = '2.2.0.0' AND file:extensions.'windows-pebinary-ext'.x_misp_company_name = 'gentilkiwi (Benjamin DELPY)' AND file:extensions.'windows-pebinary-ext'.x_misp_legal_copyright = 'Copyright (c) 2007 - 2020 gentilkiwi (Benjamin DELPY)']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:23:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"pe\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--dd7d9fd7-261d-4a13-adc4-74783b9d4174",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:25:25.000Z",
|
||
|
|
"modified": "2022-03-07T07:25:25.000Z",
|
||
|
|
"pattern": "[file:extensions.'windows-pebinary-ext'.number_of_sections = '7' AND file:extensions.'windows-pebinary-ext'.pe_type = 'exe' AND file:extensions.'windows-pebinary-ext'.optional_header.address_of_entry_point = '5368762848' AND file:extensions.'windows-pebinary-ext'.x_misp_compilation_timestamp = '2022-02-18T15:32:07+00:00' AND file:extensions.'windows-pebinary-ext'.x_misp_original_filename = 'Hamakaze.exe' AND file:extensions.'windows-pebinary-ext'.x_misp_internal_filename = 'Hamakaze.exe' AND file:extensions.'windows-pebinary-ext'.x_misp_file_description = 'Kernel Driver Utility' AND file:extensions.'windows-pebinary-ext'.x_misp_file_version = '1.2.0.2202' AND file:extensions.'windows-pebinary-ext'.x_misp_lang_id = '040904b0' AND file:extensions.'windows-pebinary-ext'.x_misp_product_name = 'KDU' AND file:extensions.'windows-pebinary-ext'.x_misp_product_version = '1.2.0.2202' AND file:extensions.'windows-pebinary-ext'.x_misp_company_name = 'UG North' AND file:extensions.'windows-pebinary-ext'.x_misp_legal_copyright = 'Copyright (C) 2020 - 2022 KDU Project']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-03-07T07:25:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"pe\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--07c2b4fb-e9fa-406d-ab22-73500f42ad62",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:23:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:23:37.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"pe-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".text",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0b7ad0c8-84f5-44c2-b34b-b95aff3b58db"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "837632",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4e5cac36-1c4b-4d19-ad62-a60a5e86da06"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "6.4600321590627",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "97b9d49d-0324-4d32-b00a-8dd22255445d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "0768c03b26216fc21524933d67f6680a",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6d0febf8-ef99-49a8-a50a-6e6e9aea6c7d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "0e18ae3c4ae11b38ccb1072b5369b4980adbdcf4",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "9ea5cbad-bbff-4af2-9e54-0f087803e4d1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "c668054dd19a4259877dd3d56ea2b202c30ef0790a57baa126015e0b3a9673c6",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5bfefb66-5899-4f63-9d6e-e752c228af05"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "d7273abb2409f281330f207d0b71f66d728cf3326e5464f4fb8c79cc7f0d79688e1f0fdc6e17a293a5ac961a3b8f35337a63ff2af6bc1faafbb172cbd27c09c5",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "af835e02-8fb7-4bc5-a448-b11693525eef"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "24576:+LEFifQAdvYAy9r3OM6wQOSb3p48ZDuZpa2NLGBrOa:+L94F3YBnpxZuZp7Ny9p",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b0037ad3-a802-4ebf-9957-d28e43030dbc"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "pe-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--2860e27b-7f9e-4990-a6b1-a346e01febcd",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:23:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:23:37.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"pe-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".rdata",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "fa145784-fff3-401b-a40d-e3079c588765"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "409600",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "52d7ac75-6d25-4b69-bf0b-72876b8070e9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.2365794172303",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7e15f738-a95a-40ab-984f-313479917476"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "66fabf217cc74a656bbabba89c28bfb3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "2bdd5a51-95f4-4c72-88c4-130dcf374f16"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "771bdb17d5ada7fa82d47ff1593516b03d71ba2f",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "69723f43-c670-4445-b7b0-7307a3cb8deb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "7412aba7dd0aeaf17e98b42adaef5c5cbb0ad30a510dbec56c24ecb030a5924b",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "2d5065e3-295b-414b-86b8-c341073330d2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "c2c34ba3d77be16e1278c5b147a639ad989289ea3bac9ac8faf86e4fa36525d3c2e1de23cb2fd60ef1d9153262721037b8026919e2295cc5f6dc1be78a376794",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "38ce763e-b8ea-4a5f-8033-00527ece0820"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3072:5th9uOPLmlIlKx+ckWFaBWTMXyKTTps9DVShidteczXTCokSCwYJWIEhpLg7xYjZ:5t7uOTmlTV9Dig8pISuAjQ",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "14e091b1-086e-42e3-8761-e82bae5e71bd"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "pe-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--12a41e75-3b1c-47b1-96be-8b682d1ab61d",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:23:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:23:37.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"pe-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".data",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5e64b77b-e177-4008-ae20-4e7cf403bd52"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "26624",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "243c6445-8077-4d5a-b8e2-e8b99a8370a9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "2.8697040068015",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "57142e5d-7bde-4644-845b-ff0b918b11a3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "4f179126043c4c3567c738dec155a031",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "01959f3a-a6ed-4436-8c24-a7a2f0733c57"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "8424fd01ef4f52512c2df0eb51d8a6fdbcb2b6a9",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "acf70048-228a-4693-be9f-b7826fd1e1dc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "a24ee34b348c6cd640c13b6f333a6e46b8587ed2a6718cb55beba88820a4b8a0",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "137d7f68-9a40-47fd-a4c1-bb9b1090be1e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "3bc2bfb8fdd8a2cb7eab66d7465722441f44865de822a9fcdba7ba0ea7bdbe0d891a4579a281f8ed24ef5f709bc487114e134682ee818000bdc43c1a9ae6f6f9",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "004742ae-f554-460c-8d3b-4f15effed6eb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "192:EIb/h4PaK9G6XRh6LvM/Y2vrMPVlmHR5D5ctz:hyrPmEg2TIrO",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c871c231-7cc8-45d1-8ae2-108216c793c0"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "pe-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--bb8398ca-cc8b-49ae-90af-4bd656a42d62",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:23:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:23:37.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"pe-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".pdata",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6763c390-2b26-4c5a-a8e1-ab521991d1f2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "26624",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "730b5053-cba3-46de-9b25-a3be11cf8aa0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "5.9221550473257",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1ae3eb97-34ff-48cf-be51-e8119b95af2a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "ce753ee78af0e55f6469c7398b34d4c5",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "95e2cc10-a733-4c0f-9a0f-b75664d6b66d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "852e20f35a0425c9bf9eb353e21b71e8201080f2",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "82c197cc-b6c4-4531-b7bc-cdad74fb4265"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "b31000b05a5418555bfe42a3cceb7f3fe18304bd4a9f9915b73bbe372584e21a",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "dfa7b5d4-6ab5-4e79-a376-f8d84d6383a1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "3138b2ee2e4e739b38625ea57f61e5ef7567ab880793f345ab8404f67e94e6f9678291751696af79937f592cf1f82f9f902cb68a48755203b8caa09725ed4f72",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "83936ddf-ad98-4d47-ab52-a3f622634a33"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "768:gKpWBQRFA6CepA3sEc1/C6ActFpAKttf6o:7sQRFfCe+8EOC6ActFzfv",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "084dc3f1-316d-4ccf-8a3f-90e0b9fdaf86"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "pe-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--9c105266-e7ea-4c0e-9808-131fdb64a474",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:23:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:23:37.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"pe-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".rsrc",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "62b36932-fdf1-45aa-919b-fb69906cb87e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "16384",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ab9a35e8-333f-4ab5-bbbf-e02bbdf2c75d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "6.5468797158872",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "423977fc-912d-432a-aee2-c53aa1279a35"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "59c87c4f69b6a9349ba93d1f4b967224",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f377d09f-9c00-40b2-998d-e24ff86b61df"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "985232d3b15faf3fd21c60778075528c0841149c",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "8e6826c1-3a1f-40b0-8919-ed81961868ec"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "7ffe9ea85ecb0c11649e92d687132bd9b57f813da8f85bd0c588012b3c11cbe0",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "3186c77c-d0ec-4cec-bbc9-c5c83ff5c1a4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "d6207a7f1cd62b62e898b2756dbe3ceb0393c96e86187b5e14b9c24c2ca487673594efbe758e0d95ec45598d58a42268700136ac44b2887030fd3a0962438cd1",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "aaa2f73d-37e9-451b-85c0-739abbd2cd89"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "384:i2ullDWFeEF5+ldBojfT2emBwAyas1NQddz+Kd3uGNfJACgFm:i2ullDiulTojfSe+iJPQv+Kd3uGld",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "1aca427b-6718-4370-8bf8-ab2c4c5d7e78"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "pe-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--a965524e-c2c3-460d-83c5-a17c02d908a1",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:23:37.000Z",
|
||
|
|
"modified": "2022-03-07T07:23:37.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"pe-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".reloc",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "386c932a-9cd7-4573-b5df-eff9c4d19ff3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "9728",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "af342e4b-180e-433e-881c-54178fe0d654"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.4435942791133",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e44ae8e4-9f1d-4001-a5bf-87dbc5a9c0ee"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "df726189dbfbc5ec82847060b3b253ad",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "4defc442-f0d5-43a4-a34f-bb3c0bacbfff"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "782aa47e2a2939ee6d8c7917756dbfcb5f84db23",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "4353587e-51d7-46bd-9036-97115c3e5ae3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "456406d8dab481fe8564a929d87bc45f85d0106629c812644321f15c5084c39e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5b344d6c-fcbf-4c46-b868-ed63b0c1cb96"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "f518fdeaa2583ee2734cddea35eb35bf0bad70ca39bfcce4bb70155a295fccf51adb334aa63d0d84061928cbf277bc5d0c651008a2122a8fc122ed3f04a74636",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f531a2fc-a1e2-4026-9e19-77ee18f5c213"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "192:vIkneUn3mp6nnnwGcnc112+S+9On/MXQjVZT:wkjU6nfcWjSD/MAjVZ",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "9e9fc1e9-291b-46a4-a91f-80021b788876"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "pe-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--5d1dd2a7-a140-49ca-8ba0-bca1be214c3b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:25:24.000Z",
|
||
|
|
"modified": "2022-03-07T07:25:24.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"pe-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".text",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "228d34d1-0ae9-45bc-9eb0-07b8ac49f8cf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "143872",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9d8b0a81-a0d4-49d7-955c-09349acc71ed"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "6.4864928992316",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "56cebae0-8e2d-4763-8b89-18576fa81d82"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "e3c6c0b01f5f25a2392b5ca6ad880a78",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "3b4c97e4-34fb-42c8-b93e-2f18dd7c2128"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "261e8503ee46b4e44d602daf903e6888b177862b",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "0a009699-630a-46d5-8a73-61c1e385314a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "30a6c767552423728400477e883bbbffbfa575c95ee9370f282e6c6786ad1fd7",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "4e581feb-bbbd-4dba-87c5-6f80dff0115a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "b3d75a58e14497b546a22d2a9a8eddc01f9b35f958308b81ea977d54a14f3c5685ab518a53c330c4765615f8384259667cbba9addfd1e911efab19250208deca",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "78520664-a3a5-4d5a-9865-3fc2fed463a6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3072:Dc1cyHAdiBvpdU3psbyaI5GOv+NJppMAOhksy1fOH:oHAEBjU34yaI5GO6pHOCsEfA",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "27c45c56-b713-477f-8398-a38ab403a4ca"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "pe-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--749085c8-ef1d-4a2a-a8e2-596a8686b76c",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:25:24.000Z",
|
||
|
|
"modified": "2022-03-07T07:25:24.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"pe-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".rdata",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1040d5ee-e369-4ab7-974f-cb5cdad245d2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "63488",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "47e21d3e-2b21-4cfc-a615-cc120ee263e9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "5.3226709464474",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7dd4bc36-b1e1-484a-8afc-a42f988d0e51"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "6bd5073d9ce13c0ab413a97f1bdceb71",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "bd98adcd-2f8d-4c72-9bd4-c77988c9030c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "d41f7dff05b7df8a6e59cb1cd0cbcbf6f1ca37bd",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "e665bd88-8407-4284-a018-a7bb44396031"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "61c6c04187e89c74bc6cd23effd4fcf0c9e8fec37dc5038eab795461c1332bfd",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "682930eb-8478-426e-ac8a-6b11aea2cc26"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "191a168af6da94686bc231c0e97b2abcbe94bf5043a16e8559599bb06966356eaaab267f92cf2a127994c5af18b640bffb065050f255c9cd46b2f18aba1c6955",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "8ce9ce83-7f7e-4626-813c-648db167a01d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "768:NyHUQv1QxhXpWpEjLs0uR2dNdGjz2mV9dl5FmWsGxFxR081gSs2eyHVeZmM1dZ:NyHUQwXppsWjdGjB9dlvG4FayHimodZ",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5d9341e3-69ec-4059-a750-8d036b2e4d9e"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "pe-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--53b00fee-f304-4f36-b433-52960f0aacee",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:25:24.000Z",
|
||
|
|
"modified": "2022-03-07T07:25:24.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"pe-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".data",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "548e54b3-e05a-4672-87e3-d14778473e44"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8192",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "cf69148b-c66f-40cb-8a64-20b6296871a5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.2766711127236",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "94539ca1-0a57-4d58-b849-94a8b2e794dc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "584937d7a9a63d97c1ade7561a39fd8e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "30d4d626-007c-4a35-9957-72dc26e0c5a5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "7296cad5b0587888c0783e0e2f234252af2aec52",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ea823084-edf8-45f0-a93e-57e775405a60"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "0546e3f719b6bb059477c7d50c70c139720b194680a48c46b85bb4731b2876d1",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5a7c64a9-5c7a-41ec-b2c9-0405b9f91606"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "5a7d2e5d2b3e9fa7b12687f642187008d1f7a4ac3cd7723590f60ad909bfa0a77410acc5b636ec619bc5c169af465bc36682942c14ade9db343743c816cf20ed",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "fc6c8199-18c9-46e8-bc15-656821f471a9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "96:86RajhA4fw0Q0LSIE3Nh+qaM8VPVoc6Zu:8BhA4fw9qSEq1xZ",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6f1aa6fd-9b0c-490d-ba51-0081511a556a"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "pe-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--619bb4a2-cc96-465c-aa93-73343347555c",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:25:24.000Z",
|
||
|
|
"modified": "2022-03-07T07:25:24.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"pe-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".pdata",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7d512eb5-6b9b-46c9-a114-4186a07be580"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "7680",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4e13b163-8073-40a1-b985-c98089536011"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "5.4069869496635",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "dfa6f36c-cb32-4cfd-b7b3-43b8084f8535"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "1b0727852c86ac17955e1d00d5ae686a",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7267e69a-1277-45ec-88bd-de13dc390f42"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "e63636fef17277ed36b5865d20caf4dcc98c7919",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "bdc82df4-526c-45d7-b423-3c7072baf5ec"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "fa4f5e0983a582381f7676a7b120640bba67585f01e800bdea40e1b2fcee9c43",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "8c617818-4eff-469a-b5da-e26ce1397c1e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "92ce8af58f9782d63213fa7c391c43cfdd8ebb7d68d85ed8380f017cb6d1b810a0686e0fe960266f859d2f7422b07bf218f18ba95bc7ad9bcb182179eec2420e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "8072b7b0-e3cb-48fe-9004-d8dc16f5b015"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "96:xOTBpTkTwBBSkgv0zAYGRrW5ef0DfSMlx1VBwoxmjTj6S7voO0pvyaOfi2P3u12V:WPJAPvsATyMfiSkjVRxmGZoTfxvuKia",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c4b911a2-2e0c-48b1-944b-ea25f93a127e"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "pe-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--dd44833d-e39b-4c7a-9a5d-620cd2f0a3f1",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:25:24.000Z",
|
||
|
|
"modified": "2022-03-07T07:25:24.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"pe-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": "_RDATA",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "345189d6-ff0e-4f78-b86f-ce1ea0ef268c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "512",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "302a3f0a-793b-4b97-b444-4fc2d84a7f1a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.4940818171259",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6646cfbc-fb3f-4eed-bd5e-f4948e84b8ad"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "3292bfabfd195d5fc4d3e38ec6ed2672",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "44c3a804-480d-4e65-82d3-0ed1388ce972"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "69fea6e742f898b13aa8f4b8642e9cdaa2451557",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "1392a699-1611-4a45-b23b-34f56c9a0b03"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "325fd0f461217881acf1f1da6b4e104ac011c504434b12bbeced3b14b7533aef",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "219d83cc-bd8b-4e14-8749-630a028acbb3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "158d2f6552ceb3c80425cf76203ea94f84a3fa466893abcccf8c77d80e04435b12afbddbb3fd6cac86b0ded40eba67b98e334a0631ce8960a435c5c0e5f54681",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "120ec668-d7ae-4629-afca-5567ed11dbe3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "6:O7Rll4+k4ddhyliLu//aUlI+idbt3/sluD5rb+4B7/d5z:K/k4ddhyliLu/CUlI+idb5Ulk5rf7l5z",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7249e18b-627b-4e80-85d0-6dadb099ee48"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "pe-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--cc41003e-3856-44c0-aa7d-2286fbd94b05",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:25:24.000Z",
|
||
|
|
"modified": "2022-03-07T07:25:24.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"pe-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".rsrc",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "08331ea4-253a-4120-ae8a-6c9926860c31"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "76800",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "416fbf5a-c52b-4397-a369-a7e23c35c452"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "7.4164733665345",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "35d16300-131e-498e-aa0f-6558d4e7caef"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "3621a75a5d08f6b7d9d712ab396defe0",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b093dfcf-4447-4f4f-aa5e-4d05660ca611"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "f1b43ca58d93941ad0c739672a0f0c1ca9af2172",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "0ce8346c-f61c-4822-8f14-90b673a2fac6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "8d93c3c28c032efd6c2dff0a503abf0f7b2c7ccbcdd71f00b6a80a213b5aa25a",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "2920b8eb-75a9-491c-9f56-a079d22cafef"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "ab429463186095afe52c85c561e54ea9e394f37bac875c9fd29b10d7c282a14d0fdd9e5f8fb75d23040c87ad39b4617febd9f735ea3c03dbb781ef61f8f4a6ad",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7da366aa-69da-4757-addf-c65860404f69"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "1536:EZYX8oWWnmiDZZa0TXqHJ+djlVdJnHZbnuhTfQMn20qy1PGW:EeLW0mp0TXqsjlDJn5buhrVnRHGW",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "31dd1466-8f40-479d-b5e7-1d9907f62598"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "pe-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--74b68823-451d-4d5f-be76-2a5401c527e5",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2022-03-07T07:25:25.000Z",
|
||
|
|
"modified": "2022-03-07T07:25:25.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"pe-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".reloc",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ad303ee4-f3c2-4473-ae56-d508baf2bfdf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "2560",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9348f319-0550-4890-b6f1-425847cc1557"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "5.418587134613",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0aff58a8-78bc-4e82-a967-ab20b6991167"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "c7795ec056b7b10df3769508048bb08f",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "fab54c4c-b761-4839-876a-09901cf47076"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "c39569f00ee54b52c5cc751c7e369e18e3b87a36",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "183bb2f3-a18d-4ce2-a506-03656b1dff18"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "cfe0fde345b34da678533c57a1ce0db9aa16272593e9454ba12dcd0c70ed1da5",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c78d3ec0-9e23-4048-8eca-66378b1591fb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "0f67987688561feb0ca222031cff9161996d682d504f6a8e7e7ac71506dfa4cdebdbab48c2a7d77833055bd8ed3877c415a37c3fe70968b4e414f700ccdd0e2c",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "11adb44e-d213-4ec4-b756-585eeec22109"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "48:hEnnYHkEP8P/vcvvW1PcPEvvKz8aOpE9ncX0+kHXn6:Knn4kvP8vvtPEvvcop8ncX0+kq",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "a8c61b21-c1b2-4691-9cbc-d7f2616ba308"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "pe-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|