1873 lines
74 KiB
JSON
1873 lines
74 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--59282a08-aec8-49e7-932a-45d3950d210f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:48:40.000Z",
|
||
|
|
"modified": "2017-05-26T13:48:40.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--59282a08-aec8-49e7-932a-45d3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:48:40.000Z",
|
||
|
|
"modified": "2017-05-26T13:48:40.000Z",
|
||
|
|
"name": "Jaff 2017-05-26 : \"Scanned Image from a Xerox WorkCentre\" - \"Scan_0012_123456789.zip\"",
|
||
|
|
"published": "2017-05-26T13:48:48Z",
|
||
|
|
"object_refs": [
|
||
|
|
"indicator--59282a09-7dd4-445a-8555-424c950d210f",
|
||
|
|
"indicator--59282a0a-8e08-4872-8704-432f950d210f",
|
||
|
|
"indicator--59282a0c-47ac-4f58-8de7-4959950d210f",
|
||
|
|
"indicator--59282a0c-dd14-493a-9bc5-4688950d210f",
|
||
|
|
"observed-data--59282a0d-7bf4-439f-95bf-4082950d210f",
|
||
|
|
"network-traffic--59282a0d-7bf4-439f-95bf-4082950d210f",
|
||
|
|
"ipv4-addr--59282a0d-7bf4-439f-95bf-4082950d210f",
|
||
|
|
"indicator--59282a0e-9188-4a06-a98e-411e950d210f",
|
||
|
|
"indicator--59282a0f-397c-4b05-9075-4c44950d210f",
|
||
|
|
"observed-data--59282a10-b258-44bc-9da9-4ffc950d210f",
|
||
|
|
"network-traffic--59282a10-b258-44bc-9da9-4ffc950d210f",
|
||
|
|
"ipv4-addr--59282a10-b258-44bc-9da9-4ffc950d210f",
|
||
|
|
"indicator--59282a11-9070-49ce-ab6e-41d0950d210f",
|
||
|
|
"indicator--59282a12-5f2c-4b10-9048-412e950d210f",
|
||
|
|
"observed-data--59282a13-31b8-41c4-9512-4782950d210f",
|
||
|
|
"network-traffic--59282a13-31b8-41c4-9512-4782950d210f",
|
||
|
|
"ipv4-addr--59282a13-31b8-41c4-9512-4782950d210f",
|
||
|
|
"indicator--59282a14-4a64-41ae-b3e7-487f950d210f",
|
||
|
|
"indicator--59282a15-ab14-494b-9a05-4913950d210f",
|
||
|
|
"observed-data--59282a15-9d74-4f6d-a2d3-4133950d210f",
|
||
|
|
"network-traffic--59282a15-9d74-4f6d-a2d3-4133950d210f",
|
||
|
|
"ipv4-addr--59282a15-9d74-4f6d-a2d3-4133950d210f",
|
||
|
|
"indicator--59282a16-f19c-4485-84b1-4640950d210f",
|
||
|
|
"indicator--59282a17-5e20-4228-b43a-4b19950d210f",
|
||
|
|
"observed-data--59282a19-d318-4db7-90a0-44f4950d210f",
|
||
|
|
"network-traffic--59282a19-d318-4db7-90a0-44f4950d210f",
|
||
|
|
"ipv4-addr--59282a19-d318-4db7-90a0-44f4950d210f",
|
||
|
|
"indicator--59282a1a-46bc-48cd-bb32-456f950d210f",
|
||
|
|
"indicator--59282a1b-6340-4af5-8646-4267950d210f",
|
||
|
|
"observed-data--59282a1d-13ac-4c10-a36b-423d950d210f",
|
||
|
|
"network-traffic--59282a1d-13ac-4c10-a36b-423d950d210f",
|
||
|
|
"ipv4-addr--59282a1d-13ac-4c10-a36b-423d950d210f",
|
||
|
|
"indicator--59282a1e-60d8-4eee-a1ee-4450950d210f",
|
||
|
|
"indicator--59282a1f-4b1c-464a-b80f-47f2950d210f",
|
||
|
|
"observed-data--59282a21-5688-4bbc-adb2-44a2950d210f",
|
||
|
|
"network-traffic--59282a21-5688-4bbc-adb2-44a2950d210f",
|
||
|
|
"ipv4-addr--59282a21-5688-4bbc-adb2-44a2950d210f",
|
||
|
|
"indicator--59282a21-d7e4-4524-bacb-4382950d210f",
|
||
|
|
"indicator--59282a22-6a4c-4b4e-ae98-484c950d210f",
|
||
|
|
"observed-data--59282a24-80ac-46b9-853a-4b5a950d210f",
|
||
|
|
"network-traffic--59282a24-80ac-46b9-853a-4b5a950d210f",
|
||
|
|
"ipv4-addr--59282a24-80ac-46b9-853a-4b5a950d210f",
|
||
|
|
"indicator--59282a24-d2bc-49c5-8def-4aed950d210f",
|
||
|
|
"indicator--59282a25-6ddc-47b1-a5b8-4a28950d210f",
|
||
|
|
"observed-data--59282a26-6f9c-49cb-8c0f-4d69950d210f",
|
||
|
|
"network-traffic--59282a26-6f9c-49cb-8c0f-4d69950d210f",
|
||
|
|
"ipv4-addr--59282a26-6f9c-49cb-8c0f-4d69950d210f",
|
||
|
|
"indicator--59282a27-facc-4a43-b42b-4bc8950d210f",
|
||
|
|
"indicator--59282a27-a8b4-4fab-860b-46b0950d210f",
|
||
|
|
"observed-data--59282a28-a288-439e-aff9-4137950d210f",
|
||
|
|
"network-traffic--59282a28-a288-439e-aff9-4137950d210f",
|
||
|
|
"ipv4-addr--59282a28-a288-439e-aff9-4137950d210f",
|
||
|
|
"indicator--59282a29-77e8-4a70-b084-466d950d210f",
|
||
|
|
"indicator--59282a2a-e55c-47f4-9044-452f950d210f",
|
||
|
|
"observed-data--59282a2b-7290-452d-a58c-49eb950d210f",
|
||
|
|
"network-traffic--59282a2b-7290-452d-a58c-49eb950d210f",
|
||
|
|
"ipv4-addr--59282a2b-7290-452d-a58c-49eb950d210f",
|
||
|
|
"indicator--59282a2c-34d8-4d9a-b750-4340950d210f",
|
||
|
|
"indicator--59282a2d-794c-4cc5-ab19-493a950d210f",
|
||
|
|
"observed-data--59282a2f-fdac-4630-bce3-40de950d210f",
|
||
|
|
"network-traffic--59282a2f-fdac-4630-bce3-40de950d210f",
|
||
|
|
"ipv4-addr--59282a2f-fdac-4630-bce3-40de950d210f",
|
||
|
|
"indicator--59282a30-7b88-40a9-8fa9-47d2950d210f",
|
||
|
|
"indicator--59282a31-0e64-4e00-a9bc-4f7d950d210f",
|
||
|
|
"observed-data--59282a32-9854-4402-a645-4ed2950d210f",
|
||
|
|
"network-traffic--59282a32-9854-4402-a645-4ed2950d210f",
|
||
|
|
"ipv4-addr--59282a32-9854-4402-a645-4ed2950d210f",
|
||
|
|
"indicator--59282a32-36cc-4b99-86d2-4a15950d210f",
|
||
|
|
"indicator--59282a33-b888-4322-a661-49b3950d210f",
|
||
|
|
"observed-data--59282a34-3298-4f51-bc40-4356950d210f",
|
||
|
|
"network-traffic--59282a34-3298-4f51-bc40-4356950d210f",
|
||
|
|
"ipv4-addr--59282a34-3298-4f51-bc40-4356950d210f",
|
||
|
|
"indicator--59282a35-9d84-4cbd-97f0-4add950d210f",
|
||
|
|
"indicator--59282a35-16a0-4f69-afcd-4c5a950d210f",
|
||
|
|
"observed-data--59282a38-4f38-41a2-a02b-4a08950d210f",
|
||
|
|
"network-traffic--59282a38-4f38-41a2-a02b-4a08950d210f",
|
||
|
|
"ipv4-addr--59282a38-4f38-41a2-a02b-4a08950d210f",
|
||
|
|
"indicator--59282a38-da10-4718-b142-4035950d210f",
|
||
|
|
"indicator--59282a39-61cc-4a85-a560-4331950d210f",
|
||
|
|
"observed-data--59282a3a-2578-4dfe-beb5-4011950d210f",
|
||
|
|
"network-traffic--59282a3a-2578-4dfe-beb5-4011950d210f",
|
||
|
|
"ipv4-addr--59282a3a-2578-4dfe-beb5-4011950d210f",
|
||
|
|
"indicator--59282a3b-5c34-492a-accc-4c3f950d210f",
|
||
|
|
"indicator--59282a3c-7528-4b92-bd56-41f4950d210f",
|
||
|
|
"observed-data--59282a3e-7e78-4d61-a42f-4b86950d210f",
|
||
|
|
"network-traffic--59282a3e-7e78-4d61-a42f-4b86950d210f",
|
||
|
|
"ipv4-addr--59282a3e-7e78-4d61-a42f-4b86950d210f",
|
||
|
|
"indicator--59282a3f-1ae4-4fcf-bf7f-498f950d210f",
|
||
|
|
"indicator--59282a40-0b8c-4a97-b149-4a7f950d210f",
|
||
|
|
"indicator--59282a41-e010-49b9-8b50-4495950d210f",
|
||
|
|
"indicator--59282a41-6fec-4ac0-a04b-4178950d210f",
|
||
|
|
"indicator--59282a47-d4c4-4c25-b0a4-4723950d210f",
|
||
|
|
"indicator--59282a47-a674-4fc4-a581-4d5d950d210f",
|
||
|
|
"observed-data--59282a49-9c80-41e4-93da-4474950d210f",
|
||
|
|
"network-traffic--59282a49-9c80-41e4-93da-4474950d210f",
|
||
|
|
"ipv4-addr--59282a49-9c80-41e4-93da-4474950d210f",
|
||
|
|
"indicator--59282ed9-3cd8-4a48-b42a-406002de0b81",
|
||
|
|
"indicator--59282ed9-ad38-4ac8-ae12-46e502de0b81",
|
||
|
|
"observed-data--59282eda-d98c-43d0-8c94-442002de0b81",
|
||
|
|
"url--59282eda-d98c-43d0-8c94-442002de0b81",
|
||
|
|
"indicator--59282eda-fca4-4b2b-8583-444f02de0b81",
|
||
|
|
"indicator--59282eda-05ac-46fe-882e-4c1202de0b81",
|
||
|
|
"observed-data--59282edb-5dbc-4c23-9c2d-4fbd02de0b81",
|
||
|
|
"url--59282edb-5dbc-4c23-9c2d-4fbd02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"ecsirt:malicious-code=\"ransomware\"",
|
||
|
|
"misp-galaxy:ransomware=\"Jaff\""
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a09-7dd4-445a-8555-424c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'aace687d16706b05aa49c9b7fff7572b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a0a-8e08-4872-8704-432f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '6708cc80916e838a9bbed09c91854230']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a0c-47ac-4f58-8de7-4959950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[url:value = 'http://better57toiuydof.net/af/6gfh33']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a0c-dd14-493a-9bc5-4688950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'better57toiuydof.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59282a0d-7bf4-439f-95bf-4082950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:48:00.000Z",
|
||
|
|
"modified": "2017-05-26T13:48:00.000Z",
|
||
|
|
"first_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"last_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59282a0d-7bf4-439f-95bf-4082950d210f",
|
||
|
|
"ipv4-addr--59282a0d-7bf4-439f-95bf-4082950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59282a0d-7bf4-439f-95bf-4082950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59282a0d-7bf4-439f-95bf-4082950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59282a0d-7bf4-439f-95bf-4082950d210f",
|
||
|
|
"value": "46.173.218.111"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a0e-9188-4a06-a98e-411e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[url:value = 'http://dsopro.com/6gfh33']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a0f-397c-4b05-9075-4c44950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'dsopro.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59282a10-b258-44bc-9da9-4ffc950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:48:00.000Z",
|
||
|
|
"modified": "2017-05-26T13:48:00.000Z",
|
||
|
|
"first_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"last_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59282a10-b258-44bc-9da9-4ffc950d210f",
|
||
|
|
"ipv4-addr--59282a10-b258-44bc-9da9-4ffc950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59282a10-b258-44bc-9da9-4ffc950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59282a10-b258-44bc-9da9-4ffc950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59282a10-b258-44bc-9da9-4ffc950d210f",
|
||
|
|
"value": "35.166.221.246"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a11-9070-49ce-ab6e-41d0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[url:value = 'http://easy2.cn/6gfh33']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a12-5f2c-4b10-9048-412e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'easy2.cn']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59282a13-31b8-41c4-9512-4782950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:48:00.000Z",
|
||
|
|
"modified": "2017-05-26T13:48:00.000Z",
|
||
|
|
"first_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"last_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59282a13-31b8-41c4-9512-4782950d210f",
|
||
|
|
"ipv4-addr--59282a13-31b8-41c4-9512-4782950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59282a13-31b8-41c4-9512-4782950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59282a13-31b8-41c4-9512-4782950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59282a13-31b8-41c4-9512-4782950d210f",
|
||
|
|
"value": "47.89.53.24"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a14-4a64-41ae-b3e7-487f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[url:value = 'http://eisenerzgrube.de/6gfh33']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a15-ab14-494b-9a05-4913950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'eisenerzgrube.de']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59282a15-9d74-4f6d-a2d3-4133950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:48:00.000Z",
|
||
|
|
"modified": "2017-05-26T13:48:00.000Z",
|
||
|
|
"first_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"last_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59282a15-9d74-4f6d-a2d3-4133950d210f",
|
||
|
|
"ipv4-addr--59282a15-9d74-4f6d-a2d3-4133950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59282a15-9d74-4f6d-a2d3-4133950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59282a15-9d74-4f6d-a2d3-4133950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59282a15-9d74-4f6d-a2d3-4133950d210f",
|
||
|
|
"value": "81.169.145.88"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a16-f19c-4485-84b1-4640950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[url:value = 'http://eselink.com.my/6gfh33']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a17-5e20-4228-b43a-4b19950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'eselink.com.my']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59282a19-d318-4db7-90a0-44f4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:48:00.000Z",
|
||
|
|
"modified": "2017-05-26T13:48:00.000Z",
|
||
|
|
"first_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"last_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59282a19-d318-4db7-90a0-44f4950d210f",
|
||
|
|
"ipv4-addr--59282a19-d318-4db7-90a0-44f4950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59282a19-d318-4db7-90a0-44f4950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59282a19-d318-4db7-90a0-44f4950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59282a19-d318-4db7-90a0-44f4950d210f",
|
||
|
|
"value": "124.150.140.96"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a1a-46bc-48cd-bb32-456f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[url:value = 'http://e-snhv.com/6gfh33']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a1b-6340-4af5-8646-4267950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'e-snhv.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59282a1d-13ac-4c10-a36b-423d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:48:00.000Z",
|
||
|
|
"modified": "2017-05-26T13:48:00.000Z",
|
||
|
|
"first_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"last_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59282a1d-13ac-4c10-a36b-423d950d210f",
|
||
|
|
"ipv4-addr--59282a1d-13ac-4c10-a36b-423d950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59282a1d-13ac-4c10-a36b-423d950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59282a1d-13ac-4c10-a36b-423d950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59282a1d-13ac-4c10-a36b-423d950d210f",
|
||
|
|
"value": "61.106.62.37"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a1e-60d8-4eee-a1ee-4450950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[url:value = 'http://fabriquekorea.com/6gfh33']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a1f-4b1c-464a-b80f-47f2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'fabriquekorea.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59282a21-5688-4bbc-adb2-44a2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:48:00.000Z",
|
||
|
|
"modified": "2017-05-26T13:48:00.000Z",
|
||
|
|
"first_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"last_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59282a21-5688-4bbc-adb2-44a2950d210f",
|
||
|
|
"ipv4-addr--59282a21-5688-4bbc-adb2-44a2950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59282a21-5688-4bbc-adb2-44a2950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59282a21-5688-4bbc-adb2-44a2950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59282a21-5688-4bbc-adb2-44a2950d210f",
|
||
|
|
"value": "211.174.62.52"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a21-d7e4-4524-bacb-4382950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[url:value = 'http://jinqiaonkyy.com/6gfh33']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a22-6a4c-4b4e-ae98-484c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'jinqiaonkyy.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59282a24-80ac-46b9-853a-4b5a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:48:00.000Z",
|
||
|
|
"modified": "2017-05-26T13:48:00.000Z",
|
||
|
|
"first_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"last_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59282a24-80ac-46b9-853a-4b5a950d210f",
|
||
|
|
"ipv4-addr--59282a24-80ac-46b9-853a-4b5a950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59282a24-80ac-46b9-853a-4b5a950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59282a24-80ac-46b9-853a-4b5a950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59282a24-80ac-46b9-853a-4b5a950d210f",
|
||
|
|
"value": "162.251.21.215"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a24-d2bc-49c5-8def-4aed950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[url:value = 'http://orhangazitur.com/6gfh33']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a25-6ddc-47b1-a5b8-4a28950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'orhangazitur.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59282a26-6f9c-49cb-8c0f-4d69950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:48:00.000Z",
|
||
|
|
"modified": "2017-05-26T13:48:00.000Z",
|
||
|
|
"first_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"last_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59282a26-6f9c-49cb-8c0f-4d69950d210f",
|
||
|
|
"ipv4-addr--59282a26-6f9c-49cb-8c0f-4d69950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59282a26-6f9c-49cb-8c0f-4d69950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59282a26-6f9c-49cb-8c0f-4d69950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59282a26-6f9c-49cb-8c0f-4d69950d210f",
|
||
|
|
"value": "109.232.220.235"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a27-facc-4a43-b42b-4bc8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[url:value = 'http://paradigmenergycorp.com/6gfh33']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a27-a8b4-4fab-860b-46b0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'paradigmenergycorp.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59282a28-a288-439e-aff9-4137950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:48:00.000Z",
|
||
|
|
"modified": "2017-05-26T13:48:00.000Z",
|
||
|
|
"first_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"last_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59282a28-a288-439e-aff9-4137950d210f",
|
||
|
|
"ipv4-addr--59282a28-a288-439e-aff9-4137950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59282a28-a288-439e-aff9-4137950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59282a28-a288-439e-aff9-4137950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59282a28-a288-439e-aff9-4137950d210f",
|
||
|
|
"value": "107.180.40.126"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a29-77e8-4a70-b084-466d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[url:value = 'http://poltec.com.au/6gfh33']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a2a-e55c-47f4-9044-452f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'poltec.com.au']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59282a2b-7290-452d-a58c-49eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:48:00.000Z",
|
||
|
|
"modified": "2017-05-26T13:48:00.000Z",
|
||
|
|
"first_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"last_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59282a2b-7290-452d-a58c-49eb950d210f",
|
||
|
|
"ipv4-addr--59282a2b-7290-452d-a58c-49eb950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59282a2b-7290-452d-a58c-49eb950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59282a2b-7290-452d-a58c-49eb950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59282a2b-7290-452d-a58c-49eb950d210f",
|
||
|
|
"value": "27.54.86.236"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a2c-34d8-4d9a-b750-4340950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[url:value = 'http://praktikum-marketing.de/6gfh33']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a2d-794c-4cc5-ab19-493a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'praktikum-marketing.de']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59282a2f-fdac-4630-bce3-40de950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:48:00.000Z",
|
||
|
|
"modified": "2017-05-26T13:48:00.000Z",
|
||
|
|
"first_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"last_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59282a2f-fdac-4630-bce3-40de950d210f",
|
||
|
|
"ipv4-addr--59282a2f-fdac-4630-bce3-40de950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59282a2f-fdac-4630-bce3-40de950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59282a2f-fdac-4630-bce3-40de950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59282a2f-fdac-4630-bce3-40de950d210f",
|
||
|
|
"value": "76.74.235.244"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a30-7b88-40a9-8fa9-47d2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[url:value = 'http://pw-shop.com/6gfh33']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a31-0e64-4e00-a9bc-4f7d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'pw-shop.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59282a32-9854-4402-a645-4ed2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:48:00.000Z",
|
||
|
|
"modified": "2017-05-26T13:48:00.000Z",
|
||
|
|
"first_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"last_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59282a32-9854-4402-a645-4ed2950d210f",
|
||
|
|
"ipv4-addr--59282a32-9854-4402-a645-4ed2950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59282a32-9854-4402-a645-4ed2950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59282a32-9854-4402-a645-4ed2950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59282a32-9854-4402-a645-4ed2950d210f",
|
||
|
|
"value": "93.170.136.50"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a32-36cc-4b99-86d2-4a15950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[url:value = 'http://tasfirin-ustasi.net/6gfh33']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a33-b888-4322-a661-49b3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'tasfirin-ustasi.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59282a34-3298-4f51-bc40-4356950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:48:00.000Z",
|
||
|
|
"modified": "2017-05-26T13:48:00.000Z",
|
||
|
|
"first_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"last_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59282a34-3298-4f51-bc40-4356950d210f",
|
||
|
|
"ipv4-addr--59282a34-3298-4f51-bc40-4356950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59282a34-3298-4f51-bc40-4356950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59282a34-3298-4f51-bc40-4356950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59282a34-3298-4f51-bc40-4356950d210f",
|
||
|
|
"value": "95.173.189.38"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a35-9d84-4cbd-97f0-4add950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[url:value = 'http://thanprints.com/6gfh33']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a35-16a0-4f69-afcd-4c5a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'thanprints.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59282a38-4f38-41a2-a02b-4a08950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:48:00.000Z",
|
||
|
|
"modified": "2017-05-26T13:48:00.000Z",
|
||
|
|
"first_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"last_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59282a38-4f38-41a2-a02b-4a08950d210f",
|
||
|
|
"ipv4-addr--59282a38-4f38-41a2-a02b-4a08950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59282a38-4f38-41a2-a02b-4a08950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59282a38-4f38-41a2-a02b-4a08950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59282a38-4f38-41a2-a02b-4a08950d210f",
|
||
|
|
"value": "61.19.251.181"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a38-da10-4718-b142-4035950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[url:value = 'http://trade-unite.ru/6gfh33']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a39-61cc-4a85-a560-4331950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'trade-unite.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59282a3a-2578-4dfe-beb5-4011950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:48:00.000Z",
|
||
|
|
"modified": "2017-05-26T13:48:00.000Z",
|
||
|
|
"first_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"last_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59282a3a-2578-4dfe-beb5-4011950d210f",
|
||
|
|
"ipv4-addr--59282a3a-2578-4dfe-beb5-4011950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59282a3a-2578-4dfe-beb5-4011950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59282a3a-2578-4dfe-beb5-4011950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59282a3a-2578-4dfe-beb5-4011950d210f",
|
||
|
|
"value": "80.78.245.178"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a3b-5c34-492a-accc-4c3f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[url:value = 'http://vigs.mx/6gfh33']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a3c-7528-4b92-bd56-41f4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'vigs.mx']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59282a3e-7e78-4d61-a42f-4b86950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:48:00.000Z",
|
||
|
|
"modified": "2017-05-26T13:48:00.000Z",
|
||
|
|
"first_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"last_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59282a3e-7e78-4d61-a42f-4b86950d210f",
|
||
|
|
"ipv4-addr--59282a3e-7e78-4d61-a42f-4b86950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59282a3e-7e78-4d61-a42f-4b86950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59282a3e-7e78-4d61-a42f-4b86950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59282a3e-7e78-4d61-a42f-4b86950d210f",
|
||
|
|
"value": "192.185.48.180"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a3f-1ae4-4fcf-bf7f-498f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[url:value = 'http://www.buchenried.de/6gfh33']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a40-0b8c-4a97-b149-4a7f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'www.buchenried.de']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a41-e010-49b9-8b50-4495950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[url:value = 'http://youtoolgrabeertorse.org/af/6gfh33']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a41-6fec-4ac0-a04b-4178950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'youtoolgrabeertorse.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a47-d4c4-4c25-b0a4-4723950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[url:value = 'http://comboratiogferrdto.com/a5/']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282a47-a674-4fc4-a581-4d5d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:33:51.000Z",
|
||
|
|
"modified": "2017-05-26T13:33:51.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'comboratiogferrdto.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:33:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59282a49-9c80-41e4-93da-4474950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:48:00.000Z",
|
||
|
|
"modified": "2017-05-26T13:48:00.000Z",
|
||
|
|
"first_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"last_observed": "2017-05-26T13:48:00Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59282a49-9c80-41e4-93da-4474950d210f",
|
||
|
|
"ipv4-addr--59282a49-9c80-41e4-93da-4474950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59282a49-9c80-41e4-93da-4474950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59282a49-9c80-41e4-93da-4474950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59282a49-9c80-41e4-93da-4474950d210f",
|
||
|
|
"value": "46.173.218.145"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282ed9-3cd8-4a48-b42a-406002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:34:17.000Z",
|
||
|
|
"modified": "2017-05-26T13:34:17.000Z",
|
||
|
|
"description": "- Xchecked via VT: 6708cc80916e838a9bbed09c91854230",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '375ba5457b0a8e0328f38e942dc16fa07e03e2b39571392c0f10f93031158d6f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:34:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282ed9-ad38-4ac8-ae12-46e502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:34:17.000Z",
|
||
|
|
"modified": "2017-05-26T13:34:17.000Z",
|
||
|
|
"description": "- Xchecked via VT: 6708cc80916e838a9bbed09c91854230",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'd4b86429537c3b1d9e15e96a965166fc053efbd0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:34:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59282eda-d98c-43d0-8c94-442002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:34:17.000Z",
|
||
|
|
"modified": "2017-05-26T13:34:17.000Z",
|
||
|
|
"first_observed": "2017-05-26T13:34:17Z",
|
||
|
|
"last_observed": "2017-05-26T13:34:17Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--59282eda-d98c-43d0-8c94-442002de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--59282eda-d98c-43d0-8c94-442002de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/375ba5457b0a8e0328f38e942dc16fa07e03e2b39571392c0f10f93031158d6f/analysis/1495799038/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282eda-fca4-4b2b-8583-444f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:34:18.000Z",
|
||
|
|
"modified": "2017-05-26T13:34:18.000Z",
|
||
|
|
"description": "- Xchecked via VT: aace687d16706b05aa49c9b7fff7572b",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '68c7b7d97fada3f558a54260491ffe1ce77add158f8a91c2599432f13718b807']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:34:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59282eda-05ac-46fe-882e-4c1202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:34:18.000Z",
|
||
|
|
"modified": "2017-05-26T13:34:18.000Z",
|
||
|
|
"description": "- Xchecked via VT: aace687d16706b05aa49c9b7fff7572b",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '124e4c77e52026c2de1a88be302c00a6db4f936b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-05-26T13:34:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59282edb-5dbc-4c23-9c2d-4fbd02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-05-26T13:34:19.000Z",
|
||
|
|
"modified": "2017-05-26T13:34:19.000Z",
|
||
|
|
"first_observed": "2017-05-26T13:34:19Z",
|
||
|
|
"last_observed": "2017-05-26T13:34:19Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--59282edb-5dbc-4c23-9c2d-4fbd02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--59282edb-5dbc-4c23-9c2d-4fbd02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/68c7b7d97fada3f558a54260491ffe1ce77add158f8a91c2599432f13718b807/analysis/1495798709/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|