1263 lines
50 KiB
JSON
1263 lines
50 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--59c8f958-be58-46da-8a21-4c5f950d210f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:58:00.000Z",
|
||
|
|
"modified": "2017-09-25T12:58:00.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--59c8f958-be58-46da-8a21-4c5f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:58:00.000Z",
|
||
|
|
"modified": "2017-09-25T12:58:00.000Z",
|
||
|
|
"name": "M2M - Locky 2017-09-25 : Affid=3, offline, \".ykcol\" : \"Message from 02087654321\" - \"Voice Message.7z\"",
|
||
|
|
"published": "2017-09-25T12:58:05Z",
|
||
|
|
"object_refs": [
|
||
|
|
"indicator--59c8f959-ac8c-4e13-936e-9b1f950d210f",
|
||
|
|
"indicator--59c8f959-481c-4f85-a01f-4dd9950d210f",
|
||
|
|
"indicator--59c8f959-cd48-45c3-8d58-4c5f950d210f",
|
||
|
|
"indicator--59c8f977-c8b4-4c61-ba89-4c64950d210f",
|
||
|
|
"indicator--59c8f978-11f8-4997-8f83-4d7e950d210f",
|
||
|
|
"observed-data--59c8f978-9e6c-4301-9e45-4ad5950d210f",
|
||
|
|
"network-traffic--59c8f978-9e6c-4301-9e45-4ad5950d210f",
|
||
|
|
"ipv4-addr--59c8f978-9e6c-4301-9e45-4ad5950d210f",
|
||
|
|
"indicator--59c8f978-e850-40fd-85eb-9dc2950d210f",
|
||
|
|
"indicator--59c8f978-557c-42cb-8552-4dd6950d210f",
|
||
|
|
"observed-data--59c8f979-6138-4c7c-9cbc-4137950d210f",
|
||
|
|
"network-traffic--59c8f979-6138-4c7c-9cbc-4137950d210f",
|
||
|
|
"ipv4-addr--59c8f979-6138-4c7c-9cbc-4137950d210f",
|
||
|
|
"indicator--59c8f979-2bec-4e95-9bee-4bf6950d210f",
|
||
|
|
"indicator--59c8f979-e378-452d-9637-408a950d210f",
|
||
|
|
"observed-data--59c8f979-1298-4b34-a5e9-4c2f950d210f",
|
||
|
|
"network-traffic--59c8f979-1298-4b34-a5e9-4c2f950d210f",
|
||
|
|
"ipv4-addr--59c8f979-1298-4b34-a5e9-4c2f950d210f",
|
||
|
|
"indicator--59c8f97a-7670-41df-976e-4c5f950d210f",
|
||
|
|
"indicator--59c8f97a-7130-4898-874b-9dc2950d210f",
|
||
|
|
"observed-data--59c8f97c-71e0-45cf-a3a3-4c64950d210f",
|
||
|
|
"network-traffic--59c8f97c-71e0-45cf-a3a3-4c64950d210f",
|
||
|
|
"ipv4-addr--59c8f97c-71e0-45cf-a3a3-4c64950d210f",
|
||
|
|
"indicator--59c8f97c-cc4c-44b9-a834-4c2f950d210f",
|
||
|
|
"indicator--59c8f97c-450c-41b9-b8f9-9b1f950d210f",
|
||
|
|
"observed-data--59c8f97c-07cc-4b9d-b850-4214950d210f",
|
||
|
|
"network-traffic--59c8f97c-07cc-4b9d-b850-4214950d210f",
|
||
|
|
"ipv4-addr--59c8f97c-07cc-4b9d-b850-4214950d210f",
|
||
|
|
"indicator--59c8f97d-28d0-4993-bb4b-42ad950d210f",
|
||
|
|
"indicator--59c8f97d-4d8c-4f56-94c2-45f8950d210f",
|
||
|
|
"observed-data--59c8f97d-4cbc-422c-bc56-4bcd950d210f",
|
||
|
|
"network-traffic--59c8f97d-4cbc-422c-bc56-4bcd950d210f",
|
||
|
|
"ipv4-addr--59c8f97d-4cbc-422c-bc56-4bcd950d210f",
|
||
|
|
"indicator--59c8f97d-7e08-4283-a747-4bf6950d210f",
|
||
|
|
"indicator--59c8f97e-e30c-41cd-926e-4678950d210f",
|
||
|
|
"observed-data--59c8f97e-8c5c-495e-b382-9b1f950d210f",
|
||
|
|
"network-traffic--59c8f97e-8c5c-495e-b382-9b1f950d210f",
|
||
|
|
"ipv4-addr--59c8f97e-8c5c-495e-b382-9b1f950d210f",
|
||
|
|
"indicator--59c8f97e-e88c-4032-849d-4c5f950d210f",
|
||
|
|
"indicator--59c8f97e-2678-46af-8143-9dc2950d210f",
|
||
|
|
"observed-data--59c8f97f-1d84-4154-b141-9b8f950d210f",
|
||
|
|
"network-traffic--59c8f97f-1d84-4154-b141-9b8f950d210f",
|
||
|
|
"ipv4-addr--59c8f97f-1d84-4154-b141-9b8f950d210f",
|
||
|
|
"indicator--59c8f980-4d24-4b52-a6b8-45dd950d210f",
|
||
|
|
"indicator--59c8f980-1a10-449c-8ff4-4db4950d210f",
|
||
|
|
"observed-data--59c8f980-3d88-4246-80ef-4f5e950d210f",
|
||
|
|
"network-traffic--59c8f980-3d88-4246-80ef-4f5e950d210f",
|
||
|
|
"ipv4-addr--59c8f980-3d88-4246-80ef-4f5e950d210f",
|
||
|
|
"indicator--59c8f980-130c-4261-ade3-454a950d210f",
|
||
|
|
"indicator--59c8f980-2a50-4b1a-8267-9dc2950d210f",
|
||
|
|
"observed-data--59c8f981-bd88-4432-b8c1-4c2f950d210f",
|
||
|
|
"network-traffic--59c8f981-bd88-4432-b8c1-4c2f950d210f",
|
||
|
|
"ipv4-addr--59c8f981-bd88-4432-b8c1-4c2f950d210f",
|
||
|
|
"indicator--59c8f981-d878-4b0d-8f17-4075950d210f",
|
||
|
|
"indicator--59c8f981-1400-44b1-b1ed-4df4950d210f",
|
||
|
|
"observed-data--59c8f981-0550-4d85-b6e3-44da950d210f",
|
||
|
|
"network-traffic--59c8f981-0550-4d85-b6e3-44da950d210f",
|
||
|
|
"ipv4-addr--59c8f981-0550-4d85-b6e3-44da950d210f",
|
||
|
|
"indicator--59c8f982-981c-4dbb-a0e5-4797950d210f",
|
||
|
|
"indicator--59c8f982-7b54-4776-921a-9dc2950d210f",
|
||
|
|
"indicator--59c8f988-7a04-42bb-a64e-4241950d210f",
|
||
|
|
"indicator--59c8f989-aeec-4911-a6f0-4f1a950d210f",
|
||
|
|
"observed-data--59c8f98c-1ecc-45fc-a30f-40f3950d210f",
|
||
|
|
"network-traffic--59c8f98c-1ecc-45fc-a30f-40f3950d210f",
|
||
|
|
"ipv4-addr--59c8f98c-1ecc-45fc-a30f-40f3950d210f",
|
||
|
|
"indicator--59c8fcfd-834c-42e6-862e-403d02de0b81",
|
||
|
|
"indicator--59c8fcfd-39fc-469c-bdaf-4d5802de0b81",
|
||
|
|
"observed-data--59c8fcfd-6024-4980-ba2c-4fe102de0b81",
|
||
|
|
"url--59c8fcfd-6024-4980-ba2c-4fe102de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"ecsirt:malicious-code=\"ransomware\"",
|
||
|
|
"misp-galaxy:ransomware=\"Locky\""
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c8f959-ac8c-4e13-936e-9b1f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '8dbdd9122dadc54f21747cc4f0ab267c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-25T12:56:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c8f959-481c-4f85-a01f-4dd9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"pattern": "[url:value = 'http://artplast.uz/YTkjdJH7w1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-25T12:56:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c8f959-cd48-45c3-8d58-4c5f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'artplast.uz']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-25T12:56:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c8f977-c8b4-4c61-ba89-4c64950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"pattern": "[url:value = 'http://asesoreszapico.com/YTkjdJH7w1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-25T12:56:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c8f978-11f8-4997-8f83-4d7e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'asesoreszapico.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-25T12:56:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c8f978-9e6c-4301-9e45-4ad5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"first_observed": "2017-09-25T12:56:29Z",
|
||
|
|
"last_observed": "2017-09-25T12:56:29Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c8f978-9e6c-4301-9e45-4ad5950d210f",
|
||
|
|
"ipv4-addr--59c8f978-9e6c-4301-9e45-4ad5950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c8f978-9e6c-4301-9e45-4ad5950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c8f978-9e6c-4301-9e45-4ad5950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c8f978-9e6c-4301-9e45-4ad5950d210f",
|
||
|
|
"value": "212.89.16.142"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c8f978-e850-40fd-85eb-9dc2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"pattern": "[url:value = 'http://asheardontheradiogreens.com/YTkjdJH7w1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-25T12:56:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c8f978-557c-42cb-8552-4dd6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'asheardontheradiogreens.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-25T12:56:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c8f979-6138-4c7c-9cbc-4137950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"first_observed": "2017-09-25T12:56:29Z",
|
||
|
|
"last_observed": "2017-09-25T12:56:29Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c8f979-6138-4c7c-9cbc-4137950d210f",
|
||
|
|
"ipv4-addr--59c8f979-6138-4c7c-9cbc-4137950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c8f979-6138-4c7c-9cbc-4137950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c8f979-6138-4c7c-9cbc-4137950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c8f979-6138-4c7c-9cbc-4137950d210f",
|
||
|
|
"value": "199.30.241.139"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c8f979-2bec-4e95-9bee-4bf6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"pattern": "[url:value = 'http://audio-pa-service.de/YTkjdJH7w1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-25T12:56:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c8f979-e378-452d-9637-408a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'audio-pa-service.de']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-25T12:56:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c8f979-1298-4b34-a5e9-4c2f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"first_observed": "2017-09-25T12:56:29Z",
|
||
|
|
"last_observed": "2017-09-25T12:56:29Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c8f979-1298-4b34-a5e9-4c2f950d210f",
|
||
|
|
"ipv4-addr--59c8f979-1298-4b34-a5e9-4c2f950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c8f979-1298-4b34-a5e9-4c2f950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c8f979-1298-4b34-a5e9-4c2f950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c8f979-1298-4b34-a5e9-4c2f950d210f",
|
||
|
|
"value": "81.169.244.233"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c8f97a-7670-41df-976e-4c5f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"pattern": "[url:value = 'http://augsburger-maerchentheater.de/YTkjdJH7w1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-25T12:56:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c8f97a-7130-4898-874b-9dc2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'augsburger-maerchentheater.de']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-25T12:56:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c8f97c-71e0-45cf-a3a3-4c64950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"first_observed": "2017-09-25T12:56:29Z",
|
||
|
|
"last_observed": "2017-09-25T12:56:29Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c8f97c-71e0-45cf-a3a3-4c64950d210f",
|
||
|
|
"ipv4-addr--59c8f97c-71e0-45cf-a3a3-4c64950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c8f97c-71e0-45cf-a3a3-4c64950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c8f97c-71e0-45cf-a3a3-4c64950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c8f97c-71e0-45cf-a3a3-4c64950d210f",
|
||
|
|
"value": "94.102.214.231"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c8f97c-cc4c-44b9-a834-4c2f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"pattern": "[url:value = 'http://auto-ecole-prudence.com/YTkjdJH7w1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-25T12:56:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c8f97c-450c-41b9-b8f9-9b1f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'auto-ecole-prudence.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-25T12:56:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c8f97c-07cc-4b9d-b850-4214950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"first_observed": "2017-09-25T12:56:29Z",
|
||
|
|
"last_observed": "2017-09-25T12:56:29Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c8f97c-07cc-4b9d-b850-4214950d210f",
|
||
|
|
"ipv4-addr--59c8f97c-07cc-4b9d-b850-4214950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c8f97c-07cc-4b9d-b850-4214950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c8f97c-07cc-4b9d-b850-4214950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c8f97c-07cc-4b9d-b850-4214950d210f",
|
||
|
|
"value": "193.227.248.247"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c8f97d-28d0-4993-bb4b-42ad950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"pattern": "[url:value = 'http://automattenonline.com/YTkjdJH7w1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-25T12:56:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c8f97d-4d8c-4f56-94c2-45f8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'automattenonline.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-25T12:56:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c8f97d-4cbc-422c-bc56-4bcd950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"first_observed": "2017-09-25T12:56:29Z",
|
||
|
|
"last_observed": "2017-09-25T12:56:29Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c8f97d-4cbc-422c-bc56-4bcd950d210f",
|
||
|
|
"ipv4-addr--59c8f97d-4cbc-422c-bc56-4bcd950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c8f97d-4cbc-422c-bc56-4bcd950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c8f97d-4cbc-422c-bc56-4bcd950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c8f97d-4cbc-422c-bc56-4bcd950d210f",
|
||
|
|
"value": "149.210.129.109"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c8f97d-7e08-4283-a747-4bf6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"pattern": "[url:value = 'http://awoodshop.net/YTkjdJH7w1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-25T12:56:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c8f97e-e30c-41cd-926e-4678950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'awoodshop.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-25T12:56:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c8f97e-8c5c-495e-b382-9b1f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"first_observed": "2017-09-25T12:56:29Z",
|
||
|
|
"last_observed": "2017-09-25T12:56:29Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c8f97e-8c5c-495e-b382-9b1f950d210f",
|
||
|
|
"ipv4-addr--59c8f97e-8c5c-495e-b382-9b1f950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c8f97e-8c5c-495e-b382-9b1f950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c8f97e-8c5c-495e-b382-9b1f950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c8f97e-8c5c-495e-b382-9b1f950d210f",
|
||
|
|
"value": "72.32.177.50"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c8f97e-e88c-4032-849d-4c5f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"pattern": "[url:value = 'http://azimuth.com.pt/YTkjdJH7w1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-25T12:56:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c8f97e-2678-46af-8143-9dc2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'azimuth.com.pt']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-25T12:56:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c8f97f-1d84-4154-b141-9b8f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"first_observed": "2017-09-25T12:56:29Z",
|
||
|
|
"last_observed": "2017-09-25T12:56:29Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c8f97f-1d84-4154-b141-9b8f950d210f",
|
||
|
|
"ipv4-addr--59c8f97f-1d84-4154-b141-9b8f950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c8f97f-1d84-4154-b141-9b8f950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c8f97f-1d84-4154-b141-9b8f950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c8f97f-1d84-4154-b141-9b8f950d210f",
|
||
|
|
"value": "80.172.241.36"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c8f980-4d24-4b52-a6b8-45dd950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"pattern": "[url:value = 'http://baburkuyumculuk.com/YTkjdJH7w1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-25T12:56:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c8f980-1a10-449c-8ff4-4db4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'baburkuyumculuk.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-25T12:56:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c8f980-3d88-4246-80ef-4f5e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"first_observed": "2017-09-25T12:56:29Z",
|
||
|
|
"last_observed": "2017-09-25T12:56:29Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c8f980-3d88-4246-80ef-4f5e950d210f",
|
||
|
|
"ipv4-addr--59c8f980-3d88-4246-80ef-4f5e950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c8f980-3d88-4246-80ef-4f5e950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c8f980-3d88-4246-80ef-4f5e950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c8f980-3d88-4246-80ef-4f5e950d210f",
|
||
|
|
"value": "213.142.143.191"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c8f980-130c-4261-ade3-454a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"pattern": "[url:value = 'http://bagnolipisa.it/YTkjdJH7w1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-25T12:56:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c8f980-2a50-4b1a-8267-9dc2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'bagnolipisa.it']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-25T12:56:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c8f981-bd88-4432-b8c1-4c2f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"first_observed": "2017-09-25T12:56:29Z",
|
||
|
|
"last_observed": "2017-09-25T12:56:29Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c8f981-bd88-4432-b8c1-4c2f950d210f",
|
||
|
|
"ipv4-addr--59c8f981-bd88-4432-b8c1-4c2f950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c8f981-bd88-4432-b8c1-4c2f950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c8f981-bd88-4432-b8c1-4c2f950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c8f981-bd88-4432-b8c1-4c2f950d210f",
|
||
|
|
"value": "77.72.25.23"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c8f981-d878-4b0d-8f17-4075950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"pattern": "[url:value = 'http://barberomudanzas.com/YTkjdJH7w1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-25T12:56:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c8f981-1400-44b1-b1ed-4df4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'barberomudanzas.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-25T12:56:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c8f981-0550-4d85-b6e3-44da950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"first_observed": "2017-09-25T12:56:29Z",
|
||
|
|
"last_observed": "2017-09-25T12:56:29Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c8f981-0550-4d85-b6e3-44da950d210f",
|
||
|
|
"ipv4-addr--59c8f981-0550-4d85-b6e3-44da950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c8f981-0550-4d85-b6e3-44da950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c8f981-0550-4d85-b6e3-44da950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c8f981-0550-4d85-b6e3-44da950d210f",
|
||
|
|
"value": "188.93.75.198"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c8f982-981c-4dbb-a0e5-4797950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:28.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:28.000Z",
|
||
|
|
"pattern": "[url:value = 'http://bor.uz/YTkjdJH7w1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-25T12:56:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c8f982-7b54-4776-921a-9dc2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'bor.uz']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-25T12:56:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c8f988-7a04-42bb-a64e-4241950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:28.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:28.000Z",
|
||
|
|
"pattern": "[url:value = 'http://tertrodefordown.info/af/YTkjdJH7w1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-25T12:56:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c8f989-aeec-4911-a6f0-4f1a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:28.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:28.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'tertrodefordown.info']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-25T12:56:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c8f98c-1ecc-45fc-a30f-40f3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:28.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:28.000Z",
|
||
|
|
"first_observed": "2017-09-25T12:56:28Z",
|
||
|
|
"last_observed": "2017-09-25T12:56:28Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c8f98c-1ecc-45fc-a30f-40f3950d210f",
|
||
|
|
"ipv4-addr--59c8f98c-1ecc-45fc-a30f-40f3950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c8f98c-1ecc-45fc-a30f-40f3950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c8f98c-1ecc-45fc-a30f-40f3950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c8f98c-1ecc-45fc-a30f-40f3950d210f",
|
||
|
|
"value": "49.51.36.73"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c8fcfd-834c-42e6-862e-403d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"description": "- Xchecked via VT: 8dbdd9122dadc54f21747cc4f0ab267c",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b86a830769fcfd54201495353c5ab8931f7ca796ef54a2219a04b9e7cb7d2a7a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-25T12:56:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c8fcfd-39fc-469c-bdaf-4d5802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"description": "- Xchecked via VT: 8dbdd9122dadc54f21747cc4f0ab267c",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '7f07f3b5ba830d55822f75836f0bbbe0ef579256']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-25T12:56:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c8fcfd-6024-4980-ba2c-4fe102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T12:56:29.000Z",
|
||
|
|
"modified": "2017-09-25T12:56:29.000Z",
|
||
|
|
"first_observed": "2017-09-25T12:56:29Z",
|
||
|
|
"last_observed": "2017-09-25T12:56:29Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--59c8fcfd-6024-4980-ba2c-4fe102de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--59c8fcfd-6024-4980-ba2c-4fe102de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/b86a830769fcfd54201495353c5ab8931f7ca796ef54a2219a04b9e7cb7d2a7a/analysis/1506338916/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|