2023-04-21 13:25:09 +00:00
{
2023-06-14 17:31:25 +00:00
"type" : "bundle" ,
"id" : "bundle--5718d275-88d4-492e-9f07-43ee950d210f" ,
"objects" : [
{
"type" : "identity" ,
"spec_version" : "2.1" ,
"id" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T15:07:29.000Z" ,
"modified" : "2016-04-21T15:07:29.000Z" ,
"name" : "CIRCL" ,
"identity_class" : "organization"
} ,
{
"type" : "report" ,
"spec_version" : "2.1" ,
"id" : "report--5718d275-88d4-492e-9f07-43ee950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T15:07:29.000Z" ,
"modified" : "2016-04-21T15:07:29.000Z" ,
"name" : "OSINT - \u00e2\u20ac\u0153Operation C-Major\u00e2\u20ac\u009d Actors Also Used Android, BlackBerry Mobile Spyware Against Targets" ,
"published" : "2016-04-21T15:15:02Z" ,
"object_refs" : [
"observed-data--5718d28f-6890-4731-95e4-4b42950d210f" ,
"url--5718d28f-6890-4731-95e4-4b42950d210f" ,
"x-misp-attribute--5718d2a3-a008-4c0d-ba56-4ec7950d210f" ,
"indicator--5718d4f3-98c0-40be-a296-40f8950d210f" ,
"indicator--5718d4f3-43a4-4bbd-bf88-40c4950d210f" ,
"indicator--5718d4f3-ba78-4f00-a3d3-4232950d210f" ,
"indicator--5718d4f4-ef9c-46a2-8d75-4f77950d210f" ,
"indicator--5718d4f4-d518-44d4-aef8-442a950d210f" ,
"indicator--5718d4f5-e228-4ed6-b03a-4bff950d210f" ,
"indicator--5718d4f5-cdac-47c9-ae00-43d2950d210f" ,
"indicator--5718d4f5-84c8-4878-b3a9-4d19950d210f" ,
"indicator--5718d54c-be50-4f58-83e2-408c950d210f" ,
"indicator--5718d54d-2990-4cb5-9bfd-4883950d210f" ,
"indicator--5718d54d-4be0-4e06-9405-4d66950d210f" ,
"indicator--5718d54e-8b80-4d4b-9b3f-48a3950d210f" ,
"indicator--5718d54e-7dc8-49eb-9432-449a950d210f" ,
"indicator--5718d54e-6f18-48bd-aa39-43f1950d210f" ,
"indicator--5718d54f-23a8-44b0-86b4-46a7950d210f" ,
"indicator--5718d54f-8be4-4981-8136-4bb4950d210f" ,
"indicator--5718d54f-e3d0-4a0a-9f5c-45a8950d210f" ,
"indicator--5718e3a8-eef0-4849-81fd-470c950d210f" ,
"indicator--5718ecb1-fb28-4bb5-85e0-40b702de0b81" ,
"indicator--5718ecb2-9428-4848-83fb-405b02de0b81" ,
"observed-data--5718ecb2-efec-4668-8f3e-493002de0b81" ,
"url--5718ecb2-efec-4668-8f3e-493002de0b81" ,
"indicator--5718ecb3-1d2c-47aa-b21c-474302de0b81" ,
"indicator--5718ecb3-71bc-491c-8314-48ad02de0b81" ,
"observed-data--5718ecb3-9f58-4d1a-8e7f-408f02de0b81" ,
"url--5718ecb3-9f58-4d1a-8e7f-408f02de0b81" ,
"indicator--5718ecb4-03c4-4676-ac2e-4c5002de0b81" ,
"indicator--5718ecb4-dd44-44ee-9cd3-4b0702de0b81" ,
"observed-data--5718ecb4-8b60-44dd-bc05-483e02de0b81" ,
"url--5718ecb4-8b60-44dd-bc05-483e02de0b81" ,
"indicator--5718ecb5-a7d0-4a52-bd6c-4bcd02de0b81" ,
"indicator--5718ecb5-fa50-4255-823a-4b5702de0b81" ,
"observed-data--5718ecb5-1ad4-4fb3-9889-4b1802de0b81" ,
"url--5718ecb5-1ad4-4fb3-9889-4b1802de0b81" ,
"indicator--5718ecb6-a3fc-4ab9-ad1a-48ce02de0b81" ,
"indicator--5718ecb6-117c-45d3-951e-4c0402de0b81" ,
"observed-data--5718ecb7-3c5c-4b28-8cf0-46f402de0b81" ,
"url--5718ecb7-3c5c-4b28-8cf0-46f402de0b81" ,
"indicator--5718ecb7-a578-4bc5-b9c2-48b602de0b81" ,
"indicator--5718ecb7-3210-4790-b39c-4cba02de0b81" ,
"observed-data--5718ecb8-7d80-4ee0-9656-43f602de0b81" ,
"url--5718ecb8-7d80-4ee0-9656-43f602de0b81" ,
"indicator--5718ecb8-1018-4832-8633-448602de0b81" ,
"indicator--5718ecb9-5f4c-48f3-80c9-413202de0b81" ,
"observed-data--5718ecb9-acdc-4965-83d0-4a9c02de0b81" ,
"url--5718ecb9-acdc-4965-83d0-4a9c02de0b81" ,
"indicator--5718ecb9-67b8-422e-b4d1-4f8202de0b81" ,
"indicator--5718ecba-bc08-4277-9a9f-473002de0b81" ,
"observed-data--5718ecba-61b8-46ad-aef6-4bc502de0b81" ,
"url--5718ecba-61b8-46ad-aef6-4bc502de0b81"
] ,
"labels" : [
"Threat-Report" ,
"misp:tool=\"MISP-STIX-Converter\"" ,
"type:OSINT"
] ,
"object_marking_refs" : [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5718d28f-6890-4731-95e4-4b42950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T13:15:59.000Z" ,
"modified" : "2016-04-21T13:15:59.000Z" ,
"first_observed" : "2016-04-21T13:15:59Z" ,
"last_observed" : "2016-04-21T13:15:59Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5718d28f-6890-4731-95e4-4b42950d210f"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5718d28f-6890-4731-95e4-4b42950d210f" ,
"value" : "http://blog.trendmicro.com/trendlabs-security-intelligence/operation-c-major-actors-also-used-android-blackberry-mobile-spyware-targets/"
} ,
{
"type" : "x-misp-attribute" ,
"spec_version" : "2.1" ,
"id" : "x-misp-attribute--5718d2a3-a008-4c0d-ba56-4ec7950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T13:16:19.000Z" ,
"modified" : "2016-04-21T13:16:19.000Z" ,
"labels" : [
"misp:type=\"comment\"" ,
"misp:category=\"External analysis\""
] ,
"x_misp_category" : "External analysis" ,
"x_misp_type" : "comment" ,
"x_misp_value" : "Last March, we reported on Operation C-Major, an active information theft campaign that was able to steal sensitive information from high profile targets in India. The campaign was able to steal large amounts of data despite using relatively simple malware because it used clever social engineering tactics against its targets. In this post, we will focus on the mobile part of their operation and discuss in detail several Android and BlackBerry apps they are using. Based on our investigation, the actors behind Operation C-Major were able to keep their Android malware on Google Play for months and they advertised their apps on Facebook pages which have thousands of likes from high profile targets."
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718d4f3-98c0-40be-a296-40f8950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T13:26:26.000Z" ,
"modified" : "2016-04-21T13:26:26.000Z" ,
"description" : "Smesh app" ,
"pattern" : "[file:hashes.SHA1 = '24f52c5f909d79a70e6e2a4e89aa7816b5f24aec']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T13:26:26Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718d4f3-43a4-4bbd-bf88-40c4950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T13:26:31.000Z" ,
"modified" : "2016-04-21T13:26:31.000Z" ,
"description" : "Smesh app" ,
"pattern" : "[file:hashes.SHA1 = '202f11c5cf2b9df8bf8ab766a33cd0e6d7a5161a']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T13:26:31Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718d4f3-ba78-4f00-a3d3-4232950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T13:26:38.000Z" ,
"modified" : "2016-04-21T13:26:38.000Z" ,
"description" : "Smesh app" ,
"pattern" : "[file:hashes.SHA1 = '31ac19091fd5347568b130d7150ed867ffe38c28']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T13:26:38Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718d4f4-ef9c-46a2-8d75-4f77950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T13:26:56.000Z" ,
"modified" : "2016-04-21T13:26:56.000Z" ,
"description" : "Smesh app" ,
"pattern" : "[file:hashes.SHA1 = '6919aa3a9d5e193a1d48e05e7bf320d795923ea7']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T13:26:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718d4f4-d518-44d4-aef8-442a950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T13:26:42.000Z" ,
"modified" : "2016-04-21T13:26:42.000Z" ,
"description" : "Smesh app" ,
"pattern" : "[file:hashes.SHA1 = 'c48a5d639430e08980f1aeb5af49310692f2701b']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T13:26:42Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718d4f5-e228-4ed6-b03a-4bff950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T13:26:52.000Z" ,
"modified" : "2016-04-21T13:26:52.000Z" ,
"description" : "Smesh app" ,
"pattern" : "[file:hashes.SHA1 = '1ce6b3f02fe2e4ee201bdab2c1e4f6bb5a8da1b1']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T13:26:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718d4f5-cdac-47c9-ae00-43d2950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T13:26:48.000Z" ,
"modified" : "2016-04-21T13:26:48.000Z" ,
"description" : "Smesh app" ,
"pattern" : "[file:hashes.SHA1 = '59aec5002684de8cc8c27f7512ed70c094e4bd20']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T13:26:48Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718d4f5-84c8-4878-b3a9-4d19950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T13:26:45.000Z" ,
"modified" : "2016-04-21T13:26:45.000Z" ,
"description" : "Smesh app" ,
"pattern" : "[file:hashes.SHA1 = '552e3a16dd36ae4a3d4480182124a3f6701911f2']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T13:26:45Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718d54c-be50-4f58-83e2-408c950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T13:27:40.000Z" ,
"modified" : "2016-04-21T13:27:40.000Z" ,
"description" : "Ringster" ,
"pattern" : "[file:hashes.SHA1 = 'c544e5d8c6f38bb199283f11f799da8f3bb3807f']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T13:27:40Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718d54d-2990-4cb5-9bfd-4883950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T13:27:41.000Z" ,
"modified" : "2016-04-21T13:27:41.000Z" ,
"description" : "Ringster" ,
"pattern" : "[file:hashes.SHA1 = 'a13568164c0a8f50d76d9ffa6e34e31674a3afc8']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T13:27:41Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718d54d-4be0-4e06-9405-4d66950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T13:27:41.000Z" ,
"modified" : "2016-04-21T13:27:41.000Z" ,
"description" : "Androrat" ,
"pattern" : "[file:hashes.SHA1 = '9288811c9747d151eab4ec708b368fc6cc4e2cb5']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T13:27:41Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718d54e-8b80-4d4b-9b3f-48a3950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T13:27:42.000Z" ,
"modified" : "2016-04-21T13:27:42.000Z" ,
"description" : "Androrat" ,
"pattern" : "[file:hashes.SHA1 = '94c74a9e5d1aab18f51487e4e47e5995b7252c4b']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T13:27:42Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718d54e-7dc8-49eb-9432-449a950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T13:27:42.000Z" ,
"modified" : "2016-04-21T13:27:42.000Z" ,
"description" : "Androrat" ,
"pattern" : "[file:hashes.SHA1 = 'decf429be7d469292827c3b873f7e61076ffbba1']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T13:27:42Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718d54e-6f18-48bd-aa39-43f1950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T13:27:42.000Z" ,
"modified" : "2016-04-21T13:27:42.000Z" ,
"description" : "Androrat" ,
"pattern" : "[file:hashes.SHA1 = 'f86302da2d38bf60f1ea9549b2e21a34fe655b33']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T13:27:42Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718d54f-23a8-44b0-86b4-46a7950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T13:27:43.000Z" ,
"modified" : "2016-04-21T13:27:43.000Z" ,
"description" : "India Sena News" ,
"pattern" : "[file:hashes.SHA1 = 'b142e4b75a4562cdaad5cc2610d31594d2ed17c3']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T13:27:43Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718d54f-8be4-4981-8136-4bb4950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T13:27:43.000Z" ,
"modified" : "2016-04-21T13:27:43.000Z" ,
"description" : "BlackBerry spyware" ,
"pattern" : "[file:hashes.SHA1 = 'abcb176578df44c2be7173b318abe704963052b2']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T13:27:43Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718d54f-e3d0-4a0a-9f5c-45a8950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T13:27:43.000Z" ,
"modified" : "2016-04-21T13:27:43.000Z" ,
"description" : "BlackBerry spyware" ,
"pattern" : "[file:hashes.SHA1 = '16318c4e4f94a5c4018b05955975771637b306b4']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T13:27:43Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718e3a8-eef0-4849-81fd-470c950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T14:28:56.000Z" ,
"modified" : "2016-04-21T14:28:56.000Z" ,
"description" : "Imported via the freetext import." ,
"pattern" : "[domain-name:value = 'mpjunkie.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T14:28:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718ecb1-fb28-4bb5-85e0-40b702de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T15:07:29.000Z" ,
"modified" : "2016-04-21T15:07:29.000Z" ,
"description" : "BlackBerry spyware - Xchecked via VT: 16318c4e4f94a5c4018b05955975771637b306b4" ,
"pattern" : "[file:hashes.SHA256 = 'a2d9ef1e249a08737d183177116cba1ed03c411d257d4b8ab66064c9affda057']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T15:07:29Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718ecb2-9428-4848-83fb-405b02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T15:07:30.000Z" ,
"modified" : "2016-04-21T15:07:30.000Z" ,
"description" : "BlackBerry spyware - Xchecked via VT: 16318c4e4f94a5c4018b05955975771637b306b4" ,
"pattern" : "[file:hashes.MD5 = '5e5a6fd42417c98fdc0a2c9391876d7a']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T15:07:30Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5718ecb2-efec-4668-8f3e-493002de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T15:07:30.000Z" ,
"modified" : "2016-04-21T15:07:30.000Z" ,
"first_observed" : "2016-04-21T15:07:30Z" ,
"last_observed" : "2016-04-21T15:07:30Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5718ecb2-efec-4668-8f3e-493002de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5718ecb2-efec-4668-8f3e-493002de0b81" ,
"value" : "https://www.virustotal.com/file/a2d9ef1e249a08737d183177116cba1ed03c411d257d4b8ab66064c9affda057/analysis/1461189256/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718ecb3-1d2c-47aa-b21c-474302de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T15:07:31.000Z" ,
"modified" : "2016-04-21T15:07:31.000Z" ,
"description" : "BlackBerry spyware - Xchecked via VT: abcb176578df44c2be7173b318abe704963052b2" ,
"pattern" : "[file:hashes.SHA256 = '7ef9af07a8a5f76a9b80349b1aeac59b25fcda1fb731e03797c682ad85f6e396']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T15:07:31Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718ecb3-71bc-491c-8314-48ad02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T15:07:31.000Z" ,
"modified" : "2016-04-21T15:07:31.000Z" ,
"description" : "BlackBerry spyware - Xchecked via VT: abcb176578df44c2be7173b318abe704963052b2" ,
"pattern" : "[file:hashes.MD5 = '9201801719ebf4c6d8b4adf0425a35dc']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T15:07:31Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5718ecb3-9f58-4d1a-8e7f-408f02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T15:07:31.000Z" ,
"modified" : "2016-04-21T15:07:31.000Z" ,
"first_observed" : "2016-04-21T15:07:31Z" ,
"last_observed" : "2016-04-21T15:07:31Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5718ecb3-9f58-4d1a-8e7f-408f02de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5718ecb3-9f58-4d1a-8e7f-408f02de0b81" ,
"value" : "https://www.virustotal.com/file/7ef9af07a8a5f76a9b80349b1aeac59b25fcda1fb731e03797c682ad85f6e396/analysis/1461189249/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718ecb4-03c4-4676-ac2e-4c5002de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T15:07:32.000Z" ,
"modified" : "2016-04-21T15:07:32.000Z" ,
"description" : "India Sena News - Xchecked via VT: b142e4b75a4562cdaad5cc2610d31594d2ed17c3" ,
"pattern" : "[file:hashes.SHA256 = '5bbcd8a7856e037418c0ac1c0c987476e3210f577beffcdfe2eceebc19c5644d']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T15:07:32Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718ecb4-dd44-44ee-9cd3-4b0702de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T15:07:32.000Z" ,
"modified" : "2016-04-21T15:07:32.000Z" ,
"description" : "India Sena News - Xchecked via VT: b142e4b75a4562cdaad5cc2610d31594d2ed17c3" ,
"pattern" : "[file:hashes.MD5 = 'e6a0066676cab0144eb6055f67d917e0']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T15:07:32Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5718ecb4-8b60-44dd-bc05-483e02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T15:07:32.000Z" ,
"modified" : "2016-04-21T15:07:32.000Z" ,
"first_observed" : "2016-04-21T15:07:32Z" ,
"last_observed" : "2016-04-21T15:07:32Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5718ecb4-8b60-44dd-bc05-483e02de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5718ecb4-8b60-44dd-bc05-483e02de0b81" ,
"value" : "https://www.virustotal.com/file/5bbcd8a7856e037418c0ac1c0c987476e3210f577beffcdfe2eceebc19c5644d/analysis/1461073518/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718ecb5-a7d0-4a52-bd6c-4bcd02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T15:07:33.000Z" ,
"modified" : "2016-04-21T15:07:33.000Z" ,
"description" : "Androrat - Xchecked via VT: f86302da2d38bf60f1ea9549b2e21a34fe655b33" ,
"pattern" : "[file:hashes.SHA256 = 'f529ccdee54c53e4c02366713ec2d2e8ff629fe56b2f5778f9f7d31f809e4446']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T15:07:33Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718ecb5-fa50-4255-823a-4b5702de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T15:07:33.000Z" ,
"modified" : "2016-04-21T15:07:33.000Z" ,
"description" : "Androrat - Xchecked via VT: f86302da2d38bf60f1ea9549b2e21a34fe655b33" ,
"pattern" : "[file:hashes.MD5 = 'dfd2eca84919418da2fa617fc51e9de5']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T15:07:33Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5718ecb5-1ad4-4fb3-9889-4b1802de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T15:07:33.000Z" ,
"modified" : "2016-04-21T15:07:33.000Z" ,
"first_observed" : "2016-04-21T15:07:33Z" ,
"last_observed" : "2016-04-21T15:07:33Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5718ecb5-1ad4-4fb3-9889-4b1802de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5718ecb5-1ad4-4fb3-9889-4b1802de0b81" ,
"value" : "https://www.virustotal.com/file/f529ccdee54c53e4c02366713ec2d2e8ff629fe56b2f5778f9f7d31f809e4446/analysis/1461051345/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718ecb6-a3fc-4ab9-ad1a-48ce02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T15:07:34.000Z" ,
"modified" : "2016-04-21T15:07:34.000Z" ,
"description" : "Androrat - Xchecked via VT: decf429be7d469292827c3b873f7e61076ffbba1" ,
"pattern" : "[file:hashes.SHA256 = '8b64a32e386d7cc51bb761bee8959bb5cac20e79ae1e549b04b7354e67bdee66']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T15:07:34Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718ecb6-117c-45d3-951e-4c0402de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T15:07:34.000Z" ,
"modified" : "2016-04-21T15:07:34.000Z" ,
"description" : "Androrat - Xchecked via VT: decf429be7d469292827c3b873f7e61076ffbba1" ,
"pattern" : "[file:hashes.MD5 = '11ba93d968bd96e9e9c9418ea1fdcbbc']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T15:07:34Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5718ecb7-3c5c-4b28-8cf0-46f402de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T15:07:35.000Z" ,
"modified" : "2016-04-21T15:07:35.000Z" ,
"first_observed" : "2016-04-21T15:07:35Z" ,
"last_observed" : "2016-04-21T15:07:35Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5718ecb7-3c5c-4b28-8cf0-46f402de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5718ecb7-3c5c-4b28-8cf0-46f402de0b81" ,
"value" : "https://www.virustotal.com/file/8b64a32e386d7cc51bb761bee8959bb5cac20e79ae1e549b04b7354e67bdee66/analysis/1461051347/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718ecb7-a578-4bc5-b9c2-48b602de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T15:07:35.000Z" ,
"modified" : "2016-04-21T15:07:35.000Z" ,
"description" : "Androrat - Xchecked via VT: 94c74a9e5d1aab18f51487e4e47e5995b7252c4b" ,
"pattern" : "[file:hashes.SHA256 = '563ebffbcd81d41e3ddb7b6ed580a2b17a6a6e14ec6bf208c9c22d7a296de7ae']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T15:07:35Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718ecb7-3210-4790-b39c-4cba02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T15:07:35.000Z" ,
"modified" : "2016-04-21T15:07:35.000Z" ,
"description" : "Androrat - Xchecked via VT: 94c74a9e5d1aab18f51487e4e47e5995b7252c4b" ,
"pattern" : "[file:hashes.MD5 = 'af046d94f254a3f85a0ba731562a05c5']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T15:07:35Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5718ecb8-7d80-4ee0-9656-43f602de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T15:07:36.000Z" ,
"modified" : "2016-04-21T15:07:36.000Z" ,
"first_observed" : "2016-04-21T15:07:36Z" ,
"last_observed" : "2016-04-21T15:07:36Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5718ecb8-7d80-4ee0-9656-43f602de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5718ecb8-7d80-4ee0-9656-43f602de0b81" ,
"value" : "https://www.virustotal.com/file/563ebffbcd81d41e3ddb7b6ed580a2b17a6a6e14ec6bf208c9c22d7a296de7ae/analysis/1461073437/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718ecb8-1018-4832-8633-448602de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T15:07:36.000Z" ,
"modified" : "2016-04-21T15:07:36.000Z" ,
"description" : "Androrat - Xchecked via VT: 9288811c9747d151eab4ec708b368fc6cc4e2cb5" ,
"pattern" : "[file:hashes.SHA256 = 'e6753bba53d7cca4a534c3089f24cd0546462667d110c0d48974f9e76714fe1c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T15:07:36Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718ecb9-5f4c-48f3-80c9-413202de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T15:07:37.000Z" ,
"modified" : "2016-04-21T15:07:37.000Z" ,
"description" : "Androrat - Xchecked via VT: 9288811c9747d151eab4ec708b368fc6cc4e2cb5" ,
"pattern" : "[file:hashes.MD5 = 'ce59958c01e437f4bdc68b4896222b8e']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T15:07:37Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5718ecb9-acdc-4965-83d0-4a9c02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T15:07:37.000Z" ,
"modified" : "2016-04-21T15:07:37.000Z" ,
"first_observed" : "2016-04-21T15:07:37Z" ,
"last_observed" : "2016-04-21T15:07:37Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5718ecb9-acdc-4965-83d0-4a9c02de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5718ecb9-acdc-4965-83d0-4a9c02de0b81" ,
"value" : "https://www.virustotal.com/file/e6753bba53d7cca4a534c3089f24cd0546462667d110c0d48974f9e76714fe1c/analysis/1461217726/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718ecb9-67b8-422e-b4d1-4f8202de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T15:07:37.000Z" ,
"modified" : "2016-04-21T15:07:37.000Z" ,
"description" : "Ringster - Xchecked via VT: a13568164c0a8f50d76d9ffa6e34e31674a3afc8" ,
"pattern" : "[file:hashes.SHA256 = '8babf68a96861c8495580b5ecf54d8e9e1c76fc89fb72a322c94e74796db4e19']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T15:07:37Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5718ecba-bc08-4277-9a9f-473002de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T15:07:38.000Z" ,
"modified" : "2016-04-21T15:07:38.000Z" ,
"description" : "Ringster - Xchecked via VT: a13568164c0a8f50d76d9ffa6e34e31674a3afc8" ,
"pattern" : "[file:hashes.MD5 = 'c4cd2f9ba10c0f773a8ec56045d3b398']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2016-04-21T15:07:38Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5718ecba-61b8-46ad-aef6-4bc502de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2016-04-21T15:07:38.000Z" ,
"modified" : "2016-04-21T15:07:38.000Z" ,
"first_observed" : "2016-04-21T15:07:38Z" ,
"last_observed" : "2016-04-21T15:07:38Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5718ecba-61b8-46ad-aef6-4bc502de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5718ecba-61b8-46ad-aef6-4bc502de0b81" ,
"value" : "https://www.virustotal.com/file/8babf68a96861c8495580b5ecf54d8e9e1c76fc89fb72a322c94e74796db4e19/analysis/1461226275/"
} ,
{
"type" : "marking-definition" ,
"spec_version" : "2.1" ,
"id" : "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ,
"created" : "2017-01-20T00:00:00.000Z" ,
"definition_type" : "tlp" ,
"name" : "TLP:WHITE" ,
"definition" : {
"tlp" : "white"
}
}
2023-04-21 13:25:09 +00:00
]
}
