2023-04-21 13:25:09 +00:00
|
|
|
{
|
2023-06-14 17:31:25 +00:00
|
|
|
"type": "bundle",
|
|
|
|
|
"id": "bundle--57b47152-b938-42f7-aa36-4bf1950d210f",
|
|
|
|
|
"objects": [
|
|
|
|
|
{
|
|
|
|
|
"type": "identity",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-08-17T14:16:10.000Z",
|
|
|
|
|
"modified": "2016-08-17T14:16:10.000Z",
|
|
|
|
|
"name": "CthulhuSPRL.be",
|
|
|
|
|
"identity_class": "organization"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "report",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "report--57b47152-b938-42f7-aa36-4bf1950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-08-17T14:16:10.000Z",
|
|
|
|
|
"modified": "2016-08-17T14:16:10.000Z",
|
|
|
|
|
"name": "OSINT Generic Yara rule to detect PlugX by Jay DiMartino",
|
|
|
|
|
"published": "2016-09-25T20:36:29Z",
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"observed-data--57b4716e-624c-431e-af53-40c2950d210f",
|
|
|
|
|
"url--57b4716e-624c-431e-af53-40c2950d210f",
|
|
|
|
|
"indicator--57b4717f-cc50-4b81-9fd1-4f64950d210f",
|
|
|
|
|
"indicator--57b471a5-25b0-4f2d-9181-489a950d210f",
|
|
|
|
|
"indicator--57b471a5-9708-4b32-885d-4249950d210f",
|
|
|
|
|
"indicator--57b471a6-5574-48ae-84e9-4d11950d210f",
|
|
|
|
|
"indicator--57b471a6-137c-4dd7-9756-46db950d210f",
|
|
|
|
|
"indicator--57b471a6-4dc4-4f35-a8f4-4d2d950d210f",
|
|
|
|
|
"indicator--57b471a6-c6e0-49f9-8e12-440b950d210f",
|
|
|
|
|
"indicator--57b471a6-7f80-4c6d-8825-4e11950d210f",
|
|
|
|
|
"indicator--57b471a7-58e0-40fe-9ce5-400c950d210f",
|
|
|
|
|
"indicator--57b471a7-43b0-44ef-80f9-4b20950d210f",
|
|
|
|
|
"indicator--57b471a7-a564-48fd-8a5e-4c05950d210f",
|
|
|
|
|
"indicator--57b471a7-9994-4528-be80-45fe950d210f",
|
|
|
|
|
"indicator--57b471a8-357c-4f03-aff5-4230950d210f",
|
|
|
|
|
"indicator--57b471a8-c8a8-4844-8897-46b1950d210f",
|
|
|
|
|
"indicator--57b471a8-fb7c-4dd7-b366-495f950d210f",
|
|
|
|
|
"indicator--57b471a8-fb24-4246-8f8e-4093950d210f",
|
|
|
|
|
"indicator--57b471a8-c074-49c5-a84a-4c2b950d210f",
|
|
|
|
|
"indicator--57b471a9-29f0-4524-9743-4ffb950d210f",
|
|
|
|
|
"indicator--57b471a9-4a44-46d5-94ad-400c950d210f",
|
|
|
|
|
"indicator--57b471a9-0f70-4473-9189-41f6950d210f",
|
|
|
|
|
"indicator--57b471a9-2588-4b70-8997-4f2f950d210f",
|
|
|
|
|
"indicator--57b471a9-83b8-4570-81c2-45f8950d210f",
|
|
|
|
|
"indicator--57b471aa-ef54-405c-a475-4d95950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"Threat-Report",
|
|
|
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
|
|
|
"OSINT"
|
|
|
|
|
],
|
|
|
|
|
"object_marking_refs": [
|
|
|
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--57b4716e-624c-431e-af53-40c2950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-08-17T14:15:10.000Z",
|
|
|
|
|
"modified": "2016-08-17T14:15:10.000Z",
|
|
|
|
|
"first_observed": "2016-08-17T14:15:10Z",
|
|
|
|
|
"last_observed": "2016-08-17T14:15:10Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--57b4716e-624c-431e-af53-40c2950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--57b4716e-624c-431e-af53-40c2950d210f",
|
|
|
|
|
"value": "https://github.com/Neo23x0/signature-base/blob/master/yara/apt_plugx.yar"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57b4717f-cc50-4b81-9fd1-4f64950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-08-17T14:15:27.000Z",
|
|
|
|
|
"modified": "2016-08-17T14:15:27.000Z",
|
|
|
|
|
"pattern": "[rule APTGroupX_PlugXTrojanLoader_StringDecode {\r\n meta:\r\n author = \"Jay DiMartino\"\r\n \tdescription = \"Rule to detect PlugX Malware\"\r\n\t\tscore = 80\r\n \treference = \"https://t.co/4xQ8G2mNap\"\r\n hash1 = \"0535e8c300204e257f0fa57630f386e9fcc8e779\"\r\n hash2 = \"088ebf9ccde958f32d11f4e7eb14f5332332f97d\"\r\n hash3 = \"0c999d0bffa007e9e6b6fe593933b52f40c75b3d\"\r\n hash4 = \"2f644e7131ec0a4f12ce04ba1e54d23856dbbfbf\"\r\n hash5 = \"3be9148ad132ca342d5fbabea1119a175ef1df7c\"\r\n hash6 = \"4c1ee94ec0e15491fc4f6b4095f67eee6309e62a\"\r\n hash7 = \"587af7ce05e61d4c312d6bae12ea380116b08d7e\"\r\n hash8 = \"5990efd83b5646a7ba419541d3a2c19260224ca3\"\r\n hash9 = \"67970367c250c44a5feb263843cf45fd91336df5\"\r\n hash10 = \"68f53f7188910a4cf67843aedd38c1523f1f2e7c\"\r\n hash11 = \"962dc7e0ad37286df012f623423ac4182fe791ca\"\r\n hash12 = \"aa0976906807af2e1b127608040aa3ef6e118a13\"\r\n hash13 = \"b170d015e32b39fa4ac15f94d58e45e65cd16d6c\"\r\n hash14 = \"c9b3d2cef3b34c7ee18fc2f60ff022965959613d\"\r\n hash15 = \"cd425ce7f3e4a823d9027780e1b439759c4dc665\"\r\n hash16 = \"d5e82513c6472d3826a22d9a15c05af8c0d33b58\"\r\n hash17 = \"d9b32084f27ef13001060e1dcee8a1a9e95d89a6\"\r\n hash18 = \"daa2d1cb9148b7ba5a86fa9ab593678e77c92672\"\r\n hash19 = \"e2c098a95d1c1f0e29f207af9c5ffc5bd69a92ee\"\r\n hash20 = \"ef8cf68dc3c80e9cb5a3fa0f92b544eab583812e\"\r\n hash21 = \"f0fc0a4e4e0748464caa6a202d0083cd33458677\"\r\n hash22 = \"fe1abe55529c1d6aa6b2a2f02d7e41ea58040feb\"\r\n strings:\r\n $byte1 = { 8A [2-4] 8A [2-4] FF 05 00 30 00 10 [0-5] 2A [1-6] 80 [2-7] 02 [1-6] 88 0? }\r\n $byte2 = { 8B [2-4] 8A [2-4] FF 05 00 30 00 10 [0-5] 2A [1-6] 80 [2-7] 02 [1-6] 88 0? }\r\n condition:\r\n any of them\r\n}]",
|
|
|
|
|
"pattern_type": "yara",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-08-17T14:15:27Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"yara\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57b471a5-25b0-4f2d-9181-489a950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-08-17T14:16:05.000Z",
|
|
|
|
|
"modified": "2016-08-17T14:16:05.000Z",
|
|
|
|
|
"description": "Imported via the Freetext Import Tool",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '0535e8c300204e257f0fa57630f386e9fcc8e779']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-08-17T14:16:05Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57b471a5-9708-4b32-885d-4249950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-08-17T14:16:05.000Z",
|
|
|
|
|
"modified": "2016-08-17T14:16:05.000Z",
|
|
|
|
|
"description": "Imported via the Freetext Import Tool",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '088ebf9ccde958f32d11f4e7eb14f5332332f97d']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-08-17T14:16:05Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57b471a6-5574-48ae-84e9-4d11950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-08-17T14:16:06.000Z",
|
|
|
|
|
"modified": "2016-08-17T14:16:06.000Z",
|
|
|
|
|
"description": "Imported via the Freetext Import Tool",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '0c999d0bffa007e9e6b6fe593933b52f40c75b3d']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-08-17T14:16:06Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57b471a6-137c-4dd7-9756-46db950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-08-17T14:16:06.000Z",
|
|
|
|
|
"modified": "2016-08-17T14:16:06.000Z",
|
|
|
|
|
"description": "Imported via the Freetext Import Tool",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '2f644e7131ec0a4f12ce04ba1e54d23856dbbfbf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-08-17T14:16:06Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57b471a6-4dc4-4f35-a8f4-4d2d950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-08-17T14:16:06.000Z",
|
|
|
|
|
"modified": "2016-08-17T14:16:06.000Z",
|
|
|
|
|
"description": "Imported via the Freetext Import Tool",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '3be9148ad132ca342d5fbabea1119a175ef1df7c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-08-17T14:16:06Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57b471a6-c6e0-49f9-8e12-440b950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-08-17T14:16:06.000Z",
|
|
|
|
|
"modified": "2016-08-17T14:16:06.000Z",
|
|
|
|
|
"description": "Imported via the Freetext Import Tool",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '4c1ee94ec0e15491fc4f6b4095f67eee6309e62a']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-08-17T14:16:06Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57b471a6-7f80-4c6d-8825-4e11950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-08-17T14:16:06.000Z",
|
|
|
|
|
"modified": "2016-08-17T14:16:06.000Z",
|
|
|
|
|
"description": "Imported via the Freetext Import Tool",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '587af7ce05e61d4c312d6bae12ea380116b08d7e']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-08-17T14:16:06Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57b471a7-58e0-40fe-9ce5-400c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-08-17T14:16:07.000Z",
|
|
|
|
|
"modified": "2016-08-17T14:16:07.000Z",
|
|
|
|
|
"description": "Imported via the Freetext Import Tool",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '5990efd83b5646a7ba419541d3a2c19260224ca3']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-08-17T14:16:07Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57b471a7-43b0-44ef-80f9-4b20950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-08-17T14:16:07.000Z",
|
|
|
|
|
"modified": "2016-08-17T14:16:07.000Z",
|
|
|
|
|
"description": "Imported via the Freetext Import Tool",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '67970367c250c44a5feb263843cf45fd91336df5']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-08-17T14:16:07Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57b471a7-a564-48fd-8a5e-4c05950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-08-17T14:16:07.000Z",
|
|
|
|
|
"modified": "2016-08-17T14:16:07.000Z",
|
|
|
|
|
"description": "Imported via the Freetext Import Tool",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '68f53f7188910a4cf67843aedd38c1523f1f2e7c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-08-17T14:16:07Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57b471a7-9994-4528-be80-45fe950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-08-17T14:16:07.000Z",
|
|
|
|
|
"modified": "2016-08-17T14:16:07.000Z",
|
|
|
|
|
"description": "Imported via the Freetext Import Tool",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '962dc7e0ad37286df012f623423ac4182fe791ca']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-08-17T14:16:07Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57b471a8-357c-4f03-aff5-4230950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-08-17T14:16:07.000Z",
|
|
|
|
|
"modified": "2016-08-17T14:16:07.000Z",
|
|
|
|
|
"description": "Imported via the Freetext Import Tool",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'aa0976906807af2e1b127608040aa3ef6e118a13']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-08-17T14:16:07Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57b471a8-c8a8-4844-8897-46b1950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-08-17T14:16:08.000Z",
|
|
|
|
|
"modified": "2016-08-17T14:16:08.000Z",
|
|
|
|
|
"description": "Imported via the Freetext Import Tool",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'b170d015e32b39fa4ac15f94d58e45e65cd16d6c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-08-17T14:16:08Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57b471a8-fb7c-4dd7-b366-495f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-08-17T14:16:08.000Z",
|
|
|
|
|
"modified": "2016-08-17T14:16:08.000Z",
|
|
|
|
|
"description": "Imported via the Freetext Import Tool",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'c9b3d2cef3b34c7ee18fc2f60ff022965959613d']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-08-17T14:16:08Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57b471a8-fb24-4246-8f8e-4093950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-08-17T14:16:08.000Z",
|
|
|
|
|
"modified": "2016-08-17T14:16:08.000Z",
|
|
|
|
|
"description": "Imported via the Freetext Import Tool",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'cd425ce7f3e4a823d9027780e1b439759c4dc665']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-08-17T14:16:08Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57b471a8-c074-49c5-a84a-4c2b950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-08-17T14:16:08.000Z",
|
|
|
|
|
"modified": "2016-08-17T14:16:08.000Z",
|
|
|
|
|
"description": "Imported via the Freetext Import Tool",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'd5e82513c6472d3826a22d9a15c05af8c0d33b58']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-08-17T14:16:08Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57b471a9-29f0-4524-9743-4ffb950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-08-17T14:16:09.000Z",
|
|
|
|
|
"modified": "2016-08-17T14:16:09.000Z",
|
|
|
|
|
"description": "Imported via the Freetext Import Tool",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'd9b32084f27ef13001060e1dcee8a1a9e95d89a6']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-08-17T14:16:09Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57b471a9-4a44-46d5-94ad-400c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-08-17T14:16:09.000Z",
|
|
|
|
|
"modified": "2016-08-17T14:16:09.000Z",
|
|
|
|
|
"description": "Imported via the Freetext Import Tool",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'daa2d1cb9148b7ba5a86fa9ab593678e77c92672']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-08-17T14:16:09Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57b471a9-0f70-4473-9189-41f6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-08-17T14:16:09.000Z",
|
|
|
|
|
"modified": "2016-08-17T14:16:09.000Z",
|
|
|
|
|
"description": "Imported via the Freetext Import Tool",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'e2c098a95d1c1f0e29f207af9c5ffc5bd69a92ee']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-08-17T14:16:09Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57b471a9-2588-4b70-8997-4f2f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-08-17T14:16:09.000Z",
|
|
|
|
|
"modified": "2016-08-17T14:16:09.000Z",
|
|
|
|
|
"description": "Imported via the Freetext Import Tool",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'ef8cf68dc3c80e9cb5a3fa0f92b544eab583812e']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-08-17T14:16:09Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57b471a9-83b8-4570-81c2-45f8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-08-17T14:16:09.000Z",
|
|
|
|
|
"modified": "2016-08-17T14:16:09.000Z",
|
|
|
|
|
"description": "Imported via the Freetext Import Tool",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'f0fc0a4e4e0748464caa6a202d0083cd33458677']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-08-17T14:16:09Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--57b471aa-ef54-405c-a475-4d95950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2016-08-17T14:16:10.000Z",
|
|
|
|
|
"modified": "2016-08-17T14:16:10.000Z",
|
|
|
|
|
"description": "Imported via the Freetext Import Tool",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'fe1abe55529c1d6aa6b2a2f02d7e41ea58040feb']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2016-08-17T14:16:10Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "marking-definition",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
|
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
|
|
|
"definition_type": "tlp",
|
|
|
|
|
"name": "TLP:WHITE",
|
|
|
|
|
"definition": {
|
|
|
|
|
"tlp": "white"
|
|
|
|
|
}
|
|
|
|
|
}
|
2023-04-21 13:25:09 +00:00
|
|
|
]
|
|
|
|
|
}
|
