2023-04-21 13:25:09 +00:00
{
2023-06-14 17:31:25 +00:00
"type" : "bundle" ,
"id" : "bundle--588a6de9-e2f4-4fbc-b09d-427f02de0b81" ,
"objects" : [
{
"type" : "identity" ,
"spec_version" : "2.1" ,
"id" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:54:25.000Z" ,
"modified" : "2017-01-26T21:54:25.000Z" ,
"name" : "CIRCL" ,
"identity_class" : "organization"
} ,
{
"type" : "report" ,
"spec_version" : "2.1" ,
"id" : "report--588a6de9-e2f4-4fbc-b09d-427f02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:54:25.000Z" ,
"modified" : "2017-01-26T21:54:25.000Z" ,
"name" : "OSINT - EITest Nabbing Chrome Users with a \u00e2\u20ac\u0153Chrome Font\u00e2\u20ac\u009d Social Engineering Scheme" ,
"published" : "2017-01-26T21:57:34Z" ,
"object_refs" : [
"x-misp-attribute--588a6dfd-19b8-44c8-b297-4f2002de0b81" ,
"observed-data--588a6e0b-3338-442b-8f7f-4c5802de0b81" ,
"url--588a6e0b-3338-442b-8f7f-4c5802de0b81" ,
"indicator--588a6e2f-3b0c-4d91-a1fe-4e9002de0b81" ,
"indicator--588a6e30-685c-41ed-9ec3-454802de0b81" ,
"indicator--588a6e31-83cc-43f7-8097-4dc702de0b81" ,
"indicator--588a6e31-fff8-407a-bc77-448e02de0b81" ,
"indicator--588a6e3c-f8cc-4b96-97e0-4dd802de0b81" ,
"indicator--588a6e74-1650-4d05-9d6c-425502de0b81" ,
"indicator--588a6e8d-6b48-4294-9a19-43b202de0b81" ,
"indicator--588a6e9a-75e8-4fbf-bd55-427202de0b81" ,
"indicator--588a6ebb-28e4-481f-9e5b-496602de0b81" ,
"indicator--588a6ebc-2270-4929-9c16-42d102de0b81" ,
"indicator--588a6ebc-9c9c-4d54-b445-40d702de0b81" ,
"indicator--588a6ebd-1900-4657-8b7a-481802de0b81" ,
"indicator--588a6edb-e2ec-49c0-8ea7-215902de0b81" ,
"indicator--588a6edc-657c-46f4-90de-215902de0b81" ,
"indicator--588a6edd-0234-472b-b99e-215902de0b81" ,
"indicator--588a6edd-d158-4416-98c6-215902de0b81" ,
"observed-data--588a6f1c-3404-4dc5-afc0-6dcc02de0b81" ,
"domain-name--588a6f1c-3404-4dc5-afc0-6dcc02de0b81" ,
"observed-data--588a6f1d-ccfc-4512-aa8a-6dcc02de0b81" ,
"network-traffic--588a6f1d-ccfc-4512-aa8a-6dcc02de0b81" ,
"ipv4-addr--588a6f1d-ccfc-4512-aa8a-6dcc02de0b81" ,
"observed-data--588a6f1e-0260-4424-b74c-6dcc02de0b81" ,
"domain-name--588a6f1e-0260-4424-b74c-6dcc02de0b81" ,
"observed-data--588a6f1f-b9e0-4c96-9721-6dcc02de0b81" ,
"network-traffic--588a6f1f-b9e0-4c96-9721-6dcc02de0b81" ,
"ipv4-addr--588a6f1f-b9e0-4c96-9721-6dcc02de0b81" ,
"observed-data--588a6f20-1df4-4b3b-90a8-6dcc02de0b81" ,
"domain-name--588a6f20-1df4-4b3b-90a8-6dcc02de0b81" ,
"observed-data--588a6f20-1810-4702-a053-6dcc02de0b81" ,
"network-traffic--588a6f20-1810-4702-a053-6dcc02de0b81" ,
"ipv4-addr--588a6f20-1810-4702-a053-6dcc02de0b81" ,
"observed-data--588a6f21-37d4-481d-b427-6dcc02de0b81" ,
"domain-name--588a6f21-37d4-481d-b427-6dcc02de0b81" ,
"observed-data--588a6f22-11d0-4190-ae0a-6dcc02de0b81" ,
"network-traffic--588a6f22-11d0-4190-ae0a-6dcc02de0b81" ,
"ipv4-addr--588a6f22-11d0-4190-ae0a-6dcc02de0b81" ,
"observed-data--588a6f23-4e18-48b4-abd1-6dcc02de0b81" ,
"domain-name--588a6f23-4e18-48b4-abd1-6dcc02de0b81" ,
"observed-data--588a6f23-05c4-4c29-a4b4-6dcc02de0b81" ,
"network-traffic--588a6f23-05c4-4c29-a4b4-6dcc02de0b81" ,
"ipv4-addr--588a6f23-05c4-4c29-a4b4-6dcc02de0b81" ,
"indicator--588a6f39-4c88-464d-8774-471002de0b81" ,
"indicator--588a6f3a-a320-4e32-9621-46c102de0b81" ,
"indicator--588a6f3b-45c4-40ae-b38e-428502de0b81" ,
"indicator--588a6f3b-7134-464a-861f-450902de0b81" ,
"indicator--588a6f3c-9764-4977-8e02-456f02de0b81" ,
"indicator--588a6f3d-8528-42b0-9af6-450802de0b81" ,
"indicator--588a7011-c36c-48ed-9abc-40e502de0b81" ,
"indicator--588a7011-31fc-4d7b-a442-473702de0b81" ,
"observed-data--588a7012-f1e8-4f25-a7c8-455602de0b81" ,
"url--588a7012-f1e8-4f25-a7c8-455602de0b81" ,
"indicator--588a7013-f6b4-487c-a1ae-4fc602de0b81" ,
"indicator--588a7013-e0d0-431e-ace0-4fc002de0b81" ,
"observed-data--588a7014-6648-4d5b-ae8e-4b7b02de0b81" ,
"url--588a7014-6648-4d5b-ae8e-4b7b02de0b81" ,
"indicator--588a7015-72d4-4d87-b1f3-4c9b02de0b81" ,
"indicator--588a7016-1130-4783-8732-421502de0b81" ,
"observed-data--588a7016-1bdc-4229-a0fa-414c02de0b81" ,
"url--588a7016-1bdc-4229-a0fa-414c02de0b81" ,
"indicator--588a7017-ae5c-4778-8d55-422702de0b81" ,
"indicator--588a7018-94e0-438b-bf8f-4b3d02de0b81" ,
"observed-data--588a7018-60ec-4202-a54f-4a9e02de0b81" ,
"url--588a7018-60ec-4202-a54f-4a9e02de0b81" ,
"indicator--588a7019-96d0-4507-81b2-4fbf02de0b81" ,
"indicator--588a701a-9664-423c-85d8-435102de0b81" ,
"observed-data--588a701a-9ff8-4e32-bea2-4bdf02de0b81" ,
"url--588a701a-9ff8-4e32-bea2-4bdf02de0b81"
] ,
"labels" : [
"Threat-Report" ,
"misp:tool=\"MISP-STIX-Converter\"" ,
"estimative-language:likelihood-probability=\"very-likely\""
] ,
"object_marking_refs" : [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
} ,
{
"type" : "x-misp-attribute" ,
"spec_version" : "2.1" ,
"id" : "x-misp-attribute--588a6dfd-19b8-44c8-b297-4f2002de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:52:12.000Z" ,
"modified" : "2017-01-26T21:52:12.000Z" ,
"labels" : [
"misp:type=\"text\"" ,
"misp:category=\"External analysis\"" ,
"osint:source-type=\"blog-post\""
] ,
"x_misp_category" : "External analysis" ,
"x_misp_type" : "text" ,
"x_misp_value" : "\u00e2\u20ac\u0153EITest\u00e2\u20ac\u009d is a well-documented infection chain that generally relies on compromised websites to direct users to exploit kit (EK) landing pages. EITest has been involved in the delivery of a variety of ransomware, information stealers, and other malware, with clear evidence of its use dating back to 2014. Elements of EITest may be much older, though, with hints pointing to EITest being an evolution of the \u00e2\u20ac\u0153Glazunov\u00e2\u20ac\u009d infection chain from 2011 [1]. The first server side documentation of this evolution came from Sucuri in July 2014 [2] associated with waves of Wordpress exploitation via the MailPoet plugin vulnerability. KahuSecurity recently analyzed the server side script in October 2016 [3]."
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--588a6e0b-3338-442b-8f7f-4c5802de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:52:03.000Z" ,
"modified" : "2017-01-26T21:52:03.000Z" ,
"first_observed" : "2017-01-26T21:52:03Z" ,
"last_observed" : "2017-01-26T21:52:03Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--588a6e0b-3338-442b-8f7f-4c5802de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\"" ,
"osint:source-type=\"blog-post\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--588a6e0b-3338-442b-8f7f-4c5802de0b81" ,
"value" : "https://www.proofpoint.com/us/threat-insight/post/EITest-Nabbing-Chrome-Users-Chrome-Font-Social-Engineering-Scheme"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--588a6e2f-3b0c-4d91-a1fe-4e9002de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:46:23.000Z" ,
"modified" : "2017-01-26T21:46:23.000Z" ,
"description" : "Fleercivet C&C" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '198.37.112.248']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-01-26T21:46:23Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--588a6e30-685c-41ed-9ec3-454802de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:46:24.000Z" ,
"modified" : "2017-01-26T21:46:24.000Z" ,
"description" : "Server initiating Fleercivet Fraud Scheme (potentially legitimate)" ,
"pattern" : "[file:name = 'searchtopresults.com|209.126.122.139']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-01-26T21:46:24Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--588a6e31-83cc-43f7-8097-4dc702de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:46:25.000Z" ,
"modified" : "2017-01-26T21:46:25.000Z" ,
"description" : "Initial Call before Fleercivet clickfraud" ,
"pattern" : "[url:value = 'searchtopresults.com/search.php?aff=8320']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-01-26T21:46:25Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"url\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--588a6e31-fff8-407a-bc77-448e02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:46:25.000Z" ,
"modified" : "2017-01-26T21:46:25.000Z" ,
"description" : "Later Call tied to Fleercivet activity" ,
"pattern" : "[url:value = 'searchtopresults.com/search.php?aff=8170&saff=1203']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-01-26T21:46:25Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"url\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--588a6e3c-f8cc-4b96-97e0-4dd802de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:46:36.000Z" ,
"modified" : "2017-01-26T21:46:36.000Z" ,
"description" : "Fiddler capture (index and post)" ,
"pattern" : "[file:hashes.SHA256 = '7a444891c642ec17459471be40bcc1ea9eef6aeb478318a679908f94bf1e7e74']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-01-26T21:46:36Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--588a6e74-1650-4d05-9d6c-425502de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:47:32.000Z" ,
"modified" : "2017-01-26T21:47:32.000Z" ,
"description" : "2014-07-14 - Early \u00e2\u20ac\u0153flash redirecting\u00e2\u20ac\u009d EITest Domain" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '48.251.102.176']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-01-26T21:47:32Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--588a6e8d-6b48-4294-9a19-43b202de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:47:57.000Z" ,
"modified" : "2017-01-26T21:47:57.000Z" ,
"description" : "2014-07-14 - Early \u00e2\u20ac\u0153flash redirecting\u00e2\u20ac\u009d EITest Domain" ,
"pattern" : "[domain-name:value = 'vidvi.cf']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-01-26T21:47:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--588a6e9a-75e8-4fbf-bd55-427202de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:48:10.000Z" ,
"modified" : "2017-01-26T21:48:10.000Z" ,
"description" : "EITest node replying to Compromised Server" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '31.184.192.163']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-01-26T21:48:10Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--588a6ebb-28e4-481f-9e5b-496602de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:48:43.000Z" ,
"modified" : "2017-01-26T21:48:43.000Z" ,
"description" : "EITest node replying to Compromised Server" ,
"pattern" : "[domain-name:value = '54dfa1cb.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-01-26T21:48:43Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--588a6ebc-2270-4929-9c16-42d102de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:48:44.000Z" ,
"modified" : "2017-01-26T21:48:44.000Z" ,
"description" : "EITest node replying to Compromised Server" ,
"pattern" : "[domain-name:value = 'e5b57288.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-01-26T21:48:44Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--588a6ebc-9c9c-4d54-b445-40d702de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:48:44.000Z" ,
"modified" : "2017-01-26T21:48:44.000Z" ,
"description" : "EITest node replying to Compromised Server" ,
"pattern" : "[domain-name:value = '33db9538.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-01-26T21:48:44Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--588a6ebd-1900-4657-8b7a-481802de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:48:45.000Z" ,
"modified" : "2017-01-26T21:48:45.000Z" ,
"description" : "EITest node replying to Compromised Server" ,
"pattern" : "[domain-name:value = '9507c4e8.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-01-26T21:48:45Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--588a6edb-e2ec-49c0-8ea7-215902de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:49:15.000Z" ,
"modified" : "2017-01-26T21:49:15.000Z" ,
"description" : "FleerCivet 2017-01-15" ,
"pattern" : "[file:hashes.SHA256 = '7fc9721cc648de138a61ec3452d63a83fc76ef527d41f4a7aba78f52df13338a']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-01-26T21:49:15Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--588a6edc-657c-46f4-90de-215902de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:49:16.000Z" ,
"modified" : "2017-01-26T21:49:16.000Z" ,
"description" : "FleerCivet 2017-01-15" ,
"pattern" : "[file:hashes.SHA256 = '7bb7848270e76aa1fcb9d11acb46c8421b86c7d528c108d8f179ec829ff977fc']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-01-26T21:49:16Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--588a6edd-0234-472b-b99e-215902de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:49:17.000Z" ,
"modified" : "2017-01-26T21:49:17.000Z" ,
"description" : "FleerCivet 2017-01-16" ,
"pattern" : "[file:hashes.SHA256 = '9190c865c214cf2b1c602edcfe4ab8858806298ca4b6de16bfbd0377385ffe63']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-01-26T21:49:17Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--588a6edd-d158-4416-98c6-215902de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:49:17.000Z" ,
"modified" : "2017-01-26T21:49:17.000Z" ,
"description" : "FleerCivet 2017-01-17" ,
"pattern" : "[file:hashes.SHA256 = 'ebeaaef3323331e7ea0e47eac6437dcf5548d9fd759943d2e5c1f3d1fb786167']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-01-26T21:49:17Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--588a6f1c-3404-4dc5-afc0-6dcc02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:50:20.000Z" ,
"modified" : "2017-01-26T21:50:20.000Z" ,
"first_observed" : "2017-01-26T21:50:20Z" ,
"last_observed" : "2017-01-26T21:50:20Z" ,
"number_observed" : 1 ,
"object_refs" : [
"domain-name--588a6f1c-3404-4dc5-afc0-6dcc02de0b81"
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "domain-name" ,
"spec_version" : "2.1" ,
"id" : "domain-name--588a6f1c-3404-4dc5-afc0-6dcc02de0b81" ,
"value" : "starrer.com"
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--588a6f1d-ccfc-4512-aa8a-6dcc02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:50:21.000Z" ,
"modified" : "2017-01-26T21:50:21.000Z" ,
"first_observed" : "2017-01-26T21:50:21Z" ,
"last_observed" : "2017-01-26T21:50:21Z" ,
"number_observed" : 1 ,
"object_refs" : [
"network-traffic--588a6f1d-ccfc-4512-aa8a-6dcc02de0b81" ,
"ipv4-addr--588a6f1d-ccfc-4512-aa8a-6dcc02de0b81"
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "network-traffic" ,
"spec_version" : "2.1" ,
"id" : "network-traffic--588a6f1d-ccfc-4512-aa8a-6dcc02de0b81" ,
"dst_ref" : "ipv4-addr--588a6f1d-ccfc-4512-aa8a-6dcc02de0b81" ,
"protocols" : [
"tcp"
]
} ,
{
"type" : "ipv4-addr" ,
"spec_version" : "2.1" ,
"id" : "ipv4-addr--588a6f1d-ccfc-4512-aa8a-6dcc02de0b81" ,
"value" : "209.126.118.146"
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--588a6f1e-0260-4424-b74c-6dcc02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:50:22.000Z" ,
"modified" : "2017-01-26T21:50:22.000Z" ,
"first_observed" : "2017-01-26T21:50:22Z" ,
"last_observed" : "2017-01-26T21:50:22Z" ,
"number_observed" : 1 ,
"object_refs" : [
"domain-name--588a6f1e-0260-4424-b74c-6dcc02de0b81"
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "domain-name" ,
"spec_version" : "2.1" ,
"id" : "domain-name--588a6f1e-0260-4424-b74c-6dcc02de0b81" ,
"value" : "askcom.me"
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--588a6f1f-b9e0-4c96-9721-6dcc02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:50:23.000Z" ,
"modified" : "2017-01-26T21:50:23.000Z" ,
"first_observed" : "2017-01-26T21:50:23Z" ,
"last_observed" : "2017-01-26T21:50:23Z" ,
"number_observed" : 1 ,
"object_refs" : [
"network-traffic--588a6f1f-b9e0-4c96-9721-6dcc02de0b81" ,
"ipv4-addr--588a6f1f-b9e0-4c96-9721-6dcc02de0b81"
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "network-traffic" ,
"spec_version" : "2.1" ,
"id" : "network-traffic--588a6f1f-b9e0-4c96-9721-6dcc02de0b81" ,
"dst_ref" : "ipv4-addr--588a6f1f-b9e0-4c96-9721-6dcc02de0b81" ,
"protocols" : [
"tcp"
]
} ,
{
"type" : "ipv4-addr" ,
"spec_version" : "2.1" ,
"id" : "ipv4-addr--588a6f1f-b9e0-4c96-9721-6dcc02de0b81" ,
"value" : "209.126.123.39"
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--588a6f20-1df4-4b3b-90a8-6dcc02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:50:24.000Z" ,
"modified" : "2017-01-26T21:50:24.000Z" ,
"first_observed" : "2017-01-26T21:50:24Z" ,
"last_observed" : "2017-01-26T21:50:24Z" ,
"number_observed" : 1 ,
"object_refs" : [
"domain-name--588a6f20-1df4-4b3b-90a8-6dcc02de0b81"
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "domain-name" ,
"spec_version" : "2.1" ,
"id" : "domain-name--588a6f20-1df4-4b3b-90a8-6dcc02de0b81" ,
"value" : "twittertravels.com"
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--588a6f20-1810-4702-a053-6dcc02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:50:24.000Z" ,
"modified" : "2017-01-26T21:50:24.000Z" ,
"first_observed" : "2017-01-26T21:50:24Z" ,
"last_observed" : "2017-01-26T21:50:24Z" ,
"number_observed" : 1 ,
"object_refs" : [
"network-traffic--588a6f20-1810-4702-a053-6dcc02de0b81" ,
"ipv4-addr--588a6f20-1810-4702-a053-6dcc02de0b81"
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "network-traffic" ,
"spec_version" : "2.1" ,
"id" : "network-traffic--588a6f20-1810-4702-a053-6dcc02de0b81" ,
"dst_ref" : "ipv4-addr--588a6f20-1810-4702-a053-6dcc02de0b81" ,
"protocols" : [
"tcp"
]
} ,
{
"type" : "ipv4-addr" ,
"spec_version" : "2.1" ,
"id" : "ipv4-addr--588a6f20-1810-4702-a053-6dcc02de0b81" ,
"value" : "173.224.124.110"
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--588a6f21-37d4-481d-b427-6dcc02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:50:25.000Z" ,
"modified" : "2017-01-26T21:50:25.000Z" ,
"first_observed" : "2017-01-26T21:50:25Z" ,
"last_observed" : "2017-01-26T21:50:25Z" ,
"number_observed" : 1 ,
"object_refs" : [
"domain-name--588a6f21-37d4-481d-b427-6dcc02de0b81"
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "domain-name" ,
"spec_version" : "2.1" ,
"id" : "domain-name--588a6f21-37d4-481d-b427-6dcc02de0b81" ,
"value" : "shareyourfashion.net"
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--588a6f22-11d0-4190-ae0a-6dcc02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:50:26.000Z" ,
"modified" : "2017-01-26T21:50:26.000Z" ,
"first_observed" : "2017-01-26T21:50:26Z" ,
"last_observed" : "2017-01-26T21:50:26Z" ,
"number_observed" : 1 ,
"object_refs" : [
"network-traffic--588a6f22-11d0-4190-ae0a-6dcc02de0b81" ,
"ipv4-addr--588a6f22-11d0-4190-ae0a-6dcc02de0b81"
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "network-traffic" ,
"spec_version" : "2.1" ,
"id" : "network-traffic--588a6f22-11d0-4190-ae0a-6dcc02de0b81" ,
"dst_ref" : "ipv4-addr--588a6f22-11d0-4190-ae0a-6dcc02de0b81" ,
"protocols" : [
"tcp"
]
} ,
{
"type" : "ipv4-addr" ,
"spec_version" : "2.1" ,
"id" : "ipv4-addr--588a6f22-11d0-4190-ae0a-6dcc02de0b81" ,
"value" : "209.126.103.104"
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--588a6f23-4e18-48b4-abd1-6dcc02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:50:27.000Z" ,
"modified" : "2017-01-26T21:50:27.000Z" ,
"first_observed" : "2017-01-26T21:50:27Z" ,
"last_observed" : "2017-01-26T21:50:27Z" ,
"number_observed" : 1 ,
"object_refs" : [
"domain-name--588a6f23-4e18-48b4-abd1-6dcc02de0b81"
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "domain-name" ,
"spec_version" : "2.1" ,
"id" : "domain-name--588a6f23-4e18-48b4-abd1-6dcc02de0b81" ,
"value" : "techgnews.com"
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--588a6f23-05c4-4c29-a4b4-6dcc02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:50:27.000Z" ,
"modified" : "2017-01-26T21:50:27.000Z" ,
"first_observed" : "2017-01-26T21:50:27Z" ,
"last_observed" : "2017-01-26T21:50:27Z" ,
"number_observed" : 1 ,
"object_refs" : [
"network-traffic--588a6f23-05c4-4c29-a4b4-6dcc02de0b81" ,
"ipv4-addr--588a6f23-05c4-4c29-a4b4-6dcc02de0b81"
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "network-traffic" ,
"spec_version" : "2.1" ,
"id" : "network-traffic--588a6f23-05c4-4c29-a4b4-6dcc02de0b81" ,
"dst_ref" : "ipv4-addr--588a6f23-05c4-4c29-a4b4-6dcc02de0b81" ,
"protocols" : [
"tcp"
]
} ,
{
"type" : "ipv4-addr" ,
"spec_version" : "2.1" ,
"id" : "ipv4-addr--588a6f23-05c4-4c29-a4b4-6dcc02de0b81" ,
"value" : "209.239.115.50"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--588a6f39-4c88-464d-8774-471002de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:52:30.000Z" ,
"modified" : "2017-01-26T21:52:30.000Z" ,
"description" : "Exemple of EITest compromised Website acting as download server (POST request with MZ as reply)" ,
"pattern" : "[url:value = 'kyle.dark7.org/download.php']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-01-26T21:52:30Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"url\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\"" ,
"adversary:infrastructure-status=\"compromised\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--588a6f3a-a320-4e32-9621-46c102de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:52:41.000Z" ,
"modified" : "2017-01-26T21:52:41.000Z" ,
"description" : "Exemple of EITest compromised Website acting as download server (POST request with MZ as reply)" ,
"pattern" : "[url:value = 'oblubienica.odnowa.org/download.php']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-01-26T21:52:41Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"url\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\"" ,
"adversary:infrastructure-status=\"compromised\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--588a6f3b-45c4-40ae-b38e-428502de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:53:00.000Z" ,
"modified" : "2017-01-26T21:53:00.000Z" ,
"description" : "Exemple of EITest compromised Website acting as download server (POST request with MZ as reply)" ,
"pattern" : "[url:value = 'sriswamidikshananda.org/download.php']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-01-26T21:53:00Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"url\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\"" ,
"adversary:infrastructure-status=\"compromised\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--588a6f3b-7134-464a-861f-450902de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:53:13.000Z" ,
"modified" : "2017-01-26T21:53:13.000Z" ,
"description" : "Exemple of EITest compromised Website acting as download server (POST request with MZ as reply)" ,
"pattern" : "[url:value = 'demo.signgo.com/help.php']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-01-26T21:53:13Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"url\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\"" ,
"adversary:infrastructure-status=\"compromised\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--588a6f3c-9764-4977-8e02-456f02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:53:23.000Z" ,
"modified" : "2017-01-26T21:53:23.000Z" ,
"description" : "Exemple of EITest compromised Website acting as download server (POST request with MZ as reply)" ,
"pattern" : "[url:value = 'retail.uvapoint.com/help.php']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-01-26T21:53:23Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"url\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\"" ,
"adversary:infrastructure-status=\"compromised\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--588a6f3d-8528-42b0-9af6-450802de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:53:37.000Z" ,
"modified" : "2017-01-26T21:53:37.000Z" ,
"description" : "Exemple of EITest compromised Website acting as download server (POST request with MZ as reply)" ,
"pattern" : "[url:value = 'chovek5.lozenetz.org/download.php']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-01-26T21:53:37Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"url\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\"" ,
"adversary:infrastructure-status=\"compromised\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--588a7011-c36c-48ed-9abc-40e502de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:54:25.000Z" ,
"modified" : "2017-01-26T21:54:25.000Z" ,
"description" : "FleerCivet 2017-01-17 - Xchecked via VT: ebeaaef3323331e7ea0e47eac6437dcf5548d9fd759943d2e5c1f3d1fb786167" ,
"pattern" : "[file:hashes.SHA1 = '35c7f51fcf445ac0a2be0dfc81ec653e3eec6068']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-01-26T21:54:25Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--588a7011-31fc-4d7b-a442-473702de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:54:25.000Z" ,
"modified" : "2017-01-26T21:54:25.000Z" ,
"description" : "FleerCivet 2017-01-17 - Xchecked via VT: ebeaaef3323331e7ea0e47eac6437dcf5548d9fd759943d2e5c1f3d1fb786167" ,
"pattern" : "[file:hashes.MD5 = '62cfd5f9a600809c9e53ea089920d988']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-01-26T21:54:25Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--588a7012-f1e8-4f25-a7c8-455602de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:54:26.000Z" ,
"modified" : "2017-01-26T21:54:26.000Z" ,
"first_observed" : "2017-01-26T21:54:26Z" ,
"last_observed" : "2017-01-26T21:54:26Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--588a7012-f1e8-4f25-a7c8-455602de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--588a7012-f1e8-4f25-a7c8-455602de0b81" ,
"value" : "https://www.virustotal.com/file/ebeaaef3323331e7ea0e47eac6437dcf5548d9fd759943d2e5c1f3d1fb786167/analysis/1484834402/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--588a7013-f6b4-487c-a1ae-4fc602de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:54:27.000Z" ,
"modified" : "2017-01-26T21:54:27.000Z" ,
"description" : "FleerCivet 2017-01-16 - Xchecked via VT: 9190c865c214cf2b1c602edcfe4ab8858806298ca4b6de16bfbd0377385ffe63" ,
"pattern" : "[file:hashes.SHA1 = '0779fa9caa48b4fd978bf732f8450668eea13f39']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-01-26T21:54:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--588a7013-e0d0-431e-ace0-4fc002de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:54:27.000Z" ,
"modified" : "2017-01-26T21:54:27.000Z" ,
"description" : "FleerCivet 2017-01-16 - Xchecked via VT: 9190c865c214cf2b1c602edcfe4ab8858806298ca4b6de16bfbd0377385ffe63" ,
"pattern" : "[file:hashes.MD5 = '7b9aae9a506fc9e19cc127b5c74bfba1']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-01-26T21:54:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--588a7014-6648-4d5b-ae8e-4b7b02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:54:28.000Z" ,
"modified" : "2017-01-26T21:54:28.000Z" ,
"first_observed" : "2017-01-26T21:54:28Z" ,
"last_observed" : "2017-01-26T21:54:28Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--588a7014-6648-4d5b-ae8e-4b7b02de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--588a7014-6648-4d5b-ae8e-4b7b02de0b81" ,
"value" : "https://www.virustotal.com/file/9190c865c214cf2b1c602edcfe4ab8858806298ca4b6de16bfbd0377385ffe63/analysis/1484886904/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--588a7015-72d4-4d87-b1f3-4c9b02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:54:29.000Z" ,
"modified" : "2017-01-26T21:54:29.000Z" ,
"description" : "FleerCivet 2017-01-15 - Xchecked via VT: 7bb7848270e76aa1fcb9d11acb46c8421b86c7d528c108d8f179ec829ff977fc" ,
"pattern" : "[file:hashes.SHA1 = '5a95dc982879b78fc44ca6e3d473aab2eafa5012']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-01-26T21:54:29Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--588a7016-1130-4783-8732-421502de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:54:30.000Z" ,
"modified" : "2017-01-26T21:54:30.000Z" ,
"description" : "FleerCivet 2017-01-15 - Xchecked via VT: 7bb7848270e76aa1fcb9d11acb46c8421b86c7d528c108d8f179ec829ff977fc" ,
"pattern" : "[file:hashes.MD5 = 'f9e1f0083e0e42833c5dfa7faa4a0281']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-01-26T21:54:30Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--588a7016-1bdc-4229-a0fa-414c02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:54:30.000Z" ,
"modified" : "2017-01-26T21:54:30.000Z" ,
"first_observed" : "2017-01-26T21:54:30Z" ,
"last_observed" : "2017-01-26T21:54:30Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--588a7016-1bdc-4229-a0fa-414c02de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--588a7016-1bdc-4229-a0fa-414c02de0b81" ,
"value" : "https://www.virustotal.com/file/7bb7848270e76aa1fcb9d11acb46c8421b86c7d528c108d8f179ec829ff977fc/analysis/1484541299/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--588a7017-ae5c-4778-8d55-422702de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:54:31.000Z" ,
"modified" : "2017-01-26T21:54:31.000Z" ,
"description" : "FleerCivet 2017-01-15 - Xchecked via VT: 7fc9721cc648de138a61ec3452d63a83fc76ef527d41f4a7aba78f52df13338a" ,
"pattern" : "[file:hashes.SHA1 = 'a13b63b53ffd8bf90665f6109b7f6294f6219dd7']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-01-26T21:54:31Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--588a7018-94e0-438b-bf8f-4b3d02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:54:32.000Z" ,
"modified" : "2017-01-26T21:54:32.000Z" ,
"description" : "FleerCivet 2017-01-15 - Xchecked via VT: 7fc9721cc648de138a61ec3452d63a83fc76ef527d41f4a7aba78f52df13338a" ,
"pattern" : "[file:hashes.MD5 = 'b9ec73f2406d87f69a6c8dfc46ed3a28']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-01-26T21:54:32Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--588a7018-60ec-4202-a54f-4a9e02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:54:32.000Z" ,
"modified" : "2017-01-26T21:54:32.000Z" ,
"first_observed" : "2017-01-26T21:54:32Z" ,
"last_observed" : "2017-01-26T21:54:32Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--588a7018-60ec-4202-a54f-4a9e02de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--588a7018-60ec-4202-a54f-4a9e02de0b81" ,
"value" : "https://www.virustotal.com/file/7fc9721cc648de138a61ec3452d63a83fc76ef527d41f4a7aba78f52df13338a/analysis/1485239703/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--588a7019-96d0-4507-81b2-4fbf02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:54:33.000Z" ,
"modified" : "2017-01-26T21:54:33.000Z" ,
"description" : "Fiddler capture (index and post) - Xchecked via VT: 7a444891c642ec17459471be40bcc1ea9eef6aeb478318a679908f94bf1e7e74" ,
"pattern" : "[file:hashes.SHA1 = 'b38e12e5346fb02d41e18574d10fbf96f085a7c0']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-01-26T21:54:33Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--588a701a-9664-423c-85d8-435102de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:54:34.000Z" ,
"modified" : "2017-01-26T21:54:34.000Z" ,
"description" : "Fiddler capture (index and post) - Xchecked via VT: 7a444891c642ec17459471be40bcc1ea9eef6aeb478318a679908f94bf1e7e74" ,
"pattern" : "[file:hashes.MD5 = 'e8a36364b057d2ca6ea79061188591c0']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-01-26T21:54:34Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--588a701a-9ff8-4e32-bea2-4bdf02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-01-26T21:54:34.000Z" ,
"modified" : "2017-01-26T21:54:34.000Z" ,
"first_observed" : "2017-01-26T21:54:34Z" ,
"last_observed" : "2017-01-26T21:54:34Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--588a701a-9ff8-4e32-bea2-4bdf02de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--588a701a-9ff8-4e32-bea2-4bdf02de0b81" ,
"value" : "https://www.virustotal.com/file/7a444891c642ec17459471be40bcc1ea9eef6aeb478318a679908f94bf1e7e74/analysis/1484822761/"
} ,
{
"type" : "marking-definition" ,
"spec_version" : "2.1" ,
"id" : "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ,
"created" : "2017-01-20T00:00:00.000Z" ,
"definition_type" : "tlp" ,
"name" : "TLP:WHITE" ,
"definition" : {
"tlp" : "white"
}
}
2023-04-21 13:25:09 +00:00
]
}
