adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/596f7d10-18f4-44d9-ae66-48d3950d210f.json

894 lines
39 KiB
JSON
Raw Normal View History

chg: [feed] added
2023-04-21 13:25:09 +00:00
{
chg: [feed] feed updated
2023-06-14 17:31:25 +00:00
"type": "bundle",
"id": "bundle--596f7d10-18f4-44d9-ae66-48d3950d210f",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--596f7d10-18f4-44d9-ae66-48d3950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"name": "OSINT - Unravelling .NET with the Help of WinDBG",
"published": "2017-07-19T15:41:41Z",
"object_refs": [
"indicator--596f7d56-5c0c-413f-8958-1ab5950d210f",
"indicator--596f7d56-08f0-412f-9788-1ab5950d210f",
"indicator--596f7d56-7c10-41fc-a418-1ab5950d210f",
"indicator--596f7d56-a90c-432e-a36a-1ab5950d210f",
"indicator--596f7d56-0600-4335-9d3f-1ab5950d210f",
"indicator--596f7d56-4b20-4277-a0b1-1ab5950d210f",
"indicator--596f7d56-c7d4-40a6-b2cb-1ab5950d210f",
"indicator--596f7d6c-a324-4766-acf1-4cef950d210f",
"indicator--596f7d6c-a9a8-4ebc-87d8-4c26950d210f",
"indicator--596f7d6c-e270-4fde-a868-4e26950d210f",
"indicator--596f7d6c-debc-4e8b-80e6-4a86950d210f",
"x-misp-attribute--596f7d8c-f2cc-49e4-a58c-4a71950d210f",
"observed-data--596f7d9c-b988-4564-be72-4a94950d210f",
"url--596f7d9c-b988-4564-be72-4a94950d210f",
"indicator--596f7da5-6420-4837-a04a-408302de0b81",
"indicator--596f7da5-2974-499b-a794-4c4802de0b81",
"observed-data--596f7da5-3070-40f2-923b-429f02de0b81",
"url--596f7da5-3070-40f2-923b-429f02de0b81",
"indicator--596f7da5-0884-4f33-b7a1-47e102de0b81",
"indicator--596f7da5-2838-4086-8f90-4ff202de0b81",
"observed-data--596f7da5-8ba4-4f72-ae5f-425402de0b81",
"url--596f7da5-8ba4-4f72-ae5f-425402de0b81",
"indicator--596f7da5-3f64-44a5-8f9f-435602de0b81",
"indicator--596f7da5-8ad8-4107-8023-4dc102de0b81",
"observed-data--596f7da5-a064-4660-a94e-4e4402de0b81",
"url--596f7da5-a064-4660-a94e-4e4402de0b81",
"indicator--596f7da5-7170-4554-bc97-4dd202de0b81",
"indicator--596f7da5-b960-43a9-866a-4f9e02de0b81",
"observed-data--596f7da5-05a4-4ad1-b112-454602de0b81",
"url--596f7da5-05a4-4ad1-b112-454602de0b81",
"indicator--596f7da5-70fc-4bbf-8736-419f02de0b81",
"indicator--596f7da5-67c0-4b36-bd23-4c2702de0b81",
"observed-data--596f7da5-8df4-4fef-b6cb-4a0402de0b81",
"url--596f7da5-8df4-4fef-b6cb-4a0402de0b81",
"indicator--596f7da5-9850-4e16-87be-434d02de0b81",
"indicator--596f7da5-e298-4951-8ba0-408702de0b81",
"observed-data--596f7da5-3f20-423b-98c8-403302de0b81",
"url--596f7da5-3f20-423b-98c8-403302de0b81",
"indicator--596f7da5-34a4-40c4-92e6-421202de0b81",
"indicator--596f7da5-6074-46b0-a001-401002de0b81",
"observed-data--596f7da5-0f84-4357-94cc-424a02de0b81",
"url--596f7da5-0f84-4357-94cc-424a02de0b81"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\""
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--596f7d56-5c0c-413f-8958-1ab5950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"description": "PACKED SAMPLES",
"pattern": "[file:hashes.SHA256 = '21acd3457c1a589e117988fe0456e50ed627f051a97ccd11bfeeaf3c0cd79bfe']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-07-19T15:41:25Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--596f7d56-08f0-412f-9788-1ab5950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"description": "PACKED SAMPLES",
"pattern": "[file:hashes.SHA256 = '344ce133363f005346210611d5abd2513934a32739bc6e1bbd2257a298484051']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-07-19T15:41:25Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--596f7d56-7c10-41fc-a418-1ab5950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"description": "PACKED SAMPLES",
"pattern": "[file:hashes.SHA256 = '45c695e610d78178ec5ca6f4e1993afacf4e435b566cd2caf65408fb6080300f']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-07-19T15:41:25Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--596f7d56-a90c-432e-a36a-1ab5950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"description": "PACKED SAMPLES",
"pattern": "[file:hashes.SHA256 = '61653b2811fb7c672584d00417cbc1a56c8372331f1913104f9807a775f25773']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-07-19T15:41:25Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--596f7d56-0600-4335-9d3f-1ab5950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"description": "PACKED SAMPLES",
"pattern": "[file:hashes.SHA256 = 'ac7bd77245bdf284d36ce1f9e2cb6a21d2dbd38aa1964dbaee4d06563f057ca6']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-07-19T15:41:25Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--596f7d56-4b20-4277-a0b1-1ab5950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"description": "PACKED SAMPLES",
"pattern": "[file:hashes.SHA256 = 'b607e87acdcb2ef0f102298decc57ca3ea20fabbf02375fd30eddddffbeec320']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-07-19T15:41:25Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--596f7d56-c7d4-40a6-b2cb-1ab5950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"description": "PACKED SAMPLES",
"pattern": "[file:hashes.SHA256 = 'e93c0aed6bbb4af734403e02d399c124f2d07f8e701fb716c2efe65942f83504']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-07-19T15:41:25Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--596f7d6c-a324-4766-acf1-4cef950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"description": "UNPACKED SAMPLES",
"pattern": "[file:hashes.SHA256 = '35dee9106e4521e5adf295cc945355d72eb359d610230142e5dd4adda9678dee']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-07-19T15:41:25Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--596f7d6c-a9a8-4ebc-87d8-4c26950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"description": "UNPACKED SAMPLES",
"pattern": "[file:hashes.SHA256 = 'b5ce02ee3dfccf28e86f737a6dde85e9d30ff0549ec611d115a1d575b5291c2e']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-07-19T15:41:25Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--596f7d6c-e270-4fde-a868-4e26950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"description": "UNPACKED SAMPLES",
"pattern": "[file:hashes.SHA256 = 'd9a732dcf87764a87f17c95466f557fac33f041ac6f244dba006ba155d8e9aea']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-07-19T15:41:25Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--596f7d6c-debc-4e8b-80e6-4a86950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"description": "UNPACKED SAMPLES",
"pattern": "[file:hashes.SHA256 = 'fe068ce56b258762c10cc66525c309e79026c0e44103ca9b223c51382722cb09']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-07-19T15:41:25Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "x-misp-attribute",
"spec_version": "2.1",
"id": "x-misp-attribute--596f7d8c-f2cc-49e4-a58c-4a71950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"labels": [
"misp:type=\"text\"",
"misp:category=\"External analysis\""
],
"x_misp_category": "External analysis",
"x_misp_type": "text",
"x_misp_value": ".NET is an increasingly important component of the Microsoft ecosystem providing a shared framework for interoperability between different languages and hardware platforms. Many Microsoft tools, such as PowerShell, and other administrative functions rely on the .NET platform for their functionality. Obviously, this makes .NET an enticing language for malware developers too. Hence, malware researchers must also be familiar with the language and have the necessary skills to analyse malicious software that runs on the platform.\r\n\r\nAnalysis tools such as ILSpy help researchers decompile code from applications, but cannot be used to automate the analysis of many samples. In this article we will examine how to use WinDBG to analyse .NET applications using the SOS extension provided by Microsoft.\r\n\r\nThis article describes:\r\nHow to analyse PowerShell scripts by inserting a breakpoint in the .NET API.\r\nHow to easily create a script to automatically unpack .NET samples following analysis of the packer logic."
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--596f7d9c-b988-4564-be72-4a94950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"first_observed": "2017-07-19T15:41:25Z",
"last_observed": "2017-07-19T15:41:25Z",
"number_observed": 1,
"object_refs": [
"url--596f7d9c-b988-4564-be72-4a94950d210f"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--596f7d9c-b988-4564-be72-4a94950d210f",
"value": "http://blog.talosintelligence.com/2017/07/unravelling-net-with-help-of-windbg.html"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--596f7da5-6420-4837-a04a-408302de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"description": "PACKED SAMPLES - Xchecked via VT: e93c0aed6bbb4af734403e02d399c124f2d07f8e701fb716c2efe65942f83504",
"pattern": "[file:hashes.SHA1 = '23b1f6dda828dc50963ea841414eab633bfc7dde']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-07-19T15:41:25Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--596f7da5-2974-499b-a794-4c4802de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"description": "PACKED SAMPLES - Xchecked via VT: e93c0aed6bbb4af734403e02d399c124f2d07f8e701fb716c2efe65942f83504",
"pattern": "[file:hashes.MD5 = 'd8c5268ff36bec6ef67522e407c99847']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-07-19T15:41:25Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--596f7da5-3070-40f2-923b-429f02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"first_observed": "2017-07-19T15:41:25Z",
"last_observed": "2017-07-19T15:41:25Z",
"number_observed": 1,
"object_refs": [
"url--596f7da5-3070-40f2-923b-429f02de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--596f7da5-3070-40f2-923b-429f02de0b81",
"value": "https://www.virustotal.com/file/e93c0aed6bbb4af734403e02d399c124f2d07f8e701fb716c2efe65942f83504/analysis/1493454070/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--596f7da5-0884-4f33-b7a1-47e102de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"description": "PACKED SAMPLES - Xchecked via VT: b607e87acdcb2ef0f102298decc57ca3ea20fabbf02375fd30eddddffbeec320",
"pattern": "[file:hashes.SHA1 = 'a0e1c6c4c0469d28e889e15cb4fd1698d580c8b8']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-07-19T15:41:25Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--596f7da5-2838-4086-8f90-4ff202de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"description": "PACKED SAMPLES - Xchecked via VT: b607e87acdcb2ef0f102298decc57ca3ea20fabbf02375fd30eddddffbeec320",
"pattern": "[file:hashes.MD5 = 'aeefcc7e278e54fc6ee71fa6075fdc48']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-07-19T15:41:25Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--596f7da5-8ba4-4f72-ae5f-425402de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"first_observed": "2017-07-19T15:41:25Z",
"last_observed": "2017-07-19T15:41:25Z",
"number_observed": 1,
"object_refs": [
"url--596f7da5-8ba4-4f72-ae5f-425402de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--596f7da5-8ba4-4f72-ae5f-425402de0b81",
"value": "https://www.virustotal.com/file/b607e87acdcb2ef0f102298decc57ca3ea20fabbf02375fd30eddddffbeec320/analysis/1491852495/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--596f7da5-3f64-44a5-8f9f-435602de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"description": "PACKED SAMPLES - Xchecked via VT: ac7bd77245bdf284d36ce1f9e2cb6a21d2dbd38aa1964dbaee4d06563f057ca6",
"pattern": "[file:hashes.SHA1 = 'e79e302f43bfe18fe777e06d321a369a6fbebcb4']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-07-19T15:41:25Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--596f7da5-8ad8-4107-8023-4dc102de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"description": "PACKED SAMPLES - Xchecked via VT: ac7bd77245bdf284d36ce1f9e2cb6a21d2dbd38aa1964dbaee4d06563f057ca6",
"pattern": "[file:hashes.MD5 = 'c61f4b7fab51bb78a635518cd1dd6bb5']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-07-19T15:41:25Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--596f7da5-a064-4660-a94e-4e4402de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"first_observed": "2017-07-19T15:41:25Z",
"last_observed": "2017-07-19T15:41:25Z",
"number_observed": 1,
"object_refs": [
"url--596f7da5-a064-4660-a94e-4e4402de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--596f7da5-a064-4660-a94e-4e4402de0b81",
"value": "https://www.virustotal.com/file/ac7bd77245bdf284d36ce1f9e2cb6a21d2dbd38aa1964dbaee4d06563f057ca6/analysis/1498156633/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--596f7da5-7170-4554-bc97-4dd202de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"description": "PACKED SAMPLES - Xchecked via VT: 61653b2811fb7c672584d00417cbc1a56c8372331f1913104f9807a775f25773",
"pattern": "[file:hashes.SHA1 = '36fce94a8feb925becdb6708ed01e3b6fa1c32a4']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-07-19T15:41:25Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--596f7da5-b960-43a9-866a-4f9e02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"description": "PACKED SAMPLES - Xchecked via VT: 61653b2811fb7c672584d00417cbc1a56c8372331f1913104f9807a775f25773",
"pattern": "[file:hashes.MD5 = '8a8c90f2f65bdab3fc1ada60d0767d3f']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-07-19T15:41:25Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--596f7da5-05a4-4ad1-b112-454602de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"first_observed": "2017-07-19T15:41:25Z",
"last_observed": "2017-07-19T15:41:25Z",
"number_observed": 1,
"object_refs": [
"url--596f7da5-05a4-4ad1-b112-454602de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--596f7da5-05a4-4ad1-b112-454602de0b81",
"value": "https://www.virustotal.com/file/61653b2811fb7c672584d00417cbc1a56c8372331f1913104f9807a775f25773/analysis/1497280580/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--596f7da5-70fc-4bbf-8736-419f02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"description": "PACKED SAMPLES - Xchecked via VT: 45c695e610d78178ec5ca6f4e1993afacf4e435b566cd2caf65408fb6080300f",
"pattern": "[file:hashes.SHA1 = '6bb562395254d750e418357e59b57061e32022cb']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-07-19T15:41:25Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--596f7da5-67c0-4b36-bd23-4c2702de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"description": "PACKED SAMPLES - Xchecked via VT: 45c695e610d78178ec5ca6f4e1993afacf4e435b566cd2caf65408fb6080300f",
"pattern": "[file:hashes.MD5 = '0c814ae689b229063ee7f0045cd36bae']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-07-19T15:41:25Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--596f7da5-8df4-4fef-b6cb-4a0402de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"first_observed": "2017-07-19T15:41:25Z",
"last_observed": "2017-07-19T15:41:25Z",
"number_observed": 1,
"object_refs": [
"url--596f7da5-8df4-4fef-b6cb-4a0402de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--596f7da5-8df4-4fef-b6cb-4a0402de0b81",
"value": "https://www.virustotal.com/file/45c695e610d78178ec5ca6f4e1993afacf4e435b566cd2caf65408fb6080300f/analysis/1493177175/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--596f7da5-9850-4e16-87be-434d02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"description": "PACKED SAMPLES - Xchecked via VT: 344ce133363f005346210611d5abd2513934a32739bc6e1bbd2257a298484051",
"pattern": "[file:hashes.SHA1 = '8ac7418803efac76bf5d64cbad35332f0ddc8982']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-07-19T15:41:25Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--596f7da5-e298-4951-8ba0-408702de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"description": "PACKED SAMPLES - Xchecked via VT: 344ce133363f005346210611d5abd2513934a32739bc6e1bbd2257a298484051",
"pattern": "[file:hashes.MD5 = '5480488e9f961e1cb1020fa48db5d038']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-07-19T15:41:25Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--596f7da5-3f20-423b-98c8-403302de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"first_observed": "2017-07-19T15:41:25Z",
"last_observed": "2017-07-19T15:41:25Z",
"number_observed": 1,
"object_refs": [
"url--596f7da5-3f20-423b-98c8-403302de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--596f7da5-3f20-423b-98c8-403302de0b81",
"value": "https://www.virustotal.com/file/344ce133363f005346210611d5abd2513934a32739bc6e1bbd2257a298484051/analysis/1492133502/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--596f7da5-34a4-40c4-92e6-421202de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"description": "PACKED SAMPLES - Xchecked via VT: 21acd3457c1a589e117988fe0456e50ed627f051a97ccd11bfeeaf3c0cd79bfe",
"pattern": "[file:hashes.SHA1 = 'ca460d04d93e535441bcc4ea3de313645eb7b817']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-07-19T15:41:25Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--596f7da5-6074-46b0-a001-401002de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"description": "PACKED SAMPLES - Xchecked via VT: 21acd3457c1a589e117988fe0456e50ed627f051a97ccd11bfeeaf3c0cd79bfe",
"pattern": "[file:hashes.MD5 = 'bed8aca8dc2ea2e8fafa2f56db06ba69']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-07-19T15:41:25Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--596f7da5-0f84-4357-94cc-424a02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-07-19T15:41:25.000Z",
"modified": "2017-07-19T15:41:25.000Z",
"first_observed": "2017-07-19T15:41:25Z",
"last_observed": "2017-07-19T15:41:25Z",
"number_observed": 1,
"object_refs": [
"url--596f7da5-0f84-4357-94cc-424a02de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--596f7da5-0f84-4357-94cc-424a02de0b81",
"value": "https://www.virustotal.com/file/21acd3457c1a589e117988fe0456e50ed627f051a97ccd11bfeeaf3c0cd79bfe/analysis/1490674431/"
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
chg: [feed] added
2023-04-21 13:25:09 +00:00
]
}
Reference in a new issue Copy permalink