2023-04-21 13:25:09 +00:00
{
2023-06-14 17:31:25 +00:00
"type" : "bundle" ,
"id" : "bundle--59aefa78-008c-4e61-a035-4bfb02de0b81" ,
"objects" : [
{
"type" : "identity" ,
"spec_version" : "2.1" ,
"id" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:56.000Z" ,
"modified" : "2017-09-05T19:29:56.000Z" ,
"name" : "CIRCL" ,
"identity_class" : "organization"
} ,
{
"type" : "report" ,
"spec_version" : "2.1" ,
"id" : "report--59aefa78-008c-4e61-a035-4bfb02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:56.000Z" ,
"modified" : "2017-09-05T19:29:56.000Z" ,
"name" : "OSINT - Jimmy Nukebot: from Neutrino with love" ,
"published" : "2017-09-05T19:30:12Z" ,
"object_refs" : [
"x-misp-attribute--59aefa8d-42cc-4b1c-925c-bc9b02de0b81" ,
"observed-data--59aefa9a-7fd8-4bfa-9b89-4f4202de0b81" ,
"url--59aefa9a-7fd8-4bfa-9b89-4f4202de0b81" ,
"indicator--59aefac1-0418-4cf1-ba15-bc1402de0b81" ,
"indicator--59aefac1-60d8-463c-8703-bc1402de0b81" ,
"indicator--59aefac1-d820-4dce-b2ec-bc1402de0b81" ,
"indicator--59aefac1-76e4-46fe-a4a9-bc1402de0b81" ,
"indicator--59aefac1-cb14-4f72-b2e3-bc1402de0b81" ,
"indicator--59aeface-5ad4-4fbb-ad9a-bc1402de0b81" ,
"indicator--59aeface-f0dc-4785-8983-bc1402de0b81" ,
"indicator--59aeface-6eac-4664-8f32-bc1402de0b81" ,
"indicator--59aefae2-95a4-46ec-88d6-0eb902de0b81" ,
"indicator--59aefae2-7e54-4fd7-9636-0eb902de0b81" ,
"indicator--59aefae2-fe10-437d-b10e-0eb902de0b81" ,
"indicator--59aefae2-b494-4300-a6e4-0eb902de0b81" ,
"indicator--59aefae2-d43c-47b2-a88d-0eb902de0b81" ,
"indicator--59aefae2-ee08-4615-b5e0-0eb902de0b81" ,
"indicator--59aefae2-fb68-4da9-ad03-0eb902de0b81" ,
"indicator--59aefae2-7740-49c4-aaf3-0eb902de0b81" ,
"indicator--59aefae2-ee68-4fb9-ba64-0eb902de0b81" ,
"indicator--59aefae2-5eec-4ff1-8252-0eb902de0b81" ,
"indicator--59aefae2-ccb4-4dc4-984c-0eb902de0b81" ,
"indicator--59aefae2-d99c-4ec2-a3fe-0eb902de0b81" ,
"indicator--59aefb35-f0d4-4a0a-8314-4de602de0b81" ,
"indicator--59aefb35-fb00-47a9-b316-4f3d02de0b81" ,
"observed-data--59aefb35-8cb8-43f2-89c6-40a302de0b81" ,
"url--59aefb35-8cb8-43f2-89c6-40a302de0b81" ,
"indicator--59aefb35-ee00-4a8b-9215-4d7902de0b81" ,
"indicator--59aefb35-f3bc-4103-b389-45e202de0b81" ,
"observed-data--59aefb35-a25c-416f-92e3-49be02de0b81" ,
"url--59aefb35-a25c-416f-92e3-49be02de0b81" ,
"indicator--59aefb35-9644-402a-a8e1-485b02de0b81" ,
"indicator--59aefb35-9d50-42d9-9efe-42d702de0b81" ,
"observed-data--59aefb35-e3e4-4e5c-9243-4acd02de0b81" ,
"url--59aefb35-e3e4-4e5c-9243-4acd02de0b81" ,
"indicator--59aefb35-2970-40be-8c32-4f4d02de0b81" ,
"indicator--59aefb35-866c-484a-9825-4f5102de0b81" ,
"observed-data--59aefb35-4e0c-493e-9988-46c602de0b81" ,
"url--59aefb35-4e0c-493e-9988-46c602de0b81" ,
"indicator--59aefb35-d6c8-4a6e-9059-45eb02de0b81" ,
"indicator--59aefb35-67dc-4417-99a3-4e4402de0b81" ,
"observed-data--59aefb35-f828-4e71-b3f8-4dd902de0b81" ,
"url--59aefb35-f828-4e71-b3f8-4dd902de0b81" ,
"indicator--59aefb35-d4a0-46f6-bf0e-4d8d02de0b81" ,
"indicator--59aefb35-b17c-4ed8-9f9c-4c3502de0b81" ,
"observed-data--59aefb35-d468-4d3e-9a07-401602de0b81" ,
"url--59aefb35-d468-4d3e-9a07-401602de0b81" ,
"indicator--59aefb35-1568-459f-86d0-4ab602de0b81" ,
"indicator--59aefb35-b9a0-424c-a9db-406902de0b81" ,
"observed-data--59aefb35-b770-4ded-8d14-489b02de0b81" ,
"url--59aefb35-b770-4ded-8d14-489b02de0b81" ,
"indicator--59aefb35-2e58-4c10-ad26-404302de0b81" ,
"indicator--59aefb35-633c-4b9b-a246-4d4102de0b81" ,
"observed-data--59aefb35-2098-4f71-81d3-408902de0b81" ,
"url--59aefb35-2098-4f71-81d3-408902de0b81" ,
"indicator--59aefb35-2b4c-4e36-9392-411502de0b81" ,
"indicator--59aefb35-e4c0-44df-baa3-479a02de0b81" ,
"observed-data--59aefb35-8f5c-4d62-a369-45a002de0b81" ,
"url--59aefb35-8f5c-4d62-a369-45a002de0b81" ,
"indicator--59aefb35-d318-43b2-b91a-483702de0b81" ,
"indicator--59aefb35-25ac-49de-b616-4f0902de0b81" ,
"observed-data--59aefb35-8524-4252-8631-419002de0b81" ,
"url--59aefb35-8524-4252-8631-419002de0b81" ,
"indicator--59aefb35-3064-49fc-978b-47e702de0b81" ,
"indicator--59aefb35-9554-42b7-b084-4ad102de0b81" ,
"observed-data--59aefb35-a38c-4351-afa1-476002de0b81" ,
"url--59aefb35-a38c-4351-afa1-476002de0b81" ,
"indicator--59aefb35-1f24-471d-ba7f-4d5f02de0b81" ,
"indicator--59aefb35-194c-42ac-8750-428a02de0b81" ,
"observed-data--59aefb35-b550-4d64-a3e3-4cf202de0b81" ,
"url--59aefb35-b550-4d64-a3e3-4cf202de0b81" ,
"indicator--59aefb35-9d80-4b44-8f1b-4bfc02de0b81" ,
"indicator--59aefb35-d7b8-4eac-b31f-425202de0b81" ,
"observed-data--59aefb35-be2c-41c2-9009-460202de0b81" ,
"url--59aefb35-be2c-41c2-9009-460202de0b81" ,
"indicator--59aefb35-41d4-436f-abe2-45b902de0b81" ,
"indicator--59aefb35-5240-4f5e-a3e8-4e6502de0b81" ,
"observed-data--59aefb35-9cd8-473d-8d44-4c5202de0b81" ,
"url--59aefb35-9cd8-473d-8d44-4c5202de0b81" ,
"indicator--59aefb35-54fc-4ac9-a599-4cb202de0b81" ,
"indicator--59aefb35-2194-4a15-8703-404b02de0b81" ,
"observed-data--59aefb35-9ee0-4375-bfb6-4f9402de0b81" ,
"url--59aefb35-9ee0-4375-bfb6-4f9402de0b81" ,
"indicator--59aefb35-7e9c-4fb7-b002-441702de0b81" ,
"indicator--59aefb35-8ec8-4dba-8952-4b3402de0b81" ,
"observed-data--59aefb35-0e6c-4abc-95be-451a02de0b81" ,
"url--59aefb35-0e6c-4abc-95be-451a02de0b81" ,
"indicator--59aefb35-c074-4f61-9f9a-428702de0b81" ,
"indicator--59aefb35-36b8-4391-8943-466c02de0b81" ,
"observed-data--59aefb35-d790-42c4-8efd-4b7402de0b81" ,
"url--59aefb35-d790-42c4-8efd-4b7402de0b81"
] ,
"labels" : [
"Threat-Report" ,
"misp:tool=\"MISP-STIX-Converter\"" ,
"misp-galaxy:exploit-kit=\"Neutrino\""
] ,
"object_marking_refs" : [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
} ,
{
"type" : "x-misp-attribute" ,
"spec_version" : "2.1" ,
"id" : "x-misp-attribute--59aefa8d-42cc-4b1c-925c-bc9b02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:56.000Z" ,
"modified" : "2017-09-05T19:29:56.000Z" ,
"labels" : [
"misp:type=\"text\"" ,
"misp:category=\"External analysis\"" ,
"osint:source-type=\"blog-post\""
] ,
"x_misp_category" : "External analysis" ,
"x_misp_type" : "text" ,
"x_misp_value" : "In one of our previous articles, we analyzed the NeutrinoPOS banker as an example of a constantly evolving malware family. A week after publication, this Neutrino modification delivered up a new malicious program classified by Kaspersky Lab as Trojan-Banker.Win32.Jimmy.\r\n\r\nNeutrinoPOS vs Jimmy\r\n\r\nThe authors seriously rewrote the Trojan \u00e2\u20ac\u201c the main body was restructured, the functions were moved to the modules. One small difference that immediately stands out is in the calculation of checksums from the names of API functions/libraries and strings. In the first case, the checksums are used to find the necessary API calls; in the second case, for a comparison of strings (commands, process names). This approach makes static analysis much more complicated: for example, to identify which detected process halts the Trojan operation, it\u00e2\u20ac\u2122s necessary to calculate the checksums from a huge list of strings, or to bruteforce the symbols in a certain length range. NeutrinoPOS uses two different algorithms to calculate checksums for the names of API calls, libraries and for the strings."
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--59aefa9a-7fd8-4bfa-9b89-4f4202de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:56.000Z" ,
"modified" : "2017-09-05T19:29:56.000Z" ,
"first_observed" : "2017-09-05T19:29:56Z" ,
"last_observed" : "2017-09-05T19:29:56Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--59aefa9a-7fd8-4bfa-9b89-4f4202de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\"" ,
"osint:source-type=\"blog-post\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--59aefa9a-7fd8-4bfa-9b89-4f4202de0b81" ,
"value" : "https://securelist.com/jimmy-nukebot-from-neutrino-with-love/81667/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefac1-0418-4cf1-ba15-bc1402de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:56.000Z" ,
"modified" : "2017-09-05T19:29:56.000Z" ,
"description" : "Droppers" ,
"pattern" : "[file:hashes.MD5 = 'c989d501460a8e8e381b81b807ccbe90']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefac1-60d8-463c-8703-bc1402de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:56.000Z" ,
"modified" : "2017-09-05T19:29:56.000Z" ,
"description" : "Droppers" ,
"pattern" : "[file:hashes.MD5 = 'e584c6e999a509ac21583d9543492ef4']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefac1-d820-4dce-b2ec-bc1402de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:56.000Z" ,
"modified" : "2017-09-05T19:29:56.000Z" ,
"description" : "Droppers" ,
"pattern" : "[file:hashes.MD5 = '2e55bd0d409bf9658887e02a7c578019']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefac1-76e4-46fe-a4a9-bc1402de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:56.000Z" ,
"modified" : "2017-09-05T19:29:56.000Z" ,
"description" : "Droppers" ,
"pattern" : "[file:hashes.MD5 = 'bccd77cf0269da7dc914885cda626c6c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefac1-cb14-4f72-b2e3-bc1402de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:56.000Z" ,
"modified" : "2017-09-05T19:29:56.000Z" ,
"description" : "Droppers" ,
"pattern" : "[file:hashes.MD5 = '86d7d3b50e4dc4181c28ccbaafb89ab3']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aeface-5ad4-4fbb-ad9a-bc1402de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:56.000Z" ,
"modified" : "2017-09-05T19:29:56.000Z" ,
"description" : "Main body" ,
"pattern" : "[file:hashes.MD5 = '174256b5f1ee80be1b847d428c5180e2']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aeface-f0dc-4785-8983-bc1402de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:56.000Z" ,
"modified" : "2017-09-05T19:29:56.000Z" ,
"description" : "Main body" ,
"pattern" : "[file:hashes.MD5 = '336841d91c37b07134adba135828e66e']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aeface-6eac-4664-8f32-bc1402de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:56.000Z" ,
"modified" : "2017-09-05T19:29:56.000Z" ,
"description" : "Main body" ,
"pattern" : "[file:hashes.MD5 = 'fe9a46cefdb41095f10d459bb9943682']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefae2-95a4-46ec-88d6-0eb902de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:56.000Z" ,
"modified" : "2017-09-05T19:29:56.000Z" ,
"description" : "Modules" ,
"pattern" : "[file:hashes.MD5 = '380356b8297893b4fc9273d42f15e9db']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefae2-7e54-4fd7-9636-0eb902de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:56.000Z" ,
"modified" : "2017-09-05T19:29:56.000Z" ,
"description" : "Modules" ,
"pattern" : "[file:hashes.MD5 = '2fa18456e14bea53ec0d7c898d94043b']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefae2-fe10-437d-b10e-0eb902de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:56.000Z" ,
"modified" : "2017-09-05T19:29:56.000Z" ,
"description" : "Modules" ,
"pattern" : "[file:hashes.MD5 = '7040b5ac432064780a17024ab0a3792a']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefae2-b494-4300-a6e4-0eb902de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:56.000Z" ,
"modified" : "2017-09-05T19:29:56.000Z" ,
"description" : "Modules" ,
"pattern" : "[file:hashes.MD5 = '629a4d2b79abe48fb21afd625f674354']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefae2-d43c-47b2-a88d-0eb902de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:56.000Z" ,
"modified" : "2017-09-05T19:29:56.000Z" ,
"description" : "Modules" ,
"pattern" : "[file:hashes.MD5 = '05846839daa851006b119a2b4f9687bf']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefae2-ee08-4615-b5e0-0eb902de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:56.000Z" ,
"modified" : "2017-09-05T19:29:56.000Z" ,
"description" : "Modules" ,
"pattern" : "[file:hashes.MD5 = '2362e3bebad1089ddfe40c8996b0bf45']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefae2-fb68-4da9-ad03-0eb902de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:56.000Z" ,
"modified" : "2017-09-05T19:29:56.000Z" ,
"description" : "Modules" ,
"pattern" : "[file:hashes.MD5 = '4042c27f082f48e253be66528938640c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefae2-7740-49c4-aaf3-0eb902de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:56.000Z" ,
"modified" : "2017-09-05T19:29:56.000Z" ,
"description" : "Modules" ,
"pattern" : "[file:hashes.MD5 = '443831a3057e9a62455d4bd3c7e04144']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefae2-ee68-4fb9-ba64-0eb902de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:56.000Z" ,
"modified" : "2017-09-05T19:29:56.000Z" ,
"description" : "Modules" ,
"pattern" : "[file:hashes.MD5 = '4762b90c0305a2681ce42b9d05b9e741']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefae2-5eec-4ff1-8252-0eb902de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:56.000Z" ,
"modified" : "2017-09-05T19:29:56.000Z" ,
"description" : "Modules" ,
"pattern" : "[file:hashes.MD5 = 'cb01e3a0799d4c318f74e439cce0413f']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefae2-ccb4-4dc4-984c-0eb902de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:56.000Z" ,
"modified" : "2017-09-05T19:29:56.000Z" ,
"description" : "Modules" ,
"pattern" : "[file:hashes.MD5 = 'd9f58167a9a22bd1fa9aa0f991aeaf11']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefae2-d99c-4ec2-a3fe-0eb902de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:56.000Z" ,
"modified" : "2017-09-05T19:29:56.000Z" ,
"description" : "Modules" ,
"pattern" : "[file:hashes.MD5 = 'e991936e09697de8495d05b484f3a3e2']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-f0d4-4a0a-8314-4de602de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Modules - Xchecked via VT: e991936e09697de8495d05b484f3a3e2" ,
"pattern" : "[file:hashes.SHA256 = '7a16129c5f35e9f4accaa1f37416a9447310139022b5eb2de4e5661baf236368']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-fb00-47a9-b316-4f3d02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Modules - Xchecked via VT: e991936e09697de8495d05b484f3a3e2" ,
"pattern" : "[file:hashes.SHA1 = 'acc4258962bc3a79fe323006e233b3d842d5a51c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--59aefb35-8cb8-43f2-89c6-40a302de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"first_observed" : "2017-09-05T19:29:57Z" ,
"last_observed" : "2017-09-05T19:29:57Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--59aefb35-8cb8-43f2-89c6-40a302de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--59aefb35-8cb8-43f2-89c6-40a302de0b81" ,
"value" : "https://www.virustotal.com/file/7a16129c5f35e9f4accaa1f37416a9447310139022b5eb2de4e5661baf236368/analysis/1503475408/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-ee00-4a8b-9215-4d7902de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Modules - Xchecked via VT: d9f58167a9a22bd1fa9aa0f991aeaf11" ,
"pattern" : "[file:hashes.SHA256 = '0e7cdb0ecbe4003cf3ebc95ff442c3a54e9c40459d678d47a0da057f78b0d113']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-f3bc-4103-b389-45e202de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Modules - Xchecked via VT: d9f58167a9a22bd1fa9aa0f991aeaf11" ,
"pattern" : "[file:hashes.SHA1 = '8ee7c3c754dc5780ae8203abd2658190819ba379']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--59aefb35-a25c-416f-92e3-49be02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"first_observed" : "2017-09-05T19:29:57Z" ,
"last_observed" : "2017-09-05T19:29:57Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--59aefb35-a25c-416f-92e3-49be02de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--59aefb35-a25c-416f-92e3-49be02de0b81" ,
"value" : "https://www.virustotal.com/file/0e7cdb0ecbe4003cf3ebc95ff442c3a54e9c40459d678d47a0da057f78b0d113/analysis/1504014536/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-9644-402a-a8e1-485b02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Modules - Xchecked via VT: cb01e3a0799d4c318f74e439cce0413f" ,
"pattern" : "[file:hashes.SHA256 = 'a7af1cf95f4578da0c29bfcacabaa7df3bc621021bfb2dee8a58a5d239a943c6']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-9d50-42d9-9efe-42d702de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Modules - Xchecked via VT: cb01e3a0799d4c318f74e439cce0413f" ,
"pattern" : "[file:hashes.SHA1 = '060dbc37943ddc01f542018d71a99a3a6da324fd']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--59aefb35-e3e4-4e5c-9243-4acd02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"first_observed" : "2017-09-05T19:29:57Z" ,
"last_observed" : "2017-09-05T19:29:57Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--59aefb35-e3e4-4e5c-9243-4acd02de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--59aefb35-e3e4-4e5c-9243-4acd02de0b81" ,
"value" : "https://www.virustotal.com/file/a7af1cf95f4578da0c29bfcacabaa7df3bc621021bfb2dee8a58a5d239a943c6/analysis/1504014536/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-2970-40be-8c32-4f4d02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Modules - Xchecked via VT: 4762b90c0305a2681ce42b9d05b9e741" ,
"pattern" : "[file:hashes.SHA256 = '8f4d621b6abfd26401615a46f8feb0d04ca9bdcc126eb5bdde943c1d968e39f2']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-866c-484a-9825-4f5102de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Modules - Xchecked via VT: 4762b90c0305a2681ce42b9d05b9e741" ,
"pattern" : "[file:hashes.SHA1 = '868fe05d78ecfede53fdbbc9fb0a30bef84a30b4']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--59aefb35-4e0c-493e-9988-46c602de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"first_observed" : "2017-09-05T19:29:57Z" ,
"last_observed" : "2017-09-05T19:29:57Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--59aefb35-4e0c-493e-9988-46c602de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--59aefb35-4e0c-493e-9988-46c602de0b81" ,
"value" : "https://www.virustotal.com/file/8f4d621b6abfd26401615a46f8feb0d04ca9bdcc126eb5bdde943c1d968e39f2/analysis/1504320295/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-d6c8-4a6e-9059-45eb02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Modules - Xchecked via VT: 443831a3057e9a62455d4bd3c7e04144" ,
"pattern" : "[file:hashes.SHA256 = 'b147e3debbe54d11c9ac2c642006dc9dafa0d0036728168b4e173e43aafeade7']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-67dc-4417-99a3-4e4402de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Modules - Xchecked via VT: 443831a3057e9a62455d4bd3c7e04144" ,
"pattern" : "[file:hashes.SHA1 = 'b2f6649f634714eb5fec05749b1769ab2867d3a8']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--59aefb35-f828-4e71-b3f8-4dd902de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"first_observed" : "2017-09-05T19:29:57Z" ,
"last_observed" : "2017-09-05T19:29:57Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--59aefb35-f828-4e71-b3f8-4dd902de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--59aefb35-f828-4e71-b3f8-4dd902de0b81" ,
"value" : "https://www.virustotal.com/file/b147e3debbe54d11c9ac2c642006dc9dafa0d0036728168b4e173e43aafeade7/analysis/1504014536/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-d4a0-46f6-bf0e-4d8d02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Modules - Xchecked via VT: 4042c27f082f48e253be66528938640c" ,
"pattern" : "[file:hashes.SHA256 = '8098926bf0da54a981e4e85f8b691bf2acb2dcc1edaab5d83d3efd92738fa80c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-b17c-4ed8-9f9c-4c3502de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Modules - Xchecked via VT: 4042c27f082f48e253be66528938640c" ,
"pattern" : "[file:hashes.SHA1 = 'bca0ab998214e62b9d15bf75015de666b0d82c70']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--59aefb35-d468-4d3e-9a07-401602de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"first_observed" : "2017-09-05T19:29:57Z" ,
"last_observed" : "2017-09-05T19:29:57Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--59aefb35-d468-4d3e-9a07-401602de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--59aefb35-d468-4d3e-9a07-401602de0b81" ,
"value" : "https://www.virustotal.com/file/8098926bf0da54a981e4e85f8b691bf2acb2dcc1edaab5d83d3efd92738fa80c/analysis/1504014536/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-1568-459f-86d0-4ab602de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Modules - Xchecked via VT: 2362e3bebad1089ddfe40c8996b0bf45" ,
"pattern" : "[file:hashes.SHA256 = 'f79093f65778e5d558a2a5291f93e623bfacfc00389b8a69b7ec8619380aa499']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-b9a0-424c-a9db-406902de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Modules - Xchecked via VT: 2362e3bebad1089ddfe40c8996b0bf45" ,
"pattern" : "[file:hashes.SHA1 = '3c50550c5eaa030b61fcdca1c78b26b42bb47b09']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--59aefb35-b770-4ded-8d14-489b02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"first_observed" : "2017-09-05T19:29:57Z" ,
"last_observed" : "2017-09-05T19:29:57Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--59aefb35-b770-4ded-8d14-489b02de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--59aefb35-b770-4ded-8d14-489b02de0b81" ,
"value" : "https://www.virustotal.com/file/f79093f65778e5d558a2a5291f93e623bfacfc00389b8a69b7ec8619380aa499/analysis/1504014535/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-2e58-4c10-ad26-404302de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Modules - Xchecked via VT: 05846839daa851006b119a2b4f9687bf" ,
"pattern" : "[file:hashes.SHA256 = '40c51de912ebe1f1ceccb3aeff18cb07d584a93228a47f006400c1b695e1eca1']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-633c-4b9b-a246-4d4102de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Modules - Xchecked via VT: 05846839daa851006b119a2b4f9687bf" ,
"pattern" : "[file:hashes.SHA1 = 'e3104fd17c31ac835e3b3d1216e208ed64d26d93']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--59aefb35-2098-4f71-81d3-408902de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"first_observed" : "2017-09-05T19:29:57Z" ,
"last_observed" : "2017-09-05T19:29:57Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--59aefb35-2098-4f71-81d3-408902de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--59aefb35-2098-4f71-81d3-408902de0b81" ,
"value" : "https://www.virustotal.com/file/40c51de912ebe1f1ceccb3aeff18cb07d584a93228a47f006400c1b695e1eca1/analysis/1504014535/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-2b4c-4e36-9392-411502de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Modules - Xchecked via VT: 629a4d2b79abe48fb21afd625f674354" ,
"pattern" : "[file:hashes.SHA256 = '87f3441f1007279756478cbc5bbf4178df1d1bc455210f43180e5131735203f8']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-e4c0-44df-baa3-479a02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Modules - Xchecked via VT: 629a4d2b79abe48fb21afd625f674354" ,
"pattern" : "[file:hashes.SHA1 = 'dc0d140b4a8e823176c4896c1168156356a41865']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--59aefb35-8f5c-4d62-a369-45a002de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"first_observed" : "2017-09-05T19:29:57Z" ,
"last_observed" : "2017-09-05T19:29:57Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--59aefb35-8f5c-4d62-a369-45a002de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--59aefb35-8f5c-4d62-a369-45a002de0b81" ,
"value" : "https://www.virustotal.com/file/87f3441f1007279756478cbc5bbf4178df1d1bc455210f43180e5131735203f8/analysis/1504014535/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-d318-43b2-b91a-483702de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Modules - Xchecked via VT: 7040b5ac432064780a17024ab0a3792a" ,
"pattern" : "[file:hashes.SHA256 = '377c3fe07774a907ad759062845b2848ce39395661e9931d6f838d4c6614d552']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-25ac-49de-b616-4f0902de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Modules - Xchecked via VT: 7040b5ac432064780a17024ab0a3792a" ,
"pattern" : "[file:hashes.SHA1 = '714e45d0ed4cd5e9684b325fad49eb00b5757221']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--59aefb35-8524-4252-8631-419002de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"first_observed" : "2017-09-05T19:29:57Z" ,
"last_observed" : "2017-09-05T19:29:57Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--59aefb35-8524-4252-8631-419002de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--59aefb35-8524-4252-8631-419002de0b81" ,
"value" : "https://www.virustotal.com/file/377c3fe07774a907ad759062845b2848ce39395661e9931d6f838d4c6614d552/analysis/1504014535/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-3064-49fc-978b-47e702de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Modules - Xchecked via VT: 2fa18456e14bea53ec0d7c898d94043b" ,
"pattern" : "[file:hashes.SHA256 = '70221154c553623d38f701d42bf5d595db6e3a8784d9f32cf6bb28171df8bf3b']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-9554-42b7-b084-4ad102de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Modules - Xchecked via VT: 2fa18456e14bea53ec0d7c898d94043b" ,
"pattern" : "[file:hashes.SHA1 = 'a932be7bc82ad4f9b1e7d4274d028c807b50c92c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--59aefb35-a38c-4351-afa1-476002de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"first_observed" : "2017-09-05T19:29:57Z" ,
"last_observed" : "2017-09-05T19:29:57Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--59aefb35-a38c-4351-afa1-476002de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--59aefb35-a38c-4351-afa1-476002de0b81" ,
"value" : "https://www.virustotal.com/file/70221154c553623d38f701d42bf5d595db6e3a8784d9f32cf6bb28171df8bf3b/analysis/1504014535/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-1f24-471d-ba7f-4d5f02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Modules - Xchecked via VT: 380356b8297893b4fc9273d42f15e9db" ,
"pattern" : "[file:hashes.SHA256 = '5716fa21b2ab01d8d4ef8be1928e3c356926c04e00774158c04f75b30a1e1bfd']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-194c-42ac-8750-428a02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Modules - Xchecked via VT: 380356b8297893b4fc9273d42f15e9db" ,
"pattern" : "[file:hashes.SHA1 = '1939c496b0e207e028e84f4e85b6db40dd27200c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--59aefb35-b550-4d64-a3e3-4cf202de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"first_observed" : "2017-09-05T19:29:57Z" ,
"last_observed" : "2017-09-05T19:29:57Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--59aefb35-b550-4d64-a3e3-4cf202de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--59aefb35-b550-4d64-a3e3-4cf202de0b81" ,
"value" : "https://www.virustotal.com/file/5716fa21b2ab01d8d4ef8be1928e3c356926c04e00774158c04f75b30a1e1bfd/analysis/1504014535/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-9d80-4b44-8f1b-4bfc02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Main body - Xchecked via VT: fe9a46cefdb41095f10d459bb9943682" ,
"pattern" : "[file:hashes.SHA256 = '19dbf37c77a28c86add5339ac4e8ed93e51651f338fe6fec4e90d5c0b161359c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-d7b8-4eac-b31f-425202de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Main body - Xchecked via VT: fe9a46cefdb41095f10d459bb9943682" ,
"pattern" : "[file:hashes.SHA1 = '1dd977c83f6e9e82690136be0f32c9a000c4330a']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--59aefb35-be2c-41c2-9009-460202de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"first_observed" : "2017-09-05T19:29:57Z" ,
"last_observed" : "2017-09-05T19:29:57Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--59aefb35-be2c-41c2-9009-460202de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--59aefb35-be2c-41c2-9009-460202de0b81" ,
"value" : "https://www.virustotal.com/file/19dbf37c77a28c86add5339ac4e8ed93e51651f338fe6fec4e90d5c0b161359c/analysis/1503388862/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-41d4-436f-abe2-45b902de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Droppers - Xchecked via VT: 86d7d3b50e4dc4181c28ccbaafb89ab3" ,
"pattern" : "[file:hashes.SHA256 = '29aae4417fc8cccaeb4617c6ac4e981a2c9f182e6b57f6dd23f05f665408de3f']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-5240-4f5e-a3e8-4e6502de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Droppers - Xchecked via VT: 86d7d3b50e4dc4181c28ccbaafb89ab3" ,
"pattern" : "[file:hashes.SHA1 = 'c32a11cb28627eee2eba0c100d0e9c72fed90259']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--59aefb35-9cd8-473d-8d44-4c5202de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"first_observed" : "2017-09-05T19:29:57Z" ,
"last_observed" : "2017-09-05T19:29:57Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--59aefb35-9cd8-473d-8d44-4c5202de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--59aefb35-9cd8-473d-8d44-4c5202de0b81" ,
"value" : "https://www.virustotal.com/file/29aae4417fc8cccaeb4617c6ac4e981a2c9f182e6b57f6dd23f05f665408de3f/analysis/1504523159/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-54fc-4ac9-a599-4cb202de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Droppers - Xchecked via VT: bccd77cf0269da7dc914885cda626c6c" ,
"pattern" : "[file:hashes.SHA256 = 'bdd7aa8f4e33c4b3c3c137ed782824f271a947bf60fc0dba8a2fb2c65da5e08e']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-2194-4a15-8703-404b02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Droppers - Xchecked via VT: bccd77cf0269da7dc914885cda626c6c" ,
"pattern" : "[file:hashes.SHA1 = '5af94b0339ab19c928868bab4cadb37a1a31dee8']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--59aefb35-9ee0-4375-bfb6-4f9402de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"first_observed" : "2017-09-05T19:29:57Z" ,
"last_observed" : "2017-09-05T19:29:57Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--59aefb35-9ee0-4375-bfb6-4f9402de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--59aefb35-9ee0-4375-bfb6-4f9402de0b81" ,
"value" : "https://www.virustotal.com/file/bdd7aa8f4e33c4b3c3c137ed782824f271a947bf60fc0dba8a2fb2c65da5e08e/analysis/1504014534/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-7e9c-4fb7-b002-441702de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Droppers - Xchecked via VT: e584c6e999a509ac21583d9543492ef4" ,
"pattern" : "[file:hashes.SHA256 = 'af075c48c9f08ac213428391eb114bdff3728d6dbc80a4b7c716a7d07e307f36']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-8ec8-4dba-8952-4b3402de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Droppers - Xchecked via VT: e584c6e999a509ac21583d9543492ef4" ,
"pattern" : "[file:hashes.SHA1 = 'a571d02432fb580424f19ed4ed908eb43e0b11ff']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--59aefb35-0e6c-4abc-95be-451a02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"first_observed" : "2017-09-05T19:29:57Z" ,
"last_observed" : "2017-09-05T19:29:57Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--59aefb35-0e6c-4abc-95be-451a02de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--59aefb35-0e6c-4abc-95be-451a02de0b81" ,
"value" : "https://www.virustotal.com/file/af075c48c9f08ac213428391eb114bdff3728d6dbc80a4b7c716a7d07e307f36/analysis/1499844684/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-c074-4f61-9f9a-428702de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Droppers - Xchecked via VT: c989d501460a8e8e381b81b807ccbe90" ,
"pattern" : "[file:hashes.SHA256 = 'a57c77e5484ad669c30b9b10bb2880fd6dfa7a6b13a51d40625df935648ab35d']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--59aefb35-36b8-4391-8943-466c02de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"description" : "Droppers - Xchecked via VT: c989d501460a8e8e381b81b807ccbe90" ,
"pattern" : "[file:hashes.SHA1 = '4db730976f7f1d28644214e6a2850be28110b1d5']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2017-09-05T19:29:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha1\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--59aefb35-d790-42c4-8efd-4b7402de0b81" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2017-09-05T19:29:57.000Z" ,
"modified" : "2017-09-05T19:29:57.000Z" ,
"first_observed" : "2017-09-05T19:29:57Z" ,
"last_observed" : "2017-09-05T19:29:57Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--59aefb35-d790-42c4-8efd-4b7402de0b81"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--59aefb35-d790-42c4-8efd-4b7402de0b81" ,
"value" : "https://www.virustotal.com/file/a57c77e5484ad669c30b9b10bb2880fd6dfa7a6b13a51d40625df935648ab35d/analysis/1500747149/"
} ,
{
"type" : "marking-definition" ,
"spec_version" : "2.1" ,
"id" : "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ,
"created" : "2017-01-20T00:00:00.000Z" ,
"definition_type" : "tlp" ,
"name" : "TLP:WHITE" ,
"definition" : {
"tlp" : "white"
}
}
2023-04-21 13:25:09 +00:00
]
}
