2023-04-21 13:25:09 +00:00
|
|
|
{
|
2023-06-14 17:31:25 +00:00
|
|
|
"type": "bundle",
|
|
|
|
|
"id": "bundle--59d4b6f8-75b0-4cc8-9872-43de950d210f",
|
|
|
|
|
"objects": [
|
|
|
|
|
{
|
|
|
|
|
"type": "identity",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:24:35.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:24:35.000Z",
|
|
|
|
|
"name": "CIRCL",
|
|
|
|
|
"identity_class": "organization"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "report",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "report--59d4b6f8-75b0-4cc8-9872-43de950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:24:35.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:24:35.000Z",
|
|
|
|
|
"name": "M2M - Locky 2017-10-04 : Affid=3, offline, \".ykcol\" : \"Copy of invoice A1234567890...\" - \"InvoiceA1234567890.7z\"",
|
|
|
|
|
"published": "2017-10-15T16:24:40Z",
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"indicator--59d4b6f9-3d80-4cf9-9991-4246950d210f",
|
|
|
|
|
"indicator--59d4b6f9-36f8-4874-bb58-486a950d210f",
|
|
|
|
|
"indicator--59d4b6f9-30a4-4d1d-9923-4b4b950d210f",
|
|
|
|
|
"observed-data--59d4b6fa-7cc8-4f75-844c-43e0950d210f",
|
|
|
|
|
"network-traffic--59d4b6fa-7cc8-4f75-844c-43e0950d210f",
|
|
|
|
|
"ipv4-addr--59d4b6fa-7cc8-4f75-844c-43e0950d210f",
|
|
|
|
|
"indicator--59d4b6fa-bd90-43d5-a3b5-4af6950d210f",
|
|
|
|
|
"indicator--59d4b6fa-e374-4a41-874e-4f7c950d210f",
|
|
|
|
|
"observed-data--59d4b6fb-2660-4744-9664-4784950d210f",
|
|
|
|
|
"network-traffic--59d4b6fb-2660-4744-9664-4784950d210f",
|
|
|
|
|
"ipv4-addr--59d4b6fb-2660-4744-9664-4784950d210f",
|
|
|
|
|
"indicator--59d4b6fb-2438-444f-a035-4046950d210f",
|
|
|
|
|
"indicator--59d4b6fb-cb84-477e-a9fd-434f950d210f",
|
|
|
|
|
"observed-data--59d4b6fc-ece4-4f26-b605-41d8950d210f",
|
|
|
|
|
"network-traffic--59d4b6fc-ece4-4f26-b605-41d8950d210f",
|
|
|
|
|
"ipv4-addr--59d4b6fc-ece4-4f26-b605-41d8950d210f",
|
|
|
|
|
"indicator--59d4b6fc-78a4-45a0-912d-4de0950d210f",
|
|
|
|
|
"indicator--59d4b6fc-a674-4353-a990-493e950d210f",
|
|
|
|
|
"observed-data--59d4b6fd-765c-4fbe-8fc8-4596950d210f",
|
|
|
|
|
"network-traffic--59d4b6fd-765c-4fbe-8fc8-4596950d210f",
|
|
|
|
|
"ipv4-addr--59d4b6fd-765c-4fbe-8fc8-4596950d210f",
|
|
|
|
|
"indicator--59d4b6fd-7a8c-41f5-a711-40e9950d210f",
|
|
|
|
|
"indicator--59d4b6fd-e890-4dcb-9389-47b5950d210f",
|
|
|
|
|
"observed-data--59d4b6fe-f0f8-45ea-aa55-49e1950d210f",
|
|
|
|
|
"network-traffic--59d4b6fe-f0f8-45ea-aa55-49e1950d210f",
|
|
|
|
|
"ipv4-addr--59d4b6fe-f0f8-45ea-aa55-49e1950d210f",
|
|
|
|
|
"indicator--59d4b6fe-6830-4fa3-97f5-4903950d210f",
|
|
|
|
|
"indicator--59d4b6fe-d410-4d5c-a5c0-4e0f950d210f",
|
|
|
|
|
"observed-data--59d4b6fe-412c-4c13-9dab-4b39950d210f",
|
|
|
|
|
"network-traffic--59d4b6fe-412c-4c13-9dab-4b39950d210f",
|
|
|
|
|
"ipv4-addr--59d4b6fe-412c-4c13-9dab-4b39950d210f",
|
|
|
|
|
"indicator--59d4b6ff-b5c4-4133-9fb0-4faa950d210f",
|
|
|
|
|
"indicator--59d4b6ff-be14-4eab-af50-418e950d210f",
|
|
|
|
|
"observed-data--59d4b6ff-3a08-4b7e-9468-469e950d210f",
|
|
|
|
|
"network-traffic--59d4b6ff-3a08-4b7e-9468-469e950d210f",
|
|
|
|
|
"ipv4-addr--59d4b6ff-3a08-4b7e-9468-469e950d210f",
|
|
|
|
|
"indicator--59d4b6ff-95e0-4958-97d5-44b8950d210f",
|
|
|
|
|
"indicator--59d4b700-b654-4513-889a-4359950d210f",
|
|
|
|
|
"observed-data--59d4b700-986c-414b-924f-4a7e950d210f",
|
|
|
|
|
"network-traffic--59d4b700-986c-414b-924f-4a7e950d210f",
|
|
|
|
|
"ipv4-addr--59d4b700-986c-414b-924f-4a7e950d210f",
|
|
|
|
|
"indicator--59d4b700-c700-403b-b7fb-47e0950d210f",
|
|
|
|
|
"indicator--59d4b701-fdb4-4ac8-b792-4d73950d210f",
|
|
|
|
|
"observed-data--59d4b701-5910-42d6-933c-4f2e950d210f",
|
|
|
|
|
"network-traffic--59d4b701-5910-42d6-933c-4f2e950d210f",
|
|
|
|
|
"ipv4-addr--59d4b701-5910-42d6-933c-4f2e950d210f",
|
|
|
|
|
"indicator--59d4b701-ae60-4154-b02c-4365950d210f",
|
|
|
|
|
"indicator--59d4b701-9184-43a4-b0f0-46f6950d210f",
|
|
|
|
|
"observed-data--59d4b702-b9dc-4cce-8fec-422d950d210f",
|
|
|
|
|
"network-traffic--59d4b702-b9dc-4cce-8fec-422d950d210f",
|
|
|
|
|
"ipv4-addr--59d4b702-b9dc-4cce-8fec-422d950d210f",
|
|
|
|
|
"indicator--59d4b702-4798-4528-8c37-44b3950d210f",
|
|
|
|
|
"indicator--59d4b702-4d94-459f-a703-48b9950d210f",
|
|
|
|
|
"indicator--59d4b703-b98c-4639-aeb7-4d4a950d210f",
|
|
|
|
|
"indicator--59d4b703-c2d0-4a18-8fdc-4e63950d210f",
|
|
|
|
|
"observed-data--59d4b703-9054-4cfa-b78b-45f1950d210f",
|
|
|
|
|
"network-traffic--59d4b703-9054-4cfa-b78b-45f1950d210f",
|
|
|
|
|
"ipv4-addr--59d4b703-9054-4cfa-b78b-45f1950d210f",
|
|
|
|
|
"indicator--59d4b704-a7ac-4c30-b320-4294950d210f",
|
|
|
|
|
"indicator--59d4b704-f0e4-4050-b34b-415a950d210f",
|
|
|
|
|
"indicator--59e38b66-c308-4adc-b7f8-883502de0b81",
|
|
|
|
|
"indicator--59e38b66-0da0-4f85-9c43-883502de0b81",
|
|
|
|
|
"observed-data--59e38b66-af78-4754-98ca-883502de0b81",
|
|
|
|
|
"url--59e38b66-af78-4754-98ca-883502de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"Threat-Report",
|
|
|
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
|
|
|
"ecsirt:malicious-code=\"ransomware\"",
|
|
|
|
|
"misp-galaxy:ransomware=\"Locky\""
|
|
|
|
|
],
|
|
|
|
|
"object_marking_refs": [
|
|
|
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d4b6f9-3d80-4cf9-9991-4246950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:01.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:01.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '3ba59430e3a75cf5c6ec1b7fcc5dfe33']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-15T16:23:01Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d4b6f9-36f8-4874-bb58-486a950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:01.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:01.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://cutwell.ca/8etyfh3ni']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-15T16:23:01Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d4b6f9-30a4-4d1d-9923-4b4b950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:01.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:01.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'cutwell.ca']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-15T16:23:01Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59d4b6fa-7cc8-4f75-844c-43e0950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:01.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:01.000Z",
|
|
|
|
|
"first_observed": "2017-10-15T16:23:01Z",
|
|
|
|
|
"last_observed": "2017-10-15T16:23:01Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59d4b6fa-7cc8-4f75-844c-43e0950d210f",
|
|
|
|
|
"ipv4-addr--59d4b6fa-7cc8-4f75-844c-43e0950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59d4b6fa-7cc8-4f75-844c-43e0950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59d4b6fa-7cc8-4f75-844c-43e0950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59d4b6fa-7cc8-4f75-844c-43e0950d210f",
|
|
|
|
|
"value": "98.124.251.68"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d4b6fa-bd90-43d5-a3b5-4af6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:01.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:01.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://ericweb.co.za/8etyfh3ni']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-15T16:23:01Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d4b6fa-e374-4a41-874e-4f7c950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:01.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:01.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'ericweb.co.za']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-15T16:23:01Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59d4b6fb-2660-4744-9664-4784950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"first_observed": "2017-10-15T16:23:02Z",
|
|
|
|
|
"last_observed": "2017-10-15T16:23:02Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59d4b6fb-2660-4744-9664-4784950d210f",
|
|
|
|
|
"ipv4-addr--59d4b6fb-2660-4744-9664-4784950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59d4b6fb-2660-4744-9664-4784950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59d4b6fb-2660-4744-9664-4784950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59d4b6fb-2660-4744-9664-4784950d210f",
|
|
|
|
|
"value": "196.25.211.127"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d4b6fb-2438-444f-a035-4046950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://pciholog.ru/8etyfh3ni']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-15T16:23:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d4b6fb-cb84-477e-a9fd-434f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'pciholog.ru']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-15T16:23:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59d4b6fc-ece4-4f26-b605-41d8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"first_observed": "2017-10-15T16:23:02Z",
|
|
|
|
|
"last_observed": "2017-10-15T16:23:02Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59d4b6fc-ece4-4f26-b605-41d8950d210f",
|
|
|
|
|
"ipv4-addr--59d4b6fc-ece4-4f26-b605-41d8950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59d4b6fc-ece4-4f26-b605-41d8950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59d4b6fc-ece4-4f26-b605-41d8950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59d4b6fc-ece4-4f26-b605-41d8950d210f",
|
|
|
|
|
"value": "89.253.235.118"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d4b6fc-78a4-45a0-912d-4de0950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://schoensigns.com/8etyfh3ni']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-15T16:23:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d4b6fc-a674-4353-a990-493e950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'schoensigns.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-15T16:23:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59d4b6fd-765c-4fbe-8fc8-4596950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"first_observed": "2017-10-15T16:23:02Z",
|
|
|
|
|
"last_observed": "2017-10-15T16:23:02Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59d4b6fd-765c-4fbe-8fc8-4596950d210f",
|
|
|
|
|
"ipv4-addr--59d4b6fd-765c-4fbe-8fc8-4596950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59d4b6fd-765c-4fbe-8fc8-4596950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59d4b6fd-765c-4fbe-8fc8-4596950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59d4b6fd-765c-4fbe-8fc8-4596950d210f",
|
|
|
|
|
"value": "184.168.126.30"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d4b6fd-7a8c-41f5-a711-40e9950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://scouting-bvb.nl/8etyfh3ni']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-15T16:23:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d4b6fd-e890-4dcb-9389-47b5950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'scouting-bvb.nl']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-15T16:23:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59d4b6fe-f0f8-45ea-aa55-49e1950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"first_observed": "2017-10-15T16:23:02Z",
|
|
|
|
|
"last_observed": "2017-10-15T16:23:02Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59d4b6fe-f0f8-45ea-aa55-49e1950d210f",
|
|
|
|
|
"ipv4-addr--59d4b6fe-f0f8-45ea-aa55-49e1950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59d4b6fe-f0f8-45ea-aa55-49e1950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59d4b6fe-f0f8-45ea-aa55-49e1950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59d4b6fe-f0f8-45ea-aa55-49e1950d210f",
|
|
|
|
|
"value": "46.235.44.76"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d4b6fe-6830-4fa3-97f5-4903950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://shopsshops.de/8etyfh3ni']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-15T16:23:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d4b6fe-d410-4d5c-a5c0-4e0f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'shopsshops.de']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-15T16:23:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59d4b6fe-412c-4c13-9dab-4b39950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"first_observed": "2017-10-15T16:23:02Z",
|
|
|
|
|
"last_observed": "2017-10-15T16:23:02Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59d4b6fe-412c-4c13-9dab-4b39950d210f",
|
|
|
|
|
"ipv4-addr--59d4b6fe-412c-4c13-9dab-4b39950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59d4b6fe-412c-4c13-9dab-4b39950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59d4b6fe-412c-4c13-9dab-4b39950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59d4b6fe-412c-4c13-9dab-4b39950d210f",
|
|
|
|
|
"value": "62.75.132.67"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d4b6ff-b5c4-4133-9fb0-4faa950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://smarterbaby.com/8etyfh3ni']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-15T16:23:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d4b6ff-be14-4eab-af50-418e950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'smarterbaby.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-15T16:23:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59d4b6ff-3a08-4b7e-9468-469e950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"first_observed": "2017-10-15T16:23:02Z",
|
|
|
|
|
"last_observed": "2017-10-15T16:23:02Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59d4b6ff-3a08-4b7e-9468-469e950d210f",
|
|
|
|
|
"ipv4-addr--59d4b6ff-3a08-4b7e-9468-469e950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59d4b6ff-3a08-4b7e-9468-469e950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59d4b6ff-3a08-4b7e-9468-469e950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59d4b6ff-3a08-4b7e-9468-469e950d210f",
|
|
|
|
|
"value": "98.124.251.75"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d4b6ff-95e0-4958-97d5-44b8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://spazioireos.it/8etyfh3ni']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-15T16:23:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d4b700-b654-4513-889a-4359950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'spazioireos.it']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-15T16:23:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59d4b700-986c-414b-924f-4a7e950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"first_observed": "2017-10-15T16:23:02Z",
|
|
|
|
|
"last_observed": "2017-10-15T16:23:02Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59d4b700-986c-414b-924f-4a7e950d210f",
|
|
|
|
|
"ipv4-addr--59d4b700-986c-414b-924f-4a7e950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59d4b700-986c-414b-924f-4a7e950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59d4b700-986c-414b-924f-4a7e950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59d4b700-986c-414b-924f-4a7e950d210f",
|
|
|
|
|
"value": "81.29.205.233"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d4b700-c700-403b-b7fb-47e0950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://tailer.it/8etyfh3ni']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-15T16:23:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d4b701-fdb4-4ac8-b792-4d73950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'tailer.it']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-15T16:23:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59d4b701-5910-42d6-933c-4f2e950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"first_observed": "2017-10-15T16:23:02Z",
|
|
|
|
|
"last_observed": "2017-10-15T16:23:02Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59d4b701-5910-42d6-933c-4f2e950d210f",
|
|
|
|
|
"ipv4-addr--59d4b701-5910-42d6-933c-4f2e950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59d4b701-5910-42d6-933c-4f2e950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59d4b701-5910-42d6-933c-4f2e950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59d4b701-5910-42d6-933c-4f2e950d210f",
|
|
|
|
|
"value": "89.96.90.14"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d4b701-ae60-4154-b02c-4365950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://tarimsalteknoloji.com/8etyfh3ni']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-15T16:23:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d4b701-9184-43a4-b0f0-46f6950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'tarimsalteknoloji.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-15T16:23:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59d4b702-b9dc-4cce-8fec-422d950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"first_observed": "2017-10-15T16:23:02Z",
|
|
|
|
|
"last_observed": "2017-10-15T16:23:02Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59d4b702-b9dc-4cce-8fec-422d950d210f",
|
|
|
|
|
"ipv4-addr--59d4b702-b9dc-4cce-8fec-422d950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59d4b702-b9dc-4cce-8fec-422d950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59d4b702-b9dc-4cce-8fec-422d950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59d4b702-b9dc-4cce-8fec-422d950d210f",
|
|
|
|
|
"value": "185.150.128.21"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d4b702-4798-4528-8c37-44b3950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://tecnigrafite.com/8etyfh3ni']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-15T16:23:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d4b702-4d94-459f-a703-48b9950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'tecnigrafite.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-15T16:23:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d4b703-b98c-4639-aeb7-4d4a950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://turfschiploge.nl/8etyfh3ni']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-15T16:23:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d4b703-c2d0-4a18-8fdc-4e63950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'turfschiploge.nl']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-15T16:23:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59d4b703-9054-4cfa-b78b-45f1950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"first_observed": "2017-10-15T16:23:02Z",
|
|
|
|
|
"last_observed": "2017-10-15T16:23:02Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59d4b703-9054-4cfa-b78b-45f1950d210f",
|
|
|
|
|
"ipv4-addr--59d4b703-9054-4cfa-b78b-45f1950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59d4b703-9054-4cfa-b78b-45f1950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59d4b703-9054-4cfa-b78b-45f1950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59d4b703-9054-4cfa-b78b-45f1950d210f",
|
|
|
|
|
"value": "46.235.43.11"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d4b704-a7ac-4c30-b320-4294950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://derainlay.info/p66/8etyfh3ni']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-15T16:23:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59d4b704-f0e4-4050-b34b-415a950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'derainlay.info']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-15T16:23:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59e38b66-c308-4adc-b7f8-883502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 3ba59430e3a75cf5c6ec1b7fcc5dfe33",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '7c88ec63f7ca11a22add9f77f47f7ac8f71e930b3dd24422940c28cc8fd22ac2']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-15T16:23:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59e38b66-0da0-4f85-9c43-883502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 3ba59430e3a75cf5c6ec1b7fcc5dfe33",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'b1813d2d4f22146817e0c5fd203b59f4fa88c2b5']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-15T16:23:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59e38b66-af78-4754-98ca-883502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"modified": "2017-10-15T16:23:02.000Z",
|
|
|
|
|
"first_observed": "2017-10-15T16:23:02Z",
|
|
|
|
|
"last_observed": "2017-10-15T16:23:02Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--59e38b66-af78-4754-98ca-883502de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--59e38b66-af78-4754-98ca-883502de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/7c88ec63f7ca11a22add9f77f47f7ac8f71e930b3dd24422940c28cc8fd22ac2/analysis/1507772563/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "marking-definition",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
|
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
|
|
|
"definition_type": "tlp",
|
|
|
|
|
"name": "TLP:WHITE",
|
|
|
|
|
"definition": {
|
|
|
|
|
"tlp": "white"
|
|
|
|
|
}
|
|
|
|
|
}
|
2023-04-21 13:25:09 +00:00
|
|
|
]
|
|
|
|
|
}
|
