2023-04-21 13:25:09 +00:00
|
|
|
{
|
2023-06-14 17:31:25 +00:00
|
|
|
"type": "bundle",
|
|
|
|
|
"id": "bundle--59db5cbe-a944-425b-b60a-473b950d210f",
|
|
|
|
|
"objects": [
|
|
|
|
|
{
|
|
|
|
|
"type": "identity",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T19:45:04.000Z",
|
|
|
|
|
"modified": "2017-10-12T19:45:04.000Z",
|
|
|
|
|
"name": "CIRCL",
|
|
|
|
|
"identity_class": "organization"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "report",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "report--59db5cbe-a944-425b-b60a-473b950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T19:45:04.000Z",
|
|
|
|
|
"modified": "2017-10-12T19:45:04.000Z",
|
|
|
|
|
"name": "M2M - Locky 2017-10-09 : Affid=3, offline, \".ykcol\" : \"Invoice IP1234567\" - \"Invoice-IP1234567.7z\"",
|
|
|
|
|
"published": "2017-10-12T19:45:10Z",
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"indicator--59db5cbf-bf18-4e2c-b12c-6da8950d210f",
|
|
|
|
|
"indicator--59db5cbf-2c80-4442-ae71-4b37950d210f",
|
|
|
|
|
"indicator--59db5cc0-a868-4d49-969e-46d5950d210f",
|
|
|
|
|
"observed-data--59db5cc0-75b0-4013-9f15-6e8e950d210f",
|
|
|
|
|
"network-traffic--59db5cc0-75b0-4013-9f15-6e8e950d210f",
|
|
|
|
|
"ipv4-addr--59db5cc0-75b0-4013-9f15-6e8e950d210f",
|
|
|
|
|
"indicator--59db5cc0-1024-4266-8367-6e74950d210f",
|
|
|
|
|
"indicator--59db5cc1-ca1c-4011-982e-4a05950d210f",
|
|
|
|
|
"observed-data--59db5cc1-8af0-498c-ad5f-6b90950d210f",
|
|
|
|
|
"network-traffic--59db5cc1-8af0-498c-ad5f-6b90950d210f",
|
|
|
|
|
"ipv4-addr--59db5cc1-8af0-498c-ad5f-6b90950d210f",
|
|
|
|
|
"indicator--59db5cc1-c5d4-4ee3-b7ef-4279950d210f",
|
|
|
|
|
"indicator--59db5cc1-bfb0-4ea3-be93-4a1a950d210f",
|
|
|
|
|
"observed-data--59db5cc2-f230-4ca6-965f-4b6d950d210f",
|
|
|
|
|
"network-traffic--59db5cc2-f230-4ca6-965f-4b6d950d210f",
|
|
|
|
|
"ipv4-addr--59db5cc2-f230-4ca6-965f-4b6d950d210f",
|
|
|
|
|
"indicator--59db5cc2-f9ac-46c2-9d99-43cc950d210f",
|
|
|
|
|
"indicator--59db5cc2-e604-42fa-b1fa-44be950d210f",
|
|
|
|
|
"observed-data--59db5cc3-b798-4090-9b97-6da8950d210f",
|
|
|
|
|
"network-traffic--59db5cc3-b798-4090-9b97-6da8950d210f",
|
|
|
|
|
"ipv4-addr--59db5cc3-b798-4090-9b97-6da8950d210f",
|
|
|
|
|
"indicator--59db5cc3-b7dc-440d-bcd1-6e50950d210f",
|
|
|
|
|
"indicator--59db5cc3-0738-4029-95c5-49b5950d210f",
|
|
|
|
|
"observed-data--59db5cc4-e3c8-4090-90c1-4379950d210f",
|
|
|
|
|
"network-traffic--59db5cc4-e3c8-4090-90c1-4379950d210f",
|
|
|
|
|
"ipv4-addr--59db5cc4-e3c8-4090-90c1-4379950d210f",
|
|
|
|
|
"indicator--59db5cc4-70e4-4960-a0f1-6e8e950d210f",
|
|
|
|
|
"indicator--59db5cc4-ee9c-4cbb-8463-6e74950d210f",
|
|
|
|
|
"observed-data--59db5cc4-b670-44f2-8446-4dcb950d210f",
|
|
|
|
|
"network-traffic--59db5cc4-b670-44f2-8446-4dcb950d210f",
|
|
|
|
|
"ipv4-addr--59db5cc4-b670-44f2-8446-4dcb950d210f",
|
|
|
|
|
"indicator--59db5cc5-b2a4-4d4f-b004-43ab950d210f",
|
|
|
|
|
"indicator--59db5cc5-a8d0-4901-9287-48c2950d210f",
|
|
|
|
|
"observed-data--59db5cc5-99f8-4526-8eeb-4107950d210f",
|
|
|
|
|
"network-traffic--59db5cc5-99f8-4526-8eeb-4107950d210f",
|
|
|
|
|
"ipv4-addr--59db5cc5-99f8-4526-8eeb-4107950d210f",
|
|
|
|
|
"indicator--59db5cc5-72a4-4c14-9c2f-4504950d210f",
|
|
|
|
|
"indicator--59db5cc6-a834-4c98-b3d0-4776950d210f",
|
|
|
|
|
"observed-data--59db5cc6-74cc-4919-a72d-6da8950d210f",
|
|
|
|
|
"network-traffic--59db5cc6-74cc-4919-a72d-6da8950d210f",
|
|
|
|
|
"ipv4-addr--59db5cc6-74cc-4919-a72d-6da8950d210f",
|
|
|
|
|
"indicator--59db5cc6-f370-461e-93ee-6e50950d210f",
|
|
|
|
|
"indicator--59db5cc7-a79c-401f-bd8b-4db7950d210f",
|
|
|
|
|
"observed-data--59db5cc7-8364-4c82-ace1-4656950d210f",
|
|
|
|
|
"network-traffic--59db5cc7-8364-4c82-ace1-4656950d210f",
|
|
|
|
|
"ipv4-addr--59db5cc7-8364-4c82-ace1-4656950d210f",
|
|
|
|
|
"indicator--59db5cc7-69b8-4422-bdca-6e8e950d210f",
|
|
|
|
|
"indicator--59db5cc7-22d0-4b4f-aac9-47b2950d210f",
|
|
|
|
|
"observed-data--59db5cc8-7728-4a33-b014-6b90950d210f",
|
|
|
|
|
"network-traffic--59db5cc8-7728-4a33-b014-6b90950d210f",
|
|
|
|
|
"ipv4-addr--59db5cc8-7728-4a33-b014-6b90950d210f",
|
|
|
|
|
"indicator--59db5cc8-c74c-4415-945a-4b21950d210f",
|
|
|
|
|
"indicator--59db5cc8-8248-451f-b77a-4041950d210f",
|
|
|
|
|
"observed-data--59db5cc9-ca90-4365-af8d-468f950d210f",
|
|
|
|
|
"network-traffic--59db5cc9-ca90-4365-af8d-468f950d210f",
|
|
|
|
|
"ipv4-addr--59db5cc9-ca90-4365-af8d-468f950d210f",
|
|
|
|
|
"indicator--59db5cc9-4c6c-451b-a0b7-4fc3950d210f",
|
|
|
|
|
"indicator--59db5cc9-9794-42d6-8688-4d02950d210f",
|
|
|
|
|
"observed-data--59db5cca-563c-4514-83e3-6e50950d210f",
|
|
|
|
|
"network-traffic--59db5cca-563c-4514-83e3-6e50950d210f",
|
|
|
|
|
"ipv4-addr--59db5cca-563c-4514-83e3-6e50950d210f",
|
|
|
|
|
"indicator--59db5cca-5e14-4900-b480-49da950d210f",
|
|
|
|
|
"indicator--59db5cca-a568-4202-9056-4c70950d210f",
|
|
|
|
|
"observed-data--59db5ccb-7828-4d1c-855d-49dc950d210f",
|
|
|
|
|
"network-traffic--59db5ccb-7828-4d1c-855d-49dc950d210f",
|
|
|
|
|
"ipv4-addr--59db5ccb-7828-4d1c-855d-49dc950d210f",
|
|
|
|
|
"indicator--59db5ccb-b520-49a3-8a40-6e8e950d210f",
|
|
|
|
|
"indicator--59db5ccb-8a5c-483e-9799-6e74950d210f",
|
|
|
|
|
"indicator--59dfb233-1588-4d77-9c8f-a10802de0b81",
|
|
|
|
|
"indicator--59dfb233-1694-47ce-ae43-a10802de0b81",
|
|
|
|
|
"observed-data--59dfb233-aac8-446e-828f-a10802de0b81",
|
|
|
|
|
"url--59dfb233-aac8-446e-828f-a10802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"Threat-Report",
|
|
|
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
|
|
|
"ecsirt:malicious-code=\"ransomware\"",
|
|
|
|
|
"misp-galaxy:ransomware=\"Locky\""
|
|
|
|
|
],
|
|
|
|
|
"object_marking_refs": [
|
|
|
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db5cbf-bf18-4e2c-b12c-6da8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:30.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:30.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '3aeeb55f8239b731603f5c907113a34f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:19:30Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db5cbf-2c80-4442-ae71-4b37950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:30.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:30.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://amatuermatch.org/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:19:30Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db5cc0-a868-4d49-969e-46d5950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'amatuermatch.org']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:19:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db5cc0-75b0-4013-9f15-6e8e950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:19:31Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:19:31Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db5cc0-75b0-4013-9f15-6e8e950d210f",
|
|
|
|
|
"ipv4-addr--59db5cc0-75b0-4013-9f15-6e8e950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db5cc0-75b0-4013-9f15-6e8e950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db5cc0-75b0-4013-9f15-6e8e950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db5cc0-75b0-4013-9f15-6e8e950d210f",
|
|
|
|
|
"value": "64.50.172.171"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db5cc0-1024-4266-8367-6e74950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://anderlaw.com/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:19:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db5cc1-ca1c-4011-982e-4a05950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'anderlaw.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:19:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db5cc1-8af0-498c-ad5f-6b90950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:19:31Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:19:31Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db5cc1-8af0-498c-ad5f-6b90950d210f",
|
|
|
|
|
"ipv4-addr--59db5cc1-8af0-498c-ad5f-6b90950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db5cc1-8af0-498c-ad5f-6b90950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db5cc1-8af0-498c-ad5f-6b90950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db5cc1-8af0-498c-ad5f-6b90950d210f",
|
|
|
|
|
"value": "98.124.251.69"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db5cc1-c5d4-4ee3-b7ef-4279950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://cagliaricity.it/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:19:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db5cc1-bfb0-4ea3-be93-4a1a950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'cagliaricity.it']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:19:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db5cc2-f230-4ca6-965f-4b6d950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:19:31Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:19:31Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db5cc2-f230-4ca6-965f-4b6d950d210f",
|
|
|
|
|
"ipv4-addr--59db5cc2-f230-4ca6-965f-4b6d950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db5cc2-f230-4ca6-965f-4b6d950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db5cc2-f230-4ca6-965f-4b6d950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db5cc2-f230-4ca6-965f-4b6d950d210f",
|
|
|
|
|
"value": "95.110.196.214"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db5cc2-f9ac-46c2-9d99-43cc950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://depomedikal.com/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:19:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db5cc2-e604-42fa-b1fa-44be950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'depomedikal.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:19:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db5cc3-b798-4090-9b97-6da8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:19:31Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:19:31Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db5cc3-b798-4090-9b97-6da8950d210f",
|
|
|
|
|
"ipv4-addr--59db5cc3-b798-4090-9b97-6da8950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db5cc3-b798-4090-9b97-6da8950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db5cc3-b798-4090-9b97-6da8950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db5cc3-b798-4090-9b97-6da8950d210f",
|
|
|
|
|
"value": "82.151.131.234"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db5cc3-b7dc-440d-bcd1-6e50950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://designordie.ca/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:19:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db5cc3-0738-4029-95c5-49b5950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'designordie.ca']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:19:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db5cc4-e3c8-4090-90c1-4379950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:19:31Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:19:31Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db5cc4-e3c8-4090-90c1-4379950d210f",
|
|
|
|
|
"ipv4-addr--59db5cc4-e3c8-4090-90c1-4379950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db5cc4-e3c8-4090-90c1-4379950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db5cc4-e3c8-4090-90c1-4379950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db5cc4-e3c8-4090-90c1-4379950d210f",
|
|
|
|
|
"value": "204.244.185.219"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db5cc4-70e4-4960-a0f1-6e8e950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://dewekker.nl/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:19:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db5cc4-ee9c-4cbb-8463-6e74950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'dewekker.nl']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:19:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db5cc4-b670-44f2-8446-4dcb950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:19:31Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:19:31Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db5cc4-b670-44f2-8446-4dcb950d210f",
|
|
|
|
|
"ipv4-addr--59db5cc4-b670-44f2-8446-4dcb950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db5cc4-b670-44f2-8446-4dcb950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db5cc4-b670-44f2-8446-4dcb950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db5cc4-b670-44f2-8446-4dcb950d210f",
|
|
|
|
|
"value": "94.126.70.12"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db5cc5-b2a4-4d4f-b004-43ab950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://drspay.com/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:19:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db5cc5-a8d0-4901-9287-48c2950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'drspay.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:19:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db5cc5-99f8-4526-8eeb-4107950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:19:31Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:19:31Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db5cc5-99f8-4526-8eeb-4107950d210f",
|
|
|
|
|
"ipv4-addr--59db5cc5-99f8-4526-8eeb-4107950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db5cc5-99f8-4526-8eeb-4107950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db5cc5-99f8-4526-8eeb-4107950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db5cc5-99f8-4526-8eeb-4107950d210f",
|
|
|
|
|
"value": "68.178.159.168"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db5cc5-72a4-4c14-9c2f-4504950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://ecotek.me/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:19:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db5cc6-a834-4c98-b3d0-4776950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'ecotek.me']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:19:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db5cc6-74cc-4919-a72d-6da8950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:19:31Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:19:31Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db5cc6-74cc-4919-a72d-6da8950d210f",
|
|
|
|
|
"ipv4-addr--59db5cc6-74cc-4919-a72d-6da8950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db5cc6-74cc-4919-a72d-6da8950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db5cc6-74cc-4919-a72d-6da8950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db5cc6-74cc-4919-a72d-6da8950d210f",
|
|
|
|
|
"value": "45.40.135.32"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db5cc6-f370-461e-93ee-6e50950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://edeldestillerie-mair.at/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:19:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db5cc7-a79c-401f-bd8b-4db7950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'edeldestillerie-mair.at']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:19:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db5cc7-8364-4c82-ace1-4656950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:19:31Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:19:31Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db5cc7-8364-4c82-ace1-4656950d210f",
|
|
|
|
|
"ipv4-addr--59db5cc7-8364-4c82-ace1-4656950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db5cc7-8364-4c82-ace1-4656950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db5cc7-8364-4c82-ace1-4656950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db5cc7-8364-4c82-ace1-4656950d210f",
|
|
|
|
|
"value": "193.19.92.233"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db5cc7-69b8-4422-bdca-6e8e950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://hard-grooves.com/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:19:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db5cc7-22d0-4b4f-aac9-47b2950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'hard-grooves.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:19:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db5cc8-7728-4a33-b014-6b90950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:19:31Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:19:31Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db5cc8-7728-4a33-b014-6b90950d210f",
|
|
|
|
|
"ipv4-addr--59db5cc8-7728-4a33-b014-6b90950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db5cc8-7728-4a33-b014-6b90950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db5cc8-7728-4a33-b014-6b90950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db5cc8-7728-4a33-b014-6b90950d210f",
|
|
|
|
|
"value": "66.36.173.111"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db5cc8-c74c-4415-945a-4b21950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://intra.cfecgcaquitaine.com/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:19:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db5cc8-8248-451f-b77a-4041950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'intra.cfecgcaquitaine.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:19:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db5cc9-ca90-4365-af8d-468f950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:19:31Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:19:31Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db5cc9-ca90-4365-af8d-468f950d210f",
|
|
|
|
|
"ipv4-addr--59db5cc9-ca90-4365-af8d-468f950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db5cc9-ca90-4365-af8d-468f950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db5cc9-ca90-4365-af8d-468f950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db5cc9-ca90-4365-af8d-468f950d210f",
|
|
|
|
|
"value": "94.247.178.77"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db5cc9-4c6c-451b-a0b7-4fc3950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://prova.eshopavant.it/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:19:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db5cc9-9794-42d6-8688-4d02950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'prova.eshopavant.it']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:19:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db5cca-563c-4514-83e3-6e50950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:19:31Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:19:31Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db5cca-563c-4514-83e3-6e50950d210f",
|
|
|
|
|
"ipv4-addr--59db5cca-563c-4514-83e3-6e50950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db5cca-563c-4514-83e3-6e50950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db5cca-563c-4514-83e3-6e50950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db5cca-563c-4514-83e3-6e50950d210f",
|
|
|
|
|
"value": "217.73.227.30"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db5cca-5e14-4900-b480-49da950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://prueba.depaterna.com/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:19:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db5cca-a568-4202-9056-4c70950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'prueba.depaterna.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:19:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59db5ccb-7828-4d1c-855d-49dc950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:19:31Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:19:31Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--59db5ccb-7828-4d1c-855d-49dc950d210f",
|
|
|
|
|
"ipv4-addr--59db5ccb-7828-4d1c-855d-49dc950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-dst\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--59db5ccb-7828-4d1c-855d-49dc950d210f",
|
|
|
|
|
"dst_ref": "ipv4-addr--59db5ccb-7828-4d1c-855d-49dc950d210f",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--59db5ccb-7828-4d1c-855d-49dc950d210f",
|
|
|
|
|
"value": "62.113.249.12"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db5ccb-b520-49a3-8a40-6e8e950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://scottfranch.org/p66/8734gf3hf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:19:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59db5ccb-8a5c-483e-9799-6e74950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'scottfranch.org']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:19:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59dfb233-1588-4d77-9c8f-a10802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 3aeeb55f8239b731603f5c907113a34f",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '203ee7bc02c3d2b01584efc23b5240fdbc37c56a99b17cef8983ff59f564ab18']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:19:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--59dfb233-1694-47ce-ae43-a10802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 3aeeb55f8239b731603f5c907113a34f",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '517c3203aed9a4229d6260a796f03e448250e0a3']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2017-10-12T18:19:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Artifacts dropped"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Artifacts dropped\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--59dfb233-aac8-446e-828f-a10802de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"modified": "2017-10-12T18:19:31.000Z",
|
|
|
|
|
"first_observed": "2017-10-12T18:19:31Z",
|
|
|
|
|
"last_observed": "2017-10-12T18:19:31Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--59dfb233-aac8-446e-828f-a10802de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--59dfb233-aac8-446e-828f-a10802de0b81",
|
|
|
|
|
"value": "https://www.virustotal.com/file/203ee7bc02c3d2b01584efc23b5240fdbc37c56a99b17cef8983ff59f564ab18/analysis/1507550567/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "marking-definition",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
|
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
|
|
|
"definition_type": "tlp",
|
|
|
|
|
"name": "TLP:WHITE",
|
|
|
|
|
"definition": {
|
|
|
|
|
"tlp": "white"
|
|
|
|
|
}
|
|
|
|
|
}
|
2023-04-21 13:25:09 +00:00
|
|
|
]
|
|
|
|
|
}
|
