2023-04-21 13:25:09 +00:00
{
2023-06-14 17:31:25 +00:00
"type" : "bundle" ,
"id" : "bundle--5c0e7410-8460-486e-8f02-a11d950d210f" ,
"objects" : [
{
"type" : "identity" ,
"spec_version" : "2.1" ,
"id" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-12-12T08:45:03.000Z" ,
"modified" : "2018-12-12T08:45:03.000Z" ,
"name" : "CIRCL" ,
"identity_class" : "organization"
} ,
{
"type" : "report" ,
"spec_version" : "2.1" ,
"id" : "report--5c0e7410-8460-486e-8f02-a11d950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-12-12T08:45:03.000Z" ,
"modified" : "2018-12-12T08:45:03.000Z" ,
"name" : "OSINT - Sextortion with a side of ransomware" ,
"published" : "2018-12-12T08:45:11Z" ,
"object_refs" : [
"x-misp-attribute--5c0e7420-3358-49b3-bf6e-dde2950d210f" ,
"observed-data--5c0e742f-6080-4784-ad0d-4f32950d210f" ,
"url--5c0e742f-6080-4784-ad0d-4f32950d210f" ,
"indicator--5c0e74fd-de64-48c6-9da9-4a01950d210f" ,
"indicator--5c0e74fe-e748-4798-a431-40fe950d210f" ,
"indicator--5c0e74fe-1b04-49e3-afaa-4f47950d210f" ,
"indicator--5c0e74ff-7ba0-42d5-9f67-4c32950d210f" ,
"indicator--5c0e74ff-df2c-40c0-8b6a-486b950d210f" ,
"indicator--5c0e7500-3428-4e9e-9f15-4b67950d210f" ,
"indicator--5c0e7501-5038-422f-9fad-402a950d210f" ,
"indicator--5c0e7502-2650-4c72-8d04-4bf7950d210f" ,
"indicator--5c0e7502-bcb4-4fc0-b0b5-40ef950d210f" ,
"observed-data--5c0e7804-aa2c-4d3a-bedb-c755950d210f" ,
"file--5c0e7804-aa2c-4d3a-bedb-c755950d210f" ,
"artifact--5c0e7804-aa2c-4d3a-bedb-c755950d210f" ,
"observed-data--5c0e7805-cf04-46a7-bcad-c755950d210f" ,
"file--5c0e7805-cf04-46a7-bcad-c755950d210f" ,
"artifact--5c0e7805-cf04-46a7-bcad-c755950d210f" ,
"indicator--ac324cbb-6dc2-4b8d-9368-b109344e1ad0" ,
"x-misp-object--44cea817-b8a6-40c1-b5ee-209438d848a7" ,
"indicator--e5365732-2c9c-4a8c-9ab8-d0d6c467d8bb" ,
"x-misp-object--0e92217d-bcf9-416f-9214-141808c91626" ,
"indicator--0cb9aed0-98f1-4f61-8a98-19bd540d7a63" ,
"x-misp-object--8bf655d4-bf40-4db6-a318-eed93034e5e9" ,
"indicator--5c0e75ee-eae4-4d42-a452-c755950d210f" ,
"indicator--5c0e75f2-64b0-42f8-8a58-c755950d210f" ,
"indicator--5c0e75f5-d95c-4f46-9faa-c755950d210f"
] ,
"labels" : [
"Threat-Report" ,
"misp:tool=\"MISP-STIX-Converter\"" ,
"misp-galaxy:stealer=\"AZORult\"" ,
"misp-galaxy:malpedia=\"Azorult\"" ,
"ecsirt:malicious-code=\"ransomware\"" ,
"veris:action:social:variety=\"Extortion\"" ,
"osint:source-type=\"blog-post\"" ,
"misp-galaxy:malpedia=\"win.gandcrab\""
] ,
"object_marking_refs" : [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
} ,
{
"type" : "x-misp-attribute" ,
"spec_version" : "2.1" ,
"id" : "x-misp-attribute--5c0e7420-3358-49b3-bf6e-dde2950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-12-10T14:11:44.000Z" ,
"modified" : "2018-12-10T14:11:44.000Z" ,
"labels" : [
"misp:type=\"text\"" ,
"misp:category=\"External analysis\""
] ,
"x_misp_category" : "External analysis" ,
"x_misp_type" : "text" ,
"x_misp_value" : "So-called \u00e2\u20ac\u0153sextortion\u00e2\u20ac\u009d scams, in which threat actors send blackmail emails claiming to have compromising information about the recipient and threaten to expose a range of observed illicit activities, are becoming increasingly common. In general, these emails simply demand payment to avoid publication of the purported evidence of compromising information. However, this week Proofpoint researchers observed a sextortion campaign that also included URLs linking to AZORult stealer that ultimately led to infection with GandCrab ransomware."
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5c0e742f-6080-4784-ad0d-4f32950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-12-10T14:11:59.000Z" ,
"modified" : "2018-12-10T14:11:59.000Z" ,
"first_observed" : "2018-12-10T14:11:59Z" ,
"last_observed" : "2018-12-10T14:11:59Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5c0e742f-6080-4784-ad0d-4f32950d210f"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5c0e742f-6080-4784-ad0d-4f32950d210f" ,
"value" : "https://www.proofpoint.com/us/threat-insight/post/sextortion-side-ransomware"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5c0e74fd-de64-48c6-9da9-4a01950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-12-10T14:15:25.000Z" ,
"modified" : "2018-12-10T14:15:25.000Z" ,
"description" : "URL in email" ,
"pattern" : "[url:value = 'http://jdhftu.tk/&4448']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-12-10T14:15:25Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"url\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5c0e74fe-e748-4798-a431-40fe950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-12-10T14:15:26.000Z" ,
"modified" : "2018-12-10T14:15:26.000Z" ,
"description" : "Foto_Client89661_01.zip (Compressed AZORult)" ,
"pattern" : "[file:hashes.SHA256 = 'a7ba2c9def86e54086f0624a73597865a90cb93aa72dec7fdf264f655cf1bb56']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-12-10T14:15:26Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5c0e74fe-1b04-49e3-afaa-4f47950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-12-10T14:15:26.000Z" ,
"modified" : "2018-12-10T14:15:26.000Z" ,
"description" : "a7ba2c9def86e54086f0624a73597865a90cb93aa72dec7fdf264f655cf1bb56" ,
"pattern" : "[file:name = 'Foto_Client89661_01.zip']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-12-10T14:15:26Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5c0e74ff-7ba0-42d5-9f67-4c32950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-12-10T14:15:27.000Z" ,
"modified" : "2018-12-10T14:15:27.000Z" ,
"description" : "Foto_Client89661_01.scr (AZORult)" ,
"pattern" : "[file:hashes.SHA256 = '29b42b0ecd874bcad5a5d9d03ed8f8dee320892305312b4898a0b64f9fbde93a']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-12-10T14:15:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5c0e74ff-df2c-40c0-8b6a-486b950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-12-10T14:15:27.000Z" ,
"modified" : "2018-12-10T14:15:27.000Z" ,
"description" : "29b42b0ecd874bcad5a5d9d03ed8f8dee320892305312b4898a0b64f9fbde93a" ,
"pattern" : "[file:name = 'Foto_Client89661_01.scr']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-12-10T14:15:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5c0e7500-3428-4e9e-9f15-4b67950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-12-10T14:15:28.000Z" ,
"modified" : "2018-12-10T14:15:28.000Z" ,
"description" : "AZORult C&C" ,
"pattern" : "[url:value = 'http://egorgerov3.temp.swtest.ru/index.php']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-12-10T14:15:28Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"url\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5c0e7501-5038-422f-9fad-402a950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-12-10T14:15:29.000Z" ,
"modified" : "2018-12-10T14:15:29.000Z" ,
"description" : "AZORult payload (GandCrab)" ,
"pattern" : "[url:value = 'http://supermainers.online/exp.exe']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-12-10T14:15:29Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"url\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5c0e7502-2650-4c72-8d04-4bf7950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-12-10T14:15:30.000Z" ,
"modified" : "2018-12-10T14:15:30.000Z" ,
"description" : "GandCrab" ,
"pattern" : "[file:hashes.SHA256 = 'ef07905923461ce13a3ca18ef6eb1833a8c8d327d47e9cc8641a2ca3d5ce97f3']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-12-10T14:15:30Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"sha256\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5c0e7502-bcb4-4fc0-b0b5-40ef950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-12-10T14:15:30.000Z" ,
"modified" : "2018-12-10T14:15:30.000Z" ,
"description" : "GandCrab Payment portal" ,
"pattern" : "[domain-name:value = 'gandcrabmfe6mnef.onion']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-12-10T14:15:30Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5c0e7804-aa2c-4d3a-bedb-c755950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-12-10T14:28:20.000Z" ,
"modified" : "2018-12-10T14:28:20.000Z" ,
"first_observed" : "2018-12-10T14:28:20Z" ,
"last_observed" : "2018-12-10T14:28:20Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--5c0e7804-aa2c-4d3a-bedb-c755950d210f" ,
"artifact--5c0e7804-aa2c-4d3a-bedb-c755950d210f"
] ,
"labels" : [
"misp:type=\"attachment\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--5c0e7804-aa2c-4d3a-bedb-c755950d210f" ,
"name" : "ssf2.png" ,
"content_ref" : "artifact--5c0e7804-aa2c-4d3a-bedb-c755950d210f"
} ,
{
"type" : "artifact" ,
"spec_version" : "2.1" ,
"id" : "artifact--5c0e7804-aa2c-4d3a-bedb-c755950d210f" ,
"payload_bin" : " i V B O R w 0 K G g o A A A A N S U h E U g A A A 84 A A A J 9 C A Y A A A D k P C s 3 A A A A A X N S R 0 I A r s 4 c 6 Q A A A A l w S F l z A A A X E g A A F x I B Z 5 / S U g A A Q A B J R E F U e A H s X Q d g l E X 2 / 2 W z 6 S E J C S R A K A m 9 g 4 A U C y D Y x e 6 d q I h 61 j v 19 P 62 K 553 l v M 8 u 55 d x N 5 F Q c + u C D Y U E R C Q 3 g m k 997 / 7 z f f z m Z 38 + 1 m N 1 k g C d / A 5 p t 58 + b N m z f f l D d v Z r 6 Q m p r a R l j O k k A H l U B N b R 1 m 3 / 0 G Q p P 6 A o 3 + v M r + 4 J g I o 5 X J T C i Z g 0 J c w U b A B O S K 1 L H 8 L v J z 8 U o Z 3 E O e w R Y L 6 S a k F r G D h H B Q M g 0 S 7 + 2 f T N C k G z R C 7 V 9 m + 51 D j 2 b q L T 8 / 0 S R 5 C 5 g t R H v L H 251 b g S c I K f H a + q m i B b y b y H a Q c c L l h d w U + Y m P i f v H m U i q j P O J N 2 h A j K R q Q n I Q x o t Y 7 g n s A T t L o / g h s y k G 2 g N u f c r 7 h T d Q y 68e0 S E + G h Q I Z 64 H g B n t H i 0 P 8 S B 4 x m 2 O Q D q I T g 2 s i Q B h p 1 p B M 7 k G m b 4 X W A K 18 A 3 c A C b T s M n a Y q z S W Z 19 Y 2 Y N q w X P n 3 v F f x u 7 l y U V t U i x G Z z 4 t C j 8 Z 35 M 7 E G a q / C c w E K P D Y q E i u X L 8 O o U S N Q a 4 t w z M U N n P q 6 O n z z 1 V K M G d g b I 0 Y M J s U m J x U c n 9 A F 7773 C e J 7 p 6 N P v z 5 o c M z j y Y O 9 o g h Z X y 7 C w K E j U J O b D V u o T c m J s q L 8 + A y l X 8 Y T B R M / c w 2 V t B 9 v z 8 a m G j t q a 6 W c 9 f U 4 s m s Y C q t r s a 46 V O F E 2 E M x K c 6 G K b 27 o 7 a h Q Y 1 I 9 Z K W F B r k r 9 t P + F T h + g a E 9 + g N u 8 K z / l g S s C R g S e C g S I D d X O D D o 5 N V J j X 6 Z y f I 8 n R s C Q S t S o N G q G P L M y j c t 7 G Z B o U H f 4 j 4 q n N f c f 7 Q d s F p k z h a k 9 j J u 9 P j w o 3 l V W M A R e P i W i N m l + Q m X k v 2 J k L Z r 6 C 21 a F 7 f b m H X N j 2 i G h 0 z E e a 1 M 4 m X O p 0 o p M 5 X a O L k k e g k 5 R 4 G j W e 4 J C W i h M Y 0 1 A p b C A t p p E / N o E 1 C C y E 6 Q R G R V B l 5 K C v K T C e C i N x S J O 8 E E b q V B y J p 2 K F q E 0 i m A 9 x m B c V U v V P / N W i T J Z X 1 Y h C z V R G V u r p o E w y p G 84 I z c V r 0 C M I a z J h Q o d 0 q w V Q 1 a F a J h O G Y b Y s P y r x e g W G 4 m M f V n I 2 J v Z l E h 81 d U 1 i l J i 13 j l r 6 y q R o M o s U b B Q h B Z U 4 v 66 m r U V 1 a i t q J c K f q h w k O T w m z I o k l x N v h q E J y 88 i r M u W Q u R g w Z g P z C Y j z 72 D w k p K T g / j 9 c o k r 20 e d f Y + / i z 1 G f F I n a O q r F T Q o z 5 U g I F e k G 7 R f S D Q 31 C K 2 u t B R n k Y v l D i k J s O W 7 N 3 q / i q 86 j N Y l 9 Y s + W d J 5 O B K Y g P w i 1 S 6 R X M S u i 9 l U C z 4 j 22 F x O l X N t E P 5 G i 1 U v y f t k k G L K V M J 6 D p r a t u m a A J 0 a f N m K P 4 T a p 7 a o 3 l 6 B J v j t x L S Q g m E q g 8 M H 1 F e 2 X E W h N N S Q 0 D q r x a 2 A f K a 3 I r w l E B r K s G T h h U O l g S c r 3 e b C O p G o B u F f h p w H W I W G l N l Z x K h l T 8 D t w n b o c u q Z C p O o r Q C r Y D U V O l c a D Z S u x V n K L l U O 50 q r v A R o h Q 0 Q n U u 9 I V I R l o x Z o R K K w C V V s i F U D F W / 1 g W Q 5 V l G v G q n / I K j r Z A 14 v 2 r J R n Q a k U h b V U F E t a o u k c D 6 G p O S B 9 F S V / h L r 4 V d A B Y 350 j i D s o a G o E c W Z v / J a s d 5 q I U l e t a L 0 X v G n S x V + s z + C 98 x z b 1 C A q B Q l m c p 8 I x V n O l G 6 b U K v r q Z a l O Y K V J e W g Q p 6 v W j N o S I F K r W 0 N l N J p u J M P / m h U k 0 K U 7 s A b z 72 N M 668 j K M H T k Y v 7 / u S k R F R i i c d 9 //DJs/+xSn9UtAZUkJs1d05KHoUrJcbBAjfZPyTL9Yru1SHsviLIKynCWBdiEBtlrVEzk90h00A7ULVlvFBMvGApk6n5GmKZxAp5CcEMtjScCQgPVuBO9NaEMTNWci6AQ9srEq30Mgh1yw5TesZQx3oVnvlLs89n+INURHyfvn/MP0WpM6uc5YMjUUXReACyNUupqUTOqABgGthKp8HDRpXdaKr5rZkaQDn2GiKYuyC8zISmKYiQtc4Uq4UeBUHJUaregZlJg/0bkJmcqk5ouY9aKc1sm2Y5swRLJUQpk0RDLnk45wQZVnE0xHKojEKxTBqRdapK/yo58JJZZhItGKzN/WbbtQV1uDyMgo9O/fF+UVlQrOtA2iqdaLptrYaCjOzL+BfknX2FiPhvo64VdUZqEp1Iy8iSM/+a9ylId6MtuUKDtOTYnEwmfnI+SyizFm1FBlEf/4k6+w9bNPcFrfOESJYBpEGSa+8SMl0pefAIy8JCByapRfg5SN5bAUZ0rJcoeYBGSFT15+vRIXUOFdW2hACf1EZutVbdfpUQ3aA+QnsY6G5iJcF2/7LEVT/bRP/jo+V0GTcNAIdXyZtrkEfrZLP9GEHf8xA+LdWeeGxy1IQszWl9PxTOjDtcx9yxg+yPuI8igXMZ2F9JGsM0d5qbOWa6BljM4stvZUNl+vsP+1ZPYimFMmVDudSodVe2LAEWEog85YATelUAqiI0opnOLXiqoCO4FN6ZUVWhggFdIiffpp5dTKKqF0hrXZgWskUDAqza5WZuIpmKRh/szWgFG5pcVZFEL5sy+3CNuyipQFl/NglQdxRXHWZVHZEMZ/BooEQiQNIQ4nHuaTFBeLnIJS5BeXYUdBFYEqDWlViyW5rLQUlZVVuP+xFxHRrRdCy/Jw563XokIU59o6bvG2YV9ZIapCwhQ9zVAKylGfuQfFtlCUbN8slm077JInLc6hUjC7/Lh1m78wScQFAvE6XReJH1QdgZdfegvpt12PgsISvPf6O7ggvBDYtgelXMlwOEqaCjMXEdRPAPUSXycUuZO7nk85r91gD7MUZ4fMrMchIgE25JgIO644ZiA++iUD6/cVw+445+G3CNjW2Mos1yYJBFWMrI+mPrBNfFmJLQlYEmi7BILSvnWbblN/a3QObl2EW6BtZW11OVuTMIh8t63Uh3JqqxL2Z+0HT7qBNTCv+TKCTvdFRkimgMrG6wg1PTjHpHMqm+LXSrQ3KzQnlCG0auo8hIjBD88qO6abhAlRm6KvmdJTUaOsVBzpVKzgUmlmDBVwKoVUaMlfdmEZdmYVqC3WpE8Mm2y3rs/PQFKInH2Wi7MMqHo4/9DaWtIYhoge/aiBSxmpaDfKFu0GFJRWoKi8EntFKScDBkeNCKurl/gaUY5rECKKry2uK1BegBrZgl1TU6OsuDRk5RaVodIWrnhkho3CWJi9CpF5OSgVtbhkx3aEhYniLHGhIQ0IE0GESamUIi2Z1QncVXG2i5V6ly0Wv/adgHPPPx21kldsTCROP+8sfDl/PmYU70RsYx3qHRUlLCuFmXIirToqzUpxtqFWNGmlOMvW8YhuPS3FWeRjuUNMAuF2G6aP6IWM/HJs3FfS/krPFqw6MxPWfMWZoLc7kNGbOtnyCDrhHcPT0Suj/Us5aBIOGqH2L7P9zmEAjdY/VP+w9nu5zDIICms+iDCKju+nv875LhseZ9Df9BaeJQFLAqYS8NmWGEmn26x4DfWWIBegQnLqf14VaCc58Sg/tVzDo/JQvYYopcamZAEJgNZls0vEuDmaijeVPirJ5EfB6FPpuPXY4JZ/mQ0t27yUjCm41ZvWaFSU4i9/vQKJSYkOLIE5HGmWlZXhpjufFGVZiBKfWOrpQKLfASddwy95ifJM8OhBfURZLkKXwf3UeeE62Sat+JM48utMID6dlmTkv1oEILiZY6SHI2hfaCy+6zUWZ1x+CQb0TcWefdnqjPPkCaNRVnEBFr/xKo4p3Y6YhmrJyoSIK00yyTI78Frcqh0qGr5exZBT247bx1wp+udvFAHxBQiV68TpXOnyunJVaT5JNcre+HrYXPnxwA8Rc76dNnuHY551LRPW6NbzAEuAB+25WhUREaEakc4+VFa+quUmPT71Cp2OC9pT3gteaNBq+nzNVAcRNI7cCZE2O1Ll2BXqJiset4CB0aH++pSdS6SL16/yHRS5HJRM/RJHZ0GyJNwOazLQtnkwisAXh468OjrNVr1LfpTVDxQysR+cUSJnudzKvB+y6wgkTSrDBORRkpYx3BM4Je4OtkJBkYA36QZ
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5c0e7805-cf04-46a7-bcad-c755950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-12-10T14:28:21.000Z" ,
"modified" : "2018-12-10T14:28:21.000Z" ,
"first_observed" : "2018-12-10T14:28:21Z" ,
"last_observed" : "2018-12-10T14:28:21Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--5c0e7805-cf04-46a7-bcad-c755950d210f" ,
"artifact--5c0e7805-cf04-46a7-bcad-c755950d210f"
] ,
"labels" : [
"misp:type=\"attachment\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--5c0e7805-cf04-46a7-bcad-c755950d210f" ,
"name" : "ssf1.png" ,
"content_ref" : "artifact--5c0e7805-cf04-46a7-bcad-c755950d210f"
} ,
{
"type" : "artifact" ,
"spec_version" : "2.1" ,
"id" : "artifact--5c0e7805-cf04-46a7-bcad-c755950d210f" ,
"payload_bin" : " i V B O R w 0 K G g o A A A A N S U h E U g A A A 84 A A A R M C A Y A A A B I y s o F A A A A A X N S R 0 I A r s 4 c 6 Q A A A A l w S F l z A A A X E g A A F x I B Z 5 / S U g A A Q A B J R E F U e A H s v f e T H d e V 53 m e K + + 9 g y l 4 g D A k Q I L e g x R F t b y X R t 3 T P T 0 T E 7 O 7 s b E b s f / D R u x v u 7 H T O z v R v a M 2 U r f M t E i p K T U l e o p G B E E S 3 h W A K q C 891 X P 7 u d 7 b i V R B A E S l C i R k l 4 C 9 d 7 L z J v X n H v 8 O f d m L F M o F O J m N r K c s 2 f P z t q h C w s 2 M j V t X L Z s L G X 5 W N J S + b T F L G 8 F U 8 n r O a J y B Q r r z / x 5 / 8 F H I b b y y 1 u O r l 77 O 0 Z f 1 L 7 F C l 5 b I R b z v u h q n D q 4 z K G z g u X j l F s 5 w p W o M a N s 3 u v x c p a k 1 O V 70 T P v / l a Z q F x U d 6 h Z Z d 8 e i 59E49 Z J 8 f h D h k D A g C Q U k b e A c t B H P A e 9 x C w B m u R j C c u C D o n C M v d L / H o B R A 0 4 m A M 0 w h V / m n s B j x L C c / 6 K R x E C R Q g U I V C E Q B E C R Q g U I V C E Q B E C R Q h 8 d B C Q R t 7 c U G + 3 r Y 3 Z X Z s b r L k 0 Y b E c F v L J 4 R l 77 F e 9 d n Z i 2 X K W s l g 8 G R R / l H + Z j E H Z l 2 l 6 f U c h d t m Y v f w U R q 8 M B I w F r w c D I 56 X I X s 9 h 0 r p T 0 9 G 9 c j 81 V X 902 X q w j A J R j T X v R G V V b n w F 9 r y G 3 r i u g 497634 Y 5 H h r E d D 3 W E E l K H B R P 6 D 1 X 1 d H S g W + l h C I O A y R r I b u s J p 4 Q M G s e O B W Q 6 H k 2 N D L O u G t H B I u I + Z z U 996 g l h U R z 6 E o 1 h b O t K Q N K P 5 Z i L n S p C o A i B I g S K E C h C o A i B I g S K E C h C 4 I 8 F A l L L S z L T t q G p w v 5 k / z q L D S 5 m C v / t 5 y f s r X G M 3 Z I K K 80 v o v v n i T Y n U f 4 T G A Y 5 V / m D 4 v + b a f W R s R E B W 8 a C T I f 3 O 9 z Y l g G r o p F l v O o h j 0 Z z 0 3 u X T 3 i Z u B s 0 m C J + U W Z K M F y i 1 m T C X E / b q 5 p 5109 F F 1 c f o c 3 V V 4 q //1AhoOixcCmJs0TRZccFGcRy4HADN0rAOa7hnqKczOIENJVaAYmizsKfGBkdeYzrvOXiMe6/E6dWChe/ihAoQqAIgSIEihAoQqAIgSIEihAoQuC3CIEYeriyrvUXj2M/6rfCXel529ZSYslnz87ZGSLNsZJGy5P2nHfFXimnijYHJR51HkuAh7j2/odM1BCZVUPBOAhPyaCIU5dMWB3ekZU2QolrfCqSxyGbYrVZEQtWMXcut5dXk2rBDRCVjtrS90o94ZIKvu8RGeUqKMNn9REi8cEkVzOCWfH4Y4GAnDEBn/Wtv5icNiIu/sUKgX50XU6ogoXlDsKngLeiNfCTAnkZ4eR3X4lfPFo8ihAoQqAIgSIEihAoQqAIgSIEihAoQuB3AIE8gSwdkQGt367Zl5Ta+bE5Sx48P4/iXmKlhUXLoewHY1ep1ijz0utJu5ZyHxm7qiA63GRE+Q+R49DQZaNVj+kpt2Td4JXh7AdROR3BuPWf7/kh81c1hedDfXogqi6vPvpBXyzrv4jheft6MqaonzwHK0+orqsZKTJk/J9XfEUfAUaIMKs31Po2TPixMh6/Ufz4o4JAHtySMZxwPFfkOdCOO5uAhBxFiUwpKIJhXMgSVQZ3EqR4ezkwEnSKcS/L8ggZ1Fejsz8qgBYHW4RAEQJFCBQhUIRAEQJFCBQhUITA7xgCMpavepB9ncDYzScqLDk2PYNhibIvC3vlAY+KybjEkJYhUGAjLSn47zxkkAY1X2uLsUsvHyosI0BfSvVW/dxVeUW1fQ00F5QSfj2Hng0WBs/zSNz7KUM6pGLL3MjLMKYdpcR6n1fapRU3cv1b1fifIoOrO8ypyrnxQ72MJ08KrvqtQ2PT3bBxk57TmY4V84iIorp0vePxR6/yEaUFRLd0Xjw+PhCIvE8Br4kUgyNpnyO5YUi1xjBOx8t93XNZgrnLZywFHq6vK9imtiarr0zZfKZgfSOTdpZ9Beat1OIJ6AFidPqiroBXH58x/657EsF4dbvRNdGDfhePP0wIRPO7er6VJhUd8gJ/mPMftbP6W21dyXej+1E/dL7aIx1dj56NUrtWXy/+/ughcOU8RvOs61fe++h7W+xBEQJFCHzcIbCah1zZ1/e6d2XZ4vnHBwLRvF3ZI8+4zud8CXMSE9ENWY/HKj17xRAIJnFIK9VaZ52/a8dft+uoAQM2Mma1P1ZMys6KgpuQUU0PQrX+wAdWfjQQ/4chbwkiyTK4V+x8qVWqVUauzA62YuJM7fun343GFMaocmzItBKZpsDlw9tRZJASrDdVO2qKEy8j81/w8gb9SqTI05gP8HJVv86vSHhn0mlLpVgLWzQSfh0w/tafUYw5mc/axrqU1VVVOD7IaaLdsbPxUughZgPj07a0uGS37ei2W7trrSzJ7vT0TLh187o6OzEyZ88e7bOhBZZFJEqokU35HCcDjfzWB/ExaiDCe6dz4KPz1YeuF48/bAhozlfjgUa7+jy6/5tCYXWdwqvV5/p9teNq+BeVjb6jMjr/sA38q/WpeO36IKC5iJwvq+dIT2uuomvR9/XVWixVhEARAn/sEIh4v+AQ8RLxkYjf/LHD5w9u/AqoenAV/T9HmnakliqOqsiX1meGzbPea+h6ikibKxsSQDk3NmVA61IOyzykpwblRIjlCOWPKZ1anZCRe3VlZXXL6ldMGyfROUWcZZjHeAeQx7FztCMDV32nvgJpsPG4jOsCSbIy/EFkT6cN/dX4VHYlxLeqGZnTlKGferZA/9141mC4LgGsqDY3vYzG4s4C7xB9WGl/VYUf+KdglGc8y8uLlkxSP+m7aq54fPQQWK1Y5XJ5a68us6/cvo55zzBHzJvjiaOGjS8s20/6e2331m67Y2uTVWbmLZ0r2DKZCXIkxXhmayvpHsl19virF2wmr4wFx0ph4B/dERkakcARrCNBtBoYulY8/jAhIBzQcbU5Fl5EOHI1vPggEInqUZ2rafr96o365bJhhSlHv3Uvuv9B+lIs+9uHQMRTVrf0Xri2ulzxdxECRQgUIXAtCIiPRLJJZSIZEMmV6Du6fq16itd/HyCAfYiNmw/hLxnOvIuWFFPtnq3D05yJ3ipqpiN69yxo4eerP4QQQh6yTVXSjcp8Nm2ZuWmbn5+3XGaZayvGKxHU0vJK/qqtrLKa9FQpQ6tre6/flKV7MQximccyhrPLC7YwP2npuRnL0aaQVP1JlpRYqrzKUpV1/q20cI+C6z7PcsanzJN3j0dXZTAnPNocxpNbmrcl2lhcmOdelpR2rvNoqrTMSmhHY0mVloctz1TBb3B4JF39W1HM+EFt7+7nb9BE8dFfEwJXMr8y3uWWKInZ//X9F22BhcuaM61b1oxlcOB0NZTbjRubfddtTWGSaHKWuxkcVS+92WNz01P20IE7bTPb278xyE72RKRB8DDlv2Yff18fi2ArGEZ0/DYN/L4OqtjvDwSBCAeu9tCHaehE7azGr8BlkWWeXkRSk4xqdSTiw/q56jx6NqpLt+RUjTh1hMO6Xjw+WghEc6G5iuYtcppE57q3+v5H2+Ni60UIFCHw+wCBiP9H3xGv+TDl1e8DHP44+ijpjl6ArFDQNZnKp33cblQqasxZHjU/2iE67Bwto1rKREhZ9gf4EKIo6uoGH98zM3O2MDVua1MztnNNi7U3tlhVKmHZbMYm55fszOCkXZyYstnFRqusb7dUkojzirIS1Xm1bxm6jpyUjRcyNjcxYrnZUWutTtimDfXWWldp5dSVzmRseGbRzg6O29DwlC1XN1tFXStdTzFWPSsjXqZoMJ2v1paizNKStH51nL6Wzg/Z+tqkrd3WbI01GMvcXiaVenByzk4PjdnoyJSlalqtorYJ6Fy3J+BqTbviJQUtIsSrFvqdXhSyuMr4O231495YhuhxNpO2RDZr+bJ6Wy6UWpIlBPms3uvMBmCsbV7b0WwNKczlhUWbA+8qKip9Xg+d6LODpwfsodt3GeskbNPaFntz6Bz4SXaBPEkYzx/2IXwKNsDHcy5D/0LflE2Sg/YEiwQeOWHgh34481Ot14aH98kbpoyciKs7wiWvYpVh9aH38aOsUINbOfTrHVDyk3dciYr+xt+R4iHYyz+
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--ac324cbb-6dc2-4b8d-9368-b109344e1ad0" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-12-10T14:15:45.000Z" ,
"modified" : "2018-12-10T14:15:45.000Z" ,
"pattern" : "[file:hashes.MD5 = '033414047da131ed4c23cf6ad8bf1d93' AND file:hashes.SHA1 = '7727d9bb9d9572f1c20c7f51b39507cd4107c87c' AND file:hashes.SHA256 = 'a7ba2c9def86e54086f0624a73597865a90cb93aa72dec7fdf264f655cf1bb56']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-12-10T14:15:45Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--44cea817-b8a6-40c1-b5ee-209438d848a7" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-12-10T14:15:48.000Z" ,
"modified" : "2018-12-10T14:15:48.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-12-09T08:52:54" ,
"category" : "Other" ,
"uuid" : "95cca45c-7dcc-4422-b581-c233cad3b40e"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/a7ba2c9def86e54086f0624a73597865a90cb93aa72dec7fdf264f655cf1bb56/analysis/1544345574/" ,
"category" : "External analysis" ,
"uuid" : "f76af61c-4563-46d2-b59c-c73da713bc85"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "31/60" ,
"category" : "Other" ,
"uuid" : "54c7b44a-d5a6-43f4-a30c-03d7138c1c93"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--e5365732-2c9c-4a8c-9ab8-d0d6c467d8bb" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-12-10T14:15:49.000Z" ,
"modified" : "2018-12-10T14:15:49.000Z" ,
"pattern" : "[file:hashes.MD5 = '3071f670ad7ec4a5985498517a5bf48c' AND file:hashes.SHA1 = '080e71f56a9fc783181cdaf1fa88666c352ba314' AND file:hashes.SHA256 = '29b42b0ecd874bcad5a5d9d03ed8f8dee320892305312b4898a0b64f9fbde93a']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-12-10T14:15:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--0e92217d-bcf9-416f-9214-141808c91626" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-12-10T14:15:51.000Z" ,
"modified" : "2018-12-10T14:15:51.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-12-10T00:00:04" ,
"category" : "Other" ,
"uuid" : "1609de83-aada-45f9-9152-e68b6083aff6"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/29b42b0ecd874bcad5a5d9d03ed8f8dee320892305312b4898a0b64f9fbde93a/analysis/1544400004/" ,
"category" : "External analysis" ,
"uuid" : "47a39420-c93c-459d-b6e5-fbdd262f3a84"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "40/68" ,
"category" : "Other" ,
"uuid" : "fda59bf9-60eb-407a-a582-2ad8bbf02ec6"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--0cb9aed0-98f1-4f61-8a98-19bd540d7a63" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-12-10T14:15:52.000Z" ,
"modified" : "2018-12-10T14:15:52.000Z" ,
"pattern" : "[file:hashes.MD5 = 'db947d361f3e06b039a705a2728606fa' AND file:hashes.SHA1 = 'f3cdae48d7e9f53667a1a7c5332c151f63cf61d0' AND file:hashes.SHA256 = 'ef07905923461ce13a3ca18ef6eb1833a8c8d327d47e9cc8641a2ca3d5ce97f3']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-12-10T14:15:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--8bf655d4-bf40-4db6-a318-eed93034e5e9" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-12-10T14:15:54.000Z" ,
"modified" : "2018-12-10T14:15:54.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-12-10T08:36:54" ,
"category" : "Other" ,
"uuid" : "384519c8-0906-4397-abea-52941d3ea601"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/ef07905923461ce13a3ca18ef6eb1833a8c8d327d47e9cc8641a2ca3d5ce97f3/analysis/1544431014/" ,
"category" : "External analysis" ,
"uuid" : "4962260e-cb24-45c2-b0e2-07d52e3efe26"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "56/70" ,
"category" : "Other" ,
"uuid" : "fccf93ff-6017-46c7-be81-c81d48edcafd"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5c0e75ee-eae4-4d42-a452-c755950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-12-10T14:19:26.000Z" ,
"modified" : "2018-12-10T14:19:26.000Z" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' d b 947 d 361 f 3e06 b 0 39 a 705 a 2728606 f a ' A N D f i l e : h a s h e s . S H A 1 = ' f 3 c d a e 48 d 7e9 f 53667 a 1 a 7 c 5332 c 151 f 63 c f 61 d 0 ' A N D f i l e : h a s h e s . S H A 256 = ' e f 0 7905923461 c e 13 a 3 c a 18 e f 6 e b 1833 a 8 c 8 d 327 d 47e9 c c 8641 a 2 c a 3 d 5 c e 97 f 3 ' A N D f i l e : n a m e = ' e f 0 7905923461 c e 13 a 3 c a 18 e f 6 e b 1833 a 8 c 8 d 327 d 47e9 c c 8641 a 2 c a 3 d 5 c e 97 f 3 ' A N D f i l e : s i z e = ' 142336 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A G 1 y i k 1 N a N U J S A 8 B A A A s A g A g A B w A Z G I 5 N D d k M z Y x Z j N l M D Z i M D M 5 Y T c w N W E y N z I 4 N j A 2 Z m F V V A k A A + 51 D l z u d Q 5 c d X g L A A E E I Q A A A A Q h A A A A a p l b m n 1 P B S C G h C y h X o 3 / f D G S h Y t P e q 55 i I 0 B u t P b W x R K W R + c 57 e / J z d p 4 q R d Z j 0 q f W K 8 R K K A i O B u E w d H i k x r r 9 q E 6 F H F q 90 v J t G 75 M G W 8 M v P 3 Z D G Y l h 89 t P 7 p q G 9 b T 4 y p m 2 X B O S d u Z 0 d v e a / w W c Q P S M Z M M J Y c 9 j b z l k b b Z S s U c h s o R f J t 70 O u 3 Z m S A 5 f J f 2 h 2 Z w a 7 c G Z y s Z 8 v t j 1 y r d L 6 k e S / 5 x 5 f J D + w L 3 s h W H r O W V / M V R 2 H L L Q A Z m 1 G x T N Y n 0 c i a t Y a T x 2 M h b 2 w J i 5 X X S t f H J x d B l 3 L p B 2 R e 8 O B I K s c t 7 Z + 4 l e 0 h Q e U 5 G 3 s d 0 Q K W r m K v P N 6 x u C W X X D P T L W T 4 c 6 s 2 C 3 Z 3 j y e F u p 7 o Q j y 6 Z 7 j i h G / 8 X x c u q 73 t w L a S 21 j n k S + N s 4 f e y V + p z n p m N i Z t 10 Z z b o 2 / 2 H 1 Z b N 6 c b o z B J W 7 J g r C k A o T c f 5 q H c p Q s P k 0 z q B t R d V w o f x U E 47 c h P p d Q / 5 G I n 2 S j I p N P s I O C 0 W A 9 c y d k v u F J 4 u J Y w V h C 8 c 83 h L 6 F n F N l + + o v c s b E s h R 8 p O 54 h + i n B O P U 9 j E / g h u q T a K c 3 v b D D r H y 49 Y e y Z 61 X W Y Q F d M v r K d w 9 I m D z D K f J + L u F k 4 D A P W t P m b l t G 4 k C N 5 j 8 u v 4 A d i N 1 S t / z c l l v d R 61 l H x Q H f 28 N m H Q Z V S R p 1 B l i g 6 L T e B M 16 X j + + t L 4 l B Y u s K 0 0 L n Q B G Z B z M V H a T R H p y D J 6 D E D S x M T i 7 m 2 p j 8 l J / K v h A l m O 81 N B M 8 r u 8 q P A x Y 0 D b + c 9 t 8 T X p v z V s P r p T B P / z h U 8 F t X 0 y J / U q F j 4 z o S 9 S 3 + F J 2 B k U D D P H C n F Z 928 w W D D e 8 L 5 J 88 O 35 a f + k 3 m u T 9 K u + t W 0 v 0 v z K B Q q z C D 0 6 b B i Y o p v n 2 G a J u u 2 G K A 3 R + D U 7 d K v G U / H b / J R i d R G T M w D U E 8 c a w J K 2 L m M + i 7 N E + X 3 d 3 e Y E 1 D f g Z r 0 P l T Y n Q 1 w O J S q h q P n 8 T C v 3 G + y A l s v r g A t q f r 4 p Y b P P S 9 E u z 92 y v 0 p 3 M O / G + 7 F q o M + V N J S d X 0 g h U C f F p b U M X W X Y s c M Y z W F A 2 e z 0 6 X 5 p P R v 3 H L o n N D w 3 v S G G o N / v 0 h d / c B P M T A R J G W M L u v m I a J u D 7 k 7 u A Y u T q B J 5 g g 4 e a A L d H I 6 v l 1 h C U r Q j w D p N / B i n T + w f W v 64 b F f 1 l W c 0 Y 0 C z O 4 D F y + m K j J i L d X r r 8 S 9 U j h r N / 1 v N T Y G y M c 7 k 90 L y d 5 X R W A I S X S w I X W W F 54 t J Y k e 6 l K U k B S / 2 B 2 E B B 0 M x 1 H j e Z i o X N O F y X A h 7 a 32 p Z o d 72 h L F 56 a H H H T W R R 7 w J e W W 8 t e p u 0 2 L J y G Q 61 H N B Y 0 R C F c a g 2 / D 5 G y L r m E O H q E z R 1 j u Z w u 9 A Y e d w C 9 y G 735 l r y V 90 f I Q v L r J + f 2 o 710 i i b V M y M B F u I X U P y c a V n g Y Y F w t 31 O 0 A N Z 9 J 2 M r i V p q E / Z N E q P S i j 1 A h i y q z Y 2 S 0 d c e 5 N O 2 U T j m a q w + 417 + H q 0 k O W t H a R 3 U P K g x O 8 w 6 k S G / 1 c n q z / Y I S Q d p e G J Y J f o 7 x S 5 k o G A 3 g s r A E U X 762 z / v T F F B 2 m t 3 J q n Z S j 0 Y r q L v P J p x T g C 0 g 9 R 4 x z d D O / T d 4 M K z p S j l e l n o Z K a d O z L 4 A C r 7 o j C V j O z e E 9 / k d 96 A I F X x 0 S 6 P E y r a E x i / e H f Y Y G J 2 o Q o 25 F Q 10 c 5 C t E F I 12 J g l p 4 H + s 2796 H r 71 + O w z K F 8 N f P K h e i z I s y x 8 U E j / y b J v A z y P v m H 5 E W x + j J h D s s b h s q e Q x Z 3 z W O X 7 I n f q e Q w Z M Y r 9 Y 11 C g 92 a b S 2 C Z v e P 639 c m q j r / C H W a T c 1 Z W 0 X N g y L k t i x 6 o 3 b 8 a I / x K T S x L A G 7 p X m V J N o I a r f F d U B K J U c u x u w n / b N k A 9 p 6 //igTQa2+Yg57CtNZfQcQWstkCOT4J6DCPYhjgHjXBB5Ru4BxWAWxEUwVVwTOO7CyoYuAD3lTbPxtuZf0MaVFWnX2hjDO2eHCpWjh28JE4q9Y2xZXYXi6GZhBJOGY0DckCiceWzsPYUDI5jQ/CUih17Skk/eAlx7JGrnDP5E19TJN16iXWdZYuOoVBUvGY8vIfzVxNe3hQVuuiGqp2Tybe1janAEoHtwDfg7BdOUx522Pu0GH8yJag8BpgQFSJWBunEgG3QieVZrOKHts0zolVvDmH+mIBQcjfFyqUESP24hnRTqISXIbGSrwPNqNdylNMGx46lFJ9muQEFvBrwbYO5pP+znTsQNAmy0q6A0Wh40Ku+iP5N3G01fpE71lMg0lX9yOWJCxwijoiLbk/ev87GRiH70fMENw9Hp8zWAPkvvDmTIRajApLSaqfMNZmuTkYnuiwYX896sXF4AoJZhUOw3BEeRDiMGKQO+0g2VFlKnn1JXN3KYrKypKwQ8w/0yjSoAp+gnVOHwUQtB7wS+Iq0aF9AOWOh6/AzyGz9a8KCay0NIRJRelTdNGAHBXN6Ysk3lIutwBK3CYejGojFQ3dmwkdEk2hVA641iMA7OKIe1DOkqFb1UJmPMLO70n1affR60IcLIAa0vyhuGo3UVhVMjlcP0q/EemtRCYhLsQBbmchhoPQJLlu26KP01DZrXGBGUnkeOlGivN8NAUr/fCWXE954MmSr/3KGA9HzbY1/UqFea43NLU1x7rs641moIIJ+wvrJ7m8sWpSqNa5esyTVdLYCWWpFfpMuX4afnfbeuTyeupTDz2ObVjf1W82hWkRjxxhgTW0S0UxyLZKTbpGS2I9lwCH8lS52NbzttGAD9/9PDhUkS+peSamMzz/YaOXVTYQVO2D6PF2QZXZMkscQOw1pRUkjL/gsXe1/7pwH5l5bVErbeGGxnG+C0oGurbHjzW8xXE7cUkrLUX0eQxv2P47U6hrwEqPtaVePhBqClQXHRNBmcLzqOlq9+RJVrRkb5hYYSko6dRsdrzf/abFdZO/mJHLKEWUJq2RJNVsRUzMv7jkOsKIvX6sX88bXabsFvKegdEn20EcSuCTa5hYAMMq6EEHZm+8sg34gvr/6ubFa8f+Rnh0poTIEDFs4CKuyOcoL2WsECBLKvRT5BHhUoXX5S7+lBOyiKrZhsXpLxKE4q9O1WFVwbWRlnUvl6CdAwCSDR5HGG9rKUWI+ndAsi/Pzbj7b7nIHhixhT/5jApJjiGadP6u5cgRoXoS1dGAjxHACW8WqNknGBlwT31CRWazZWpLWcR0Xb2anJbIMiwAUe3D/SN+O2wllq2Ol0t9zK2KnyMW9nP+Jvw6RVSOwqMWhSW+weXWs/uejrxMN/OOsTOMceZBKWhnY3GtIXOFk6LF2X4/3o5OssrJGXOy8uOmU1fnp9iLP1quZW5HauWI5KdnouTPq61YHyXFbZ6vutsGFnOSNLbmmojgnoooC6VIMRKSjze24l1Qv3f9y0MTWTILrcqhIrCr6h3mXC0T89LJz+NeDcj96FLR17wt2qmE+/8lSRWzswcfdhQLq5sNNTPSTQdDuT6v4pb0UveZvw31Nfs9Px8ElmDx3ZZlH7ixapQxyANos9QQ2LLndN+rVQGCCDDdTF4vhLDHCyC5XaxUqg5LwQgP3hqB/oBUW91/nMAzn1/75DtOI/J93ZPtFfeqwhzvKg0qsmmxlgN1+hlUagleqbQRJ17eTHQkzoSRvAgjPVSv+tdyK8LuOYjoqTym8H6ccpnrmiFRmumj5qm4YKaKMl7uWPG6DeOvM5L40t1KU
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-12-10T14:19:26Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5c0e75f2-64b0-42f8-8a58-c755950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-12-10T14:19:30.000Z" ,
"modified" : "2018-12-10T14:19:30.000Z" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' 3071 f 670 a d 7 e c 4 a 5985498517 a 5 b f 48 c ' A N D f i l e : h a s h e s . S H A 1 = ' 0 80e71 f 56 a 9 f c 783181 c d a f 1 f a 88666 c 352 b a 314 ' A N D f i l e : h a s h e s . S H A 256 = ' 29 b 42 b 0 e c d 874 b c a d 5 a 5 d 9 d 0 3 e d 8 f 8 d e e 320892305312 b 4898 a 0 b 64 f 9 f b d e 93 a ' A N D f i l e : n a m e = ' 29 b 42 b 0 e c d 874 b c a d 5 a 5 d 9 d 0 3 e d 8 f 8 d e e 320892305312 b 4898 a 0 b 64 f 9 f b d e 93 a ' A N D f i l e : s i z e = ' 642936 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A G 9 y i k 3 y w + r x g B k E A H j P C Q A g A B w A M z A 3 M W Y 2 N z B h Z D d l Y z R h N T k 4 N T Q 5 O D U x N 2E1 Y m Y 0 O G N V V A k A A / J 1 D l z y d Q 5 c d X g L A A E E I Q A A A A Q h A A A A r 8 O x X + 5 y Z 98 U v u N d L 7 o W Y e / k e M h K A r u 65 G / L 27 C m R Z A U E X o M 0 2 H 4 w p Z X 5 X 2 + L D y A l L 3 T 5 C y Q x j G t r Y M J r m 9 u / Y s I x d g J 227 v Z C M p M F K v / o M 4 t M / Y 6 X 3 y n J J p Y a V 91 L s c p m h / x m W z i m 0 Y 0 e A I y E L 34 o W Z E h S k c 6 g 2 t p s B p 8 N a T M e 3 N W j V L V + g b v T G c T i z e 20 Z E e K A h 1 I d k w O B h W z x H o H O Z H 95 D A 53 U r 9 Q m 63 n + b 32 G A a H J F D s 3 k v u Y G n C / A R K e 4 g I C l 8 / s P 5 d l B F r A 3 D O M T 4 T Z 8 t u M q B q J L k q 8 x g O a y 4 Z E 5 / E C T 0 J A S D H a W A Q l 1 H h G h 11 J I 68 s 9 f G U 2 W g z S 6 Y 3 Z + 3 r Z b 1 H w R s u z B Y R D I r 92 Z h T Y 6 h m 5 M H t g L c S S y v Y A F o 2 m z G l S / i g l g n r g V 8 S S P Q M t H U x q J 0 D W g N J v F D C k T A f 1 L B q k N E A h B J W 5 p h C q G z z t s b 47 d p Q 0 C m I t w C 1 A 6 G j d W 1 R 20 N J 20 x J + m S P o i z X B A V g T f P 7 T e p Y e T X X B f j K s Y O + i M y u M k B 9 t I j 8 l 8 K M Z 7 o X 8 Y Y j e c D 4 B y L v + w o V 3 X k b B w s l W D x c P 4 V V q N / H M A s i b J Z D j b 8 c h d t g / 7 B 7 f N z J + G e K g t j j k P x z M 1 R r G z / F / 5 x 1 G i I / W f 2 Y q P T 7 i S f F z g s r O v u U i l f O b 1 u S X 6 I J p H 5 Y f 75 a N a D e P c n K o o / G u V Z 3 X m Y m L o E / c 25 U p r c R X c c z D b F u T i u w t D s h m 5 n / f W 9 e d m H a N o y k N Q j f 1 t M B v 85 u 84 c Q F + H + b h x a 3 I d F M N 5 U O h 29 d 87 p j f C b J H T + h D / Y c l S 1 + c 77 s H 15 z b D N o i I 9 e w o L J d 9 o H l g e 7 N E + 3 a B M q x x 7 i 5 q 1 G N 8 o U c u 1 x 3 T l D U O t Y A E 6 X M U G O 3 c 4 e S 7 W a F X S k N 6 Q B U x z D K T v u + Y L 2 A H b 1 y 6 y O q W a z Z D t 3 m j 9 d r H L + O a n r V u R i H D 63 y 9 l q s E 1 t q + 27 v 8 E o P / i G k t 7 r F u A Y L c R j 4 i A N q F w 3 b h U M z k r D x 8 F L L k g F C R u v N a L u w 5 Q k N h 3 a t M l s o 6 / z b i F R Q 9 u a C 23 V E V b N C i o X 3 e f g c K 6 A a f i j w s S B w 6 L l I G P Q K 0 r B Q 4 + W Z r t D I 54 z F R O V w 8e9 D 5 P 6 f J a G X t B x t B w 58 g v u + y i h X G P 8 c N w C X K d z y Z C v f u a Q s c B w G l g j l B i d a 5 q v y R H C o U r 2 f i Z K b p O r 67 k I P 6 N + W o 58 + o y f g W Y 3 q J L P 2 W h m A i E h k Q N S E t w t A Y b K 9 o h n 3 x d 6 E M J X q e e S E H U S i D / y s 4 B r o H 873 X x N K 1 S 0 A T U J I e F d t b v C Z J y n Q X M y h w D k q H 3 M n Y s a c C 7 S X p e 7 / K g z J M D k I K b z T c A O e h o p q I c f 4 m T c K u b l d L 486 P R k A i k t 4 X 7 p T y F L E 5 F b 7 c h g R B 3 l k h G H s h j n + 4 G V 0 Y 4 g K X 7 i C S k p a C 1 n k D z S 32 + H + Z 9 G V w n 71 e q e d Q N 7 O Y D t q S / B B y t 0 K 9 H r w 20 C l 9 k 9 n s x j 9 H G Z 9 q F O U R s / E X q U 8 Y V 1 m U P Q 5 r D + T P Q h K / 5 h X J y O h z Q u c e S k r 2 J U o 0 5 z v L j t Y d U F F X R I F S s k o c g Q J m 3 Q N G + / 67 t x / D A b X K B n O r M N 9 T O A l F W X W Q / C k 4 V Z z k z b B b 93 i Y c S 2 o k 6 P d A 3 W w e D p 2 U s S l L v b X O Z i m N N Q H 6 b m R V j z + K f 8 u L d K 1 P c N U J 0 g 5 F P d 96 C G V p Y l B t T Q 6 X h a l l c U / n w 6 C R 57 n B j 2 n I T p E K D B h N w E s f T 9 B S J Q d 4 j X r E Q m / N J Q a 6 Q S P W C I r f m n + Z i x b v Q R F k B K / J I l N 6 Y D f 8 A r B 9 / C k a I u z i q 4 s w X m 2 u 1 K 39 g p 8 C x 1 T M 76 K 5 P q v x A 8 G w P g 5 a i r I g p N 9 e C A j z 3 m x g m S E v o m N J M K 0 y 1 t k / K y 2 b q 0 1 T F y c t t m c y p t j w X F Q Y 0 j f L v 4 n a a C V P 4 f S 2 P G F o Y o j + b q W m 8 w u + u R s u x l s 4 Y 7 x j O f M 2 S q s E x 0 H r A k d m U A n 7 K v H / q q p V p 5 o m + 8 / R j k H 8 b m 1 y V R 87 H + 75 Q d 0 y x P e 1 M x a 7 M j o r Z 3 E B s A m 0 b a D 3 i 1 h N R + 8 K p X P f h 3 D 0 7 k v u N 54 b B r F m 7 Q 2 Y f X B s E C p E 5 r Y m O q z E E 5 C 4 n Y o Z A G O y X C l z W 3 j q X 4 X t a c 23 u Y R u T Q i c o Z c H Q W L c N / u Z y R u J I x g k z T b i g p n S v 9 e B / U c W E h G V 1 U L N q E b e 1 i z K D e r a D 5 U n F d R v u V r M b 8 I s h D R D N T 5 Y k f f t X 0 f f S S h 6 w h s W P 6 H O A p i w r u W L t a + J 5 V f 6 e S e k X j 90 p 2 W N l f T s 6302 j Z 0 s O W z 8 e O a F P D 5 + i s A 0 o z R E 6 v O L l S v 31 Q i n 6 H p o P + M u F 0 0 b e y H Z y 1 P n P Z 9E01 I t k h z q M z v y 99 G u n / z 7 i H X T P 8 i a P Q 41 C S 5 P H s U D q G s R l B C s i 1 f Z g V 8 X o D 28 l v q C 3 g o Q H n 83 G 5 D v E J a I R X c L G 0 Q G 3 A O u P 2 A 0 g V 7 W E a i z L r c 7 H a k 8 A t h T b J o C S E 1 E h R j 0 Y 7 t 7 v X Q b f 4 c y u N I K o R Q L a G x J S W O Y d X Y e Z F K 4 x l z r t c g f l I 6 I l h G y F L K W w 24 q K 5 x k C S I 9 r r m L p f 0 j F 1 n N M p 441 y w y U A P F R E C S y z x V s L c U 54 p H 2 T a w a t 8 d u v i M e f c 9 j 0 h u H u H 3 C m C Q j f k e O d 15 E a r l W f / I T z 8 K F Y g Q e s w Q u j w x + 9 V 5 H 9 z B 3 H h 2 u D D 8 w + j o Q m x h Z p L B X I Q o H u g D P 3 u j u e w S y M r 3 c I v 7 t 2 a l 5 g 2 P n b / e W e P Z r w 4 N 3 y p n t e L 8 s z l P p g f L m / Q 6 X 2 A / T N s L Q X 1 b s F 0 d J N D p + 1 s 2 a k f L l a 5 s G 5 o j G 7 S + U d P v H l o 6 a a m g Q z a z W z e 5 Q n O m K v Z 6 w C n 2 C Y w v Y H j 5 G O m 5 t T O X H W I h / D m 1 s Q W / Q r V P R G J 0 n w 8 m c d 2 t f g E D i 4 V N 6 Z C d e a P b W e c Q k r c 1 b O 40 I 9 k H U M b I p t j T M j R 7 Y A b o 2 l m 7 i J P F u F 3 k r 2 A q B I X I X Y f Z V m I Z U K H B 4 M q J / 7 y i 701 I h D c S 7 h n r S b a g N 2 R w W L T Z n M 5 O A f H 9 Q w M 2 U s M X u y C J s U / t W 3 Z c T P F S 8 r y / W v O n / + 9 L n 8 U d S L W + R z j f R a p 0 d n s y I s R 0 u w l w b F d k E X C f j Y U C M g E U j r p N R V n t / n z U o Q P P y / z k h D 53 w 2 f w K O r b b v E N U 3 e W 7 d T 0 z 73 E R 7 R q y z T P Y k T / h j / W k M B h r 7 H B 6 Q i k X B k a B X b 2 w r R 6 F U q S 4 n u H V Z 8 z e H m 1 h S 1 + t s I d X w s u 1 x w K x W z u r Y d D z u A I 5 F q u t c O z l / S J W z P v T 7 B K 5e5 r x 4 L i g B w b U s A I K c 92 F 6 g b O E C c Q f g M Y k w 5 f I 1 U 8643 C C z W x h H e w / A C b F 9 p Y U z Q F k w I u U P l i j e K 2 a Z y W S l 6 e m y u 644 B A K E A L Z m 9 M K r 4 M B Z c a X R M R + D a D d M J / 3 V 5 C s W 5 F S q Y p q P r w o n o r i K O A 2 h 66 H j d g N V S v L h U / R X 1 + v p s u M x m i e C E Q z T V G 2 j J 3 o i C D f M R x x 1 w 8 f j y M 1 r 0 5 R t 60 R q 1 t 4 F q a q X d 2 I o 21 k 5 p 9 F D l 2 y l q w Y m O t j q Z Y 8 q t M H X O p t o 6 i F 9 I b P e s L 25 n 1 O 5 M p R f a e e 5 C k 2 U l u p E s + n W g k d p S 3 H G d k v / Z R x R h d 3 / v S 2 T A O M 9 j V v 5 U o h u z h Y u / g S o q 2 f x s A Z c 7 G h y G Q U p 1 z n z y p 0 9 y T F W g 5 R 27 X r K b y 6 z N 4 f K s L S H Z a w N a A 9 l u f 4 r 0 C w 13 U w X m V 9 H 39 p L c L C J A a 382 j w j H T U C Q Z / a a 2 M Q 5 Y C q v k i 0 T Q e + I Y P 4 R N k L I J R r E 2 j U 3 Z Q A M F p 4 J 5 T b z Z p p M s Z R o l N 47 G o Y z z P b P x k L u D 7 w r V B j a R c o 8 o q 8 / P l G 94 i g A N q R A 6 S b J V Y q C t H S C m h E z 6 O c 54
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-12-10T14:19:30Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5c0e75f5-d95c-4f46-9faa-c755950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-12-10T14:19:33.000Z" ,
"modified" : "2018-12-10T14:19:33.000Z" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' 0 33414047 d a 131 e d 4 c 23 c f 6 a d 8 b f 1 d 93 ' A N D f i l e : h a s h e s . S H A 1 = ' 7727 d 9 b b 9 d 9572 f 1 c 20 c 7 f 51 b 39507 c d 4107 c 87 c ' A N D f i l e : h a s h e s . S H A 256 = ' a 7 b a 2 c 9 d e f 86e54086 f 0 624 a 73597865 a 90 c b 93 a a 72 d e c 7 f d f 264 f 655 c f 1 b b 56 ' A N D f i l e : n a m e = ' a 7 b a 2 c 9 d e f 86e54086 f 0 624 a 73597865 a 90 c b 93 a a 72 d e c 7 f d f 264 f 655 c f 1 b b 56 ' A N D f i l e : s i z e = ' 269715 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A H F y i k 1 Q d x G Z J B 0 E A J M d B A A g A B w A M D M z N D E 0 M D Q 3 Z G E x M z F l Z D R j M j N j Z j Z h Z D h i Z j F k O T N V V A k A A / V 1 D l z 1 d Q 5 c d X g L A A E E I Q A A A A Q h A A A A e h m 7 G q N x S G r O f g O 0 S Z U v h e h 9 t k g f G 0 v F W W 4 / l H B s 17 p n W 7 J k D L o L g h B w 1 + Z Z s b y W i z S U C B g h + w b G y h Y I k C i s b w F j j M 7 + F d W u 77E6 o 3 Y F P u 3 u R V j L b w 6 m J T M L 4 M 97 z X E R M Z J 0 S H P K 4 F j r s E a N X x g p N G U 0 x h e s B p k 3 y k g U 7 C V K H d a s p z U u 6 d R e L 5 T K G q s D L X J g 54 s W n Y m 9 x + n 0 6 z R h K Q E t j 6 t + a U J u o 8 h 4 W 4 p G F Z t N b W y g n u u Q i z 8982 D 2 P L i G Q 7 N M q s 1 b P c 0 t A b V v E b E 9 f K B N t t m w 0 o g 6 O H v k j t 2 w O + T D m + k V V 6 f P I 87 D H b w a R e t 3 Q d P 2 P n t z q i N 6 C a x C D b F k r g A I r V p F Z j K 6 Y x 1 g n b 9 Y X w a 7 g / S 9 k H X 7 h 8 B L 91 c S e F s T 8 O h t S g Z u K 1 A R v h / F A b g t v f R 7 f Y m y G N V 1 P 7 z u D 5 n K 0 G P l e J j o w S B s H u a 7 o z b g k E Z m m S 7 v u f u X g s F d k T N Z X p C q v T s g C H v w P u D t n B N X 8 S F x Y / 2 U 98 m b h F N o N B w 0 w 6 k 9 j g 2 Q i k I v u v s H G i 2 q H i e e D n v m t f M A 46 x f m Q q p P n H t 5 P p s M M q + C 6 v E K G W L h b B V D b S B u A l o X o t 1 G 1 u t E l e 2 O 0 P S X j M S R I L S i 2 m 8 j e Y W M / 5 c N a z P M s e s q x m r C L H s C v z b + U + O M Z o 4 c o / G / 4 i X r F b y 0 / j / f z Z x z 4 E K L T f D k x h W t 1 l f m J y r e 6 j j u x r z o t w l Q p 9 y d U w Q 1 I D R R 3 j 2 w e P f L w S A c k Z n 0 h 0 K a 4 o R / p l u 1 H W N B 5 D E L v f H U I 8 h O L v g g u E O x 2 / O + 7 E V E F v 84 O 4 i U a 2 X K P b w X u o W s 3 w 9 j 4 I X h K p R j E T N i z l m C Y M J j g B B h S g i c B G z M w 0 F 9 Y g C I J C G 9 g R R s X n t N X T J s P a z f a l 5 k P c x R y Q n K E L R J w g + / 38 z 26 D U L K + h w / + p j q y D 14 L 8 L o 3 S 6 F 5 M h b r p i v z B 2 v Y f o p W c G g 1 c / B D N e l 8 C g k P A H i Y L 1 o l Q d u 9 X 42 r 1 d t H Y s j 6 h y 7 L B 5 + E T w s w I p v S h Z 3 m N h B 3 A u K l o g H J Z n L 7 z u R d A k p p S o Q q r T 56 x R O X / v H w O 1 j g t G G 74 K P m L B m c H i i N G c W Q G Y f //6MNzuedOIuxC5ayyxlevJYgGKceP8096u/OgQFfryZzKJ3N/MqKrRg39gqwz8GAH5R6oa1aqgBYDROrw2BUxcPc1qkEAjIinKu+Y0T2p9qvy51mTpCLD79urouJj3vTCJUzgZN9CT+ISFDK2o1yec/5SVqbh9ntztCohCmwMBw+IrIs7HOeJLXeBYiJkUWX9xFR4por5mSv7eVv7SaoQCk1B68LQdtLa55h9JYuJkQdKA0KDWL2xwX3aPdJtKJRLhdLUcG3PxkMaW0rgIaWjVsF/J1kILL1Y9QMDtgQbBSCDrHGWl1YCreB5Wor0A239VEuBithbCRCx+XUpGcU2Xa59DT/zwlE3KyjvSkFKIVzQLhwUfWBEyrc8mLeOMSduAGH76DFmaKvijdKwIxSgatA4GblU1mNG3VxGurkvL2RZbLUTlauCG4l4gZedWBeEXYjNVQmXMWtK27zvkKLvkmYV7xFJJTjxH+T9iYWEUz9wd+KSPTm+AZBZBW4bOujR3b3cRwLqqh/6+pXyu/+irpjoAW2f/i/gGy7lsgA39/msiFB5BLAtmD8w00jmq0r1JZk6oXgMSTPPgpl1brmMSWJ5rjEDBg1hT8XmbLsYiJ85kBK6js8N8FhA3uFPboLwSv9t1xZjDGl26yoZ0c0SQ6ApEMhtZCn0tQZbXh31s+hA98CbxSk81fLJkXxvbTKgh32KuQlfj1hYYYwvEzSzZouWZXePXR3532bgO2Ke22hrGDqwkzT8+/BfWlPQLUz0wGp8mUdDQn1407qOQTJkjhHSJDxP7VDmXdOm1lj8QB8wxcidyT/fSdxrdXbpvldCMmTQgDXG2FxolIeBxOrMnSr1NAyVXrdkG7rHSxZVeL88PptpbYZiau6TeAGbFW/Fno050UAzjUo2DJUZSvJANTQ5wL8MBPTIip3GOQJqbGNnel0uEt/UTLMBQQNnjmhMaXzPYAxjNC1VeFYh+fyjBne0n1ESdXso2+CuI7HyxRsWJ3ZlqrytGY4+9zbrqB3LpEBNBYihSq/jAsfaJhETAERz08T6xgktjRppqhTCvCbvcbpQD8WYmMwFhYbyw1PEFfwQ4QKMOFApdjm+WbhntdVdYk6HmRoyMI42iyU5AkZsRHtDWxf+C4QE66tEfM7TD2nlLLHpijVv57ABeyVx8L2CF2f1gz47A7niBvMtTuvgvMxag+wF+F1/HjpyXk+j3Bc0tixJzgHYkjpMm4DYpI8iU6ukLZw3CtpYfEmL+ayySk7oE8xwmAHy9v0uk7wp1cAvcJSAM0fT6oTdPf9LQRoWQAZgnLT7GxXgYuHWyUE2SLfErq2qIg43VJwxMG6RPtZ4y+OhJFXqoaqSdT7FQ5nnGaL27w5f1aSkOyf6IqWzKOHjEsREqblmpXkI6JfR7OgPnNVR3Tl05YXHflMoEkNrd+wR0QCRK3v4wjpSWA4KcbuOWPr334KYYB22VVItHy+MGgUxQEAtHjHoBQaVpCgfo0pkqvTjvfN2bCZxGTNe+XJDLRDjeFW3x0tiXmb494YtWgQ11nurlbccGhdYc+IeEDegXcSuFfNXxGrbG4pOcu9uE538O2yW6VODOi+t2jPsKT/7KB09JAbWugpgLV6GzXYq3UGXGx94l7xQHEOqVKAMJEHvBrqxfJpP4NFWTaQaT7mUypxPHI6BX9g68QOQfTZ2AX/B2tG1Qo26m9/rTiHd1GfULSG8WHIPjxD/1niN8hM11b/08zXqxwCWatypsTdaEJECQ0MtZ+by4uWkWkjkKWSU72kpQscMnGvII8AV3rkcSwpU51EXzq98fk4uucshM8EfvWPPFQtOuAOpEse5R0/AWXSFjmTPjnJ0lR4RmsolSyS9jBRTQV1/PCW/hezSn6enmNxNiQEmkbsvdYVwezbIkuSQFZkrpR+w8Upu6HpvDBpVc0zQfPTmIFfwhl/TFaTKbMqWMZZvPlei7JV1qnVu8XTIdJV+LdQjeOBdFwp+7c/8xLfOw5MgqRfoj2qpjKooZE7hBlis2KQnT//sgRFVLrFKOuPskd+7BYpIdut6L/98Sh3c3jTB9/6g/IFl/ErUWIJkUvz5wa3toU1LNXoj1v/JP+6+Xs8wiKZDodi5XxEFtXa6paNurUd7aOeegJTirHCzXF64aum+LHTZrZENdyOijelVL+Tepmv5AzGhXmnBpBEfALFXwZRALfLq6BZcSkHmyMcVso0fiYm5dpvzkq/ggBxdYvyH+HMbWBkjleBOZhydr11lW6De4u9rGGGdYwnUWdD8Wi8SbbC67UMzwqF0faW6bslhoDhxB6H/tmcRpeDmEiIDChrO0LwJtwfmbIo26Oxj9kQ4Z04lHu+DLkd/l1VhAGAixmdr36s2noW9FA+W+7eLuer475/2dx9L3CPCxlUJPtBkGiEu7olWmcTf6lQXbJP+cczfL2AT/R06s9NiIOKzLRrp98/Ryg3Omk9PDLAQAbGMAfuk4j/OYMOTclK6I/PBXK8jjsjJdyor21hNJHP/LHWrAWjhAaRgEQ86Fxt2oB7d/kZPB5eGYTn5BV
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-12-10T14:19:33Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "marking-definition" ,
"spec_version" : "2.1" ,
"id" : "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ,
"created" : "2017-01-20T00:00:00.000Z" ,
"definition_type" : "tlp" ,
"name" : "TLP:WHITE" ,
"definition" : {
"tlp" : "white"
}
}
2023-04-21 13:25:09 +00:00
]
}
