2023-06-14 17:31:25 +00:00
|
|
|
{
|
|
|
|
|
"type": "bundle",
|
|
|
|
|
"id": "bundle--5c444228-25f4-4e85-8dfd-498302de0b81",
|
|
|
|
|
"objects": [
|
|
|
|
|
{
|
|
|
|
|
"type": "identity",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-05-25T20:18:08.000Z",
|
|
|
|
|
"modified": "2019-05-25T20:18:08.000Z",
|
|
|
|
|
"name": "CIRCL",
|
|
|
|
|
"identity_class": "organization"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "grouping",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "grouping--5c444228-25f4-4e85-8dfd-498302de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-05-25T20:18:08.000Z",
|
|
|
|
|
"modified": "2019-05-25T20:18:08.000Z",
|
|
|
|
|
"name": "Economical analysis of the sextortion emails",
|
|
|
|
|
"context": "suspicious-activity",
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"observed-data--5c444524-2b5c-4d9a-aea6-4f1f02de0b81",
|
|
|
|
|
"file--5c444524-2b5c-4d9a-aea6-4f1f02de0b81",
|
|
|
|
|
"artifact--5c444524-2b5c-4d9a-aea6-4f1f02de0b81",
|
|
|
|
|
"x-misp-attribute--5c444b64-f778-4ee0-83ed-4b7902de0b81",
|
|
|
|
|
"observed-data--5c445819-574c-4e35-af21-a83202de0b81",
|
|
|
|
|
"url--5c445819-574c-4e35-af21-a83202de0b81",
|
|
|
|
|
"x-misp-attribute--5ce9a0fa-8834-4665-acb3-4500950d210f"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"Threat-Report",
|
|
|
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
|
|
|
"adversary:infrastructure-action=\"passive-only\"",
|
|
|
|
|
"circl:incident-classification=\"scam\"",
|
|
|
|
|
"economical-impact:gain=\"less-than-1M-euro\"",
|
|
|
|
|
"veris:action:social:variety=\"Extortion\"",
|
|
|
|
|
"veris:action:social:variety=\"Scam\"",
|
|
|
|
|
"type:OSINT",
|
|
|
|
|
"osint:lifetime=\"perpetual\""
|
|
|
|
|
],
|
|
|
|
|
"object_marking_refs": [
|
|
|
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5c444524-2b5c-4d9a-aea6-4f1f02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-01-20T10:21:05.000Z",
|
|
|
|
|
"modified": "2019-01-20T10:21:05.000Z",
|
|
|
|
|
"first_observed": "2019-01-20T10:21:05Z",
|
|
|
|
|
"last_observed": "2019-01-20T10:21:05Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"file--5c444524-2b5c-4d9a-aea6-4f1f02de0b81",
|
|
|
|
|
"artifact--5c444524-2b5c-4d9a-aea6-4f1f02de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"attachment\"",
|
|
|
|
|
"misp:category=\"Support Tool\"",
|
|
|
|
|
"osint:source-type=\"automatic-analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "file",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "file--5c444524-2b5c-4d9a-aea6-4f1f02de0b81",
|
|
|
|
|
"name": "btc-11430.txt",
|
|
|
|
|
"content_ref": "artifact--5c444524-2b5c-4d9a-aea6-4f1f02de0b81"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "artifact",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "artifact--5c444524-2b5c-4d9a-aea6-4f1f02de0b81",
|
|
|
|
|
"payload_bin": "cHl0aG9uMyBidGMucHkgLWUgMTE0MzANCg0KQWRkcmVzczoJMTRWcmo1NmtReThUdG5IeWltZVhteXlRendMOEhmbkxLNw0KQmFsYW5jZToJMC4wMDAwMDAwMDAwIEJUQyAoKzAuMDAwMDAwMDAwMCBCVEMgLyAtMC4wMDAwMDAwMDAwIEJUQykNClRyYW5zYWN0aW9uczoJMA0KDQpBZGRyZXNzOgkxTGR5ZXZxU2UxdTV4MWdhQ0tBMU1kMllKMWFtUkxxVGdFDQpCYWxhbmNlOgkwLjAwMDAwMDAwMDAgQlRDICgrMC4wMDAwMDAwMDAwIEJUQyAvIC0wLjAwMDAwMDAwMDAgQlRDKQ0KVHJhbnNhY3Rpb25zOgkwDQoNCkFkZHJlc3M6CTFYc2ltazhTN2dWcXlSdzZFTmdVQjc1b2c5NkhZQ2l6Sw0KQmFsYW5jZToJMC4wMDAwMDAwMDAwIEJUQyAoKzAuMDAwMDAwMDAwMCBCVEMgLyAtMC4wMDAwMDAwMDAwIEJUQykNClRyYW5zYWN0aW9uczoJMA0KDQpBZGRyZXNzOgkxOENUS0hzWnBFaUFUeHFrcXJBZFVwc0hzUDlpZTVtTTFXDQpCYWxhbmNlOgkwLjAwMDAwMDAwMDAgQlRDICgrMC4wMDAwMDAwMDAwIEJUQyAvIC0wLjAwMDAwMDAwMDAgQlRDKQ0KVHJhbnNhY3Rpb25zOgkwDQoNCkFkZHJlc3M6CTFMWTFEenZwNkNpaTR5aG96TDhSWWZCeTVuQWFoQkVQV3UNCkJhbGFuY2U6CTAuMDAwMDAwMDAwMCBCVEMgKCswLjAwMDAwMDAwMDAgQlRDIC8gLTAuMDAwMDAwMDAwMCBCVEMpDQpUcmFuc2FjdGlvbnM6CTANCg0KQWRkcmVzczoJMURDWUdpN3pidEZqR2pwaUJYZGVNRkF6NmhOZ05TY2Z1Mg0KQmFsYW5jZToJMC4wMDAwMDAwMDAwIEJUQyAoKzAuMDAwMDAwMDAwMCBCVEMgLyAtMC4wMDAwMDAwMDAwIEJUQykNClRyYW5zYWN0aW9uczoJMA0KDQpBZGRyZXNzOgkxREhFV2VkV1p1bXkyRHZXVlZuWDZmb1BYemQ4S21Vc1VxDQpCYWxhbmNlOgkwLjAwMDAwMDAwMDAgQlRDICgrMC4wMDAwMDAwMDAwIEJUQyAvIC0wLjAwMDAwMDAwMDAgQlRDKQ0KVHJhbnNhY3Rpb25zOgkwDQoNCkFkZHJlc3M6CTE5WDl6eDZFaG5MeHZKdXduUjUyY01ybW5DNXplOW9BVEINCkJhbGFuY2U6CTAuMDAwMDAwMDAwMCBCVEMgKCswLjAwMDAwMDAwMDAgQlRDIC8gLTAuMDAwMDAwMDAwMCBCVEMpDQpUcmFuc2FjdGlvbnM6CTANCg0KQWRkcmVzczoJMUNTTHdOY0ZNS3VzV1NTUmJYbzRvN3hHN3NhM2pyWUVSSA0KQmFsYW5jZToJMC4wMDAwMDAwMDAwIEJUQyAoKzAuMDAwMDAwMDAwMCBCVEMgLyAtMC4wMDAwMDAwMDAwIEJUQykNClRyYW5zYWN0aW9uczoJMA0KDQpBZGRyZXNzOgkxRGZlQ2NDN25QRUhNMm9FVWpZWVprcVR3eW80NllZTFR4DQpCYWxhbmNlOgkwLjAwMDAwMDAwMDAgQlRDICgrMC4wMDAwMDAwMDAwIEJUQyAvIC0wLjAwMDAwMDAwMDAgQlRDKQ0KVHJhbnNhY3Rpb25zOgkwDQoNCkFkZHJlc3M6CTFMc2VkbnZDR3N5eHg2VGJjQlNtQTFGYUJNb0JmVmVjODQNCkJhbGFuY2U6CTAuMDAwMDAwMDAwMCBCVEMgKCswLjAwMDAwMDAwMDAgQlRDIC8gLTAuMDAwMDAwMDAwMCBCVEMpDQpUcmFuc2FjdGlvbnM6CTANCg0KQWRkcmVzczoJMTR2Sm9iOUZnY1FrWERlblRtR3d6WGdxclE5Z29mRll5Ug0KQmFsYW5jZToJMC4wMDAwMDAwMDAwIEJUQyAoKzAuMDAwMDAwMDAwMCBCVEMgLyAtMC4wMDAwMDAwMDAwIEJUQykNClRyYW5zYWN0aW9uczoJMA0KDQpBZGRyZXNzOgkxNG5CcWtkNDhxSjhXTG5pOEtTZ3dFeDNBaVpXejUzU0FkDQpCYWxhbmNlOgkwLjkzNTI0NzczMDAgQlRDICgrMC45MzUyNDc3MzAwIEJUQyAvIC0wLjAwMDAwMDAwMDAgQlRDKQ0KVHJhbnNhY3Rpb25zOgk2DQo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQ0KIzYJMzAgSnVsIDIwMTggMTU6MjE6NTQgQ0VTVAkgMC4wNDk3MjIyNiBCVEMgICAgIDQwNi41MyBVU0QJICAgIDM0Ni45MyBFVVINCiM1CTMwIEp1bCAyMDE4IDAxOjI2OjExIENFU1QJIDAuMjMxNTY4MzggQlRDICAgIDE4OTMuMzIgVVNECSAgIDE2MTUuNzMgRVVSDQojNAkyOSBKdWwgMjAxOCAxMDo1NjozMiBDRVNUCSAwLjA4NTI5NDI5IEJUQyAgICAgNzAwLjg0IFVTRAkgICAgNjAwLjUxIEVVUg0KIzMJMjggSnVsIDIwMTggMjE6NTY6MDMgQ0VTVAkgMC4wODU0MTY5MCBCVEMgICAgIDcwMy4wNiBVU0QJICAgIDYwMi41NyBFVVINCiMyCTI4IEp1bCAyMDE4IDE1OjQ0OjA2IENFU1QJIDAuMDEyMjQ1OTAgQlRDICAgICAxMDAuNzkgVVNECSAgICAgODYuMzkgRVVSDQojMQkxNSBKdWwgMjAxOCAxNzo0NzoyMyBDRVNUCSAwLjQ3MTAwMDAwIEJUQyAgICAyOTk3LjU3IFVTRAkgICAyNTYzLjY2IEVVUg0KDQpBZGRyZXNzOgkxUTl1M3NQVldMTFVSYmdQWDF4YjdwcTFHa0drU1RIWmRoDQpCYWxhbmNlOgkwLjAwMDAwMDAwMDAgQlRDICgrMC4wMDAwMDAwMDAwIEJUQyAvIC0wLjAwMDAwMDAwMDAgQlRDKQ0KVHJhbnNhY3Rpb25zOgkwDQoNCkFkZHJlc3M6CThRb3hoYzhRd1hXZDNCNlI4UXdIUjdEQ0Y1MUhiREtvOA0KQ2hlY2tzdW0gZG9lcyBub3QgdmFsaWRhdGUNCkJhbGFuY2U6CTAuMDAwMDAwMDAwMCBCVEMgKCswLjAwMDAwMDAwMDAgQlRDIC8gLTAuMDAwMDAwMDAwMCBCVEMpDQpUcmFuc2FjdGlvbnM6CTANCg0KQWRkcmVzczoJMURlWlVpOFh1bnplVXBFUkdvTVVNYTJYamY5YWVNRURldg0KQmFsYW5jZToJMC4wMDAwMDAwMDAwIEJUQyAoKzAuMDAwMDAwMDAwMCBCVEMgLyAtMC4wMDAwMDAwMDAwIEJUQykNClRyYW5zYWN0aW9uczoJMA0KDQpBZGRyZXNzOgkxNFdDQUNjTjNGYnMyR1p6amljcFJHUzM3TUNhMVBnSDZCDQpCYWxhbmNlOgkwLjAwMDAwMDAwMDAgQlRDICgrMC4wMDAwMDAwMDAwIEJUQyAvIC0wLjAwMDAwMDAwMDAgQlRDKQ0KVHJhbnNhY3Rpb25zOgkwDQoNCkFkZHJlc3M6CTFHM0hwSGFuU1J2NDl3QzZzcTNrVzRjVGlBUllHeWNNTnoNCkJhbGFuY2U6CTAuMDAwMDAwMDAwMCBCVEMgKCswLjAwMDAwMDAwMDAgQlRDIC8gLTAuMDAwMDAwMDAwMCBCVEMpDQpUcmFuc2FjdGlvbnM6CTANCg0KQWRkcmVzczoJMTZUMWlVV2RSNXZXTUNLdUtiYXdySGFrdjlyWHNXa1pOYQ0KQmFsYW5jZToJMC4wMDAwMDAwMDAwIEJUQyAoKzAuMDAwMDAwMDAwMCBCVEMgLyAtMC4
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "x-misp-attribute",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "x-misp-attribute--5c444b64-f778-4ee0-83ed-4b7902de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-01-20T10:20:20.000Z",
|
|
|
|
|
"modified": "2019-01-20T10:20:20.000Z",
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"text\"",
|
|
|
|
|
"misp:category=\"Financial fraud\""
|
|
|
|
|
],
|
|
|
|
|
"x_misp_category": "Financial fraud",
|
|
|
|
|
"x_misp_comment": "Total BTC received and cashed out from the known BTC addresses gathered from extortions",
|
|
|
|
|
"x_misp_type": "text",
|
|
|
|
|
"x_misp_value": "Total received:\t164.20879967 BTC 930489.07 USD\t 804322.59 EUR\r\nTotal spent:\t131.84920417 BTC 688650.07 USD\t 598495.89 EUR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5c445819-574c-4e35-af21-a83202de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-01-20T11:14:33.000Z",
|
|
|
|
|
"modified": "2019-01-20T11:14:33.000Z",
|
|
|
|
|
"first_observed": "2019-01-20T11:14:33Z",
|
|
|
|
|
"last_observed": "2019-01-20T11:14:33Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5c445819-574c-4e35-af21-a83202de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5c445819-574c-4e35-af21-a83202de0b81",
|
|
|
|
|
"value": "https://twitter.com/circl_lu/status/1086939051658264576"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "x-misp-attribute",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "x-misp-attribute--5ce9a0fa-8834-4665-acb3-4500950d210f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-05-25T20:09:30.000Z",
|
|
|
|
|
"modified": "2019-05-25T20:09:30.000Z",
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"text\"",
|
|
|
|
|
"misp:category=\"Financial fraud\""
|
|
|
|
|
],
|
|
|
|
|
"x_misp_category": "Financial fraud",
|
|
|
|
|
"x_misp_comment": "Total BTC received and cashed out from the known BTC addresses gathered from extortions (2019-05-25)",
|
|
|
|
|
"x_misp_type": "text",
|
|
|
|
|
"x_misp_value": "Total received:\t 274.34008846 BTC 1405178.94 USD\t1221847.10 EUR\r\nTotal spent:\t 246.44414303 BTC 1208662.78 USD\t1057750.02 EUR"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "marking-definition",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
|
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
|
|
|
"definition_type": "tlp",
|
|
|
|
|
"name": "TLP:WHITE",
|
|
|
|
|
"definition": {
|
|
|
|
|
"tlp": "white"
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|
