2023-04-21 13:25:09 +00:00
{
2023-06-14 17:31:25 +00:00
"type" : "bundle" ,
"id" : "bundle--5e78dc2c-afc8-411f-94a5-40bb950d210f" ,
"objects" : [
{
"type" : "identity" ,
"spec_version" : "2.1" ,
"id" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-26T15:46:37.000Z" ,
"modified" : "2020-03-26T15:46:37.000Z" ,
"name" : "wilbursecurity.com" ,
"identity_class" : "organization"
} ,
{
"type" : "report" ,
"spec_version" : "2.1" ,
"id" : "report--5e78dc2c-afc8-411f-94a5-40bb950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-26T15:46:37.000Z" ,
"modified" : "2020-03-26T15:46:37.000Z" ,
"name" : "Trickbot to Ryuk in Two Hours" ,
"published" : "2020-03-26T15:47:00Z" ,
"object_refs" : [
"indicator--5e78e080-d6e8-40f8-bbbb-448a950d210f" ,
"indicator--5e78e09f-d584-403a-acbb-4d17950d210f" ,
"indicator--5e78e0a3-3740-42c5-920a-4272950d210f" ,
"indicator--5e78e0a8-d80c-4b5d-9ff2-45dd950d210f" ,
"indicator--5e78e0ae-af1c-4148-807f-417a950d210f" ,
"indicator--5e78e0b4-0918-49d9-8a30-43f9950d210f" ,
"indicator--5e78e0b4-1714-4604-819e-448d950d210f" ,
"indicator--5e78e0b4-3514-49f4-85aa-4ff7950d210f" ,
"indicator--5e78e0b5-2ed0-4b67-b81f-47e3950d210f" ,
"indicator--5e78e0b5-c310-45a1-826e-4d05950d210f" ,
"indicator--5e78e0b5-b4d0-4bea-813d-453e950d210f" ,
"indicator--5e78e0b5-baac-4b98-8ef8-46ad950d210f" ,
"indicator--5e78e0b5-20e8-4abb-96a2-44eb950d210f" ,
"indicator--5e78e0b5-da18-4d2d-a374-4f2b950d210f" ,
"indicator--5e78e0b5-0a7c-41b8-8c01-4488950d210f" ,
"indicator--5e78e0b5-f574-449c-8c51-49f2950d210f" ,
"indicator--5e78e0b5-d624-43d5-8b07-4bcc950d210f" ,
"indicator--5e78e0b5-c9f4-482a-9251-468e950d210f" ,
"indicator--5e78e12f-968c-4e3f-970a-400d950d210f" ,
"indicator--5e78e1f9-4550-4c36-b04d-1863950d210f" ,
"indicator--5e78eb0d-ed40-40b7-ad71-1a48950d210f" ,
"indicator--5e78eb0d-82f8-40af-a6c7-1a48950d210f" ,
"indicator--5e78eb0d-a630-4147-bfbb-1a48950d210f" ,
"indicator--5e78eb0d-4da8-4591-a7ed-1a48950d210f" ,
"indicator--5e78eb0d-881c-4774-8869-1a48950d210f" ,
"indicator--5e78eb0d-6aa8-4181-b2b6-1a48950d210f" ,
"indicator--5e78eb0d-bd48-4643-a3ed-1a48950d210f" ,
"indicator--5e790a19-21a4-496a-91ba-422c950d210f" ,
"observed-data--5e7ba09c-9c2c-469c-871f-0572950d210f" ,
"url--5e7ba09c-9c2c-469c-871f-0572950d210f" ,
"indicator--5e78dcfa-bdc8-4583-8efa-c9fc950d210f" ,
"indicator--5e78dd06-3ce0-47d5-b00e-c9fc950d210f" ,
"indicator--5e78dd07-53f0-4fd9-b97b-c9fc950d210f" ,
"indicator--5e78dd08-4070-45b4-8e65-c9fc950d210f" ,
"indicator--5e78dd09-42f8-4b6b-830d-c9fc950d210f" ,
"indicator--5e78dd09-63f4-4330-a68e-c9fc950d210f" ,
"indicator--5e78dd0a-8c8c-44cb-b817-c9fc950d210f" ,
"indicator--5e78dd0a-f6e0-43b1-8678-c9fc950d210f" ,
"indicator--5e78dd0a-9560-4f05-a747-c9fc950d210f" ,
"indicator--5e78dd69-d680-468d-8a43-4a68950d210f" ,
"indicator--5e78ddfe-49d8-4865-9313-4dcd950d210f" ,
"indicator--5e78ddff-bc64-4bd6-a15b-4221950d210f" ,
"indicator--5e78ddff-1490-43d3-b74c-4fbb950d210f"
] ,
"labels" : [
"Threat-Report" ,
"misp:tool=\"MISP-STIX-Converter\"" ,
"misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053\"" ,
"misp-galaxy:mitre-attack-pattern=\"Disabling Security Tools - T1089\"" ,
"misp-galaxy:mitre-attack-pattern=\"Group Policy Modification - T1484\"" ,
"misp-galaxy:mitre-attack-pattern=\"Hidden Files and Directories - T1158\"" ,
"misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"" ,
"misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"" ,
"misp-galaxy:mitre-attack-pattern=\"Rundll32 - T1085\"" ,
"misp-galaxy:mitre-attack-pattern=\"Scripting - T1064\"" ,
"misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"" ,
"misp-galaxy:mitre-attack-pattern=\"Credential Dumping - T1003\"" ,
"misp-galaxy:mitre-attack-pattern=\"System Network Connections Discovery - T1049\"" ,
"misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"" ,
"misp-galaxy:mitre-attack-pattern=\"Software Discovery - T1518\"" ,
"misp-galaxy:mitre-attack-pattern=\"Security Software Discovery - T1063\"" ,
"misp-galaxy:mitre-attack-pattern=\"Remote System Discovery - T1018\"" ,
"misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"" ,
"misp-galaxy:mitre-attack-pattern=\"Network Share Discovery - T1135\"" ,
"misp-galaxy:mitre-attack-pattern=\"Network Service Scanning - T1046\"" ,
"misp-galaxy:mitre-attack-pattern=\"Domain Trust Discovery - T1482\"" ,
"misp-galaxy:mitre-attack-pattern=\"Account Discovery - T1087\"" ,
"misp-galaxy:mitre-attack-pattern=\"Remote Desktop Protocol - T1076\"" ,
"misp-galaxy:mitre-attack-pattern=\"Remote File Copy - T1105\"" ,
"misp-galaxy:mitre-attack-pattern=\"Remote Services - T1021\"" ,
"misp-galaxy:mitre-attack-pattern=\"Windows Admin Shares - T1077\"" ,
"misp-galaxy:mitre-attack-pattern=\"Automated Collection - T1119\"" ,
"misp-galaxy:mitre-attack-pattern=\"Web Service - T1102\"" ,
"misp-galaxy:mitre-attack-pattern=\"Commonly Used Port - T1043\"" ,
"misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"" ,
"Cobalt Strike" ,
"PowerView" ,
"Ryuk" ,
"trickbot"
] ,
"object_marking_refs" : [
"marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da"
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78e080-d6e8-40f8-bbbb-448a950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:14:56.000Z" ,
"modified" : "2020-03-23T16:14:56.000Z" ,
"description" : "ET Rules that fired during attack" ,
"pattern" : "[ET POLICY WMIC WMI Request Over SMB - Likely Lateral Movement]" ,
"pattern_type" : "snort" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:14:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"snort\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78e09f-d584-403a-acbb-4d17950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:15:27.000Z" ,
"modified" : "2020-03-23T16:15:27.000Z" ,
"description" : "ET Rules that fired during attack" ,
"pattern" : "[ET POLICY SMB2 NT Create AndX Request For an Executable File]" ,
"pattern_type" : "snort" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:15:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"snort\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78e0a3-3740-42c5-920a-4272950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:15:31.000Z" ,
"modified" : "2020-03-23T16:15:31.000Z" ,
"description" : "ET Rules that fired during attack" ,
"pattern" : "[ET POLICY Powershell Activity Over SMB - Likely Lateral Movement]" ,
"pattern_type" : "snort" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:15:31Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"snort\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78e0a8-d80c-4b5d-9ff2-45dd950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:15:36.000Z" ,
"modified" : "2020-03-23T16:15:36.000Z" ,
"description" : "ET Rules that fired during attack" ,
"pattern" : "[ET POLICY SMB Executable File Transfer]" ,
"pattern_type" : "snort" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:15:36Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"snort\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78e0ae-af1c-4148-807f-417a950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:15:42.000Z" ,
"modified" : "2020-03-23T16:15:42.000Z" ,
"description" : "ET Rules that fired during attack" ,
"pattern" : "[ET POLICY Tunneled RDP msts Handshake]" ,
"pattern_type" : "snort" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:15:42Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"snort\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78e0b4-0918-49d9-8a30-43f9950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:15:48.000Z" ,
"modified" : "2020-03-23T16:15:48.000Z" ,
"description" : "ET Rules that fired during attack" ,
"pattern" : "[ET NETBIOS DCERPC SVCCTL - Remote Service Control Manager Access]" ,
"pattern_type" : "snort" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:15:48Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"snort\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78e0b4-1714-4604-819e-448d950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:15:48.000Z" ,
"modified" : "2020-03-23T16:15:48.000Z" ,
"description" : "ET Rules that fired during attack" ,
"pattern" : "[GPL ATTACK_RESPONSE command completed]" ,
"pattern_type" : "snort" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:15:48Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"snort\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78e0b4-3514-49f4-85aa-4ff7950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:15:48.000Z" ,
"modified" : "2020-03-23T16:15:48.000Z" ,
"description" : "ET Rules that fired during attack" ,
"pattern" : "[ET CNC Feodo Tracker Reported CnC Server group 15]" ,
"pattern_type" : "snort" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:15:48Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"snort\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78e0b5-2ed0-4b67-b81f-47e3950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:15:49.000Z" ,
"modified" : "2020-03-23T16:15:49.000Z" ,
"description" : "ET Rules that fired during attack" ,
"pattern" : "[ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)]" ,
"pattern_type" : "snort" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:15:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"snort\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78e0b5-c310-45a1-826e-4d05950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:15:49.000Z" ,
"modified" : "2020-03-23T16:15:49.000Z" ,
"description" : "ET Rules that fired during attack" ,
"pattern" : "[ET CNC Feodo Tracker Reported CnC Server group 19]" ,
"pattern_type" : "snort" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:15:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"snort\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78e0b5-b4d0-4bea-813d-453e950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:15:49.000Z" ,
"modified" : "2020-03-23T16:15:49.000Z" ,
"description" : "ET Rules that fired during attack" ,
"pattern" : "[ET CNC Feodo Tracker Reported CnC Server group 21]" ,
"pattern_type" : "snort" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:15:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"snort\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78e0b5-baac-4b98-8ef8-46ad950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:15:49.000Z" ,
"modified" : "2020-03-23T16:15:49.000Z" ,
"description" : "ET Rules that fired during attack" ,
"pattern" : "[ET CNC Feodo Tracker Reported CnC Server group 12]" ,
"pattern_type" : "snort" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:15:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"snort\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78e0b5-20e8-4abb-96a2-44eb950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:15:49.000Z" ,
"modified" : "2020-03-23T16:15:49.000Z" ,
"description" : "ET Rules that fired during attack" ,
"pattern" : "[ET CNC Feodo Tracker Reported CnC Server group 9]" ,
"pattern_type" : "snort" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:15:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"snort\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78e0b5-da18-4d2d-a374-4f2b950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:15:49.000Z" ,
"modified" : "2020-03-23T16:15:49.000Z" ,
"description" : "ET Rules that fired during attack" ,
"pattern" : "[ET CNC Feodo Tracker Reported CnC Server group 14]" ,
"pattern_type" : "snort" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:15:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"snort\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78e0b5-0a7c-41b8-8c01-4488950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:15:49.000Z" ,
"modified" : "2020-03-23T16:15:49.000Z" ,
"description" : "ET Rules that fired during attack" ,
"pattern" : "[ET CNC Feodo Tracker Reported CnC Server group 4]" ,
"pattern_type" : "snort" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:15:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"snort\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78e0b5-f574-449c-8c51-49f2950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:15:49.000Z" ,
"modified" : "2020-03-23T16:15:49.000Z" ,
"description" : "ET Rules that fired during attack" ,
"pattern" : "[ETPRO TROJAN Cobalt Strike Malleable C2 Amazon Profile]" ,
"pattern_type" : "snort" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:15:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"snort\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78e0b5-d624-43d5-8b07-4bcc950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:15:49.000Z" ,
"modified" : "2020-03-23T16:15:49.000Z" ,
"description" : "ET Rules that fired during attack" ,
"pattern" : "[ET POLICY Possible External IP Lookup ipinfo.io]" ,
"pattern_type" : "snort" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:15:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"snort\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78e0b5-c9f4-482a-9251-468e950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:15:49.000Z" ,
"modified" : "2020-03-23T16:15:49.000Z" ,
"description" : "ET Rules that fired during attack" ,
"pattern" : "[ET POLICY OpenSSL Demo CA - Internet Widgits Pty]" ,
"pattern_type" : "snort" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:15:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"snort\"" ,
"misp:category=\"Network activity\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78e12f-968c-4e3f-970a-400d950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-25T18:17:52.000Z" ,
"modified" : "2020-03-25T18:17:52.000Z" ,
"description" : "C2 / Possible Cobalt Strike Team Server" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '206.81.5.253']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-25T18:17:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78e1f9-4550-4c36-b04d-1863950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-25T18:17:41.000Z" ,
"modified" : "2020-03-25T18:17:41.000Z" ,
"description" : "C2 / Possible Cobalt Strike Team Server" ,
"pattern" : "[domain-name:value = 'norulless.com']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-25T18:17:41Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"domain\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78eb0d-ed40-40b7-ad71-1a48950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:59:57.000Z" ,
"modified" : "2020-03-23T16:59:57.000Z" ,
"description" : "Trickbot C2" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '146.185.253.178']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:59:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78eb0d-82f8-40af-a6c7-1a48950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:59:57.000Z" ,
"modified" : "2020-03-23T16:59:57.000Z" ,
"description" : "Trickbot C2" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '195.123.239.67']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:59:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78eb0d-a630-4147-bfbb-1a48950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:59:57.000Z" ,
"modified" : "2020-03-23T16:59:57.000Z" ,
"description" : "Trickbot C2" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.62.188.159']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:59:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78eb0d-4da8-4591-a7ed-1a48950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:59:57.000Z" ,
"modified" : "2020-03-23T16:59:57.000Z" ,
"description" : "Trickbot C2" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '190.214.13.2']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:59:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78eb0d-881c-4774-8869-1a48950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:59:57.000Z" ,
"modified" : "2020-03-23T16:59:57.000Z" ,
"description" : "Trickbot C2" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '64.44.51.113']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:59:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78eb0d-6aa8-4181-b2b6-1a48950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:59:57.000Z" ,
"modified" : "2020-03-23T16:59:57.000Z" ,
"description" : "Trickbot C2" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.255.96.187']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:59:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78eb0d-bd48-4643-a3ed-1a48950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:59:57.000Z" ,
"modified" : "2020-03-23T16:59:57.000Z" ,
"description" : "Trickbot C2" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '203.176.135.102']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:59:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e790a19-21a4-496a-91ba-422c950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T19:12:25.000Z" ,
"modified" : "2020-03-23T19:12:25.000Z" ,
"description" : "RDP Tunnel from/to this IP" ,
"pattern" : "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '195.123.242.48']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T19:12:25Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-src\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5e7ba09c-9c2c-469c-871f-0572950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-26T12:28:05.000Z" ,
"modified" : "2020-03-26T12:28:05.000Z" ,
"first_observed" : "2020-03-26T12:28:05Z" ,
"last_observed" : "2020-03-26T12:28:05Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5e7ba09c-9c2c-469c-871f-0572950d210f"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5e7ba09c-9c2c-469c-871f-0572950d210f" ,
"value" : "https://www.wilbursecurity.com/2020/03/trickbot-to-ryuk-in-two-hours/"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78dcfa-bdc8-4583-8efa-c9fc950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T15:59:54.000Z" ,
"modified" : "2020-03-23T15:59:54.000Z" ,
"description" : "Exe called RYUK or ran shortly after RYUK" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' c 908088e542 c a 306759249 c f 4 b 35 d 25 b ' A N D f i l e : h a s h e s . S H A 1 = ' 80e9 d 9 b 7 f d 95 f 6529 c f d 0 d 94 a 15 d 24 a 14 a b 0e91 b ' A N D f i l e : h a s h e s . S H A 256 = ' 1 c 7 f 778 b 20 d 47 a 6466 f 4 f 2 b 49 d c c 0e269 e 62526 b b 325 b b 4173450000e21993 c 7 ' A N D f i l e : n a m e = ' a H S I i . e x e ' A N D f i l e : s i z e = ' 143360 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A H t / d 1 B Q U f V Q j S A B A A A w A g A g A B w A Y z k w O D A 4 O G U 1 N D J j Y T M w N j c 1 O T I 0 O W N m N G I z N W Q y N W J V V A k A A / r c e F 763 H h e d X g L A A E E I Q A A A A Q h A A A A q A W 2 f n Y 9 w X A V t C O f R H E F 6 W 1 d C n K U i D H b w F J A H m O w c Z U N V 83 Q a x Y N Y p x 5 D h F P z 28 b B N c Z 90 D n Y l u c i 5 r L e z P 7 C x 1 V P u R N B W R 2 X m r t R X + l 6 A P J / 3 c J M o l X Y t a d C N 9 t Z i k L G B 7 E N 7 o A b b F e J E k 97 S a + A f r 3 g G g F d g W R 74 U d F 1 P 95 w u g h R b E A f h p 539 R q E j j T o F w o O E N E i 3 Q u U u k I a 2 I p g k G X p a Y 4 / u I / 1 P Q k 9 x + b V z P f T 0 4 F 4 f x r A v L F S u I y P f Y x 333 H 8 X t F 6 p M M 67 W o a B 3 / Z Q 8 S U x E u Z + a b 3 c E M e F f / z R 9 l V s Z E L D p H Q l w L p 32 i V b E F p P P L t j i b S y 9 w J P D D 67 i 0 O z z B Q x G 7 G X f W Q g x k o R + p 39 o l z E C 0 K K s L 6 m s A q U a D 9 R z D 9 e g q 4 z s v g b z Q P B O g l 59 m q F Z F O 6 Z V T x u W G N m O 4 P K 4 P c W k E k W 5 f t b K U x 1 s v f 9 N D I G A C A d b U S / g D j C p / w i M Y g 9 W M z Q X s s S N A p Q q R f Q L T V x m O D g S I o j W U R l A C z u z 4 X E 0 e h 5 D y / L I A h q L n 4 r k z r P / G 6 V f i x Z G Y S n l O L F D N o y n r u L C x D g e / T / R 12 e C I Q 1 Q l w Y 3 n C K D t f h B O l Z 0 B 0 l O R D s / a 0 l 58 g Y I b W h O t x H i u h R w M K W t Z I u B y k 2 h C g C C b V T U W Y K r s Q T N c / 6 W i 1 N X s E y Y p X M v / 4 k k 8 c r / 50 c N q Y H / k y 7 g t 7 u W K L i b j n W D O k i a c n E w N v K m / d I 5 K Y v U J v c S c + w 47 z D T h G / I J u h U W X J r b B q 5E2 P 6 / y z Y 4 L X a B U U y 9 F J i J B g I K 8 l L W d z f H S z o Z G q U 8 I C E 12 X Q 7 d x w T v f 8 w U 9 Z u q Z U U 7 y / 8 Q W K Q 4 x p v w R C B Y S Y c D z k 7 n n p z w s s Y j L t U / + 3 f r M 40 O b 4 M M Y q i o 9 g m M v L Y L + m D e m X r 9 o P 3 U x F s g o 3 x k o 6 B 7 X r e D t Y 5 d Y Q / O P m R 6 A L r 8 J m H a N V + F O X V Y x y y O c c L f D a 6 V + 7 z n i P n J / H u Y p 0 K B V e 6 s K C 2 O N 4 L h x q 37 a b L z / o i 3 I A s T E / i u 4 l R n A v D + m / z e e X C 7 M Y z h f / l q y f + L O Y Z 89 / F G C X p m O 3 Y 1 + e Q Y w N l X E T z X A d H W p Y R Y Q w n 0 j s M t P 8 p R D G X 5 h R K h v + 1 D p d e D H u 81 s c K Z E o a e 4 + k 52 R / r u g X J 38 o S i p a K U B t 2 l K E G q y u C x H Z q X y U k w 7 l Y w T K 0 T K P 9 R p p Z W Z r z E o p F U F A 8717 L f C E o x l H l k b A J A t 9 k M g f F e Q 6 x U h J 4 X w A s S N P d I 7 x x F p 1 M g Y M r v 7E2 A T 5 / L 9 A y a t A X r 6 J C g C k R 29 a V l / i r s p x 0 r z / 0 Y o V 8 u J G n u x N T h U J l 8 a c + 1 a 6 Z Y 6 M 4 G G e h D G 8 B Y n E G Y e a 7 + e D i 2 l 7 e I u p z B Y o o l L N e v Z F 2 r r 1 i y c 19 t f O N p l E 2 / u A / Y F Z I M O 7 A 75 b r U w D 4 P E V C O h X E / c X G Z s V + V + R D K H 9 r 0 / q O E y M + 9 D t + Q 9 P K / U 0 a W a 7 J U V N B j v c s a 9 v D h j j 6 N C h U t 18 J T 1 a B R L r T w z n f 2 + L R e g S Z W f G Z f 3 v q q e 2 d s w Y W B Y j I U P h 7 E V F + t s F 7 y p r i c T L Z P M a T 5 i J X m j f H A 2 c a o M m B x Y l c + Z J 1 F N Q 6 d a c I L w a B m a s H 5 k 7 v N g r L q 7 f r K g j l + Z L j I x U X M y 4 K Y V q 6 C O R b h R k I 6 H Y 8 q m D i p v W S 9 c R P a + I Z p a K G N j g M M d d a E T d J + C Q Q g 33 A C E z s I h H w O J O d / D w Y x v X 1 v A 8 Q 6 E k 9 q 20 D M l R E 7 Y 2 E h r d 6 p b F b r l N u j 2 C j 5 A j 8 k 3 f t l x v u H H q p u 0 H L g d P v 8 W 7 l z z 7 z x c E g 3 K w d z a L Y 9 q l 2 / I x u 8 T L G K y D W v e U i o z Q / P e Q 9 K k I f / 4 / v U t w V L p A F c i a O v m J H h D j b M 7 H V p n c n 4 o G C u d b r 8 + s C A M n C R z S Y D D J D K 19 u H q 1 L W y H o m o 6 D X / 74 H c 5 e Z D c s Y k O 9 h s u 8 k K X 5 s F q a 1 A 3 J + f Z h 9 Y r z P 3 Q 7 Y g j h 293 F v n e 35 k d W x l U g N 5 j N l f 0 L K p s b u m r 4 R E p f i f q u t v V Y d N b K s B n W u h j / R h 0 4 M K H h X J B T w f 6 y z 2 T + x r e A l F V e L 4 e l M s S E 23 z L Y o D N p Z P h e T 7 E L 4 K J T q C z 3 l 7 J 8 b J p f Q S v i J b D y c / X d c P z t R l d v / 38 s u m 4 J q J G s W j X j 9 G H g A + s L M r c 3 o o N i J a L D o G R R e L C b B p d j l q a 0 K 9 J E w s g 7 U / i B c u Q f F r 0 a a 4 y 5 g k 0 U 7 k V s / n G c h Q 8 z R K S 47 p b x f + l 59 Q f P j c B J o l J U d D Q / + 8 Q O I 1 N 2 n Z J A i v x 0 75 Z O A u Y p v D / 6 B 1 h l 9 b R j e f P C z c w o L u H C 3 X J m b x + v M 6 c q U 2 m r f i L C z H a H d / K G W 9 g d H f n 8 J y d W y I x T a Q q v V J Q h h H q 5 k F Z v T c c / e w A N M k c i 2 f m j X s W 7 z I W w L 93 F 9 B z X h n i f B e I t 4 W h Z B P I i W s / z D S + n a G y 1 c M 6 c q s V V b G q D l E C s t p s r B C Q Y V Q G V 2 c 5 c r c t J C 6 b H s B G i n 8 Z F / Y n n E l O A f V 9 H n F B W l i n M s w O b + n G K d S 0 F d 6 v k o j g w 6 W p 90 D v J q R 5 P c Z J h J M A L t I B E / a c U F n Q H 45 R j 1 P 1 S H n n n 5 L e h w 94 Z X j J V m Y b D s / c R J N j r F Z d M 7 u + 2e9 C b k 8 E + N Q L e H m H G a 6 K p o F Y 3 W n c E e 6 k v K x b n I X 6 Y y e B O 6 T s R S 3 y P I K 20 J J j j O D V 0 N 1 q K e R W 8 Q d o 78 A s n l T o c 5 U e v W Z p t V 7 S y G i O n W f o 856 d v C O Z G D Y a M A e 3 U r Z i 4 C n h B q f i E y X b V y x t j 90 a Q h + W v w 18 w i 9 h G f F 2 s M e v 9 G a n v A U F o c Z + H p 9 Y t z r Z j E j f u l T h V Y j 4 + r h k x a u B w X N W o C x g P H M D q j A n X G J i A u x m B N e 4 f 6 f a e 9 M 0 k z M Y B 1 / A 6 I B 8 f o E l g N G j e + 9 R N + l J U a J k G v k H m E / s r 4 R Q N 8 P u T W D o / K U + + / Y e + I S S X f b t 2 O S v / j d N 0 k V I w t o p m T s m x T W w d d Z z g d Z 5 w T l U 8 g f C N u z n B v //M2MpCqzoFh3W5TMPnWunL4vYmLI6nh+UlbCvORVZa1Hasvxix9ny2eHaeJGwA60q17XOosEtlkX+3gYM7DkGX7SChRb5NWtbxXcmMSC0p5mvGOTxGgwTCNSKTnC3ubuhDyhn5zKRjLQmGwlLCE3WHduW97ooSdOj3S/QIAnrtuCXUMtjJ5c5Nj0R5hU2HL1Nv2oRMLcFh7Hq9L7QyOPHi1b6tj1z5P3InZHrQgAHKX+8ap6R2Kx3MCSCtSKmsXItHLdqOd8YIzz6bVO+EKD7w927tRonFcQvlNVKRuyXmRTxaTe7Xt2eSzgbbEuc0LMX08L5H4uqdIxO1WIM2J21eXUFA4k5EBI2rZnWCaislE4KjjB/qx3Vp2BPzWM3d93rj0IQHszPYfs/aTNVs5EOW/Y3oPo9Qryizfc8lrgCJIhjZDsmI7SkSVxiPRp98ueXigvCWcLzw04GvSWGJxUebSr5T+jtrugzy/kKHMhkXcEXHF96FTIIC9XEf/iSVbj5lqqZc+gPtNl8dPWIhgXn9HadMnhQC1rMrQiNHB/zYwyNbMtqRfqvM9uzJBN0NOdXLZ3eVU11mr6vTOBkVFUYEO+8PVwH0I+zZSD+BUYp+wOxHNP/NyUjMyzN1Vw/PNv3JNE/HXV5wtwaQUZNPFw8jXrEXcPTeWWE93EOdr/f562glMKX+iJH2pve6id7sS2VbClyupy4pRtIOo2i2AWNpK60dD0rT/+/lzEnjf/bq9uCjwYweQYK5Si+F8Lx/n3bcfKTP1dH2hamsEg4+5w8a/P0OS0DUDYO5+XIkfmcPQlZAKUNez4AuAJpRATYyaLsofpOX7/lS3
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T15:59:54Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78dd06-3ce0-47d5-b00e-c9fc950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:00:06.000Z" ,
"modified" : "2020-03-23T16:00:06.000Z" ,
"description" : "Exe called RYUK or ran shortly after RYUK" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' c 908088e542 c a 306759249 c f 4 b 35 d 25 b ' A N D f i l e : h a s h e s . S H A 1 = ' 80e9 d 9 b 7 f d 95 f 6529 c f d 0 d 94 a 15 d 24 a 14 a b 0e91 b ' A N D f i l e : h a s h e s . S H A 256 = ' 1 c 7 f 778 b 20 d 47 a 6466 f 4 f 2 b 49 d c c 0e269 e 62526 b b 325 b b 4173450000e21993 c 7 ' A N D f i l e : n a m e = ' c A v Y q a M f O l a n . e x e ' A N D f i l e : s i z e = ' 143360 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A A O A d 1 B Q U f V Q j S A B A A A w A g A g A B w A Y z k w O D A 4 O G U 1 N D J j Y T M w N j c 1 O T I 0 O W N m N G I z N W Q y N W J V V A k A A w b d e F 4 G 3 X h e d X g L A A E E I Q A A A A Q h A A A A P w 80 n s z k m A B L 5 I 2 g B W a m u B w f + 0 O 6 D 46 d Q e i i 15 B 5 w 10 e Y a i x A e L 1 X t A r C K I O A Z C 69 M f F A + g p 8E8 G 1 U 8 x u n h w O x K f 8 k B V y c d K L V g b m b Q b m h 1 N M N C W e H 5 O i B H h i H E a b B C e C k l 0 t k n G i C 2 S c / F R p 0 T V 0 i e I y T D m 13 A K a c 3 a Z 1 n m P 9 q s p 6 q F I i 1 p z l u r o l / y 5 D I 99 R m t B 6 e H Z K A A r U 0 l 6 B D c / F X Y / 9 x V s I b v G W l W k o 1 x T l s 5 j k N I 5 a V B r 8 k H t j B Q U 52 i C 8 I h q d q b S j y s O i 604 v L i z 6 B i P t 0 R z U d k B P 2 s l 4 N Z 5 W N I Z y h g T p 3 i d i W O u r b 4 I G D Q E t s J Q W T l B j L o d H S c b P Z T 3 v X h F C n 6 m u j q B T i U 2 j c l 3 o A t l e N / 51 m S + L B Q G 8 i + G L a n b x 0 v B H 3 G m E S F 4 B r w o i t W R N t 7 C I E / t x 3 Q a k U Z b M 9 f l u i Y j 0 f 0 3 u S y S q n B J r v D V o T m S 9 k L 5 k 7 f g 9 G S X n 7 t / G j 5 e B R i U f F 0 J x X s Y P w l d a X O W I m I 8 e q x J l D 51 B w u M H 20 Q 8 t 7 W J a L 2 E x K 0 I X K l e d E r s M p c x V e z U I z R p o 0 Q m 37 Z w a P f h u K u a K E l G h V 13 I v S 8 s + y b j 3 q q 0 9 k R m G l T l + Y U 6 u U M + 44 C I J w / A n D w t u z o e D e V 0 n U I K A m s v g a Y M 6 C 9 S b Z m T P f o n / s n 3 A v N B R r T f O u y L A d s 2 r 2 j c C p 5 j R W z z A j s + a a + D l o J 1 H 35 H Q / F w x C 9 E C i l l x i a u 85 M v g a 6 K 7 A 7 R V / 6 O C X Y o 1 v z u t z K R A t Y p N h s k 2 l O j d f 1 F q P R e L S 3 C H 48 F S D g v q 9 g M l W c K M r I v h h E 1 y W K Z q 8 c 4 m k p i s O 4 r J X R Y B f n P z i 0 o K 5 w + A T i 2 i u O W Y p Z 31 i F + j 9 j i K T L o N A s t N A X t B d F R Q B x z J h A t b 7 g 6 o u P G 6 L + s q 1 O C m V j 9 i b a r P V B U U m m W G 5 f s J M x p W O Q y 8 X 5 Y 6 P X D c 1 b B o Y I g 6 d o c m q y Q 9 a j h t i b d a z z O I a P S / X 48 q K e P w Q f O c i a F v 7 K X X + + 4 i J 8 I W S r 6 Q b h / s X J J o J J t i L H x Y X s F 9 C c Q y I w X C m h x r B R 9 M C o h s 1 l A 1 B u A c l v s C m y U d A l C y 87 M s 0 s N z G G O H 7 / 3 X U 623 N L 6 J D / i i o 2 F F Z l i h m J d T + c i R 47 f z e 8 M o x H u A I N M g 9 n I v j 100 q A M D 9 o / R R 1 q i r d v n 9 n 3 D Q A z C T r h L 9 A y z w M i T w 6 n x W O x R 2 g u 5 v 9 i t Y M z C W h g 5 u x q x V E a a 74 n L H J R p / G h J o E u Z P A + / v M 3 y 3 k P 5 j x v Q B 3 U e + p Y / n X + U x U K Y p f S U W Z Z c b h 5 a v S D A k Q c v 0 M 1 d R B v Z l a T + G p X a E O W a b 1 P X r x X W z p U s K V k p 1 T l y F D y F M F 0 4 n c z P j u p v X c w q K i E / I q 7 C t l O L S I C N x r L Y r 4 h k q D E n U / s K 1 Y l 2 r o f i / Z A V N I 7 p D p w v Y t A j K M W T O r / o P S H P I E G k n C H R D k b X J Q V p g B n f o I Z f s G M 6 / R M h W S U Y 7 I D J 9 O Z 3 C r A q u P e W B S d 4 M J N r M O O K Q 6 D R e T J t E 8 / + G 1 T 4 v L s K W T / a a 8 f + n F 6 S W 0 T R Q y G r 8072 l j F J d F 7 b k I / W 5 y U W 5 r u b D 7 s c Y m N l P 77 i o + 4 O P M e Y r H 2 f M V U k f q v p 4 G b O l G R o j b o D d K z T d a G Y x U h c T k H c 0 J d h i e 8 P h W 6 / f r U L X N 8 G 3 h r o W o 4 m 1 Y B h k S L J v V h a o b p Q w g n w y c s 3 T I W D H V 3 X + v a l b 0 n K V J T C 8 O G f W A B N p o m 4 J B v 86 f S i p 6 r R U 1 c u U p h 218 + 9 Z x v B y u w z C J h n s 3 L E o g + r x 9 Y G 5 e U Y T 9 T 7 w P W Z i Y j A 1 f D L W a Q 8 S y s / b C 4 l v j f i u 8 K N h A c e Z r s Y 30 Q d 9 K H v S i 48 Q 2 O y m s c 5 B H i c f + M M n b E V j j k V c n J H E p 439 a 2 D v N D q C a Y 0 K W Q r o p V L Z p S c P y + 6 u Z p i K L K J A S E a 64 T m q s w f 1 c h z v R C Y N t l B 7 d H 9 P f o Y 1 H I s e m q f P l T A W C p k Q P Y C 5 u j N z u 0 R 9 t / r b 9 I O s v B N v x 5 T f w B Q D 99 w h f h 6 T j y P f A p 8 t a Y O v B L V W G u S l T L N o v B A V P x L q W + Z s c x 9 / q h H a X u u s Z J v R Q + Z E i u n j N F J E D q 2 f 7 H 4 i / A N N b j i f 9 O 7 H z c 88 n 3E5 B y E H 90 m S z S C s T C B 5 L Y b T X 7 Q 5 V J e G m R 4 y w P z n V 0 U Q 40 p B w t e o 5 V L r f b z y a m V w j u s o K s S F x N Q V Z G / e 1 C J y + r P g V j C B 3 b S t J a 7 L e X / S E X N D t M a J F Z J F Y l k i A I h n 6 Y v S 2 p b l 2 O 6 v 6e7 c n u J O b n R 83 z p u L t 0 K P 2 n a A P / u l o 0 p U 75 c N k B q c f L z 5 S u v e R / d 2 E g R + f Y p R U E w E H 2 z c M L U 0 s q G Q b Y b M x L Z O K O 0 P P P D 26 p f v d 3 c u k s G 5 o R e h 5 c r f a 0 3 R z 5 l 7 w l w 8 w x i h I s w U 4 Q 0 e e Q m i k A h e B X Y 7 c H z g c A g z 2e56 q E p J K 2 w W X X l x u a 3 V V l o j m c N Z I Q S Z q Q 8 c t 6 w / v 8 N 7 Q 1 c S D C a J j q Z m 6 q 7 y N r a I i 9 B 2 X E j N F 12 G G A w d N 1 D v K n d p Z T y C L U R 5 c Q 8 J l y X Q g p 85 M y r p 4 u w o 0 n O T 3 r w K w b 6 r U q A 2 B i A p R A 8 x c 9 x 4 k A h T 0 D p a D s f R A D m O 0 c v u S y J m G 0 m G p D d w U n o 6 Z Z V i e r L C M T v M r e 5 F P m d 5 c C + e Q o C c G L 4 w X y T L o i t R p w 5 A I 82 t 2 Y u s Z z Z 4 S T r b e f Z p F C O K / P 4 Q H J i L h 1 J v j m + i n q j k A U N H 8 A 7 H 5 D y / i Q 8 O A + j n w / D V 5 y 37 V F W S C v p a i M G T / J e x K h Z Z v L c M E C m 9 w y Q Z I Z / l t A q L g P 8 f I n U h m p g j k + X Z t r b 4 Q m G 2 D A U X t C v 8 j s w c Q Z M / B n f W / T o g i 4 G w Y + n d 4 a H i r 24 H Q R d P O e B j n v C w t G B / r Q O p Q 3 G E B o K L j C o b 3 p R r F 6 d 7 h f W I F + 2 P + e x P S l w 1 j h D f c 0 y 4 Y v K t g H Y K W + P I 8 b v k a R z p F g E L B U J b W 1 k 5 G U e A Y X 1 s R y O g y g i Z n m B O 3 q D + 90 j K U k M j P S m s 5 f G e T r 4 K C Z n 8 + A k h Y d a J 0 c i k T m k c g o 8 U Y i 3 o A z P o 3 L n p T / j / W d X w i w v I o 4 k d p M + Q L N T 0 R G v Y U / 1 F g n B X f u O 2 Z m t S Z U l H L V h 92 T b F B K 9 g D 0 B A b S / E k 6 G A c t T E T O f d u m 7 q u C z y G V j e b k y h 1 A 5 l a 5 C M L 2 g c O j j W Q v w v g / k f G J P J w L v 2 A g i E G + d d r Z l C z W x w L v u I I t t U d u b 1 u a + n 18 n z / 7 u I 0 i P d 5 Q F Y j h M u F K 8 x x Q C P d V 6 H E p B k H P G a x J q 9 / Y Y a 2 U t L H B q p O Y j h K y a 4 J a 1 z 7 g q S l I N n u 62 f 55 K H w j J c L L Y F 2 J j y p 3 w k 8 T W P Q G P L A l R W S A Y i e W L p Y 0 3 M o N H 4 G G b V L L q f c l B T V T U z S r / W S R H E m 3 D B u Z G A w f t q i u t J e e I W N g h v 2 V 9 g t a Q d L I L K R i K w 4 m 7 n J y E M 2 X N o + G v e O Y J 60 U a v t e C e y F p v 10 / P 9 G G M t 2 Q W 2 b t 230 x 7 Q J Y E g j 462 I p e C x E A 7 N 8 c S p E W M y R 5 / c K i I x 9 s i F I B L 0 2 b + J m Q + D p b A Z J F E k q A h k A F Y i C 4 N U O n m z b 1 l F 5 p U 5 Z 6 w X t i 2 N U 7 / s 5 l H F i / 0 n R r X 2 N d K 3 + D / O h P E B E T W i l V N n Y A 7 o J s H E k D M y y F u P i B j S 4 n s i d x 3 V O B G c V T Y f 7 n X 23 R F P c c Z X h T g q O S u n O S i I Q E z / Q r u x c i r D x 1 d J Y A l N s j c / + a E h Q B 6 m e o l 9 P 7 p + V 3 C w H X R 37 O U j D X x Y u 6 C K K F i T G u v B O 0 W 4 Q W u d C t 0 / P o n T B b R a U N u k Y Y / P h 69 i i p i j N m b J N H 2 r 5 x + Y f 5317 c 4 w Q Y 6 s v R N x M R 3 g 5 p O Z d M 4 u s Z t S R 4 Y r + N L p D c C j s p I t p O e H T F x M z X O m 0 E Y g k x A p B + f X N y a f X 4
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:00:06Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78dd07-53f0-4fd9-b97b-c9fc950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:00:07.000Z" ,
"modified" : "2020-03-23T16:00:07.000Z" ,
"description" : "Exe called RYUK or ran shortly after RYUK" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' c 908088e542 c a 306759249 c f 4 b 35 d 25 b ' A N D f i l e : h a s h e s . S H A 1 = ' 80e9 d 9 b 7 f d 95 f 6529 c f d 0 d 94 a 15 d 24 a 14 a b 0e91 b ' A N D f i l e : h a s h e s . S H A 256 = ' 1 c 7 f 778 b 20 d 47 a 6466 f 4 f 2 b 49 d c c 0e269 e 62526 b b 325 b b 4173450000e21993 c 7 ' A N D f i l e : n a m e = ' c S K t g . e x e ' A N D f i l e : s i z e = ' 143360 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A A S A d 1 B Q U f V Q j S A B A A A w A g A g A B w A Y z k w O D A 4 O G U 1 N D J j Y T M w N j c 1 O T I 0 O W N m N G I z N W Q y N W J V V A k A A w f d e F 4 H 3 X h e d X g L A A E E I Q A A A A Q h A A A A 6 o t 9 A D y b X h I Y J c 3 T m D d l F n C z g r G H C h w a M A 0 n d l 6 s P 0 e O A p 5 v l / k 1 s p q x 1 q u G j j X A e I 3 T 4 m 0 D M v m q d e + T p l 7 c n q e I l Q h h U / L v 3 s S R W Y + Z 6 j 5 D C d M C G Q P z C 7 W R g Q J C o m 0 T 6 M 7 Q c n Y B j V 0 r h U C n v Q V 1 J 5 C 9 C j r d / P L S d A D 9 i y B K Q 7 r q 6 A 2 R q Z H p S L f 5 e v w c G / j W 1 c L L Z j s O G 0 5 u 0 P v L I c g T X Z 1 I Y 9 S Q y 9 Q I j X B g J T n a G M f D R b B j m 7 Q 8 E b 1 j d x f 7 W k V T P R 1 x Z H t 7 B 2 p C U w o z d 4 H 3 K N J s J q 0 p t 0 + S 0 l S s Y b m 3 O R W S q A p 6 f c U 1 x d I C r X g 4 t L c O W V g M J Q P + 34 R w k 69 P C 3 b D o a f p N v l V 7 I Y O Z M 4 P H x 6 w b o d g t R / Q w b i z c M 40 z L b 7 k o U / E Z / 2 M c n A P 6 f Z X H v V I a w K y k / J 34 / X N Y d L a Z A M q i a N K a k j z Z i R 3 D i 53 h m a Q 3 B H W D y 3 q P d D I 2 O I y z G 2 I / D a C m E G 1 O J F / J e E r U 6 + 6 J h P 7 n 85 o p t b H 2 R S B + z 2 t Y n U e E e t V n 6 o T 5 b q F i p A 3 V c B G Z F y h m E C F R B 13 Y W W P 1 w P Q R + F Q F 8 S 8 E Z N 5 W I g R J p 7 R 9 o Y T Y t P E H X A l R Q B a V E b q 2 W U X c D + t k w y C t W t S g i n T K w C Q A S G I G R P n F h 1 w i W / b k a 4 w Y b E A J F E D P Z t b n n K V n 48 k V M n s 7 v M r V b J m + 0 K 8 Y 3 o g / A x T / m X f f R g W S s f J U 7 n n L c j U L l 5 l Q u w s 6 E c V o H m N 15 o z R m g K j c C 4 O j f w q Z W s H L G F z m L w Z k L h h 8 u s v d t 3 H K K i D E 71 t F N R W + D M T T H r 9 M s b 6 T f 0 d J x c i Q f f G / a r w N 3 D f S Q k P n x W b 6 x w e W M a y q k q s / A k b 6 n U d a P k S l 6 E / o 6 c 1 w g X b u T Z q Z + F G j Q o W B + r n n i r M + Z 22 g 27 H A O e T / u d Z 6 B / p + c Z P W x x b g z V s u 1 P C o 0 0 50 / m A U 5 v q H J P H U K V g O P C I C R Y h E 1 j E Z x A V u k W R e D G C / B s 4 x W O 9 l 4 e k 4 R V r T G M m g q n b Z N Z L g U K 30 s M z E D q H R W F E L X C f v r / i E 2 n e o e e j U u G U S 6 F e 9 M l Q H h 2 f q q l p f a 2 + 7 T Q s B F u V Z u f k w W G 5 u N R P 6 t B C v W F n v a L 2 X F M g c z L f E e N h Q 7 N S o s h w X P C M v K m g P 8 G C x 4 L N X + 9 q i p 38 X E f a A A c + W j 5 Q 5 h D H a t A j U S + 8 T x C s h O 8 S X L 1 T c Y b a l h E c B F b 8 w N + O u e Q V q P K J o u 0 q M R 7 h f g f L L M C H 6 G F G d W d c T / c O M 88 k C 5 b s M W r e 62 x 0 M W s R 7 L B z 5 g m T 0 2 w t n B g E G q Q H m U K 0 t l o y j k + K Y 220 B 0 R q q Y t S V v w l V / 1 Y 3 s X f Z v U Q C M B V + w s M 1 x p u l b z P a I o Y U i c + f V h 3 X A 1 e L h u D R s + c C r J d u M + a B x 3 o G 1 p 8 K m p G C S a 3 R s W w M z t R L t J g D J B R x e G r H k B 36 N e l 6 f h / A R Y 9 m a 5 d y P e T E S Z I O g K e U V y q P D V h O 7 + r R p / H U B 3 Y u k 4 d E r R R a w C c a 42 g R j R l d 5 n p U Y a t d R d T O B K b r p x B G 5 J R m / J W o / 6 u j D O e A Q P 8 g t g p s n Z C 6 Y w P H Y S i j 6 / 4 q n b g l c X j I 0 V i t u F H / H q h U J A m J V V + A 0 j 1 z P H a e U B a K t e E 6 P U B x H S C / 1 y A 8 A Q E C 4 O 0 j 1 z s v V + k z y S D 8 V / F L f r f q J o e 3 N n j 6 M A y k v Q H K A R S Z 3 a O C e w w n k F z p T r B P + 6 p 67 + u U h w D z E k p I S X L H u 7 / Y E V v M y X y Z A 5 k Z o q z R c o i g C j F K 4 L g I g v G I 30 V 3 D 8 P B h w U C 8 W d g e L o S 1 f g 9 p l x E E R 6 o S g R M O x Y W e j b e i q T P y J v 6 d d + j c d l Z i 6 W H X + P I i 35 T B d L s 8 + G n A Z k s g Q 0 2 m z D 149 G q 7 K / L b q A O N l r r f 9 K G z Z H A 1 H 1 o H v r z N x s 0 y / x v D p d + M 53 K J 3 c 91 J J X U g V r 1 h r j + K + B r T 8 B M + q B S i h / n E R F a f f F D 47 y K L C K b x a 4 N v C C S s f w c v L w k W d A U T t 0 0 d g i m F b W A T S x A Y I Z + A L 33 M N U M R / Z o 8 w B W q Z S k L w a 76 X x W 3 X R d P M w + M z 7 p I O 4 m K Y c X v m V E S e 9 k Y p T C Z 3 a X w i K Z I G R S U X s 7 e o V Y 7 t I O G y w W X Z 4 c 67 J + X u n 8 I F S 7 A 5 s A I A 8 t 9 a 9 C X a E m W N t W N 9 y 0 d O 0 G Y i S 917 V C M S 0 z w + a d k u C 1 v + 4 / m L 3 b a E o w z 3 f q c l w C M 5 q N S X f e F O C 22 U K v d j B h Y N 7 h K 7 d v b 4 w 0 v V v R x M Q 5 G w t 2 c K h T R I j V c 93 E C r R I 3 z z M y 4 o M / H W y K u C i O F N e 5 v Z / o 6 a Y S 94 i G Y z O S E d e 6 Y c r s m + L A j U n F Z i b z E p X I Q c 1 t 5 p M Z D g T i y 1 H C G o D l r O G P X 8 S 5 x Q 7 m m f V u k F E g 8 n h P C Q i y 0 l 1 / l p u r h y i 3 s q h 4 P r c w 57 T I W X R i t 4 I K f L b 7 z n O 3 H I x R u / k 96 w L w 0 j x a Q A Y y Z S 1 j 4 u P D J m p g c f k f L X I 5 s r j R 1 T T x 7 v Q z q 0 Y / J V y f e Q 1 g U W + 1 r 3 t w t c T 0 4 J m h k / D g J o n r b H R r 0 F D K G 6 o P Z g K o u D R y l d B B V z j U d c N W x T s 5 P / L N T Q 4 I M R N i 8 f 9 l Q r 4 o H U T 0 9 H P 6 J x 5 S H b P N x a Q E q h / 6 d s U 82 l F T N o / e Y c T O e K A 0 m l 44 Q 9 L U R 9 J y Z y v G 4 y T w k x L W N z M s i r R s 57 T A y O 5 t 6 t j + R Z X p q i G y D M B c N D I u x A J o C r c n O p U M q A c z w / F v M E v z i p R Z 73 C g / f 9 V e v L M 68 U H f t U p p G Y 9 J B z E J P A L d 2 + / i t + / F D 4 / W U s z U g J z m Y R X + B g m p 0 M u z O 7 u U v E E 0 Q j j w E b B w z 8 G d d r R r C g x b K b x m c Z Y i S B K + 7 c G D A 1 S 8 i 1 A j 1 U s V V I E l o N l l O L W h j w Y + 5 J C T j 4 M g N P f J e P c y e 3 Y z N O R l M c W S Q P 4 D 0 E K Y x v o 218 Y M 0 7 R P D 37 + S U 0 8 r r 1 C o l b B 7 t Q J t N p w + m 250 A M m P S w p P J Z u E d t E P i T x o J H 29 n F 35 I 7 K U 0 P A v U H 4 v B t W E y N E O E d 7 q z x m a C y H 633 s g 5 U v 3 u h c 3 + O S 4 s M p / U f I n R R b G i X Q c o i j I w U E m W 8 v O t 0 V K u B d 7 J N 5 l V r S Z D F M t K v L 8 I x y e i N X s z o G / w 2 O b 3 L 3 h 7 A 7 W k E v X T S r y h q i i b Z 375 h W n j z f M E Z r 5 K F C g E A D Y e H V s + u G w z s A P s q H k k 3 n n L h q r J g H O y T q s C 9447 m m j / 8 D + X r n E S d L i H H 0 V / I R p J d f U q c Q N S U d U Z H i S E 3 n T y e r t Q + + T l z 6 L I B y G h l c E E 1 u Z E V F v 3 v o d Z t s n R u m A l S Y j q 6 y Y G 0 z a t 8 r I K d p L c r T C F C M 4 a D K 7 C / t C k Y n j Y t I a 52e9 i 7 E e l n 0 b Q 1 W j P U P 9 + l G h X N 7 C B t e y x P I 22 t / 7 r X d t o v X Z v n S A T / o E v 7 H y Y O y T 5 M g w 5 x S X M g f R M C O a 1 g 0 L j Z Y 8 Y Q P o G 4 r o y Y n e h B a J h I 5 W R B j 0 X 47 s q f Y x Z W q Z e I z t e S r e I 2 k 9 H Y n 5 / 9 P p V w g f G + Q V 5 A + s d e q P d q n f C P k w D f 0 J b i S X z F M M 1 n x s O H + A C 908 U p o r U B X A g M Q 5 x R w F I z G R C q J K q l / j o t W 7 U x + p 4 l m M G z Q N X l y g 4 O I 6 w K b v q P g X Y t P / n 9 B R y S v t e o q O Y K E V J X y P 1 Z 2 K N M Y F X m g b 5 Q V 0 i r O s c C j Z b R z t 4 V y Y a t C T b 2 L A 0 H h x x b q 2 C 2 R d R E + z 0 w 1 k B l v R T H T 9 I m O F z K W o C k d z N 7 + k 7 R N R l P A L b E P k p d 9 / d 0 + X i 1 S 5 D G f N 1 N 6 c D W m z N C o 5 M d w L n 1 p s J N 48 j 38 R O g q B B Q g g R g J m D Z a H N 6 F w T A t d 1 j Z o T y M n K J r / k L 2 e + C J J 2 K P e g n Z L m E E w T k M d L S b O Q o 0 1 p Y c V 7 j f Q G l i s g 7 t Y T N Q j z 78 Q c D y V M T P + 9 d u B C e l L w H 7 D U e t r F Z c U S h
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:00:07Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78dd08-4070-45b4-8e65-c9fc950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:00:08.000Z" ,
"modified" : "2020-03-23T16:00:08.000Z" ,
"description" : "Exe called RYUK or ran shortly after RYUK" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' c 908088e542 c a 306759249 c f 4 b 35 d 25 b ' A N D f i l e : h a s h e s . S H A 1 = ' 80e9 d 9 b 7 f d 95 f 6529 c f d 0 d 94 a 15 d 24 a 14 a b 0e91 b ' A N D f i l e : h a s h e s . S H A 256 = ' 1 c 7 f 778 b 20 d 47 a 6466 f 4 f 2 b 49 d c c 0e269 e 62526 b b 325 b b 4173450000e21993 c 7 ' A N D f i l e : n a m e = ' d O p M d P W I B l a n . e x e ' A N D f i l e : s i z e = ' 143360 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A A S A d 1 B Q U f V Q j S A B A A A w A g A g A B w A Y z k w O D A 4 O G U 1 N D J j Y T M w N j c 1 O T I 0 O W N m N G I z N W Q y N W J V V A k A A w j d e F 4 I 3 X h e d X g L A A E E I Q A A A A Q h A A A A w 2 G c a 6 R b O k p d p 8 f F W G O H W T 2 Z b / u T r A r X A F a 4 c v E y K v M S 8 y Q t y m N p H k q J l F S i M S 7 f w Y C F 0 b w l + L P F 7 O j 53 x S / g t m v n l w X O j W d 3 H a K 7 l 7 C S E D u M 3 u I I m X K i Q K D r 8 T B l 9 H F t M V m I 3 B 47 S 4 K 5 l e e k j V F + V E l W s p s E i H S N r i T I v p W o n Y n 7 s N B w z t q m F y x h 4 U S O / C 65 B b E l M q j 4 b V L H X X o r l f H b s v N M b G D 0 G t g p w 5 X b r o H B T i 4 Z c x j 3 c w j h 0 + u l H l y K 8 N g 57 r i 4 U u 12 K e w v j d m J s X y u t Z S 2 V y V H B f Y N 1 D m Y e 29 t c 65 X D B e N 27 u u V g H t b w 3 v n C e D M A I 0 C Z g C G l x F S V q w f s u g 7 L d k u n D C / F 4 O q y 7 + C t t 6 P S u 8 c / n q J b 1 l B 0 3 r A A m S X Y 5 R s k q o h q u j Y s U m 9 U c c w i s L 0 O S q s i H t R 8 V M O e M j R Q m P b D 39 / 4 m s L 9 v J 9e2 h 3 w P 7 w V N T n i 6 A 2 a k M v u m z 9 r q / B O y R O X Q O w F S b Y z / c Q B Z Z 4 l N e j 0 m K g g G 1 u O l Y O B D + s I d K d 0 Y W h 4 D B g C w s o g / K D z Q 7 x A m x 29 G Z T L t f / 1 / N T f 8 Y 4 C j q U 4 / I + 7 U C D 5 p z O A l Y H X y F S / W M p p c h 4 G E D y x z Q l E M H N k a 1 N H I O n K u q 8 J B i / x 0 G D h H s z N y R j g N 3 g o k I d u c g w Q 3 + S b I A e J I 1 E r q M a H L l x I 5 + S n 1 g / N W 4 J O 2 Y j V C L I z n I 3 H x P q Z P o F Z D P v D G e I r L + 96 u H o v I 0 p B w G 4 i J 1 A Y Y O h x 6 G c D n J Z l A 7 C g r 0 + Q k L 44 I 4 x 96951 V t Q p L k r Y M V Q g Y y J G h / C 9 Y 6 / r n j g i e w x o p 535 y K D w R Q 5 X m 0 U k 4 g z 0 w z N R l f N S u t i 7 h X A q V e s d X x R y W w 0 n c 0 I A w p n v F X Z c 4 a l Z j + 71 I 4 y t v o Y V K Q n h 7 b N v x d S 1 q n S c l a f 9 r k p s g S R / q Z V P y K + x n 1 v I 0 Z l Q p K 1 C a n t p G e L M y m E + k P 5 s L 8 l y n F 6 M A 1 S N H f j I V 9 b l 73 m p Z 1 I x z 9 y 1 v J y V Q o N G d b Z 0 A C 7 e u N c 21 a f z U 15 x c y 3 d R 4 N b Q w X w K q z 1 u o S h z J W e / n D w q P D g X h v 2 z c o d 9 v a V P s h 7 K M i 1 l / j n 80 L 4 a A B I G M T s f 8 b K N 2 C k B j q o F o s H A J s T T r I p d o G r e 2 H z o m B E N r D X 3 l d M C i t t Z d X b 63 r p k l 7 p N w 1e1 S 5 P J m / 4 I n z C a q o R M y E 72 H X h P R p Z K z + X t 5 r v 56 D o + P Y X F T / r 3 i 1 a a C / C 1 J m S j 36 f 9 E Q w d 8 g B G k F g D J f X o z 3 Q 0 l / O 3 d / t b c p r R B i e l I E r C n s d p n P 55 c P 8 O 5 t 9 u z Q z 0 N G z Q W L / H p p X y f K 8 s x m U K Z D Q w + q a D Q q B n K 3 C 2 h r J F N 9 Z + 0 M H S e Z j T j s z L Z Y Z t + Q + 4 a y t J q G y e r I 5 G I U 4 + r z t L / 5 z 0 z / G 6 V O o F u I H K K o P F x v D + n 6 U D E 0 U p n a v 7 A m k d g b G F m W x C W h u 32 H S n S N K S x l p 8 V k + 6 f U T U R 0 t Q W S / h N E v 74 J E l O V 6 l l m t A m x c q T s y d 5 t D L W D / 6 A s d n m K J Y K j M l C W A 1 f f I 4 H Z s s D S 2 L 3 K 3 X 61 T n e l d 57 t 5 S / O g X + z r Q q //TS1j+k2VV0EMcG/fitIHrcZjM6qpoTp2kwG9KPf8tD3FCW3FMcD6z56H4mnwkCgE1mXfWyBL8ljSRiZNwgl+nbOiMOuFBsjiEcGd0jm1mTR3tWou3zZc1LOMbgILT6d63BJsuShWik6thNXLzFFgWkH1OC7rXOxJFiXku/oB9ohdMKepSgheZ/1SMUvTl4B4ZYOjF5AGLuOWWCLw1ltVnbfUikpBVZcvoL54fH3RZT8JPW1NncuJHDRxmlhZjNgXXSlmESRtjqwI618bMTYnI96f2VX7rBp7CI5z7ImnVuTxmBjPa7X8e4K3R6crISRkfHuKYm7A/I3V0CF34X+qzTcAzASoFKhYirepZ1P8Xw3niBKM4ZKkQm59aqh7C1xD2MW+61bxFa5cJ+ACF4k3k7460nJ7vnteJ4Molk58iyrScYuK2qkOSUYMqK7RwN9xri1OwM8ywBMjU6MdbH0aEahz+R+LJBXv1wpwAyQj9W9mNdu0gGj0uueITSXm/CsRWCshjgfIq3LlEM8OBnDNdFFv6qBfg7LoSM2sMuQUA0xfzk7TNZxA0nl7bxamgGGetTh5FFTbG4cvRWShI+DFdfETxtR485MMgysuDSwGEFkZhINQhARyMPoNs7swwMc3QN7SymLvwD9cE5J/MJuY2gAWR+Yo1BNhFGplvOMp7vbudK3zDIMew6pYezKdgC97pczdHg5NcljdxH2S+H+h6or9A7jbWIshSYQwRzitusiqbGFc+cnMHjQEsIQDv30MkV/br2Lg0mRs4JSos8UEYeg3J8yn4BBW6AoCDjmRNovjFGr06VlssnKO78V0x7+kFUcYc20EKeaTm9K/2UilMS2QMtkvtkTiQ13fiPSbw+DSWmiz8G4l9Debkd6e7klZaKW2IC/m7AZxFnSLI1PC+ghw3T4/8ZubdMdTj7fcE5ERP5CqUfxh1kI1FEdd14POio+/dPvnx4dizejJZSTRvqiZbt3J+mUTQSVI+/F4CQ8w7j645QUsp8uQDszu5V2VsFdUzh/n3kFatrg9A5jjmO3jiMdbvhd+ziWH+6z6yJWj2rawl9sVj1Ey+M4aRQXlp3Ez2SOGzLEkvjm6x+DAoSr/7/VXHkF3iW3zRQR3h8ITGXkgwjQAKCAnGcbj/RZGygQIYCZG0FfZP64kGhYBM88D1mJjt552CFmFpzGdRC6laUxdy2BPfn1SPcwUQv5X7PbU04dIoMJo5JoIUbOvRnjC/7bzBWlUzTsJjXZzhEF+A5HuvBrUtB+CnWH7jSIxSThsKNuSE2jrzatF0v0Jy2ZKJoIXv1NDf9y2TGTZDo7MEv23R03P2RSJ1XcMtIuahgOKBA/S7ItZiDTUVXFBXJtEZDxdKtfErL4xEo6gpG0+T3wD+XO6D607oNHjDVvBBcJY1APkNkhFgptO9hr+b5w3CR4yTgCZ8KowCvFlXXfdHlvUczo/KdkHkptq4q8DsAKZtrYv/mHXJqTj9lzYVPRpLdAOrDNYDYA5fugvkrNgiL+E36F6MGZvrJBwZP/ISaSvH/KWKQYih02AI2VvT0s7txlA9SkNHcsg5gLNKrVYZHCjOf9MKJSDwa5NvgXPaXSXDOs8i3diGEgFFkszdqJzylnGCyFQqUD7mdQxpb4j4VAMvVkCnCGd8yBbWAum0Era9ycSmUM0GTaqd58kgLMJXroV/WFSNVbIRiQ93r6kU12aehe0wrQV/ymsjsHc14NzFtQVOjfFzj0yCvzFcuoDFOf5PGoXJrfai2PB7LksT4nwMwEBcrKN/HsamnwM5wOuslYIOvKljqCI9QQzsmUlvaYtiNcleh8yuoQGr1/OmQMNlQ9sQnJCdYxa/KAC2NgbrVoClvAt5FpeG81W90gb0ljA7bjJJuuDr+KtiIjIC5VpI27WqgTeWt4ys3zQ8J8MYBwNtI53RXuVeYL/r64dpRF4JzS/pCr0EEi3ExuvITml9qOCppYnzZ3vm8ZmKuzdm8FxK5wlKnRdfECMC3X74EiK1aHuN6tucjyVLdg1RAr1C3mXOEzaVeFrcU40T5r50XJ1dBBoNIKjQuT2f4qkNRGwZ163XmrrzwkPyzmAsEum7NC+VWTnkzidKzMzBO2Atc07nGrAC4eF/3M93R1HHJuuaiyosH3XE8vlbv2
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:00:08Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78dd09-42f8-4b6b-830d-c9fc950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:00:09.000Z" ,
"modified" : "2020-03-23T16:00:09.000Z" ,
"description" : "Exe called RYUK or ran shortly after RYUK" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' c 908088e542 c a 306759249 c f 4 b 35 d 25 b ' A N D f i l e : h a s h e s . S H A 1 = ' 80e9 d 9 b 7 f d 95 f 6529 c f d 0 d 94 a 15 d 24 a 14 a b 0e91 b ' A N D f i l e : h a s h e s . S H A 256 = ' 1 c 7 f 778 b 20 d 47 a 6466 f 4 f 2 b 49 d c c 0e269 e 62526 b b 325 b b 4173450000e21993 c 7 ' A N D f i l e : n a m e = ' h O X r b K d I Z l a n . e x e ' A N D f i l e : s i z e = ' 143360 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A A W A d 1 B Q U f V Q j S A B A A A w A g A g A B w A Y z k w O D A 4 O G U 1 N D J j Y T M w N j c 1 O T I 0 O W N m N G I z N W Q y N W J V V A k A A w n d e F 4 J 3 X h e d X g L A A E E I Q A A A A Q h A A A A 70 T j d w 3 H y t i e H b S d o 2 R U e v 2 Z 7 G k k F b L 457 Y c S M + a 4 R c a b X H K E s A N e x Q q o 7 o N F C u c E A L D 0 2 p k d u f c 5 F 8 O / x N w S n + Q V o C r N n C D L / r D E X S Q S w c V z g b I l E m 0 I s Y 5 c L O D 1 K + p T d 3 h N O T F y B T n v 7 K O L x / 9 f N o T o f j T D m / 6 Z b K b 7 L K e a 68 h 19 j D K q v d U A w M 1 H 0 f 9 v k s P L o O + y d I 94 H w 698 j A H n S 9 l Y d K Z C Q y p T G J R D N 605 a 3 p y 4 b d n Z C Z + 6 O p j l D J d B N A 66 e a + i f G Y S k H f O J x P 4 z + b s p H 1 Y y u d f H b B f b R n 11 X T a 6 W W o d S h W o o 4 h o v 9 I j B R Z G 77 W m Y b p H z 9 H E Y f 2 b U T Y s w 0 60 F H 1 s 2 S k W a x b V t 6 C 61 T G J X p X Y Q n 82 q m T s E A P O + o + h A K E a L 1e136 + V 50 l M 5 v h + 4 I Q M 1 C 4 D d F c i G b x N T 8 t M c C 6 a c Y g h 2 Y 6 + c Z k 5 N J 9 Q v G z M O y + 43 M i V M 88 + j p j B n d K t L x W 8 G o Z i K i S Z T p g o 7 I U s N 6 G i P q a e N 5 z j + R U y z V m d r m V m v + d R S Y z z L l n o r r / w R o W B j j b R p T T W B Y A 3 S 6 k 71 W H 74 o x A a W Y 0 P 2 R T o V o 967 H 8 z 1 k 1 o I K a G 3 N o W 79 m 2 z x i f Y L 0e95 M Z u i + y U i d 3 I s F y b o / b U x K 1 s 1 + s / s w C i o d K l E A e r W z l 8 u f n b t E j 2 O Z n A 6 c o h E Z z f a A u G W 1 u P 6 O r m h F G U f 0 g 99 k T C m B U m 1 I y G S v + t 6 G o / W q H / z x I N + d 33 h S 2 Y n J Y s R k D P I o j 2 n j C A X 8 g d R C C Q s v z N 4 X 87 F C 7 U F D / 897 T 2 C x S A 1 o P n H E L C M 6 G T I U k M z F T F h K W s b g r h m k 57 q u G e 2 r L h z S e 54 u m m K e n j A B J c / x z k f k i L s S F b E d l 8 z H 9 T G N R G R n m e 9 C H s v v 1 c t x j 1 s k P 7 z / K N 1 A 4 v + V i O s b T V y B K B 7 w F O t F X p F 4 n U f E B B S D C b i d 3 F e v i 0 Q f N A H u G N t L n j V 7 B o 6 Z 0 x a Z E y j l L 3 N F U m u O T E 6 x y o B J p y A M e 189 A J x Q 5 D 4 x f 0 z f y z d 5 B v 3 O v 6 E h m I S / a c q Y m c / 8 o Z M U L 60 v o 5 P b 3E6546 Z U 3 v 7 S w g 9 r C R P B / j f l L 4 G / 1 p n Q K z d R m w x 0 R 6 X B Y O J v j w B e Q w 4 B L F z t 9 V U m R M W g 0 x f p T G B x w l C 7 j f w H Z E Z D X d 5 C H c g n i g Y c S o k J s F R m P m D n i 79 U u T 4 e k 30 f 1 v 0 d J c C 3 x s X s n a A z a B + k J V D 6 D t Y n E A Z o 0 A r M N b q 6 S o l W 4 U g p / c g T J Y 0 H B J e z 50 c O u I B t U S P d M 7 n 3 d A H N g q O p 0 o R R O S 3 h v g b G g H Q o 5 I J 8 H S y h F K M Y 2 i M Q r U t u m K H 6 B 4 c D 8 n a X 4 H i J o B m r x l Y I v u r l h B l k 7 t g y L f I a S Y T e k M x N T W t P 4 o 1 u 4 J L s i 2 e f H 8 E i / V u d j p B H M Q D y Z D a h a J g X Q P O u u j 12 o w R 6 j p v I N C G B o B 89 H z i J v C U G 3 k c s m z B M Y p H Q L Z Z P U u d 7 s n / Z / H I Q w X U y V / p F i o e Z v u M t u 5 e F / f j G 5 j M D W Z I j i r X Y x O t j z q j a x a K i V N I a K 6 i 5 X k E S J s H X i Y U L Y w B O W n l s M z A R x 7 d B v y x 6 E B O I / E l d B j G A L b a Z 10 V P h n V p k S x c 2 G N K A c 4 q q E X + c d w e l E C u 96 t G x Z 7 z G w j 4 + 1 c s 30 v 7 f m 67 Q 2 I M G l Z G + A l 8 r z Y H m b l D T X 23 L 8 q F v 8 i z R U d 5 u R d h T J F E 0 4 h N X t e + F T T d 85 k i B 3 d v P K Y g x L i X s U 3 D F L k Q F L D i U O m W 4 Y d V z D z x + V w l X v P d / + f 8 p j 5 P S F h L l t f / S J I y H W i F w / O u g P 5 u 6 b c i L T u c L H Q E t 5 f i i 77 q E 3e6 Z H g M m u Z e O t v 5 j D O 8 T / J I j z F + / z L 1 k W Z i N L v i c i v k 3 K 2 + S 7 K N 2 P a C F H 2 h Z S t h s 9 f a j s m 5 l k g Q D I + 28 i 7 j o H 19 O C e W w q J T 9 u u 7 G C L p 2 v 9 J V i T i R J Q S 4 + 0 o f e v X p z U A c + h B Q O I s G k d B d p A L k h a y a 7 H k 9 m v J 4 R b m e i j s 6 r C R 50 H D r S D o x i 1 G B I 9 m s T E + f z K U 10 k N c M T a Q h i P Z 0 + 1 t C A G w 8 f R O c w + O w H j B Y z l K w L 4 C J q o x Y H 3 P e z H H l a z D E / a f C F S f t p N K B 3 S G 7 L R v Y t l l w 88 H c 5 i 2 T h z q P x M / O Z z j b u Y A z p a a i S h 9 j 4 g K k + m L h v N 57 X b 79 L q N R y r i 12 M Q n P 5 P Z 8 f B J a L m M 2 F s A t T f K p d o x 7 f Z 2 F S Z B V L L 4 / p H T n 93 + 9 D K j J K f G x p P + x / 7 p 0 S J 4 y n 7 g J C N j 5 x V X g k E u 44 M S Y 2 x p + p T o / 534 F q F H h f Q o T I 64 J V Z o w R / c u v G e A 6 f C i l H e v D S t N w S V e R A r M o 62 D C 5 T P F 0 h s B b D P m v e X T S L E C M R l c X Z 0 x + v S 7 U 7 J I l G W S 4 o S 5 H B B n C n 9 n n 0 B l 8 X 0 b d g w j q p x x a s z W 8 b w + 44 s L Y p H 1 n V 71 T P t / W p d A V F y M K e 2 W 2 I 7 a Q o i A k q u Q x t S i j a n N g y O y h D o k P 9 Y n j o x B 4 r + W P j Z M Y Y K x Q o w Q q 7 h k 3 c A k 1 s Z H J 3 L Z + F z a 6 O 2 Z J y Z 2 F Y k Q O u q S z k 3 N u C T q b 3 H F k 9 V c r l A 5 O M T w C V G u 9 y u T P c f H p f 8 D s k t S y v n Y F A N + P Z N v r Y d 9 R h X g y y a h C E t a Y 5 y Y A U Q M o B l q 8 E f d E O h r k 0 X 0 a O z 1 w v o 3 v U G l Y 2 U R F g y 1 D 1 J 6 C i b F x k k N X T / Z A b V 38 i D V P D r W G 8 + O K J 1 L Z u h v k B X I m z H 1 q a G t h A A F 1 W R 7 g Q R H O 2 p J 5 v k m 38 W t 4 k 9 l 3 m K u 7 d s O E 2e4 d S k b z w 2 X a Q r q q N x 0 Q e 2 l f H f r K 0 N n I Q / d j w S y P 7 c f h O e 1 O q L G x l t u 7 Y F c l I 83 g t G J Y n T 0 C 6 P s J k 3 M Z e P e e w k L Y P E L W P 0 N 7 v S y w U s B c J U 0 L A 1 z G I 5 c S Q D T H y h / i S 7 q 0 P I K c c s r 7 b U p z 0 M l Z X 4 I 7 / L m o W M E h 211 e l I p P e I n T z f u P V 3 h o 6 X 8 b f A j O B B E P C a H F A M r k 40 M A j l c n T y g z g 9 r w 369 S 7 R D b 38 L t G i J l C w 5 a f X U k E l W 3 p Y / B a P 75 Z J d f n y E i 0 n A / 1 r u D k h q k 9 G x v q I G s 1 v h + S 0 / J t E 6 S q h b 8067 M k M Z Y U F C J O r Z m b w Z C V 2 K n 7 c T M K K S t f e Q R m X S y 5 K t t B Z f U S f a L V f B a P z g 7 K g H 7 A v H j k P r p o f k I W 0 Q H k A l + K k W S 33 M N Q F i I d f P J F e g W y I N H 1 / S R N F H a a B F J 3 a n p 9 A K C P Y 38 d 2 t A I Z I T I g c 5 L G e 6 t 2 + P t Z i A v 8 / W W r R 3 U p n 6 M s g Z s H R y S o c u L y x z + / Q B v + m G i 0 l X B J v y n 298 o n 0 + j 3 V F C x M M i k t 1 l d x m g g S g s B B k p X B 3 w g x m c M p 4 r s l P s E 66 C 4 Q U r b D w y f C C C Q A + h r W e g x N u f k 6 p R b X D k + w G A J R K j b Y P w 3 S T s f R U J j M 4 p g M 33 z J L 4 p X b x 4 n v X V D y l 9 J P C 2 o 9 h o G o J A r l 5 d A / q s s d i h s 4 W s C 6 j q 75 l S u R B n b E w l e J 3 j D 9 K o f n V Y I R O F V C K H u a J Z C 7 P 8 R 56 g o p w y 6 P W V q M Y + m w o l L v l q 1 M V h R 1 b Q A z U g z v 1 R j 5 i e r v s z L s v E c x h c B 0 5 I 9 b M G u 8 X s 6 l X k i f A a R M S x f S 4 A Y l H h S k S M 7 p O + J R i z B Z a Q 9 x n m N E E l Y t X k Y E c W g f O v / Z v q f B Q o P 2 O 8 O W v E L c D G O c N o l N A V I 5 y r 9 o R a t 43 g N D H B T Z W 4 J J i a 7 Z W h J 0 Q w D U E 903 d 13 x d a s y s W B H Q s a N h u X Y 34 W t 9 i 5 T c H C 2 t w 9 r M Q S O X t 1 i f 9 n F G o O v F B a m + + z d z + T G C 3 m l N s 6 d R v 8 A i n d 22 S J j F r f q k r n 9 Y o 0 m u F 914 c B q Z o H S G l d W v y L 96 G F 9 w e 5 R 9 D L Y c T f + I 0 g 3 v n z r H k s 9 L H U V U 2 C 0 w U K b M J E F k M b U
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:00:09Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78dd09-63f4-4330-a68e-c9fc950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:00:09.000Z" ,
"modified" : "2020-03-23T16:00:09.000Z" ,
"description" : "Exe called RYUK or ran shortly after RYUK" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' c 908088e542 c a 306759249 c f 4 b 35 d 25 b ' A N D f i l e : h a s h e s . S H A 1 = ' 80e9 d 9 b 7 f d 95 f 6529 c f d 0 d 94 a 15 d 24 a 14 a b 0e91 b ' A N D f i l e : h a s h e s . S H A 256 = ' 1 c 7 f 778 b 20 d 47 a 6466 f 4 f 2 b 49 d c c 0e269 e 62526 b b 325 b b 4173450000e21993 c 7 ' A N D f i l e : n a m e = ' m u I V O i F n G l a n . e x e ' A N D f i l e : s i z e = ' 143360 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A A W A d 1 B Q U f V Q j S A B A A A w A g A g A B w A Y z k w O D A 4 O G U 1 N D J j Y T M w N j c 1 O T I 0 O W N m N G I z N W Q y N W J V V A k A A w n d e F 4 J 3 X h e d X g L A A E E I Q A A A A Q h A A A A 9 B B q b H r x h W r P Z w y h F O u F 0 F A 9 F L T n Y A h I c t i 1 V e w 56 g r x 8 S l 5 k X m L 2 N r d m + c 108 B D R 7 u L s w E U l / e S 5 r + V D q 8 a d 1 v H R D u 4 V M + J r Y D C W g 56 V f 6 y a q h r i 92 C G T 7 s j n D o g a W u 4 g 2 u H B / i 2 c J V / v a A E P 6 v o R T l y o 37 R o r I J 3 s / s 8 f 8 z 5 i 3 c N m N W t a N F 7 a Y C K n n K S Y O d l X e x E 4 j 7 D E X k / m 1 q v d x 52 q 9 K A 4 X Q M q D Y m Z 4 I P e 43 W d M j 7 R 8 I j R e 2 J 8 q v h i g 3 c S d G h u q 8 R n 4 d u Z t T n z 2 W B g S d E u j e 35 j C f L 3 e o 5 w 2 T a W P z x X S l e Z Q B m 7 I N r 0 a h i c y u l j I Y / 1 t A w S 4 E l Q 2 + k K c j U 7 b w a t M 8 V X 5 H 91 T / Y c D Y 8 K P s 2 w z C + 21 t b 28 / B A f q Z u O z T 0 F Q k K C S f D E G k x Q o n l L R 4 M + z M R v v 6 P t 7 z O 8 h M z 0 k 9 q a t h v 0 G a y R e c F V 9 w I m l y 5 e t r 3 o r V x 1 G x N t C L c V R H 4 F 2 s Z + U g d 9 W U d S h N C u F U w U b K P S f A 40 v D K 15 + d e h a T J S k z z C c K 9 K f n h N L r 2 / n R y S j 60 K s U f Y q y 2 l i t x / q M n L / h g i g G M 5 I g + l t K d X v l D 6 + t I + D m C i b x O P T O Q s Z B 1 C C P R n h o s 8 S S p U K K / V 6 T d e t K 0 y o a 0 r B L L h U t y o 7 m B W R I 6 V M G h l b I M W l h S f z T M O R 5 a A U P A x j + P 9 c D 3 B B X h F 7 N m 3 d 5 J 6 L 1 / e D V 3 H a c 3 L a 1 P U 708 x l L x Q U I N O + 19 D u x O h 55 C 4 a j s i b K G x G K R 1 P Q A / + t s a T 8 y Y t B 6 D b P 6 L a P U u H C x P i 28 J x 4 c W T p b 6 I I U 8 + N D R j K V s v b 7 o l s D 8 e W p y S v j + z O Z 4 r 7 S Q s i 36 q v P p p B D 3 T 4 W 5 D O E n r j V S 4 p T B G U A l G i u H P 34 o Y T r F L + x u b E K h r G K w U 8 F t D F f Z Q y a + F S r i w b J V f 1 z X P n X U Q A X O V a 9 c N Z d Z I L C o E e R r Q w + e k O a z y f X 0 n N p K M R + w m L 1 z E o J M J U u X v A O m Z 3 Y A 2 Q I B z r R H w S I Y D 1 C v Z / 0 6 b l 3 d 1 p x 1 A V z f B M 443 + 7 i / Y I x B g I p p V O T f i 7 W F w w c V P Z J a v W 0 b T q 0 I X q J N U 4 x m z m h S D C R h d r D e T m O o Z 32 i q 2 a j n I 5 F O B Q Z z z p B U D + m B 5 v m a w + H n 8 S b u p r R 4 r v Q 3 D p K c 1 L I m h B P n j Q b 0 Z + a m 2 + 67 d Z 7 C U G r 78 v B 8 f u F a y d R 7 q E / e e m 0 U h y k g T x 8 O M N 69 D G g H i N m 6 c w 7 q 7 v e M z i C M M 2 D q V D r Y / z N j 397 R l y P a g C x n N m X Y l j 92 + l 5 x S X W 2 f t a Q j P k I l q 7 T b 81 v c A w j 9 p D + j p s v k O B U V V E Q 4 k K v y V n S P e B i z 50 O b Z c n 3 H Z + 983 S / Q g q + 13 N 9 x g + 5 N v k b x c K U d i J x k N U q z G U o z N Q i P K c S z R z L X a D T D i J S 8 D u 19 e q 70 z Z H k v v S c e B a 7 h Z D u b y X 0 h a k W 87 X C 8 R 3 W L A 0 E p K 69 z e U H p k G v T M z P B p y I K e 2 P o F x n C z F p n m l R n z E z E 452 E t s e L B M k y t U L k Q n S j R E F k I C I b 6 i H z f A H h 3 v x X A 3 f I F U Q 1 Y F T m s 26 T N C 2 I 9 N M 9 J g q L s J v F A k U y o k G 6 E Y V u / 7 P v q 6 J l 8 I z U e d v Y t E N G v s r P c E L e J e a o 6 j n n g s X L S a B R 7 P 2 B g S o S 4 U s P B n g b T s I w / Y 7 N O h J A j f c x W r K z 6 q C + 1 p 0 T 6 L b Y T T 4 k E t H 3 V s I k e 4 h Y 7 q X 1 V c 0 f r o z a L + Y 3 m + E P d o p E F q v J o O l U 7 i N i F F c E J 8 Q V f A G W 6 D k G 4 D I K G 7 C D x 23 S 1 Z i k P n q t W 3 S h u a R v f j l R m Z k J t A 21 N c t 5 I 0 M 14 f p N 8 n U r 6 + Q f Y F t R d Q e J g P 4 M 0 X 9 n 4 Z j m 0 20 b F t X 3 X M P C f D f R 9 J 2 B A K h q A n G G e D C f D L P k N E j C S f T k 9 Q M n X X P Z m o 5 P i N j T p o v u c E J 1 r l H K O G k H Y V J O U s + j O R b c W e S l p p 56 F D 48 M N r Q / W E W l F 4 u d L T p f L n m u I W Z K G s t D y Q 0 3 k C P 3 y m C x g S z X E b n w e g h G / c d / T F Q S 31 m G R 5 f g U A f s + v S s 29 B 0 3 X q H X c 37 T v C H n V Y P j p 8 F P B t d e H 4 W e a H Q u I G q t M 8 M I 40 c q H 0 H A f m Q 7 E L K a R g A p b W + l W 1 q 78 Y X n Y 2 r M g j W u n v Y F T x 1 E F x n j q M u K U P R u C L y d 2 z x 1 Y j Q G 8 B m G X D m 9 m s u t b r E C O A P 7 u o 9 E H R W 3 f O c S c O k d m G 3 w s w 5 D N g g / N y Y T W f E Q Y c w T 4 r Z L u Y / h / P 3 Q 8 w y X m 896 e V Z 3 e l A L J P J m 1 a 8 i / 3 X C + 7 I f L e N c D E p 8 S t 0 d X q y x 4 O v u z d S o q R l n 2 C m O d 1 A D i a H Q l v g q J M + d 9 f S W 9 s J U m 9 f P S u b a 1 B 4 q 4 W x y H w N 68 / F t z o M g 7 n F l t J N t 1 c T W 3 N 4 L h 0 R N B 8 J m I 4 + n N 2 J + O h b w + l n Z X Q V 0 N u Z r o 6 J X v L 2 i U z o + u w h / j F 2 F 4 i a N t P V L 4 R d y W k / 6 z 47 L N N n Q D M A z V h U I H l e H Y c D z 5 B p v t B 14 p l 2 k N Q I V Y X Q 9 G K o c K + h K E b g w a 1 T s J K n l i h X z d h c Z f V t v f Y 1 T P F g Q r O Y / Y 5 s S 0 a 9 G X x 1 O D l U w e h X E c l e N X + a P G F A S 0 9 D h x x B C q C b L W 5 c H m a P V 5 c K X / Z 8 S c Q z E k H F E 3 a 87 s d b e i T I F N k H X 7 G q d 7 z t T I 4 w i p K 4 D k o 8 n q 10 F e H P P d a m P S 9 C A c V P h b W A X I l P w K Y L p 8 b E B U Y C h f j d k d E Y 7 s r A C K 9 H D i f Z y / e U u A k g h w z + Q J e 4 d 3 a Z k H s x A q X e 0 P A R O s e 1 Z O a 3 s K E B / q d 75 I + t c g U b x Y o 6 P C 9 g F u B E D s x B H g t y y j A x Y M v T y E x Z 12 X 8 Q m 1 M r + F C Q 7 r U 0 N v W 9 U F v P T 4 d X E a c s d l C z 9 a 2 K w h g F B i o 70 s K g 2 w C f x V E v y b c X i C R k q 6 m Q 5 t y b n u d 9 B c t 5 H j v d 9 Z X z e q F w h 5 D J 32 L K N u a o J K l F 5 y p 5 I A 8 A 0 a O P A G z N m U E k e Z x K p c P B + 5 P z 2 I 50 y X 8 Q s K 2 v c g P U u U 3 z Y k N e r p v h e N B j b U U X 3 F 2 V J h p 2 Z p J 4 y I k Q S s t p E M W 2 F K 2 r s 7 o O N w l G u z S q P y t w q B S 0 x k n 6 a N v K f c j Y t j F R a i a X a Z M K N B S 0 H Q Q 5 I x s l 5 a w D P I 3 O e h U s s Q v L o 4 c 1 d Z d B z O 3 A t P Y 5 R 5 a Y p c j 9e6 w r H D i d O U k 3 Z L j 7 W a k k u d n z d J j R 7 k x c / J F d A x R C A 7 x N 1 x s 2 a 3 I P a i R 7 X O L Y l B y z I 7 O u 6 w W H l N M g B C k d q A a H H e r v q l Q F g 99 V j O A h i N r b r d l 7 Z o q v G g Y R 27 T z P z x f 2 T o u s w k C s P D G B H 0 / 8 t w 88 i q 1 q V k A s M d l h 0 C y C 98 S + W 7 Q 6 s L P l x o t R n o N q j I x r 8 q 4 v I + M 6 u l E k 8 / K u 9 y o H S z G 6 N c r c t i n v Y M B f d q o 1 W F J r K x t b i Z 95 v H U 2 S D t h U J u 9 T F I J B + 6 J J Q v 8 Y + b Q T A r I Y 8 e F n w 7 g / w T w 0 4 x D j 8 Y u 8 p D s 7 B K U T + I B K N V N 8 U V R Q r B l E g N 3 B M n k N R o u m S t p H h t M k A v O 0 e + z 5 A n O s / E F Z s d z t 0 8 Z m 3 x 5 K 130 B f x x u Z f 7 s q Y 3 K f 9 + g C k 1 d K C c b l K b W M j X M z m d S I s R C u C w L e q r Z S y d + Z v S 7 d u K p K X l i h + Q Q 5 L 31 s t R Q V t 9 a U z f t T x z H 74 v X U X d p Q 7 h G D G N / S G H v z 89 g T K m S m r n j 7 R P b i 6311 n d z b X R V D Q a e z a A p 0 6 p J Y t C F P y w x p X 53 i E l g 7 / R 6 T m x 7 E c 7 o n W K 382 r a b / O x v 8 d G + Z c / M P 6 G A g n + y F q a H 9 Z D m Z e w / k i b O P N Q R L g E R U + Y F 36 m e + + W u z R b k t k u N y i 2 Z a 2 s p 6 m c G 0 g T V M 3 P 1 A I n t G h m B l c 1 J / I P D 1 T A 3 e w o g d 9 x O J 46 E C z s i g O 29 A L i I D 5 H m w R U G g q E Y / p
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:00:09Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78dd0a-8c8c-44cb-b817-c9fc950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:00:10.000Z" ,
"modified" : "2020-03-23T16:00:10.000Z" ,
"description" : "Exe called RYUK or ran shortly after RYUK" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' c 908088e542 c a 306759249 c f 4 b 35 d 25 b ' A N D f i l e : h a s h e s . S H A 1 = ' 80e9 d 9 b 7 f d 95 f 6529 c f d 0 d 94 a 15 d 24 a 14 a b 0e91 b ' A N D f i l e : h a s h e s . S H A 256 = ' 1 c 7 f 778 b 20 d 47 a 6466 f 4 f 2 b 49 d c c 0e269 e 62526 b b 325 b b 4173450000e21993 c 7 ' A N D f i l e : n a m e = ' v l G E g C B T i l a n . e x e ' A N D f i l e : s i z e = ' 143360 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A A W A d 1 B Q U f V Q j S A B A A A w A g A g A B w A Y z k w O D A 4 O G U 1 N D J j Y T M w N j c 1 O T I 0 O W N m N G I z N W Q y N W J V V A k A A w n d e F 4 J 3 X h e d X g L A A E E I Q A A A A Q h A A A A 4 F W p v 7 y s u 70 o a / G n A Y 7 g n b p B 5 O 1 M Z y w Q m q a B S W O p 8 m H 2 p z O j A S Y D 6 M Q S w e I + g 5 o z q 1 I / k n U M m B P p 0 2 S T 6 H H 7 p E 6 r u a l t U w x T e o r 8 i T N 5 E b S 33 S L D M Y K N h 5 x b W l I f c e / x v 5 G 7 w H n B 3 Z O s 5 B z 9 I M E h P s e O / S P 1 N q X i s / H H h V m U r O L k j + t e v T Q 5 V y 2 u O 3 M q E Z u l 8 I M 28 p d j f A o 8 E a c C b U 81 X 6 O 2 a r 8 l + 3 i S A S B C P 1 q U 2 U 9 E j / 0 T r J u r g k J R 1 t F 7 t F 5 / y g 2 + C G G D 6 C 4 g 1 Z t p + 9 E K j L 3 K 0 K p W s 8 c O j W L h 7 f B t t e 5 j j l m z O 3 K 6 y G x z i S V N / T q n R A s k u n J g F v / R s x j P G 4 I l / e r f w 7 Q Y O l x g w l d L E a 9 b K j 2 j n 27 c 85 f H j x F h t S + 1 + h W t T P C W s N 3 k B s E l Z h r R G 8 k u x c Q W 73 l P G R c i N / k M e v k V O V J V e U C c e N K A F A b 0 A Y c z U 2 D o C C W Z m h c f C O f 4 J A e d c c G W N 2 P 9 K e t w 1 Z 6 p i B m / t D h X z a n t R m H 8 c z D a M H G Z D o X 9 A i G 0 U Z v n 0 C M U n 4 J N V F 0 c 7 a Z x 4 l J m N O W 7 K a F G 7 I R X 6 Q 6 g j m / W K 8 p r a O c 72 E S J g f f 8 E h H o l L i a 0 B a 86 w 4 w L R O Y y X 310 Z B s / 691 v l r Z q h q 7 I 3 g + C L 1 v o 5 w K g m q E M F d 3 B p u B 7 / s Z 0 C 3 x 14 k g 4 R A U v q u 9 H R G q B h U n k p c m p q g Z e q R X k S A u o 3 q 1 / y 0 494 m P h q t 549 k y 6 D l x e n / F y B X 28 S Z / + G O c b f Z Q K O p 4 Y M Z F 8 T K b F 5 c a a / f C K E q P V c 4 d V Z h J 0 k U O 9 U m 5 N w / 6 z R o l t c p 4 T U b g J + S e w m L X h 1 H 2 m n 0 g 0 U k b 1 L B L o 2 k z e m x N 1 c N k a r 9 X D R n 3 s c u s w k g P t t 7 q v U 5 r K X F H s 3 M y B H F p E c C i s C T 8 X E 8 D m O y r D 4 j G 2 Q 9 b + 7 x Q e V a n 8 F l C F B m f G G e i A 0 B P y U n j I m w O L t h u 94 v 57 l 5 g Y x V O V E 0 d 7 r o 5 Y Z 3 p r Q K R g 7 j H I J y x c m Z E 2 u Z 8 U J 6 m N w 7 m S o M P Q G 7 H N / q e 4 x e n n E F B O 2 z / x b h C R R F j t a 6 R d C I G 29 z + Y T n O q X Q r i g V s o W X m 6 + Z p Y b 6 e I z r P F n I w c + g V b P 82 s Y T p o c Q y 3 e + l Q b Y G N + M n m H Y A Z D c g R K n P d / l L P X R t a 9 R Z l X W 1 z A Q I 1 j Z 61 I m A b z r h 76 R u U z S H / T x a z q 6 k Q A 7 A v f / Z D e 9 T N R c N N X 5 w z / s G 3 R V Y g y H W 8 + h O X + a a D y y T 4 s d J I F E D 1 E a D z t 0 Y 5 o p s A T Y f A X o f k j r c Z 0 u N x o c / R o 39 Z a c z 9 j B J g O O S n V U X b 5318 / y H 9 E Y S G s / F + 0 5 W 9 X 7 A 4 J 5 P 0 0 W / Z f Y v c i T N 2 y e s T H Y V e J w u f b 5 K w H x N a P 2 Q F e m u Q V v C r A X Z w + a J h 82 I j 6 b F u E V 5 u h T G g D 0 R b k H L 75 K V y U J S V w x 22 i c Z w L F 28 q r V n z w 2 t T Q 3 n U j b m 6 h g s m p T j J 5 K z p m k 6 w S Q 8 i A U o y P P K 5 j g L i i j j 4 t G h e F w D 0 J o Y z J F v 0 0 s C c w L 4 P Z E u + w c 5124 X J E p X 7 W / l / N Q P q n s 8 P u f F x X u s C n A k s 7 u v k 6 c Y z x W 3 j y h j T A 4 T y d 9 f 0 4 c 4 t e L L 4 y J M + 9 c C V O V S F E n Q J L U / V 6 a 29 d + M 9 g 30 d T b 1 n q U K d N 2 c s n + / 4 I V C 2E9 g I 3 Y b q J g y K i r j d M z Z V S 2 F l 307 U N k Z C W p Y l a t 6 l Z g X K G o Q A 1 G o j P 7 t 11 e l t 823 C 3 J c P n 3 I R A D P w M L e h y d r k J U h K L S P 6 d k s O G 5 / c B H V 1 A i P T R c Y O / h 7 V + q d j b X K i i Z C / p X T N A X E u y 0 r z y P Q / E J l x 7 N Y 1 l 3 Y A q 6 e + r K G 7 F W M G y U J T E T C V l P c g c G K F c r Q l R 1 X f 1 I C K D Z T h z R t b p J z h W + o g 0 f E x 7 S v V O c v v L E l L W k J u U q d X + x N S R j q 6 O U 3e8 o K 1 t G U + 1 Q q R P C Y n Q p g N h 7 M y j Z I 4 J J n 9 A I m r Z e t c K g Q L 3 x u + 7 R 9 g Y b H V Q y Q 5 c O 1 y I 8 N Q K 5 + 6 L 3 F D b d z M R N j Q c 3 P q Q a x s a 0 T 3 w d R 3 N d K s W T N 6 N 0 y A o + 5 C y B s g D d E Q g g h R d O 4 v o d M x d I i Y s 8 B 85 e l 5 j J B g h + / X c W N f g A 9 q U K A Y A J 8 p R A s 1 D x / v i O g z 6 B P t N Q R S i o 4 q 2 V o c m g a 9 u e 1 m E t 2 e w V t J 6 Z o t P j 7 I L Y k N / q 59 x q H h L l 9 g X p E p 9 P t N s i c 7 e e j m B I Z w + Y M X + e W V 4 g 3E2 Q a J Y V J 3 b L i B 1 i c I Z 8 b X i 3 j N W b h 5 i n 9 V z w 0 A Z e u O E 3 J m / o o 6 C v x 1 u E K J D E 6 k H w y 5 X H F q V f e Z c i v 5 O B M d r A r S 7 e k l c p A g Y Y b X d h 9 S r 7 i 0 8 N f o w 1 c U G 4 u q C P 1 U c A q L r R C e 8 G V A G i X Y / L 1 V v g C N 1 J 0 L 6 r Z n Y 6 q Q A W e E t F T O + L Y 7 A N y L l 3 D f W K L a t J 33 R + a i v P 1 d z + c 96 c F + K 5 M Q r B N h 0 y P q C d v H A g y y O S 2 B F I E k T t o 1 N 1 a S o w + 6 h g g J r t + W L Q 5 T o d 0 28 X 2 t A 24 j l T 6 g 8 + e / J U O 71 E J w m a r 8 A q K o 62 Z x i F d a T m f K o Z 98 A g A G d p w v p C q w h 9 u p L m a J K 35 X n 0 i U F w W 4 Z l Q x p v C p / e C 5 g W U S J g n 7 Z y T c 4 s w s j w q G n + o a 3 S i Z Q L y A o n 2 f C c F c 37 C M 0 W P y V m U 9 p K f t 57 M b c y s Z s / O t e w t w y c 3 S x C e F 5 + A Y p 1 v x T z Z 8 R K u v + 6 w C C e V A q k M N w j J / E Y g y a c 7 G O y P 4 j G o i M 4 i g v x 3 R o Q f e I N W y c D n o B 7 s S n Y e 5 p K H 27 Q t k D a E w C N S w c q I 6 F P Y U Z w W h q e s X h Q X 2 l y y 0 P Z 5 P / l c 4 U a w k 9 / + M z o y Q c K r m 0 j a Q X m 6 c V M J 9 p K v F C j e l o 1 v S p 2 a x V 1 p y B d 24 W N v R s R 0 F b o 3 x f R n S 7 U t H B D t / V 4 a B r U Y N 0 U Y Q e B 0 g 1 y l E p P 59 u a + 0 O u A 8 A m T F R E Y K H H O Z o F B i 0 H S L h S 0 q L 9 K O V B 4 O X 59 t M N N o I z d S L z / 5 n Y B j c L e Y G G h W u V H Q b H 605 B r p / 0 8 v X m m 1 I + F 5 h c P F 4 j L o A x i 1 + t A 9 f r c R K G V B t i J f e g Y A I 7 X g m m s + x S G x b 3 j L a C r R A K r l m w V O H h 0 S V k B t 9 O 6E20 R D F n b Z 3 w a x W H x l L w 2 f 2 H w 1 O D d d 5 i E e q 1 L 5 X 7 L R X 7 R 9 O B V B B X h q O 3 d C 9 L A e i a R q + q t A q 0 Q u m j 3 a O C P T U s u J J P o E d O w X v D S 9 I + 2 H M 6 p g w E 1 u r E u T + Z T n r 3 j s K 4 U G 8 Q Y f a m 14 h h X g c B w 5 + 1 x 0 K + 5 d M Z 7 w T M H D R E I a k l L 1 v 81 R H P P M w R y a L K n q I j r 9 t F 68 j 0 B o S 6 O G s D S w 1 C 8 R w m 18 i j 0 0 I q w v t n 2 u S n r d L y u M D Z a v N x T G t T i c k f Q E H A 7 s T 8 D 8 z N x C N i q / R d J x V h J Q U / t a 0 X G x N N 10 C H J q S p F 62 d q d I s s p z p q J c 7 J 5 f z u c P v 8 M f R x M n a 3 K G o Z m X v m f 8 W G g V P 960 F q 0 h u J B + l C 8 J 9 Z t g c j n v O c p A 9 T V D 8 P P W A Y s t G n 38 F E C d W f v + C u j k n b h 69 v K 0 37 i D r Z X i A / 62 t m m + z K I i N Q B 7 r g p a 3 u y z W H l b a E P u g X g i / 4 Q Q i d B D k 3 w W r G q x m v W q 48 Z 0 R 8 Y J R w H J v V M m y 0 c U 872 U f r l Y Y o Q j o B M j L b i z T D U + 1 i k D 6 c J f t Z g J l F I 9 d / Z m p 4 X G S o S U r i N t 3 G A S C M G B 9 y L q U o I 1 q U T R r E N t L v t L 2 e D 2 V q P w 5 J s 8 R M K b k T V 42 o D a h K 2 M 7 K D K i R W W 86 H 8 c S M / n t M d g W 4 t 8 V l h x 8 D f y 7 b o / H / E s r + b c R f k B a J w 7 V I r 13 F K J + q x u Z D f C H J q X R g z g M B c N E F g 9 U t M u v p x z M M l L w E O 9 s V O c 0 m G G G n Q U k 4 v x e 7 V A + / U + 0 Q C v e g c 1 a K H u J R 4 E b 8 n E V k z t e 9 l N D +
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:00:10Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78dd0a-f6e0-43b1-8678-c9fc950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:00:10.000Z" ,
"modified" : "2020-03-23T16:00:10.000Z" ,
"description" : "Exe called RYUK or ran shortly after RYUK" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' c 908088e542 c a 306759249 c f 4 b 35 d 25 b ' A N D f i l e : h a s h e s . S H A 1 = ' 80e9 d 9 b 7 f d 95 f 6529 c f d 0 d 94 a 15 d 24 a 14 a b 0e91 b ' A N D f i l e : h a s h e s . S H A 256 = ' 1 c 7 f 778 b 20 d 47 a 6466 f 4 f 2 b 49 d c c 0e269 e 62526 b b 325 b b 4173450000e21993 c 7 ' A N D f i l e : n a m e = ' V S u z Y p Q l r l a n . e x e ' A N D f i l e : s i z e = ' 143360 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A A W A d 1 B Q U f V Q j S A B A A A w A g A g A B w A Y z k w O D A 4 O G U 1 N D J j Y T M w N j c 1 O T I 0 O W N m N G I z N W Q y N W J V V A k A A w r d e F 4 K 3 X h e d X g L A A E E I Q A A A A Q h A A A A 4 m x T F X z 0 M R u v a Z P x 6 A 9 I z A 3 l J l v p 0 2 M A a t y 8 w z + 6 V g J 9 W z j V c B G J Z / R S n N 83 M V I M 7 V 6 n Q i q U 4 p / j c y S q y Q p k s F n T e G z J l S y l t j E G j A u y B n 79 Z T G H O j L 9 F s r K X q A E 788 / I 2 W y B F w b j H P J 5 p i Q s Z s I S + P P z x C 2 R T P y 0 W j M A 6 p P z d n s a x c 1 + / i R 7 j l S 7 f v l Q o E P / w S i B n n Z q Q s 5 F 8 V c n K 31 E O Q Q Z l t x l Y M f F 7 o I L Z u Q W p 94 Y d t 0 2 z 51 J 6 C f V M K 2 b 7 r 2 s L l M 2 j 5 a M V T 8 f h L + v q 85 Q Y h Y D 4 U M B K X P P 6 W I V e B 4 Q 7 c 8 Q n C a f J a 4 f 0 U Z s B E H + W a b c D O 0 u u 6 c G i y n i 9 f H t D i Z 99 V 7 Q p / g i Q s H a 6 D s z c m f C A 0 61 g v R 6 g t f h u E g 0 p 7 x S K 946 u x + l o T g a 2 i o N R R i 1 C T K 7 v Q m B 7 g Y D m + l U q H p H W D 3 q o Q T L A + D W l 0 L V 9 B x 9 F J a V d R o o F C + g h i B V N O d U S d W 6 f T y b / 4 h x 8 t j 6 z C q z 0 x L 10 M a / j + D 8 C o p F Q N A z f k / G e J y B M U J C D 4 k J u f J b Y W 3 k j i F q R Y q 0 X V C K c m d 5 P I 31 C C R l w m Q u y M h 2 + J 8 u Z c t d y x l s k z I i h 7 e w M c v B S t R b h c N c P X G 8 a U D S p 9 / L 96 z K 1 f B F 4 o 5 / s 48 C Q x F E b 4 L g L o 32 r r 2 W I w / 4 W p B b 4 G 2 s S K g S d a / t A E O 4 W 0 q u x t r m 66 h T w H P N a m 9 c Q 18 w h 0 z d h f m 6 U p r 49 E S x e 5 J Z a + K l h u D K q k 9 C F j 1 E V T o a o 8 g D + H F m j H G B r f 6 W k l 2 + 46 f e o r m U c k u S r Z D y B W M 6 J 8 z 6 Q a a 7 r 8 z J j E 8 x c j t t 0 + G K z 7 q F W 2 R E l D k V + R K l 8 A S Z l R Z s V m f l p X f D 7 F I I 1 f / N S o 9 a l y x T H Q v O t Q j s B U / C g H Q j q p P a C m o M R r c x T A c t 29 N f C M q f r k X i K v E N I x z 1 K n t G f u M q h x / S F f O X G G E 1 X m S Q J 9 E O 48 s U a H k g W h X J 2 j 3 H D z 1 M j c J M Y + U p e / Z 75 y A 5 Z s m c 6 h k H j J A Y t b m y s 7 J h d x + 7 F u 69 c F e o t l v 5 b c V P g w H u O S 7 n c Q W U V f a n C f 2 P P R o o N q M 2 a Y N p c G V l 0 M l D K u o D 6 N 1 C 7 Q o H t p 8 y O c l 0 B L I 5 X / Y 96 Z i d r / B J j + b C R m 3 F 7 t 4 G f T Q b U H h w P k Z j N R e M t i g M p o Y r Z T L l 64 F Z u w m f 0 l + u o H M o k b b O R j V u f 1 j U U n A 70 H T B / 9 w u H g i R m H G y 9 a e i f v C Z A R f 7 C Z 3 C c 5 e D O S e k e n D 3 U m L U Z U 0 y Z h D 8276 I g 2 X 0 v y x 3 / n Y f M v i f L c b B / T 32 Y l D 7 a 9 J l p E a X V n + M 2 q I V H n 2 K x C W U k 8 d G T e + u U t W V 6 I a J 5 l + X 1 E i T G 38 O e a g d w B F h R b W q V X 9 g N + u e c q 8 I Q H k p Q N e 3 o s A l i 5 m K / v A n D V b L N a w 35 A w O 0 C L 58 G 0 e J n H 783 A K G D N g K d F H b 4 n W P 0 D D I s z x J J h q L W m f L E o q 6 J 3 o Z 9 G Y w p x z t t V v v i E E y A A B H U X P 2 y G W w l 0 z L h s D + 5 Q t G 4 w c 0 H K a t G d i + h 1 I 8 F 7 I Q Z o J c y + r S M 8 r c w J h F f L z 1 L e C 7 d 9 P x X 3 g N P D 55 a b D r B w M o J B u 5 x l x I z 0 C Z Q a k l c / J 2 a f r Q W i l a t 6 r 0 z W q h v y f T / 9 R 37 P O m L k Z J h D + Y p U r P C e + J z J Q p S Q b 4 o 49 F Z G 3 g o o 3 q B Q M / v k b S F o p N h G u b 1 x z A s C C 7 + 4 r f O Q q V j A H u Y + i t v Q 33 q 5 c Q q w d P Y D i + Q U t 9 g O G w P k W O K H P 8 W E N E 3 J F R A e S P b 9 S j 9 N k q 9 o 6 q I k C P 9 J a H T t u 1 V h t Z r K o f P W 9 J y n w R 3 B f 5 M z z S R x B Q v X f u K 9 c u Z e q 7 n D h + V s o e U 8 Q 9 o x 0 3 P V 2 m z D n 9 v L 4 w x 5 A 3 F o L A / 3 + k F d D I Y E p p S 8 U 3 H m z 2 a 0 F J L T P B d k 7 F s O b O c E m 4 M r 3 q o N t y D d 0 S l L I A w V S X a y s b P K w D F M 3 R 2 O g i G 7 B 1 w m 6 n Y j 3 G U c 93 C h h u H L S n X m u r b V f q 5 S U T i T c 4 S S m R L t W Z i e 44 g Y 9 S G f H b o l 1 U 0 0 i T u X g 2 i u T J v 8 s n h U M F j T r D v T O h 41 I w V Z z u 8 y 5 n U O J O W L J F i 5 X q L t 7 U o G B X t b K 4 o d c 69 C r P B e 0 z z Q c Q u G 2 I X 8 r d c C X y I C 8 a d 6 d 7 c O p 9 N V A M o B N Y 7 D j U 9 D E O u w F p Y R q m v X 2 K + n 95 O x 4 r j d 3 F f 8 N s W G 6 r q 44 + J R 2 Y G O 9 A Y L 5 j i Q 5 Q k I Z z z S a 9 W L r 5 S r v 8 R F p u t i S F s Z C 5 m h z h G d 8 F 71 y x T 0 X K n M R / D 60 y Q r f n U B 0 l F S 3 s V D X D e o V W H E w m a v X G p E k 4 a f N I d 1 H V h + g g 4 p 9 p B l i 114 D b G n M x V H i b 7 l A O D L r l T D 7 K q 8 S p 31 y 8 E M P O 8 N x H y 4 G d g l U I J N i g O Y U 6 c N T v r s J a A k i d x t Y y Z P K f X f 1 y r R Z Z 3 W y 75 t Q N p L L a I a x U U s S a u t W + R i Z m J Y z l U / I y 27 U w V J p i 5 W 4 k r G J P + W Q R t q 9 y e N a t s j s f 0 Z Z o l W t 9 c B L C I X u U K z p Y N 831 L U x s 3 B J 4 d H s p j n 5 C X N K q e e + 6 q 7 t 2 T G E e R V n 6 z R C x p C m f A j q D q U f P d o I X 3 n / s V w A x Z h N p y 5 u O C h 1 X z J 6 Y J u V R 1 q F j P f 4 B r q N Z B i / 3 a u 5 b n u Y 3 y N x c 48 u d v i J A d x L Q P k N I H w P t + I e v z X 528 U 10 D g G 3 v U T X j i z n 2 z O F 7 g b G Z w 90 F Y w T a R 8 G d Z S 9 G N m 2 + z l q s B 5 n C 8 n C R f E p M V Y M n T v 4 G 9 U i S m c w L V 16 C e S O y u x b L r z k J 8 U 62 C 9 z j A w I K l A x p T c k Y j x u E W Q r 842 y 0 r l N v I Y r H 35 U 0 l c K 7 w W D U M Q 7 f N U Q 81 F + x h m g Y O q D K V g K Y e / 0 r V I A J k v N g v E t Q 0 a c o l d g i W S + z U a Q g C e q M s A k S Q O s s I W Q 4 I m k F W f s J z Q P F S G o I 9 R J A f h m a E R G w 2 i q p k h 9 C 86 p x U K n c / w X 9 K O V L T E c i + / 6 k B C V 1 l L v S r q n R k 66 B / s W E 7 D a G a P e C T 5 K T H f 2 N S W 19 k R B V O 4 A X q W 8 X G 7 X I P B 7 H F B 8 b d 6 B Z Z F i X N o U B i R O S d I f I s 9 D k Y j T t v y P V v b j r g g u c J N E x x 2 k u M e 6 U r P S 0 S m M 3 J W O Z y 4 l h p 0 F t c 5 T n N M k 2 K j Q a P m 7 o J 5 P 5 G + z X N 3 p 0 P u R t R u + u v w R P j g 2 o w N K I D X A x u b o 1 F u P + u w E T 8 l M X O A N S s Z / L k b A 7 e U h 6 T A N L M 1 j F 2 W h S 3 L X V c 2 f s Q j y u A P K x f S G R x p O d K n Q l I Y f j / P z D J S 5 d c 9 y X 0 / 8 T D i 425 L a O d o Q V 6 K F Z m 6 c X q a p k C m G g 3 a d c n + 9 A 9 g g E 53 m 3 H e l M b a V Z / D / E z 0 z / G F t A V b j w Y X k g p 0 9 F T Y i i l z U l + k J R W / Z f S Q S F m z G v 3 C e R 0 E J q t D D S p W E N 7 c Y t F 1 S r P I v b O F 83 M r / f 2 h i e G A 9 x N 3 g 5 o / X L z N 7 t F y A R 7 j B o 8 J t y I y 90 Q t f R b 1 O s y Y 8 X + i D G 5 e y T L d N A E F h C J V b J f x Y O 3 m M R c b Y Q + v u O P A x W E k y + J X P Q o H Q T Q X k p x d r 4 q f T K p 7 P K 7 P 4 e z 0 P Q N s d Y m 3 F I 2 D d X B 1 x 5 g V b a k A a A E g A w R / i E U z O d 8 t p 2 R b 2 h V k 16 F e 3 x W K T H G h s L E R P Q O i 32 o J Z Q r 7 b x 0 J f P W t l o 0 x L S V s a G X 20 d S 5 m K 2 w E i 89 n W h 3 U v I y M I M M o h c / i m / h D 5 w 3 V l 1 R t Z D c z p z K t y + G Y j W s r e b L t y y Q x X h H s t K 82 p i A u d n T J s I U 30 s P / 2 S 5 p h 7 C R u 5 t 29 R Q t + v G Z K f V m V m n S U G L T 1 I h 1 p O 7 a P m w s v z C O g U 5 H o O K S + c J j r K y O q i 8 t K o s l j / U C + y z 1 o 12 q 80 K J c E c Q C X 5 K u a g z Y P v m a 0 9 X O t 3 N B 1 O z 4 C U 9 p r K l 1 O T r 2 E l A v 7 / s O g + p g / I i p t 8 J o k t V
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:00:10Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78dd0a-9560-4f05-a747-c9fc950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:00:10.000Z" ,
"modified" : "2020-03-23T16:00:10.000Z" ,
"description" : "Exe called RYUK or ran shortly after RYUK" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' c 908088e542 c a 306759249 c f 4 b 35 d 25 b ' A N D f i l e : h a s h e s . S H A 1 = ' 80e9 d 9 b 7 f d 95 f 6529 c f d 0 d 94 a 15 d 24 a 14 a b 0e91 b ' A N D f i l e : h a s h e s . S H A 256 = ' 1 c 7 f 778 b 20 d 47 a 6466 f 4 f 2 b 49 d c c 0e269 e 62526 b b 325 b b 4173450000e21993 c 7 ' A N D f i l e : n a m e = ' y j n f V . e x e ' A N D f i l e : s i z e = ' 143360 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A A W A d 1 B Q U f V Q j S A B A A A w A g A g A B w A Y z k w O D A 4 O G U 1 N D J j Y T M w N j c 1 O T I 0 O W N m N G I z N W Q y N W J V V A k A A w r d e F 4 K 3 X h e d X g L A A E E I Q A A A A Q h A A A A M z Z Q U + R A D 6 Y c T v B 0 6 Y h z j R z O S 332 R q s 1 u C q 6 v M i j h 3 h T o s D 8 c n W U v 7 g D / a O P O Y l t 53 a O z n 1 Y 2 T K Z u h 2 t I T 9 T f T I P T J C y b l B g 4 O x 8 + r g O i f b E Y G x Y F F n n D A N l 0 K L r / y B T 8 p l b 3 F a j w v Q 4 L k 3 d a R u r F h Z / 2 j c N t b 945 w x J s J W y H z d t / t 4 L t A 1 C T 0 T L p 7 j X B R 2 I Z U F v i P U G W c T 69 J H D S Y m l u n s R W b l w T S b a L b + h w H J + U n w I r t 1 d d H y P 2 Z E P v T 93 V N F p d 8 k 0 K k f Z C d J b h / Q 87 j h Y G t z u f h m S 64 s S 0 U N w T F p B n X x g S u 3 g f o m I g p b J j U C y r E T I f h m G 0 d l 7 r u A R v z r t Q 4 o s a M / 2 B R I 2 v c z 2 A U q 5 s g a 0 8 a + I A z E W 5 g 0 2 h l 0 J R w Y V 1 + P r F Y g k 2 Y N m d h 9 W D E S K B 6 U x p Y g S x T 8 C t q P I m C H / h g Q q g 6 F h f g X C P g 5 / u O l L y I e U 50 y C 7 + m H P U N K W 4 c p 0 8 S w C w f o m s o 6 C a 4 q d B o i s Q J o G S t B l 0 e Q 8 V C O x 4 G y y f A P q U O t p v L i N s 3 F C q 8 S U 9 W f 0 F J e 3 Q B E H y Z f E U / c N M O + o m R i Z r G 77 x W v l 3 L C L 3 C / 9 a H t 7 q r H 7 a z N x 1 p a l m N H + E / p b D 5 h n g 2 P l x 90 x e + 0 0 M 2 W 5 y c R S K z z R G f b H v z H f L g F o 9 w W x m D L Q S N G K V V l C C e w M s P y w l u V p d S + C w P r w W W w q L R a c 7 g y 9 N T J M n V V 21 R 7 F 9 k Y f h q 8 g p L S 3 v X 3 t x G S e j N g W q u v G V w m K S M / q 4 I Q Y u 6 v F j f i i K p u U B T v I V B P 1 b / U N c x I 7 y X I T A n K b G j J M b v O i f 4 x G 27 q C 46 p z T P z z c K x v N z M 2 C z x o q s X b k Q f S I h a U / 2 U q p w u q A N Y t Z y t G q o T r 4 O y K G h + a e q L W c j a g C X M U J Z V 4 c E X 66 t 6 A J 5 c C 2 M Z u K 1 F s A Q e X Z A F n c + K T m C D 7 P J n g 5 m 6 K w Z b Z O k A B y f / 2 u 5 Y S V l k w a / U a v s f B o c a 5 C k r N m o q q I B 66 w I l s A E Y B u 9 t + v z p d D f C L f 4 i Z u n T R a S g Y I j h W s j m C K T 5 Z 0 E A y k K w W G M e e o 3 B c K h Y g T 8 l u W f k j Q B g f F q 2 / y C i 3 H i Z v S 8 K / 0e5 p N J T M z 8 F B x 7 q l z 1 B J E J s g f A o 2 / w J C 1 F N K 2 X 6 h f C E S t P y G 2e2 J H 2 R / I q t I 1 D 3 F f e l b e n I i B A O U 1 + N b O g q j v 9 W Z x p Y a k Z 1 t k p P u z j 7 l T n f N c J I d s C M / 549 Y G V L P A G r 74 v v x D t c Z Y x b X y N Y y U X 5 Q v w V F n Z q B L L e 8 A 3 o A d M J 7 B c w n 3 Q x 0 1 + 3 V u A 7 r + W c A H v b 9 I h y B + 0 r P 5 l m I m 1 A Q h j P g o T Z z m d G 9 G 5 T 414 d i V m A + 7 J Q m v Y R o A p c 7 a 5 A H G / Z d t X w m t n / j + H c + z G M S e R q a 3 n z t j X R 0 U D Z O 5 R 1 / V h 4 f M V o 3 t + w + K t F u Y D c 3 O 8 Z w 1 o l 3 W x w y 4 L s L U F n f O v + J q x L K l t 26 n g p Y w 9 M Z y E t 6 N h b g p B e s n P 6 U 494 x I z 0 O t L Y z g j v W J W u W E q a W 0 + A p m y n k 5 O d y 7 / J V M P F 3 / f 2 C F x d R C / p t L 2 y D h b c 1 J c 5 C y Z f p 21 M C m e K 5 d v d 0 l i 7 / k 7 F O Q v p m Y N 7 Q i K r h u 6 c 7 V v F w n e I G A 8 f q H C o 24 T k + E 7 x L i p 8 g 7 T e / t P H i H n O 9 w K g z W g 1 Y r q 34 o P K m 1 A q D g D R 976 + c Z J l e j A 53 s D J U 8 W D n E + 9 N H S G X J h N u s s w / 3 v s X q m W A 89 G Q o o c r V p w L f D k l K h f B t S t o T f o S t s J l l F R 7 P d s y x I N t w O w z z i C r 4 N e x q C Q X q n 5 w H k r t Q i 5 f b R f a i C J v a L w Q a v Y M 5 Z d z y B Y 6 m g s c 8 E o y m S k s t C K + y / N O y g c Z F m Z Y 3 Y T 2 D f 88 q L 6 p + 57 X F 2 v s / D 0 B p c q + b V 2 Y i M T J j v + m i L 965 F q D e I E z h i A 4 M l f 0 E y Z w w T o A S B i Y c Z c H N U s F 57 C O U v 0 W N t X S u 19 E b j X e b o D q K 50 v i h J B B 8 i H 0 n j f v 6 F l p 3 o C y q T + M L 42 R 7 o H 6E96 W Q W / O V 9 L t v W c E d 5 q b 7 q b m 12 i B i / I 6 x b U 8 b D O O G P 4 q + 3 f h 2 c D X d r H N d p D 5 p b 3 u P X 7 D s e X n / d 6 D 3 s h W 6 D n N r N F f F l D J z v z H V b o n 3 J K G n B d 1 P O J b n x l A G 9 U I Y i r D w + d 8 w I F n p 7 X b h p o S N 4 A 96 y h l q H q b 17 + M K c P h i q O T 9 s Q i J k 9 N f i u p O 2 g d C z n x e W X P c L T P U V O r j k i L 8 r j P K r Y J J l 5 q o I Z R B H A J v g 4 M w q r B n z P e V r V w X l A h k m U P b b d q U a q o W + 6 X m 2 a 5 J 46 R l u S K o d V L 32 c Q R 87 F r t J b M t o l g r X A o 8 K M T g 2 w I U Q e W a z G K z F 0 I r V + m O W z m Z K 11 a 45 r S h h g m w W 5 j z h d n 2 s I d P t + J m 2 q R V h D Z Z b O / J J 0 O i w o g v S B e l Q O W 4 i Q L D 4 I o S q 1 F 17 u F n w b M 0 L Y 0 2 c T A a P j v H C v D H Q u W t o L 2 / f h / Q 5 x f z d 6 + F y G l z K 9 O o l I r P J J r 4 a A j 8 A 2 V n A O l o C c K o 8 d 0 z 5 G n 7 a E k m e u Z q m Q 5 P 5 x 63 x Q b j g H O D / w z I O n j q b W e I H 9 B Q n N 8 M V c t E f M k T o S 37 H C W D 0 c M 7 P M 5 G m n C k 8 Y f H D a K N 6 Q 9 J B t 1 O g K D w 9 X r s v e F 3 f 9 I P j l r h + U l O k g F 7 y l U + d j c G V Q T b 6 l 1 d 14 w 6 J K Z Y U z 2 r b X a B y n y q a M 7 V J 2 z 6 z 2 X f X q t G t N m n s N 3 H x Z n w B J + N 3 q q 8 U G j q 8 O J W G 4 l E p w E P z O b i K x z r L g M e N Q p 9 R Y + k 75 x / m u c r P 2e9 V Z o N / H F 7 w 7 N i z z G l S b O l Y N V p q 29 k 2 + u 9 e p o v f m N s X e J j 31 G o L 2 A 70 + f h B X + x y l u f o 2 h i L t m a 0 W 1 h t g S I T Z 6 c Z O l f v 0 6 a e t A 3 W B m 3 t A I l n f J B S t A e s L O b f 0 u u 9 x S C f S Z 9 x y S l K e K n h 1 m t B C A / h c U 80 h x Y 1 Z h d H f L W 1 L J Q o R S T w I r l f D 0 0 O t C T 6 j M v U V 7 x 0 n R w + 4 K z 5 t K O b M m x 18 P H w + D V n 36 t p Z 0 R / 6 g j C r 8 D p X 1 b 0 V j L 5 O T M D o d m O j s z E a P a 52 N i h 0 V u 5 X 7 W f d b z R D a x o W t 5 R w Z R i L l k 6 V P v F v z G 6 B Z g l 1 G V w K S 6 n e H e 17 M p R M h q O i G v Y k o 0 i J U 0 L l i l / w m z 1 + 20 Q p 3 x 5 R h g p u s H P 7 J A O 5 E c Y o / 2 Y O 0 O I B L j / v V z v X W m V O 2 u 4 G 36 u 2 A / Z 8 J 8 k t x p L O y L u I V f D j 5 O h m V l 1 T R 4 l U e K l E B u X 5 o g w s p G O 3 n A c T h O O y U t f + 1e92 o P H N q u I Q w U H 67 d P 6 p X W N W 2 u d e T W j P b z e N c I s H M Q D O t A i 9 / f a t m b y i m g m n R z W c d q K P B s h E 8 / g r y J s K j p + O 4 c q M D G H D l J b Z o U n k J 5 z / a 8 E O Y x L 1 o 0E+9 c z g a p 4 U a m 0 53 u m v S y I k p F F R 6 G 9 I f 7 M 91 H 6 p F O 5 R s S 6 x q z B t T L F j g I u R j O R x 0 4 U m h D M S 6 h x y 0 m V Z w C I c m 4 / p p m H 7 n 32 V r 7 Y H F 3 z n 6 / p R m C C T M a //1Qq+1awYUW+0xT6QG9nbVlIOIrO8WgRG+z5c8Nwuux8zKb2yY+91bqvV/+0473/ki8WR/tp8Wmm+EKG9BUcGIMdU5tePkNbL+h1+Dxpb5oGWjLXIgvbfvc5BlndePurVwhWWJ6hpkJICYwt6h8tE+qutrsH6gyNFmETiph+rzQbK2vbJ12miAsvfj+SiQ2gul1fZ08Z1wXYewQ+CYn0bprtt+Ac1Nu+8f0y+6KUTGf5Pa8+CMi9tc1vzEghSDd4AlEC26sID56m2G1jbto+3w09PSbnVZtpi+wQfRTAVH05v0n8idIJ1uGI+vhV7ouuThL7PGhARoj7GZ8KUDUTmX71zOvJwL6p5n+OsJ8sUW0k2cqh/xk/HbzwBp
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:00:10Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78dd69-d680-468d-8a43-4a68950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-26T12:32:28.000Z" ,
"modified" : "2020-03-26T12:32:28.000Z" ,
"description" : "RyukReadMe.html" ,
"pattern" : "[file:hashes.MD5 = '707cd0593aa6917a81cb18571d68affb' AND file:hashes.SHA1 = '83e2c8cd65f1a124cd680c797b517f67f0f0519f' AND file:hashes.SHA256 = '0cc351f09bf0de42a100bf4bc30cbd5e6e613055ef35354d0b8a613a748b0c8b' AND file:name = 'RyukReadMe.html' AND file:size = '627']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-26T12:32:28Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78ddfe-49d8-4865-9313-4dcd950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:04:14.000Z" ,
"modified" : "2020-03-23T16:04:14.000Z" ,
"description" : "Potential Cobalt Strike Beacon" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' 4 b d 6 b 95947819e3175031 b f 917 d a 0e6 e ' A N D f i l e : h a s h e s . S H A 1 = ' 90 c 80 b 856664 f 0 41770637 f f 6 f d 9 d c e b 2 a 5 e e a 0 b ' A N D f i l e : h a s h e s . S H A 256 = ' 28 a 40 d c b e 6 d 9626 d 2115 b 76 f 3827017 b a 7 c 5 a 68 d 40179e9 b 77955 f 0 b 13 a c 25 d d ' A N D f i l e : n a m e = ' 13307 d 2 . e x e ' A N D f i l e : s i z e = ' 285696 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A I e A d 1 A y R G S J Y E 4 C A A B c B A A g A B w A N G J k N m I 5 N T k 0 N z g x O W U z M T c 1 M D M x Y m Y 5 M T d k Y T B l N m V V V A k A A / 7 d e F 7 + 3 X h e d X g L A A E E I Q A A A A Q h A A A A 0 M b 5 l o Z m A P U S I H M Q D + V + n M v a V T D z F X W a 18 C f z 7 Q A N 11 j O B 0 I S 61 c E g S R l l P / U e R A w X z e x h 9 v E a 9 y w s v m m o W c 4 X 5 t + v o Y p q R L d m L Y p R j M 5 V x U 7 z Q P B O 4 v p d F i i R J Y n k r H o e 8 s K I r + V 35 k S a 3 V b p B Y N / S e a i p b 9 u b v h X 22 D C F b t F / O 7 T 3 e T q 0 Q K M d l a k s w + g b H 0 3 + Q d C i U d u H k d Q r g i a 4 Q t 7 E A j 2 Q X e y / f 4 w b 43 W Z N Z x Q R X S n 51 t e E S u x H X C c n M p x b J Y F C p 9 f 759 S l l L + q 732 u m j o B o g 6e9 J b G y X 4 G u 2 n v / j j 7 r w p m x K Z e O H G L u 5 w X q P s p 1 M p M w 3 J l O G a 2 w y E P w e t B e E z P c I 6 U R r z d r s R c u Q p d O i N G S a f B a 8 L b 21 W V e 0 P 9 R 6 f S p K f x L d 8 t s d 24 b H g w i 0 j P j U v 6 m g K H v a a A p n 3 t 6 K q Y R 8 Q / D 7 s 2E2 / 2 g w W + W M d y g R l T s l V I c 2 b + 1 D o y Y q 2 s P D p a i c s d U t K q Z B H U g X p J 4 W 9 p 2 S d G X 1 i j A U g + i + O 0 q h 8 W P X m h o y / t D K l e b f S 64 i T U u h F o F S 4 Y Z 6 Y R N k n + h C Y Y U t 6 J u x 9E1 f c v b B L W e p V m B i 36 I G F I A x o I N J d r 9 j z c E s i 1 S y c h K z Q D D b e Z l F 0 R c G V r f J c k + h A R j b M f G 1 G j K S L M r g L 4 I l i + g c j e l C 1 L v A n X R b + R X 3 W / j O V B W a H J H p 0 f E X d p R 8 + l e U d f d + a j 7 z J H l A d Z G I H v D 7 y w o 71 A x 4 l h b Y J q p z W x O H 3 z j n W F x u e B 3 / n W h n d 0 I r F k V x Q m Q u / X u E O I o O S K t l x E P y R j t 2 s I K W f 0 J 2 u G j T 9 D l R h C f Y x C c + I H W M + w d Y S 3 P G v p / c R E S o o 7 f 2 P Z D Q A H r 3 N M G O y h F Q A O Z I 2 R 7 Z I K z v 2 z K T E t i Y j J t N b h K 3 Y a 43 t g 3 x x W D L A v O / I / J S / s 1 K X W z m + Q G f N e f l f g J 6 P V y Y d q e j L r V 5 o d Y Z / u l m r + h Z J K x z O a X z i H n 13 v K H t A j U p L w P w Q a 5 g E B + 1 / 29 o Y v e h k / j 1 x P t r Y 1 K 9 g S 7 + A 0 v W o l g E V G N S 1 l Z i + A A A L Y 4 J B n f F W q K j E v 5 D Z v n m 3 L X I y u w / 8 v Q w l K F 0 E c 6 r T o l b n w M I V 170 F D f P h b n + x 8 F e A m a f 24 n O q t w K R a x / S b d G w Y L q 0 b U m n r J 9 g a l P 7 F X n u Y T o D s d 6 x 6 v 6 l z t U R Y 2 m d L t w I 1 L B d 7 t Y k o X / R 9 D f H m f 79 p l K U r g 38 f P 7 Y M p t r X 60 k C L 4 Q y r o L G m H H c / s p a X j p y u n x t y r c Z R Q W i 2 J y 3 I H 7 d F 6 b b M y q n X j E D k r G o r O s R F E i s g K 89 + t p H m t p D U b F n r 0 b m v k t t S 1 x / D L 2 N n G S c L 3 Z l i y r D u Z 2 y i R D r R r U Q d g t a X d 9 z J K s 1 t L 6 q 8 S D r R h O x V K l Z s t z c H U Y x / X E F I k 8 B Z c a N k c r P s i q s f V k y o a B + O B t 5 m K V U 62 q k T 56 J 5 o q i c R M 9 E D n f g + 9 F U X w R i d 1 J t g y n v v L c b t Q p L K u R X 5 Q S P 63 q T e y Y t A e / 3 X s 2 R G q 4 G h 8 M o J v 5 w t 4 p o C x T A I V f X m t 9 E w U 5 g A P d S B a j W 6 B G i 7 w o O m s / p f 6 c e g Z J s L f / A t l L Q G A G p v 9 W b z E c b L / Y C r O r C X N Z 6 s + J k 3 j N b s O W V 9 U j m J N q y q J a W P K E L L J 5 O e B c y 72 F C T M C C p M B 8 n P p 4 z s q 2 E V B v l V F h h U c d w h h 8 D q j A S 5 V i 45 t 7 Q 0 P W 5 a b H z S K n e o 2 s / N 35 g X R 6 h 6 u H M s 7 D i f z F s F k E r l 4 l W h U N A D h J G 93 k 8 e S b V y i z + Y Z 0 E f W Z e I 1 h r b 2 r w 9 J m z C K R l w 6 q 174 U 6 Y O n F k M v 2E9 P 7 Y Z 4 x k g U O m F 9 Q z Q 9 n R K 3 r t n j T 6 + 3 l q 2 y 6 e H b 1 z O 2 / J M q T 6 F 0 e p q p E w D x o + K 4 T e + 7 G U r b 4 G L d p o j d U 3 l P y E X C 0 R 5 g V w 9 l p r J m 3 p 2 v h c P h y + B 2 N / G b 7 t c T w B V y 40 L 34 U 3 k v K X z 1 r x i u Q b 3 b c e u J Q k 5 i 64 b A r x q 0 s h J W L X k / z Q 1 x j v f y H 5 w 5 P X e s / x I k 745 a Q L / t 9 M t F U a k l T + m 1 z O z 2 V 9 G L 8 O k d N D 2 a w z b 9 m V A r U t 2 c m 3 X u q o d e Z U p m C w 7 / 1 h i u 18 + e v Q T S i o d q i M a J 8 k L K l J 3 X p C 3 b z f 4 z x U g Y Z E a i z 0 7 x u x j z L h M v 3 L w W N 0 i c G 1 T g D v K M e p A p + + h c R N c e O 6 R 9 J y f A g g N C v e l M k 0 L y b w g u k h E W u 2 k 3 S q x H 4 Z i + 46 a N 3 D Z h h / U S + W A J R q Z P O T H 26 X F 1 w r 2 H i L X S 7 p A 4 c v D i F W r U 714 q j g s E m 8 r H F g + P J h x p / f 0 D + S / w 4 d o 3 n q 4 H 5 R P V X / 66 x i T S U B V R l n a A w J O p 91 T t + s 4 Z G K k U q z 0 X 4 r u 4 d I p H 7 t U N c t 3 k F w D 2 a 5 S L o X 3 B r r n 2 I k R T g 2 Q w z a b J g y K X V p z R c g p w K I O R 178 + 50 T h h + d r C F B r G i K Z 0 I G E q t 5 a R b 2 N o d 5 F y x t b p H P Q 952 K 1 w O R A e i 6 q / w 67 t g P 7 C 8 K F d N V / a h A q T b J K v B O 3 b w c n x g b W + 5 U h g z D / Y N b e W 53 P 3 b H 9 T F K c 8 A 9 e E D K z T q g Q i 6 A T G R 7 L p Q / Q n 0 k l Q D s u / v A 5 X w O C b i P n h X l K y p K V Y T o 9 q Q 7 V Q A q 8 o 1 u R 0 h H p F Z u / 8 + h z x U u s 1 r x P h f 6 x 9 u M o m 7 K k H z x e 2 V r i t v o k e Y O v P s 1 L g 6 G 7 U V 6 Z x M 4 Y r X 0 i Y D f H j 1 a 84 / G 1 h / 5 L o 2 P g + v X D 2 R V 2 s x i W v d O Q 9 t M q 9 V p T o O 2 l U U X Y K W t k h C r I v W J a G R p o / 25 v v b y T B 1 I a j c X g j E Z 7 r Y f d F v W Y T F k q 4 V s Z M C S S u R P 2 z Y P 5 c R b d b d P 4 l E w Q Z F u 46 + S j C K i A N 1 y y F A H o u v 5 n c Q 4 h a j / r V A f J d u E T K I W m 8 N u e d 7 v O o F p Q T P w N o c P 1 x 7 s w T 4 F 1 j 4 K F M H 6 e Y l s Y C S I I E W Z 77 I e q z C n p o j U u c 7 + 5 G E E I Q A J Y F o 0 u z c u j w u J 4 i z 2 P N d p T s 1 k P F U f 4 J v 6 U h Q + O 4 t 3 z n z 0 K e v a M o e D s U r 3 H F Z T a Z d o A d N D 4 l m F S D 4 d F 1 J y K M T k a x m L 1 Q D K E w 6 R Z 5 J t I B M X F P O 4 + i b F Y v 0 g E + s c 2 U a N i j x 9 V z m O f k s G b C b d h F D v r j H V e d o C L W e p c Z W y N y r d N k c w 7 Z k / n X w V o B a K s 9 c N G m R / 9 B y c 0 8 g 6 U 52 F W D e 5 h M R n 4 X 514 / h i y l m r D f X E 27 u H p c K f p Z i q i S 5 M W w F b N S D M a G Z 2 N Z q z M t k p G + X L H v t / f S Y O B 5 + 76 D q j T r 0 1 x y b h s q f 4 T t B G P + P 6 O 7 M Z V r S g N C v j A m 4 O o M A n R / n Y C w I u S 1 Q I A l b g B p i X N r + G Q e z R 0 P P r 7 S Q u S N x U n u 5 u h q D K d c r 8 B k m e Q C P T 4 U X q h V a i X h s y 5 n d y z g o a I o 40 Z w 23 m c K / Z k E Z Y N l Y Y I L y h e E i 0 1 W x / n 0 i C x 4 z Y 1 v 8 a N j q 8 V i Q 7 f p P n 2 M S G Y M / C V P I z + C M h F Y J j q 6 S / o 9 e Y 0 R G p C u e 7 Z W 1 X n Y 4 q f L R 7 Z P E T Z 23 / l 5 Z A I z 3 / b B A t V 56 V P H v O G n C S T e v Z D w V 0 5 e w S s G G + z v 0 D u z H v D n F j 0 w G B L T o o P G N A e V 7 W 2 p X o + U f k 8 C R n C 4 j + s t e 2 s x E b L h G f X 86 / R u 9 z U X o q r u i K X H 7 G L W 8 c O o F y w 35 M t 1 i t M 2 y B G W / 9 u s 7 S x m U g f y V h W E Y j D d b F Y l A p a c 1 H m I / E r e P C W r S + V / n O K z r 0 F Z A p h d p Q l W I s W / X U P l H Z j k 9 z e P + C a h z F S J 4 G 9 c B 7 U t u s y B P Z n R 0 4 L G W K j s 0 o k W w R S j G G Z X S E y Q D n j X h O n A B W B 3 N X 9 Y 0 a E D T r G M P B k F 9 o 1 H Y L X N u O b 4 C K a a / Q o M N M f V Z Z N X q c T 0 / 2 b k X V G 772 G Y C V 5 F B U 8 K e a N T r M H L J T v 5 A X 6 N n O h 0 l
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:04:14Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78ddff-bc64-4bd6-a15b-4221950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:04:15.000Z" ,
"modified" : "2020-03-23T16:04:15.000Z" ,
"description" : "Potential Cobalt Strike Beacon" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' 9692 c a 87687778 c 5 a 9 d 44100e6 a 6 c 4 b 4 ' A N D f i l e : h a s h e s . S H A 1 = ' 3e2 e d 3831001 d 5 a b d 32e581 e 31 b 4 f d b 38 a 8 d 3733 ' A N D f i l e : h a s h e s . S H A 256 = ' 0 4 c 1075572 d 92 c 5281 b 82 a d 0 17 d b 9 b 2 a 0 f 6374 b e f f f 3 b d 69e1 b a 81 b 722 c 6 a 9 b d ' A N D f i l e : n a m e = ' d 417 c 9 c . e x e ' A N D f i l e : s i z e = ' 285696 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A I i A d 1 B 5 B Y s U 104 C A A B c B A A g A B w A O T Y 5 M m N h O D c 2 O D c 3 N z h j N W E 5 Z D Q 0 M T A w Z T Z h N m M 0 Y j R V V A k A A //deF7/3XhedXgLAAEEIQAAAAQhAAAAPYkus58yzfoO82X9UhWlCHJwGs7KqI5AkiX8aZ/gBmgpcH76m29svIQo+z6moyM5G1oGJaIyF1ewCHUPlvgus0fYMUKqMDAMgkJxUBJE2xyq0CjjDWBoQWGLBqQRee9EGSDzohATFb1jQKTkMJ1Q4ssZbnX4gCHTfLDj7sEKDr+5biK9ONEMRAqW9QPA/k4d9iiaICap+43q0cQmaQuf5eGNpA6ZqbnoI4POPSezxelzmmQURSLTGtV2IxZH4AjbjF8iSxAf3WYBiC9DGnsFoZq2yBGgRfsJpqRJeKjlCcxhqNVeuFmpINbUOxVtaVZIhh31mJ1RFLfngrAMcRN5zyIQNsxNe4UozkjoI2Im5p78MOCR6rreXNjO6/Dj1GRZTK4eCF88Vm+AepLZ2ETwBdwu58W9ki88ytcpNTvN5tc9u6MrbEXO6Gl0uDKoLFn/PEeIqW0S81gEQM2axv13lcGKcMuZynzPTk4hWmzb+EqPv4jtZoEup7vdGt9WnpAriZXJy3yG74ZBcTZjCAIsSNsJk6mPJtdJAaE6RB1yqUoU37SirzPtGXKWeUjB/EGHuM7EfwsxwPw2ObcfpqfbfF7uIQFk6ZqQPKaC+uQxlc2AePbbGclfBTAZwDGUqV+JrSTpYb/rOVN9McGIkg4ibcIdK9NGItOUFFRwCAOLC7WDR0V2Y2DIafs68BWFUfXoKCmYukvI1YnDOMMafSvsnF3K+nK0I1aVFwg2y1VXCJ9ZK3U1LiMqhbR3dIzQOmAO5aFN2Aj/wU+HagjVXljnI9LcvwkyF9LXrVCQsSJfP/2CWR89/Q6G3xFSQugE+mvCiAJAhRPheuexdiZLZKzKD/RR3jqKy/gmzDymFeY+uKj5bk1UVNgbh/4Q9pFXUEVTXAn2tO8A684NOLGVkc28v32j4y8Ntz2eKbJqTe2l4QsQiRtts3zRVub5t1k8RMYHLTBzGkiihngdhWtPbvWbg1ZlsG0k6tZ/rOCOAQKKo/7Xi+bE28K3RGQU1UxfMqTMmO2Kptt/7URn+X5lhiNbakTnQKqsexLksmiAVWnsqPr+DlIRmzdv5wv6+lq5+om3FsRqaY+59hHDNNY4Tf23vz1fdMlRyHA2I9Ye7ALRj55qzCmx7P3RCFnpuA4EzBrzl1Lo5YKZQkg+Vsm7lwtfTN+AbZ7q//UVO85ZufVqjs+b8W0yI8B+LzIRWeNyl622YqB4krMV+g8jAUVV6YPm5RwkEuu6OvWLvIJeOli5WWdWNIg/lcWALBnIz5F5m8Bp9PIWnudr9irtF6Rc1MF+wbMiRvYDZ69JKJzfa3LoTxilry3YnrpODpD12kzgjMfxvb2vB8rpXWurfejWVCqHjNo/6Mx+r9Tgz5Z0PTGunOfZYh/XHexGwxfUgRVZgEZ2q6LNzPt8adNgaB/pp5/iWaIl6sn95SBmxUz8xS2A4n1MH/lGiHiuhc6rQ1HwPHZ88RjiqcclgmDFQlytB+/IUqAa6zX/pwyX2CAQMKL90C4xVJVQZVq/T4bzIZ3U6RsyPmwIVtWEvCqC8hnxeFcVO/XMXf2EHfKVq8ttj1bkin++QlJoqdGp/sBRuZO7Sk7TLVOz8B+RDK1YDRVMZZApnmGfAR6P1DxFQrLs0xOHyfj4VG8oB0O2Y02wcXYXorZ/zTX665hsTwQ6coEuJyBznATed2OBWJpEZES9ReaziHDa+DjjSh/XtBGmtGvKNvnfjHTC1o4s9LjGEWtJAWbGrNYEkL81oHIfeBYFwPtuLviUbT8hE3+vg4VnyRoVS7OJLH32lSxzJTDAI9BcGPp0lHffxUQv2VDOm8hY3+lxNACyejtb1NlhY3q07J/mtyp8vd4nYB3ZvGvVn/3s3zXJ3AaSLXr6R1HbNSGh5auGOAjjGwrp0dyDOoRfhYRFZsptiwvIoPdTBqqd6JahD+MnMj36Hag0mXujdI7R2+70v/Z7hfyafuTG3yjZvTjfkCSCJpUf13/tOwOveJZVBRN81rTf8EQaFolqn5cEZtGda7D+UTbPsajQNKszZCDLYFxKnR1bkkrVxOxLhF2nPmlXUgson2Rbyyr28/Z32WZ7mmv6vmb0xKWY3QupwQQU6yIwUV/uxbXZVqxfqL/U8x9/QjdnJykZda2Xv2r/qsHpQxWz2jweyolkM1zgWlgCseYpHyqNJYsXSUXyCJfs9RhR/IajCRGhA6dVxvUUK3n4sEEM2k0tLq5rrPMxBSxKNrXn8Egh9xSVYVG8S+rZ7o+zOfOqV3LrpbHCQxNU7M8WrC20e2GwqRUI3/ynfJNmBAfj+1UJP96PK9N83EgI7H0GS0n8BXegKdSYxWZA6GjsyN/UQ/DM5a2N3gKmforpq8mLXZpoHbpYdQdB//siUHqAnreEhHoTSd4TZ2lc0amfbvo4OjZ3V2/0HBPKvbW99fwAfdpUjMZaUEgapJRvs216DOdv0KMXCCcRjVP3vnhCZdXkyf8HJAq0PcU0ZuXlB3hq4jPC+1Z6PIilCfio5p5GxtoCiIx7/rNGrx/+ePezduGmRmftl/7G5eR5Niu+weZCugo8vtfywUdLWFUPUvpjQa8Jvv+PPkQNG4Aa85hWaV2+J+fO2omEtfVsp01u6eGNHfFpPUytczX29246GRU5ocSDeCeGFR8e1rB9yxQ2T713wivt8Q1qVlfl7WLPKVd25sKFxEmuEac8MKk1YAyojUK/xlX+L/KqkV8IoOkXJRh73S2uJOVrp1LCHqqbtJ6rftN+18JZWRFK1eX5pcorWbZQefWueFAROfmuHgf4GpGxEAiCcjY9Wr70U+8d2zDxNQsy6lNTzG6+TxXR7rPdF+gPY8UZ377+Xboqigzu/KgztPVmz9mfdpcyzzTqKa2MCI5pytt7Kdup8z+AF3uYgATF/R0+e1HQ2Ksb9HYtcFp0F6O0PbPrR+HiUtIsnYQIkaq6rmiAnoIR11YfZEYGcO0BFmTED2pNDuP86FV1PgfSH9l2ouDsjPvHW2qTIOJ7yI5UwNERYQ9jFmmoKV2QqI9I/fxgULbtzaCjLzkinROSbe+IrLozWOQVfHFjHBMbtR1U+xqGZixobdLitClNo/85Hx8sPIR7vCimGc1lp/aM/lCEerV8Bni+XVu78U9NQhBIbQTuivXZbIm9tT8/t/Pj1hbUv9pYBhrj9zOV1vHzSgtRdaH0Qt0CjbSg6Am7d+ZuIIQ9jRA8HNk+n1sD4Klz7XMCikJT3K5FBNn7KZiVvxRuNfU2c/mBOmGF0xr8QYYDqkyp1lswYa2TWKOZFK6ZeTMEIRMfA8chsqauYn/mOGsnh4DvS8puQgDXU1SaZWCYMic7jusFI1qT1PpBynDm1ZTlNh4+v1QNTzXsQ21PGp8Ss7hyjpYUYF2IyVq1pPxT2/DMk49nVOhyLAuyu5nwMTILaJcolZaYPzc7GjI4z7hQAiJZqGazJhdcoqSTG9tCYkoOcGXTjxx7BEcViv+XTWac91WWnyCYKhtXN0PVO3rqqN4m2tuGKwUvJHKi3fNVVDZoCBMjAZ8I7V0Qvn3PGvrRqTg+ZO2yLfTv+ABfMcxX+KRsWADpp7qpU3Y6PwIE4Zn88V1LSc48kZvLKN9+TPFPkvWjVhUgDXJuVpVGwHtTENK7kWZ7fITALjf
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:04:15Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5e78ddff-1490-43d3-b74c-4fbb950d210f" ,
"created_by_ref" : "identity--5e16d2bc-5c68-4ef1-bc80-47f5950d210f" ,
"created" : "2020-03-23T16:04:15.000Z" ,
"modified" : "2020-03-23T16:04:15.000Z" ,
"description" : "Potential Cobalt Strike Beacon" ,
"pattern" : " [ f i l e : h a s h e s . M D 5 = ' c a 7 b 238 d f 0 492720 b e a 33e2 c 0 a f 3 f 552 ' A N D f i l e : h a s h e s . S H A 1 = ' 18 a 45 b 60928 a 0e516 d 641 d e f 15 f c 49127 e f 0 888 b ' A N D f i l e : h a s h e s . S H A 256 = ' c a 7 f 5 a 7897 b d 4725390 d f 3e851 f a 19e54 f 9896 f 5 c d 27 c 1 a d 0 f 70321711963 c 51 ' A N D f i l e : n a m e = ' d b 73 b 2 . e x e ' A N D f i l e : s i z e = ' 285696 ' A N D ( f i l e : c o n t e n t _ r e f . p a y l o a d _ b i n = ' U E s D B B Q A C Q A I A I i A d 1 B O H z w + 3 E w C A A B c B A A g A B w A Y 2E3 Y j I z O G R m M D Q 5 M j c y M G J l Y T M z Z T J j M G F m M 2 Y 1 N T J V V A k A A //deF7/3XhedXgLAAEEIQAAAAQhAAAAJT5MUSv3bh+jJhABvMGvsfo+4ZOt4e5cXVlueI80YHO1o2C1+e2jn1DB0QOTa+rDvS8Ub25R4VZwx8mrcOob6FYlsRLMOMnowV1yyoCi5fev6zqZD8Ba3IvvAdfIE2xx1/YdD2Y22Kp9ZVfSdTwvkuP9q1PbCWI7ro7Nl/D70j0YGHL3No1BCGUZamc7DzAaBsnO9Ew1UAQRT+xUBC6FNTCMTXhstmFBrmxTfxS/AeNKwwSNZ302KqT3FIY+GtPmkWYWrIXCuIYGDCIN3trv3zBmdLv/iv8OBl+pL2NMh9Vz25RCmLXMUCGhFy+9HXPSieiOUFNV6bGYZqh0qBG7Shz2e6l7Tup3hdb3PiEs6iQ4tH0I+0IICIo9qfhAuvCgSNviYyNMSyoUxgSWlF0uWkaLTFYyox3KFXd2kMkbTVwIOu1e9FpHbzIzLj67JgDKwaVUvWgvk0YskkzsMeL8T4CsEsIuqhDMmb2lwJIG843YOCiyt5UYNK07Lf2LniSgW+DRMTZbSnm9Zas7KMEX2Dy/s7hIANzpClJlQrqaOqkzQJtY/1H3SZDegjmp7O7XFEXGc3rqDiGFbWY6WQ0rrKPGK+N5Ui0UfZBFmh0UqeTtrXJUwQLUDqe/Wba9vKdPSCvG/SpbgIvQL8+QlbBp76gs+TNMkpOJCeloL7p/hzUk5RKaGSR1ovn8EpcUNgGXLJ/mDWBhgIDpP25/H8IB7AVurZSZQJkf40amydxFfOHghlIk97vOaWcQGdEqxWFdm993/1v7ivI2CMaF1i1EeIzISH/+6meETQeqe1gOo0ST+TnC0v477Jn2OMhB4b8N22j6Fg2g0tJCPI4HA8SA+OASKwdwXauTujahkqP64YAGHBmLcg5pQzBXNMegv44ma4A7AlPFsAATY+1AuVj/jj8MtKw1v7+DBniN40pj2lV+NWi7vIQcBaPpCSelB1XjZyiteW5L9cf5y0b1PUhF307Pa15yz16omtHQr+mcrLPOiJ5RDlsHS/tVcwxod8gpkQ3fx9goHQlovAfcQ7wq27TE/zNOwpGcbEVH0c8EiF2y2SyF/eRBuAt5bAhrCS6XzAM9kfzma3+5w+QRI1vuwEhF3WgFkOGR7eR2HTBVyev2C40wumR/3WRaJYEV31QdMibvJC1p+QuL1vY0tduaC6JzKxorOqgvEZCEH8cRu3CX7BoZeQ8qp9J6SzbvBCEGxNqAhD57BvUWsbXckzev6VE18EmeBEZ2TN07RP9R+BIvAeosHbIYGTylH9Tg2RA/4AIgucrjkfz2xDp3YLqBnRR8EYAZ75huPhXMwgMwavhkB6U1LA0rKb0aS2ZzKbKNqty8sdGbbagiLY0UP28EGPyHKGETFjhhHNqZdpiGqszeJD52wZBYWxNcGBlS6bjS++qJv7FCZNZmJrW0qFwo22XlP/6XL+PXSmPn9EPMWAUfZGZY++P7+sI5k3tYayJ3UhgRavpPXxLO/JclN8k3XWUfm2HV7U/YlBoLwaMBW6SqE2ONiiQ/30V82/eD5U9uAudk7qeHgbyZWQWHuI50RKHnAVfV0YPNkjP9HPe2bwSmcFf0PYX93DaZRhyqQSj/8iA5MvePiAcQVkKmRKeYMKu7U+jdg6hhumDNPmoZUNCciSvB4/wH+frTIbjH4HkvYGuGkooEDb4zxrSgD7tT8twL+upooCtk6RT1BDDk78W0ww5PrAu8fv69U2HU4dnnPP1VfWYGNjDY+IncyaHKUvn2zww0sp43IXwnjhePpQ6mmJt5BNLKfkFH6ujW2NVYeZNe7+3vYjpS5IdGLDC9sTuL8YCFMCsMxCaPD0iHYTHpfJhh7UbCuw/2ElVm7VsdFmUn+f13cN6q/IMNhf3VyoakBZaq1Api2rVnW9Cd5+Z4O6SDGcP/VS2RYSfXKXwrsyIrqTzzKuI+X8uxvAJLHgCnWLoMCBlzDBqXKtmNi/3iVbv12/clmYLWtXIJKbphrrBn2gqlOCGTp6mHWLxzODpOIWdYryZqz6ZoleI8P5w29qtUuoaDJzr7M8gdzv48g8c5pq5tM2S7w0CTx41pzdzk3tQTQchN7i49YFWd8GW+k7z0p5BEwA4ZTOztBNmXL1sFpeokr+afaXYiBRtG4DiXZhw3cQNePuv15ktaPjaskeyM/mBTqwGfN3Zx3sbKhVugQxM8+Xq0MBh6IOolZrLAFPpQPqLtkIutPbS4piE9Sk9kSIJxNcbsm9K8otAsrKv98/1oYMxIDnJJOekdugiJg4HyeMxt841yH6Muro8nSiUEwWIfSl4ptfjb7gBpHQe6rR6p+RTj/LdM268s5Xveq84L0YeqsHiUzdaPQAlXBOlpwRj7tE0uVoorR2HA514nTYBRchZOa5Uq1gOXHQ8FpKbw+T556i426ikulmIsN/bylh3eZ6VrpF3/5CF2na0cK6JUY8Ar8ystgc4yjaDAJXf/xWFNKeqCTbaab3nV/4Iv6ZC/KQ+LMc0VlsEOMvqegfBuG5avmEDmtAxHqYiUCcDybLwQwd+3OkIDNi23x32y8RMQZ0tJGyVk0yYk8OzNEqh15C6zbW+BIM9mwBlKa7I9X9EAVxvsceC9QEXkoxScYZsPmGSlpAuLSXxvgc9EQHiucrAmRcwztgSM1Ya9mfpYEhll5T+/bBK4XxKm/KVi43LSlsivf2D4N1uaw1qiaVE27waunOjf5PAC/8KTa2xXdMKxg6KOXebj4IaJMq018Vq1WD1bdxKBcrz5ETnwHM4uGQgOiyEXKSXouqD5WQLv3pG711r7VIK0feXw4KC332bKgrNs0fTNdneEiIHKFekf+7MUoWiiCQZP6SkdCK4l3lO8lutIUCx1BtiL+/LFIC0DxAd5VXYtiGG8SzG4jvEtW7cBZAEPevORabaiDMXqoK6zHPEOAQ5YQrOUbNd30mZT+4Em0SfY+uw0AnaW2jaLtEyAZ6DLWMbThO28krDOYYFilq34seqzObGwkvHJpNsj7GOdz7sPXMkwrgxf26ssLyCRH8kHgIPunGJL1q/elu4GvmUpAiwhsPjFsejtv4hBNtb+Nv4Mo9pK3UhF/T47HMgFlWTL8wbZCHfe++bAZ7MPZnAEtdQLVwwCpXJjJWNdo768UvDvucmVvapusVFsChNp2qqaTxKj7I7A0PKTE8KBV4VOh/lFuBPGwP7pysLHeNVW52KVrHqbnjn7AtQZEw4bZcYKPMHQx1L3gB5Yni/9g7VDvhva/Q/6SlHalaje5mXjCw8+R/qo4Hof7+lKGIveCkHf3WJpJixXfjvVriyGUNOnM9/khH2hU+1jRD40EnIQbx/x37jpsUdHVAbNeUHZ/4VInFicA+tVMg/zMwmFf74UXQcSA5rwZUypeknvObnJMhy/aoXivFJG3Zg4URFJgLHChAXpfwv75TNYR4W1DycMLlKDWdODq7bUh5Nl3Vu1hVA47vn4EzgcWqPLqiwG+KMSCQi7bAj0NUqqt8AAJf75njtETx60CZ8ZPXgE9Hvq83UMIir9RqZMrrF771zmHzHMF3rj5vGI4NGuvvaKvNG0rwF886mgzhiL9gn0ZFYcDDFv4aOR7GnHKytsHd9qN5+Pr2Dr5OaqHdyIK9pWm2g0mB7DDtqwzxNW3Tdylp6bagdnHboW
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2020-03-23T16:04:15Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "marking-definition" ,
"spec_version" : "2.1" ,
"id" : "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da" ,
"created" : "2017-01-20T00:00:00.000Z" ,
"definition_type" : "tlp" ,
"name" : "TLP:GREEN" ,
"definition" : {
"tlp" : "green"
}
}
2023-04-21 13:25:09 +00:00
]
}
