2023-04-21 13:25:09 +00:00
|
|
|
{
|
2023-06-14 17:31:25 +00:00
|
|
|
"type": "bundle",
|
|
|
|
|
"id": "bundle--78deca96-305c-4582-9cd8-c5c39dcc2ab1",
|
|
|
|
|
"objects": [
|
|
|
|
|
{
|
|
|
|
|
"type": "identity",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2023-01-10T15:45:38.000Z",
|
|
|
|
|
"modified": "2023-01-10T15:45:38.000Z",
|
|
|
|
|
"name": "CIRCL",
|
|
|
|
|
"identity_class": "organization"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "report",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "report--78deca96-305c-4582-9cd8-c5c39dcc2ab1",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2023-01-10T15:45:38.000Z",
|
|
|
|
|
"modified": "2023-01-10T15:45:38.000Z",
|
|
|
|
|
"name": "OSINT (VT Collection) - GodFather Malware Returns Targeting Banking Users",
|
|
|
|
|
"published": "2023-01-10T15:45:48Z",
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"indicator--63135353-015e-4f09-b72e-a7ad0513a52c",
|
|
|
|
|
"indicator--03e416be-9ece-423e-9e02-943fc64d78b4",
|
|
|
|
|
"indicator--381c8714-cf57-4644-a95b-5053a5bfb907",
|
|
|
|
|
"indicator--771e426e-3d01-4350-b029-d5f6d42f53cb",
|
|
|
|
|
"indicator--2689dc56-7d5f-47e4-b4c2-853f0776e57a",
|
|
|
|
|
"indicator--8782702d-e060-4e0a-875d-2225795a78c8",
|
|
|
|
|
"indicator--274af04f-884b-42f2-9df4-d62c1c4a5b08",
|
|
|
|
|
"indicator--a00f2b17-bed8-45d2-b3fd-6b1e50ac5d33",
|
|
|
|
|
"indicator--3334658c-7313-455e-8706-8d21beb29578",
|
|
|
|
|
"indicator--bf58472c-fdfd-490d-b9da-f2c3eddeae2e",
|
|
|
|
|
"indicator--abe76623-d1d4-4fa7-8350-a4216e48adcb",
|
|
|
|
|
"indicator--34d074e9-8001-40ab-b497-2a464de2cd1f",
|
|
|
|
|
"indicator--a5a5fc97-6e9a-44eb-b569-4d73f634e069",
|
|
|
|
|
"indicator--20746a48-0da6-4f8b-934d-5cf32d815a96",
|
|
|
|
|
"indicator--631dc7f9-6f0e-4a37-8fde-590c95b0831e",
|
|
|
|
|
"indicator--71e5af99-b1d1-4a20-8a14-c8bb3c6bee5f",
|
|
|
|
|
"indicator--deb9b68d-720c-403a-a097-c731ee9cfc19",
|
|
|
|
|
"indicator--97dee319-2ec0-45ea-adb8-6dcf53d80d78",
|
|
|
|
|
"indicator--0b844791-b638-4700-8ae2-5c7c1d4d5bae",
|
|
|
|
|
"indicator--d3fcf9e3-f21f-4768-a8c9-e782f09275fe",
|
|
|
|
|
"indicator--a45443eb-f1cf-4477-9065-35c1d0ef6feb",
|
|
|
|
|
"indicator--b58ca60d-242a-4665-8bef-acdba573d77d",
|
|
|
|
|
"indicator--a57b8530-7c29-484d-a46c-fc392fab220f",
|
|
|
|
|
"x-misp-object--e5b7441e-1c99-410d-9ba2-53172c763547"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"Threat-Report",
|
|
|
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
|
|
|
"type:OSINT",
|
|
|
|
|
"osint:lifetime=\"perpetual\"",
|
|
|
|
|
"osint:certainty=\"50\"",
|
|
|
|
|
"tlp:clear"
|
|
|
|
|
],
|
|
|
|
|
"object_marking_refs": [
|
|
|
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--63135353-015e-4f09-b72e-a7ad0513a52c",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"modified": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '06b0bebc1422a969ef10a0f13fb253b0697d079d7126551370b9757da6564c9d']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2023-01-10T15:38:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--03e416be-9ece-423e-9e02-943fc64d78b4",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"modified": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '0932a99030a80786f8215e5cb5c879708848bd62141ff4672e23823ddc562ac7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2023-01-10T15:38:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--381c8714-cf57-4644-a95b-5053a5bfb907",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"modified": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '138551cd967622832f8a816ea1697a5d08ee66c379d32d8a6bd7fca9fdeaecc4']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2023-01-10T15:38:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--771e426e-3d01-4350-b029-d5f6d42f53cb",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"modified": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '32c7ef93f3329709bf38b7d6ea5f076fb8bd86d36785ed811d99efcb98f8ae58']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2023-01-10T15:38:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--2689dc56-7d5f-47e4-b4c2-853f0776e57a",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"modified": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '363eb5d89b43946a4af03e2399e47125bec822729d764b08004eb492212d51db']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2023-01-10T15:38:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--8782702d-e060-4e0a-875d-2225795a78c8",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"modified": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '3f7eae6cc61fdc2553a2acdede69be84945a7a724b632dea3ff8466f74b56249']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2023-01-10T15:38:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--274af04f-884b-42f2-9df4-d62c1c4a5b08",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"modified": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '40a099d574cd588903d9cf8701da8d006e58be406049d26a61cc291720270b60']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2023-01-10T15:38:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--a00f2b17-bed8-45d2-b3fd-6b1e50ac5d33",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"modified": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '50df8248535002052622f00b691bd60ad735e16e685a9d7b95a0850dc4229ad3']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2023-01-10T15:38:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--3334658c-7313-455e-8706-8d21beb29578",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"modified": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '536e9a5b341eb6e0708e58f65679232513b2896674b8b2615ff93c58fe1dbcf9']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2023-01-10T15:38:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--bf58472c-fdfd-490d-b9da-f2c3eddeae2e",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"modified": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '55183db5a190f08ce9e1589b2b7186ce64523c85c2c8b2ea03c52315b529b451']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2023-01-10T15:38:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--abe76623-d1d4-4fa7-8350-a4216e48adcb",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"modified": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '61e67d1ce1577d5a08d0ae970ac20fa5f0b8db3660b6c6c83189130be3039675']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2023-01-10T15:38:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--34d074e9-8001-40ab-b497-2a464de2cd1f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"modified": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '76cd894001f01f56299079b7eace162947b51b8b3a587c26709613e42279b850']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2023-01-10T15:38:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--a5a5fc97-6e9a-44eb-b569-4d73f634e069",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"modified": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '7d9d89371f0409660136ad7a238e345b140b9359fae186814ec9572996f373a6']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2023-01-10T15:38:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--20746a48-0da6-4f8b-934d-5cf32d815a96",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"modified": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '896301f184ff67a0fa9570e4275eafe66ab907636e381b86b87d28532aea0c82']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2023-01-10T15:38:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--631dc7f9-6f0e-4a37-8fde-590c95b0831e",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"modified": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '8d07967b9253951b52c631383a3dde8513572b3c996c338819f4e12a7a60bf23']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2023-01-10T15:38:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--71e5af99-b1d1-4a20-8a14-c8bb3c6bee5f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"modified": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '93a8d9d57a816b1c0401660256db8e37d29a92a43cd7d9668f9d05db820aa572']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2023-01-10T15:38:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--deb9b68d-720c-403a-a097-c731ee9cfc19",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"modified": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'b58b9a2ba58813ad4fbf2f6349a522f9a49bf8b3190237eb9c43c1d085f4497e']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2023-01-10T15:38:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--97dee319-2ec0-45ea-adb8-6dcf53d80d78",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"modified": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'd981bccfde804bb662e4acb1e7a97298b4a081c02b498a01abfeec74a60b8fdc']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2023-01-10T15:38:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--0b844791-b638-4700-8ae2-5c7c1d4d5bae",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"modified": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'da021a501372f8de9a1d2c11802ec452f218a1c3fd39356151acae076c3304ff']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2023-01-10T15:38:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--d3fcf9e3-f21f-4768-a8c9-e782f09275fe",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"modified": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'e67b8b78550396f542ded77d2118487ac1afb0d4ac6b70774889bbb4e6d88265']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2023-01-10T15:38:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--a45443eb-f1cf-4477-9065-35c1d0ef6feb",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"modified": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'e6fb245a7dd02af549e2d62f42413dcacda0fb847ee84d52b0f69c8219f3e81d']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2023-01-10T15:38:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--b58ca60d-242a-4665-8bef-acdba573d77d",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"modified": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"pattern": "[url:value = 'https://t.me/varezotukomirza,']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2023-01-10T15:38:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--a57b8530-7c29-484d-a46c-fc392fab220f",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"modified": "2023-01-10T15:38:38.000Z",
|
|
|
|
|
"pattern": "[url:value = 'https://t.me/varezotukomirza']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2023-01-10T15:38:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "x-misp-object",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "x-misp-object--e5b7441e-1c99-410d-9ba2-53172c763547",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2023-01-10T15:38:54.000Z",
|
|
|
|
|
"modified": "2023-01-10T15:38:54.000Z",
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:name=\"original-imported-file\"",
|
|
|
|
|
"misp:meta-category=\"file\""
|
|
|
|
|
],
|
|
|
|
|
"x_misp_attributes": [
|
|
|
|
|
{
|
|
|
|
|
"type": "attachment",
|
|
|
|
|
"object_relation": "imported-sample",
|
|
|
|
|
"value": "patricksvgrapi - GodFather Malware Returns Targeting Banking Users.stix",
|
|
|
|
|
"category": "External analysis",
|
|
|
|
|
"uuid": "2e86fbf1-6729-4eb8-9a5f-320d3a5da3c4",
|
|
|
|
|
"data": "eyJvYmplY3RzIjpbeyJwYXR0ZXJuX3R5cGUiOiJzdGl4IiwidHlwZSI6ImluZGljYXRvciIsInZhbGlkX2Zyb20iOiIyMDIzLTAxLTEwVDE1OjM4OjM4LjU5MTEyMloiLCJwYXR0ZXJuX3ZlcnNpb24iOiIyLjEiLCJuYW1lIjoiRmlsZSBoYXNoIiwiY3JlYXRlZCI6IjIwMjMtMDEtMTBUMTU6Mzg6MzguNTkxMTIyWiIsInBhdHRlcm4iOiJbZmlsZTpoYXNoZXMuc2hhMjU2ID0gJzA2YjBiZWJjMTQyMmE5NjllZjEwYTBmMTNmYjI1M2IwNjk3ZDA3OWQ3MTI2NTUxMzcwYjk3NTdkYTY1NjRjOWQnXSIsInNwZWNfdmVyc2lvbiI6IjIuMSIsIm1vZGlmaWVkIjoiMjAyMy0wMS0xMFQxNTozODozOC41OTExMjJaIiwiaWQiOiJpbmRpY2F0b3ItLTYzMTM1MzUzLTAxNWUtNGYwOS1iNzJlLWE3YWQwNTEzYTUyYyJ9LHsicGF0dGVybl90eXBlIjoic3RpeCIsInR5cGUiOiJpbmRpY2F0b3IiLCJ2YWxpZF9mcm9tIjoiMjAyMy0wMS0xMFQxNTozODozOC41OTExMjJaIiwicGF0dGVybl92ZXJzaW9uIjoiMi4xIiwibmFtZSI6IkZpbGUgaGFzaCIsImNyZWF0ZWQiOiIyMDIzLTAxLTEwVDE1OjM4OjM4LjU5MTEyMloiLCJwYXR0ZXJuIjoiW2ZpbGU6aGFzaGVzLnNoYTI1NiA9ICcwOTMyYTk5MDMwYTgwNzg2ZjgyMTVlNWNiNWM4Nzk3MDg4NDhiZDYyMTQxZmY0NjcyZTIzODIzZGRjNTYyYWM3J10iLCJzcGVjX3ZlcnNpb24iOiIyLjEiLCJtb2RpZmllZCI6IjIwMjMtMDEtMTBUMTU6Mzg6MzguNTkxMTIyWiIsImlkIjoiaW5kaWNhdG9yLS0wM2U0MTZiZS05ZWNlLTQyM2UtOWUwMi05NDNmYzY0ZDc4YjQifSx7InBhdHRlcm5fdHlwZSI6InN0aXgiLCJ0eXBlIjoiaW5kaWNhdG9yIiwidmFsaWRfZnJvbSI6IjIwMjMtMDEtMTBUMTU6Mzg6MzguNTkxMTIyWiIsInBhdHRlcm5fdmVyc2lvbiI6IjIuMSIsIm5hbWUiOiJGaWxlIGhhc2giLCJjcmVhdGVkIjoiMjAyMy0wMS0xMFQxNTozODozOC41OTExMjJaIiwicGF0dGVybiI6IltmaWxlOmhhc2hlcy5zaGEyNTYgPSAnMTM4NTUxY2Q5Njc2MjI4MzJmOGE4MTZlYTE2OTdhNWQwOGVlNjZjMzc5ZDMyZDhhNmJkN2ZjYTlmZGVhZWNjNCddIiwic3BlY192ZXJzaW9uIjoiMi4xIiwibW9kaWZpZWQiOiIyMDIzLTAxLTEwVDE1OjM4OjM4LjU5MTEyMloiLCJpZCI6ImluZGljYXRvci0tMzgxYzg3MTQtY2Y1Ny00NjQ0LWE5NWItNTA1M2E1YmZiOTA3In0seyJwYXR0ZXJuX3R5cGUiOiJzdGl4IiwidHlwZSI6ImluZGljYXRvciIsInZhbGlkX2Zyb20iOiIyMDIzLTAxLTEwVDE1OjM4OjM4LjU5MTEyMloiLCJwYXR0ZXJuX3ZlcnNpb24iOiIyLjEiLCJuYW1lIjoiRmlsZSBoYXNoIiwiY3JlYXRlZCI6IjIwMjMtMDEtMTBUMTU6Mzg6MzguNTkxMTIyWiIsInBhdHRlcm4iOiJbZmlsZTpoYXNoZXMuc2hhMjU2ID0gJzMyYzdlZjkzZjMzMjk3MDliZjM4YjdkNmVhNWYwNzZmYjhiZDg2ZDM2Nzg1ZWQ4MTFkOTllZmNiOThmOGFlNTgnXSIsInNwZWNfdmVyc2lvbiI6IjIuMSIsIm1vZGlmaWVkIjoiMjAyMy0wMS0xMFQxNTozODozOC41OTExMjJaIiwiaWQiOiJpbmRpY2F0b3ItLTc3MWU0MjZlLTNkMDEtNDM1MC1iMDI5LWQ1ZjZkNDJmNTNjYiJ9LHsicGF0dGVybl90eXBlIjoic3RpeCIsInR5cGUiOiJpbmRpY2F0b3IiLCJ2YWxpZF9mcm9tIjoiMjAyMy0wMS0xMFQxNTozODozOC41OTExMjJaIiwicGF0dGVybl92ZXJzaW9uIjoiMi4xIiwibmFtZSI6IkZpbGUgaGFzaCIsImNyZWF0ZWQiOiIyMDIzLTAxLTEwVDE1OjM4OjM4LjU5MTEyMloiLCJwYXR0ZXJuIjoiW2ZpbGU6aGFzaGVzLnNoYTI1NiA9ICczNjNlYjVkODliNDM5NDZhNGFmMDNlMjM5OWU0NzEyNWJlYzgyMjcyOWQ3NjRiMDgwMDRlYjQ5MjIxMmQ1MWRiJ10iLCJzcGVjX3ZlcnNpb24iOiIyLjEiLCJtb2RpZmllZCI6IjIwMjMtMDEtMTBUMTU6Mzg6MzguNTkxMTIyWiIsImlkIjoiaW5kaWNhdG9yLS0yNjg5ZGM1Ni03ZDVmLTQ3ZTQtYjRjMi04NTNmMDc3NmU1N2EifSx7InBhdHRlcm5fdHlwZSI6InN0aXgiLCJ0eXBlIjoiaW5kaWNhdG9yIiwidmFsaWRfZnJvbSI6IjIwMjMtMDEtMTBUMTU6Mzg6MzguNTkxMTIyWiIsInBhdHRlcm5fdmVyc2lvbiI6IjIuMSIsIm5hbWUiOiJGaWxlIGhhc2giLCJjcmVhdGVkIjoiMjAyMy0wMS0xMFQxNTozODozOC41OTExMjJaIiwicGF0dGVybiI6IltmaWxlOmhhc2hlcy5zaGEyNTYgPSAnM2Y3ZWFlNmNjNjFmZGMyNTUzYTJhY2RlZGU2OWJlODQ5NDVhN2E3MjRiNjMyZGVhM2ZmODQ2NmY3NGI1NjI0OSddIiwic3BlY192ZXJzaW9uIjoiMi4xIiwibW9kaWZpZWQiOiIyMDIzLTAxLTEwVDE1OjM4OjM4LjU5MTEyMloiLCJpZCI6ImluZGljYXRvci0tODc4MjcwMmQtZTA2MC00ZTBhLTg3NWQtMjIyNTc5NWE3OGM4In0seyJwYXR0ZXJuX3R5cGUiOiJzdGl4IiwidHlwZSI6ImluZGljYXRvciIsInZhbGlkX2Zyb20iOiIyMDIzLTAxLTEwVDE1OjM4OjM4LjU5MTEyMloiLCJwYXR0ZXJuX3ZlcnNpb24iOiIyLjEiLCJuYW1lIjoiRmlsZSBoYXNoIiwiY3JlYXRlZCI6IjIwMjMtMDEtMTBUMTU6Mzg6MzguNTkxMTIyWiIsInBhdHRlcm4iOiJbZmlsZTpoYXNoZXMuc2hhMjU2ID0gJzQwYTA5OWQ1NzRjZDU4ODkwM2Q5Y2Y4NzAxZGE4ZDAwNmU1OGJlNDA2MDQ5ZDI2YTYxY2MyOTE3MjAyNzBiNjAnXSIsInNwZWNfdmVyc2lvbiI6IjIuMSIsIm1vZGlmaWVkIjoiMjAyMy0wMS0xMFQxNTozODozOC41OTExMjJaIiwiaWQiOiJpbmRpY2F0b3ItLTI3NGFmMDRmLTg4NGItNDJmMi05ZGY0LWQ2MmMxYzRhNWIwOCJ9LHsicGF0dGVybl90eXBlIjoic3RpeCIsInR5cGUiOiJpbmRpY2F0b3IiLCJ2YWxpZF9mcm9tIjoiMjAyMy0wMS0xMFQxNTozODozOC41OTExMjJaIiwicGF0dGVybl92ZXJzaW9uIjoiMi4xIiwibmFtZSI6IkZpbGUgaGFzaCIsImNyZWF0ZWQiOiIyMDIzLTAxLTEwVDE1OjM4OjM4LjU5MTEyMloiLCJwYXR0ZXJuIjoiW2ZpbGU6aGFzaGVzLnNoYTI1NiA9ICc1MGRmODI0ODUzNTAwMjA1MjYyMmYwMGI2OTFiZDYwYWQ3MzVlMTZlNjg1YTlkN2I5NWEwODUwZGM0MjI5YWQzJ10iLCJzcGVjX3ZlcnNpb24iOiIyLjEiLCJtb2RpZmllZCI6IjIwMjMtMDEtMTBUMTU6Mzg6Mz
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "text",
|
|
|
|
|
"object_relation": "format",
|
|
|
|
|
"value": "STIX 2.0",
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"uuid": "8efbfb27-f004-49de-9610-9d91b39f4c48"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"x_misp_meta_category": "file",
|
|
|
|
|
"x_misp_name": "original-imported-file"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "marking-definition",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
|
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
|
|
|
"definition_type": "tlp",
|
|
|
|
|
"name": "TLP:WHITE",
|
|
|
|
|
"definition": {
|
|
|
|
|
"tlp": "white"
|
|
|
|
|
}
|
|
|
|
|
}
|
2023-04-21 13:25:09 +00:00
|
|
|
]
|
|
|
|
|
}
|
