25889 lines
2.3 MiB
JSON
25889 lines
2.3 MiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--5c6d21e5-bb60-47b7-b892-42e6950d2111",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2021-09-07T14:18:26.000Z",
|
||
|
|
"modified": "2021-09-07T14:18:26.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--5c6d21e5-bb60-47b7-b892-42e6950d2111",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2021-09-07T14:18:26.000Z",
|
||
|
|
"modified": "2021-09-07T14:18:26.000Z",
|
||
|
|
"name": "IoT malware - Gafgyt.Gen28 (active) - 20190220 - 20190222",
|
||
|
|
"published": "2021-09-07T14:18:33Z",
|
||
|
|
"object_refs": [
|
||
|
|
"indicator--5c6d24bd-d094-4dd6-a1b6-4fa3950d2111",
|
||
|
|
"indicator--5c6d24d5-3f18-438d-b77f-40fb950d2111",
|
||
|
|
"indicator--5c6d25b2-491c-4c4b-9ed2-45260add7fba",
|
||
|
|
"indicator--5c6d25b2-b900-4180-80a5-44e40add7fba",
|
||
|
|
"indicator--5c6d25b2-aefc-470d-8c36-477d0add7fba",
|
||
|
|
"indicator--5c6d25b2-9da0-4f41-ae71-4bc10add7fba",
|
||
|
|
"indicator--5c6d25b2-8418-4512-ac0e-429a0add7fba",
|
||
|
|
"indicator--5c6d25b2-3214-45fa-9073-41200add7fba",
|
||
|
|
"indicator--5c6d25b2-6ed4-44b1-b235-49a90add7fba",
|
||
|
|
"indicator--5c6d25b2-6040-426b-8539-4a520add7fba",
|
||
|
|
"indicator--5c6d25b3-c9c4-493e-b0ef-4a910add7fba",
|
||
|
|
"indicator--5c6d25b3-fc3c-4326-a26d-411b0add7fba",
|
||
|
|
"indicator--5c6d25b3-f31c-4575-a603-43d50add7fba",
|
||
|
|
"indicator--5c6d25b3-f5ec-45b6-9664-43aa0add7fba",
|
||
|
|
"indicator--5c6d25b3-56f8-4ba5-896d-4d4d0add7fba",
|
||
|
|
"indicator--5c6d25b3-858c-4985-bcf5-45e60add7fba",
|
||
|
|
"indicator--5c6d25b3-e6f8-404b-b245-488f0add7fba",
|
||
|
|
"indicator--5c6d25b3-a0fc-47eb-bb93-44ec0add7fba",
|
||
|
|
"indicator--5c6d25b3-8090-4aef-832a-45840add7fba",
|
||
|
|
"indicator--5c6d25b4-118c-40a8-95d7-407c0add7fba",
|
||
|
|
"indicator--5c6d25b4-b64c-4df7-9a9b-491f0add7fba",
|
||
|
|
"indicator--5c6d25b4-9a00-4467-b95e-4ef80add7fba",
|
||
|
|
"indicator--5c6d25b4-a64c-4623-bf7e-41bb0add7fba",
|
||
|
|
"indicator--5c6d25b4-381c-4a93-84cd-47410add7fba",
|
||
|
|
"indicator--5c6fbe6e-eba0-4dd5-8e04-4881950d210f",
|
||
|
|
"indicator--5c6fbe88-6100-4d4a-9efd-42de950d210f",
|
||
|
|
"x-misp-object--ab5f0c85-5623-424c-bc03-d79841700d74",
|
||
|
|
"x-misp-object--4f5d6000-e3f0-4282-944c-8ab3f686c973",
|
||
|
|
"x-misp-object--dc897614-58b7-418c-a6d6-fee0515c8e7a",
|
||
|
|
"x-misp-object--7f64ad39-cff6-472b-a6e1-7bf50d613d3c",
|
||
|
|
"x-misp-object--5d3c8572-b1e9-4af6-9067-34d2c9359651",
|
||
|
|
"x-misp-object--1c18e4e0-8fb3-4d11-ba91-63c60ca95981",
|
||
|
|
"x-misp-object--2198b5e0-4891-493a-8a0c-19452f7d5702",
|
||
|
|
"x-misp-object--4f3aeec4-3cbb-42ff-8caf-9b50e6e172b0",
|
||
|
|
"x-misp-object--9d4b06b3-e506-4b63-991f-fdde148494b0",
|
||
|
|
"x-misp-object--1d9b9f2f-295e-42bd-9793-e553832e940c",
|
||
|
|
"x-misp-object--7a8106f1-71ea-4f5c-8835-74ebe31688fd",
|
||
|
|
"x-misp-object--1f6dfa85-e357-46fc-aab5-c7f886092666",
|
||
|
|
"x-misp-object--9bd89f5b-da48-4fbf-bcf6-722baca2ea3d",
|
||
|
|
"x-misp-object--1bf32510-81a1-4ade-bccc-d0044cb5267f",
|
||
|
|
"x-misp-object--c873cad9-ab04-4a26-a0ee-fba9a8a4b27c",
|
||
|
|
"x-misp-object--0070abd5-c842-4a8e-8b48-54138e4136b1",
|
||
|
|
"x-misp-object--321a716e-311b-4023-a02a-1980cc3b3d02",
|
||
|
|
"x-misp-object--de794f38-760a-4c03-8514-98ddceeeddc5",
|
||
|
|
"x-misp-object--320625e6-bc23-4868-967f-ac3a684997fc",
|
||
|
|
"x-misp-object--504ec11b-59f4-488c-bd75-ca4d85c57f37",
|
||
|
|
"x-misp-object--23275e05-c202-460e-aadf-819c417fb326",
|
||
|
|
"indicator--3f183dde-981b-468a-b9ed-5c4c3e16b42a",
|
||
|
|
"x-misp-object--0efddb66-b6bf-4244-8fee-2cba6be0f5a1",
|
||
|
|
"x-misp-object--ae12d82c-b919-4527-b625-8c178fd4f30a",
|
||
|
|
"x-misp-object--91933b10-68ce-4a57-aed6-5f379af1b5e4",
|
||
|
|
"x-misp-object--b4c0cfbc-93ed-4be0-b4fe-b644085f4463",
|
||
|
|
"x-misp-object--38ec7e98-19ab-4d57-bb9f-7986d2c6a038",
|
||
|
|
"x-misp-object--a4a5a544-d184-49c3-9682-0b8c96d98c69",
|
||
|
|
"x-misp-object--632a229e-d0b5-4524-a97d-8816e5792f43",
|
||
|
|
"x-misp-object--e90c448e-ba4c-40cf-8546-cee2c43613c8",
|
||
|
|
"x-misp-object--c8acbc26-1989-4f19-abde-85f8ca74b0fb",
|
||
|
|
"x-misp-object--cb41f2a5-6432-4a61-a25a-b54abef32bc8",
|
||
|
|
"x-misp-object--51c1d7f7-0362-43a7-8a81-cf5d558e36e3",
|
||
|
|
"x-misp-object--39c43ea1-e61e-411a-b531-553326d63b56",
|
||
|
|
"x-misp-object--1fb60859-3d2f-488b-a56f-1cb8ea504f54",
|
||
|
|
"x-misp-object--9dbf82e2-a659-4f65-a1cb-1a4c1917a005",
|
||
|
|
"x-misp-object--4dbada84-b2ff-42b0-9263-5f43ec5ce1a9",
|
||
|
|
"x-misp-object--1608b5e5-da24-49e8-b0c4-8609562bce1e",
|
||
|
|
"x-misp-object--67da960b-1262-4850-8386-de665b4e1399",
|
||
|
|
"x-misp-object--af6f3841-8a1d-4348-8e26-9b0f175c048b",
|
||
|
|
"x-misp-object--ce498a1e-28d1-499e-afdf-799d6da13d3d",
|
||
|
|
"x-misp-object--4d9a9254-0873-49bd-9cfb-62a1f0848a58",
|
||
|
|
"x-misp-object--2cee848c-2326-4854-9d96-93a7fa2cf988",
|
||
|
|
"x-misp-object--d8d201a0-3149-42b2-9513-34b447c1c13f",
|
||
|
|
"x-misp-object--1926ac04-ef31-4e89-911a-345958a68ede",
|
||
|
|
"x-misp-object--e10eaa5e-938a-466b-8710-99628dd0f5fe",
|
||
|
|
"x-misp-object--6ff6a916-e131-436f-95b6-6266d38a16fc",
|
||
|
|
"indicator--82185331-b6b4-4731-9a54-341245df56f4",
|
||
|
|
"x-misp-object--470171f6-6891-4934-a348-9e23bb444d58",
|
||
|
|
"x-misp-object--ea29e220-832b-4092-a670-d3959c5e6f05",
|
||
|
|
"x-misp-object--8e75def0-9d85-46a9-b3a0-766442a23aff",
|
||
|
|
"x-misp-object--6283cbe6-5c69-44d0-92a5-f9947fb7f579",
|
||
|
|
"x-misp-object--857bd85d-cf7a-4c31-835a-d33b78de4309",
|
||
|
|
"x-misp-object--10cbb692-f777-4e40-b3a3-1530d159680f",
|
||
|
|
"x-misp-object--f5bb7808-71a9-480b-8be3-5a131cc7b14d",
|
||
|
|
"x-misp-object--54d38ffe-220a-487d-9d9f-4c9601bcfc26",
|
||
|
|
"x-misp-object--2b50e37a-113f-40b7-83db-8d7cecd7445e",
|
||
|
|
"x-misp-object--686654a9-8744-4acd-8c99-882671eb86a5",
|
||
|
|
"x-misp-object--ffa1f4b4-6c33-41bb-a9c6-8497c56cc1c1",
|
||
|
|
"x-misp-object--076dfd16-0873-42f0-b06f-fbbcaae6b7c8",
|
||
|
|
"x-misp-object--af66b768-1c00-49f7-a4ff-803d8ab37233",
|
||
|
|
"x-misp-object--dd6bb24d-60aa-4447-a2c3-53e4719c1a6d",
|
||
|
|
"x-misp-object--d17533f6-f053-4ad0-8ac3-e4640059a3f2",
|
||
|
|
"x-misp-object--925757a0-52b8-4622-a57b-ec05a890b587",
|
||
|
|
"x-misp-object--519d047d-55a5-45d8-ae55-1f511b364c39",
|
||
|
|
"indicator--ee88ac4b-ae90-4c72-9d23-ea171d52a814",
|
||
|
|
"x-misp-object--e826781f-d8c9-432f-9e69-4d36839e3633",
|
||
|
|
"x-misp-object--3986c66c-514e-404b-9e28-7ab45578994e",
|
||
|
|
"x-misp-object--bd803983-4b03-49b8-ac03-9d349ce2c233",
|
||
|
|
"x-misp-object--c0d75914-c1de-4526-a7ff-48062734a6bc",
|
||
|
|
"x-misp-object--56631f91-e310-44a3-9ffc-5f87beca5393",
|
||
|
|
"x-misp-object--fec33774-1305-4cf9-a062-9695c3c0b2f8",
|
||
|
|
"x-misp-object--8a8f8c42-4139-4fbd-8e47-95c67bf44b7e",
|
||
|
|
"x-misp-object--06eddc48-a6c1-4ee3-b93f-59153e8d07e8",
|
||
|
|
"x-misp-object--65ea31ac-3e42-4d1d-b488-ee8a30e3ddba",
|
||
|
|
"x-misp-object--c02bb6f8-3bd6-4cab-af0f-d4175ce1757b",
|
||
|
|
"x-misp-object--8e061ff5-a705-494a-8cec-a45f3aa7b0b4",
|
||
|
|
"x-misp-object--a30e6ecd-679f-41c5-9535-9bba600cefd1",
|
||
|
|
"x-misp-object--4fe89ca0-8d15-4412-9c39-907e06000097",
|
||
|
|
"x-misp-object--14ba151f-dbf3-4567-86d9-a7ef3a3a92a1",
|
||
|
|
"x-misp-object--ab60dc7f-1824-4330-ae97-d4fd35d8b19d",
|
||
|
|
"x-misp-object--8c00983d-18f4-43af-924c-52e733a3ba2b",
|
||
|
|
"x-misp-object--2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
||
|
|
"indicator--9fa78408-d5e6-4e34-9133-e6b63f8ccb00",
|
||
|
|
"x-misp-object--1d2a78b2-cca6-497e-8d34-e4aaf48058ab",
|
||
|
|
"x-misp-object--3736e5f2-fbf4-4c27-9a64-1329ce50e0ff",
|
||
|
|
"x-misp-object--053151e3-420b-4c23-a820-a05687c79638",
|
||
|
|
"x-misp-object--42057437-daf0-47d5-8ef9-1265ca9c3bf8",
|
||
|
|
"x-misp-object--55e74daf-857f-4346-9f69-051c3955ecf3",
|
||
|
|
"x-misp-object--db355308-9731-45bc-bf64-a51def874d82",
|
||
|
|
"x-misp-object--51a41008-1ed4-4a5a-b4aa-d61c285491d5",
|
||
|
|
"x-misp-object--b2e6ff07-699a-4a1f-aca7-3a21fc9300ef",
|
||
|
|
"x-misp-object--7ebf77db-51f9-4ccb-8d44-0900b626feb1",
|
||
|
|
"x-misp-object--31451acb-ef2b-4981-a413-52be999c4c77",
|
||
|
|
"x-misp-object--843e2684-e148-4805-8002-5680f152c755",
|
||
|
|
"x-misp-object--32380cda-a18c-42b5-9842-d32ed0ac8899",
|
||
|
|
"x-misp-object--b79752d2-5f10-435d-aad3-88d65099277c",
|
||
|
|
"x-misp-object--75289f6c-02f1-4bc1-bdcb-c2f34d6f534a",
|
||
|
|
"x-misp-object--6483f9f2-8ef6-455a-adb4-ee92998a2d8d",
|
||
|
|
"x-misp-object--2510904a-8b31-4775-b820-c2118673d768",
|
||
|
|
"indicator--6a28fa02-9b7a-4619-ac64-780383067644",
|
||
|
|
"x-misp-object--12e6d593-a557-4c6f-afde-5691fa98d03c",
|
||
|
|
"x-misp-object--626c678f-ed94-41f2-8bdb-5c22a0416ce8",
|
||
|
|
"x-misp-object--68122fa4-5fef-452f-b5c7-65856255d959",
|
||
|
|
"x-misp-object--98dcda44-bc1c-49d1-be0b-0b84a84cf09d",
|
||
|
|
"x-misp-object--8e4b1b09-47c6-497f-9e3f-f3944b9072dc",
|
||
|
|
"x-misp-object--c5228190-32c1-414a-9cf4-679d7b6c5278",
|
||
|
|
"x-misp-object--708f5d2f-37cb-490b-8273-aa0d60d45e30",
|
||
|
|
"x-misp-object--17269a28-42b6-4d6f-94e8-f1c16976b19b",
|
||
|
|
"x-misp-object--c28ef437-adb6-40bd-a96b-c3decc193b3e",
|
||
|
|
"x-misp-object--11a4d35a-907d-4351-abcd-dfcd4c4d0aa8",
|
||
|
|
"x-misp-object--c3c71253-50ac-4d14-9d85-8f08cba16df3",
|
||
|
|
"x-misp-object--db63748e-1bda-4748-bdd0-64159e4eb3a6",
|
||
|
|
"x-misp-object--3ee50d25-47b5-4e5a-bfe1-e6376f8e7e83",
|
||
|
|
"x-misp-object--a9c5f0eb-2b88-4b62-b69a-6de7f6682586",
|
||
|
|
"x-misp-object--96b539e3-df21-4c39-b770-a222dbb1e1a4",
|
||
|
|
"x-misp-object--551ba26a-581a-4c53-b192-ec14f254250f",
|
||
|
|
"x-misp-object--e9c37e32-2ab7-4409-ae3d-23b6911f98a5",
|
||
|
|
"x-misp-object--491db90d-b576-4739-bfdc-15c82825d4c2",
|
||
|
|
"x-misp-object--0432ec5c-2735-4638-aba6-74383c250015",
|
||
|
|
"x-misp-object--eea5d69c-5686-4b44-adc9-6d4f0a46c4ea",
|
||
|
|
"x-misp-object--85b5e80a-bbea-48d8-b54f-72e758c59ffd",
|
||
|
|
"x-misp-object--109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
||
|
|
"indicator--0b58e05e-34ee-4211-9c13-db3d9083b852",
|
||
|
|
"x-misp-object--461050ca-2a51-4f11-99ad-ec7a63b03ff1",
|
||
|
|
"x-misp-object--df522c29-c65b-48fb-afb0-d3a4932b1bdb",
|
||
|
|
"x-misp-object--45c8b70f-1502-42c0-bc02-f1d0ebc460d6",
|
||
|
|
"x-misp-object--33b1ae23-3cf2-45bb-88b3-3af9b3643cb9",
|
||
|
|
"x-misp-object--6675bbb5-046a-4034-adfd-d70db36993e1",
|
||
|
|
"x-misp-object--b4262ef0-03fc-4efa-a3b2-8a44fc89a4de",
|
||
|
|
"x-misp-object--05b17a24-12c5-4980-a8fd-d8d54f8d2a5b",
|
||
|
|
"x-misp-object--14689a10-2a7f-48b4-948f-824efe79131a",
|
||
|
|
"x-misp-object--652eae67-7686-4363-8583-b31aaed4af30",
|
||
|
|
"x-misp-object--60a5f09c-c861-4eca-9448-5e7bd592ecbe",
|
||
|
|
"x-misp-object--5d8e7117-335f-491c-8980-53cc0c20d4bd",
|
||
|
|
"x-misp-object--11bec101-ea69-448a-ae53-247c2f25a01f",
|
||
|
|
"x-misp-object--8d079804-d695-4435-819b-3f1a65812d66",
|
||
|
|
"x-misp-object--c2730fc7-ccd3-4ce5-8fba-da72a3db38c7",
|
||
|
|
"x-misp-object--f75edb72-2a39-4aac-934d-4980703c3a9d",
|
||
|
|
"x-misp-object--bb14a9d1-e11d-4590-83d1-0165d6c59aa7",
|
||
|
|
"x-misp-object--4a1d8145-fb08-41ef-80d4-50120ea92a11",
|
||
|
|
"x-misp-object--609bb5bf-21ce-4df3-ac3c-7c2a3a16fe6b",
|
||
|
|
"x-misp-object--96e3297f-ce4f-4c24-a681-26b10337c17f",
|
||
|
|
"x-misp-object--f7f0af2d-7551-405c-ac2b-f1f347b83d0d",
|
||
|
|
"x-misp-object--7dbd1012-551a-4944-9652-28e708774042",
|
||
|
|
"x-misp-object--80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
||
|
|
"indicator--ec4f8e6e-5a17-4c5a-adce-434e99f66868",
|
||
|
|
"x-misp-object--56573e90-319c-4ca3-ac05-7a9ac20743dd",
|
||
|
|
"x-misp-object--e896240e-1257-4cec-bb1f-90ca909285c4",
|
||
|
|
"x-misp-object--3e5eaa70-dd1e-45c8-ad6f-35ad3b7449ce",
|
||
|
|
"x-misp-object--1d17b468-ce54-48b9-a8a0-99af923ffe3c",
|
||
|
|
"x-misp-object--622d5d53-20d6-4c02-ab1c-ed562b45155e",
|
||
|
|
"x-misp-object--c3b033c9-8301-4eb9-a7c9-042bf5a2947a",
|
||
|
|
"x-misp-object--2595727b-8ac2-42c0-a335-601eb9968f76",
|
||
|
|
"x-misp-object--c805be7e-462a-4067-bdac-5a2da1a49d53",
|
||
|
|
"x-misp-object--67665457-214f-4ca0-a9e2-1caa8f1a4c1e",
|
||
|
|
"x-misp-object--4b8a75a1-68c0-498d-bec0-ac8af7b192d1",
|
||
|
|
"x-misp-object--fdfae2ea-c125-4b8d-85fb-34052ca74b95",
|
||
|
|
"x-misp-object--c5ea61b2-3a24-44c1-b223-d7405de29f18",
|
||
|
|
"x-misp-object--521c8b9c-76be-4a62-9dca-73e4c9b9c218",
|
||
|
|
"x-misp-object--c2b4cf8b-9b6b-4149-940b-11d0d691318d",
|
||
|
|
"x-misp-object--d137929b-9eb3-4c34-b326-d9a7014b134e",
|
||
|
|
"x-misp-object--3555c174-555f-4e29-9da8-5a6bb5018d8b",
|
||
|
|
"x-misp-object--760f1ed0-af91-44f1-a78b-2860b083a1ad",
|
||
|
|
"x-misp-object--7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
||
|
|
"indicator--5dc63b80-216f-4ae2-9c4e-c0d92e1608f2",
|
||
|
|
"x-misp-object--7bb5de32-42dc-492f-9f15-dcc7b301e494",
|
||
|
|
"x-misp-object--68eded72-59ce-4d08-bef1-668df62db58a",
|
||
|
|
"x-misp-object--09c61fed-920a-412b-a271-ce02a84a1545",
|
||
|
|
"x-misp-object--6f2f215b-e90a-407c-a890-9b4e7b6ddc25",
|
||
|
|
"x-misp-object--ee43fd41-f5e9-445a-b64e-591bae9edac3",
|
||
|
|
"x-misp-object--1a82c8d5-cc26-4b68-87a0-34c96ed9245d",
|
||
|
|
"x-misp-object--289f1b4c-540f-4f29-8969-e9ebcd0e670b",
|
||
|
|
"x-misp-object--e30070e6-2fe3-4492-9dbc-8a6ba6399a0e",
|
||
|
|
"x-misp-object--8aba5cf0-1929-436e-b447-dc91c761dea4",
|
||
|
|
"x-misp-object--14cb1917-5119-4963-a18f-dac5e7d2e59f",
|
||
|
|
"x-misp-object--daaf43a3-100c-4fe3-8e89-4adfd9057efe",
|
||
|
|
"x-misp-object--e92fec30-1048-41d7-adad-639103eaa63c",
|
||
|
|
"x-misp-object--020ca0aa-39e9-4f7b-982d-0ca840149593",
|
||
|
|
"x-misp-object--23e9bde3-6221-41de-943e-87d5c9c1d128",
|
||
|
|
"x-misp-object--614810d2-58b6-4b26-a507-2ed5e82abab6",
|
||
|
|
"x-misp-object--0b73ecde-d78d-45cd-8c84-be00190cd1c1",
|
||
|
|
"x-misp-object--64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
||
|
|
"indicator--bbe86c8c-5387-4624-b3db-0d287317db87",
|
||
|
|
"x-misp-object--9551bb88-fa96-4aa6-b707-cfb4cd8623fd",
|
||
|
|
"x-misp-object--2fcb8fce-1cef-4ef9-9efd-7a0b98c6a106",
|
||
|
|
"x-misp-object--1aa3230b-657e-4e2d-9e07-84564e79d11f",
|
||
|
|
"x-misp-object--d9cb1d67-bc67-4288-843e-fc58b2bcef1c",
|
||
|
|
"x-misp-object--1a3da186-1bbc-4a48-97b1-6440eca59723",
|
||
|
|
"x-misp-object--c216228a-4acb-47a3-8d5e-3f4a1beea28f",
|
||
|
|
"x-misp-object--733971a9-763b-4866-ae77-1700627e83cc",
|
||
|
|
"x-misp-object--f9aae507-1a91-4b11-aafd-2a42fbbc55b3",
|
||
|
|
"x-misp-object--a494e224-56b1-43cd-8678-60dff775e87c",
|
||
|
|
"x-misp-object--4efcbd17-7421-4e61-a49d-ad3da379ac93",
|
||
|
|
"x-misp-object--9ab8c8f5-6fa8-4f4a-a71b-3835066ce15c",
|
||
|
|
"x-misp-object--4f972a14-ad50-49dc-a95b-26939a450cb2",
|
||
|
|
"x-misp-object--dc0ed1b0-554c-41b1-98bb-de6a6bd8363c",
|
||
|
|
"x-misp-object--7d20a574-f708-4c7b-83a2-4b1e863e5034",
|
||
|
|
"x-misp-object--29ee112d-4c89-43d2-8ba2-eaceb48e47ea",
|
||
|
|
"x-misp-object--a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
||
|
|
"indicator--2778da7e-f6a6-4dfa-8675-3b0214ba6312",
|
||
|
|
"indicator--3c4ed87d-5198-4427-8fb2-cc8522bd9471",
|
||
|
|
"x-misp-object--11a24eda-644d-4f56-b930-c983aac96f18",
|
||
|
|
"x-misp-object--bff723ef-9525-4a8d-bbcb-753601d37d1f",
|
||
|
|
"x-misp-object--a49c56e4-b1e1-4a90-afc5-94f7685081b4",
|
||
|
|
"x-misp-object--b0776b62-9478-444b-9c3c-c2a23fb56166",
|
||
|
|
"x-misp-object--ecbfe0e5-1dc5-4622-8b31-9936022825a8",
|
||
|
|
"x-misp-object--88733aec-0db4-4ead-919d-7dcfe9a62add",
|
||
|
|
"x-misp-object--d0db047a-afca-43c5-bd64-7dffd0f35bb1",
|
||
|
|
"x-misp-object--69f51d30-c609-4518-9971-33891e74a22b",
|
||
|
|
"x-misp-object--928e4d64-d370-4ab3-ad61-288a74833311",
|
||
|
|
"x-misp-object--0ff49c85-00fb-4092-99b7-c6e1b843f89f",
|
||
|
|
"x-misp-object--7343fd4a-fcd7-4dd8-959b-7e502301d511",
|
||
|
|
"x-misp-object--055a24f0-2875-45f3-a7ed-4a44945d23d2",
|
||
|
|
"x-misp-object--4788fcc5-b819-409f-a970-8e3fef7d57f1",
|
||
|
|
"x-misp-object--e13cf509-faaa-4fa2-8905-57403bcd10b0",
|
||
|
|
"x-misp-object--fa037f31-83f9-48a6-a6b6-d705198c4000",
|
||
|
|
"x-misp-object--c4856c35-6cb0-42bf-a9f3-d3ce5619e33c",
|
||
|
|
"x-misp-object--ef892eee-4947-4c5c-b2dc-02c4e857d362",
|
||
|
|
"x-misp-object--07ea2ef7-9551-4312-9f4d-c35eb8644384",
|
||
|
|
"x-misp-object--3655f618-c369-48cd-ac03-09c998b3d4df",
|
||
|
|
"x-misp-object--3028e64b-ce69-4bb7-9130-bf908c6d8a71",
|
||
|
|
"x-misp-object--571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
||
|
|
"indicator--145938cf-4945-41a3-9bf2-5faacbf1f366",
|
||
|
|
"x-misp-object--e35ab664-d370-4925-a464-f43cc09ca4ad",
|
||
|
|
"x-misp-object--140ed95e-052e-402d-abe2-4216654b44e0",
|
||
|
|
"x-misp-object--6cc47bbf-9bdd-4a5f-bf98-5cc516bbf0cb",
|
||
|
|
"x-misp-object--69ed74d7-a7b4-4a25-8067-14b425cdfb18",
|
||
|
|
"x-misp-object--7bd7974f-8307-46b8-b3c4-e4eb88ccd02d",
|
||
|
|
"x-misp-object--baa88f1e-d75e-4a25-83ad-70258c54cc5b",
|
||
|
|
"x-misp-object--77aa1ec5-ea18-40f8-823e-a7595a9fe702",
|
||
|
|
"x-misp-object--310046fc-01e4-41d2-86a5-f515ca712b2a",
|
||
|
|
"x-misp-object--37c15adf-ea19-4531-8ab2-7adb7442b7e3",
|
||
|
|
"x-misp-object--47a5cfb3-b3d8-4372-b682-a0192c36d11a",
|
||
|
|
"x-misp-object--5a72317a-eb57-4df5-affc-4f4db6de49de",
|
||
|
|
"x-misp-object--91040cf2-0fa6-47d0-9b25-3d469c7da8d1",
|
||
|
|
"x-misp-object--3fd5d40e-c67b-46b5-a180-910ff2014aa3",
|
||
|
|
"x-misp-object--1b8bf0c9-da8e-4ebc-8fcf-12f148cb8aa7",
|
||
|
|
"x-misp-object--3bcb4d1a-66ee-48db-962f-a49a365cca79",
|
||
|
|
"x-misp-object--9c4329e8-ac6c-4b40-8b90-93c97d47ca19",
|
||
|
|
"x-misp-object--48c25567-9566-46ab-bd81-b76a29f55869",
|
||
|
|
"x-misp-object--5e67bb4a-3c5b-4fd9-bda9-52e99ec1a9ec",
|
||
|
|
"x-misp-object--4c8a51c8-1527-4aee-a2f5-b1107db7deab",
|
||
|
|
"x-misp-object--3cc45be1-3a29-4489-a74a-e3ac6595c32f",
|
||
|
|
"x-misp-object--86fa725a-e9cd-4388-9582-e6dfca955dc9",
|
||
|
|
"x-misp-object--307d5d46-5ba4-47af-89a5-baa05c4a9ef0",
|
||
|
|
"x-misp-object--a57e5e78-b889-4b58-b687-ccf0c7fffcfa",
|
||
|
|
"x-misp-object--f4ddf335-7cbb-4c16-9ccf-449c0398225e",
|
||
|
|
"x-misp-object--a9353096-af17-4e62-b066-40c4b6b32588",
|
||
|
|
"indicator--dd31ea85-5cbb-453f-85b0-296d5ca4daad",
|
||
|
|
"x-misp-object--e3af71ca-c00f-4243-886e-3c4d279bd335",
|
||
|
|
"x-misp-object--a2ea1f52-91be-4888-86e0-af75ed6a01b9",
|
||
|
|
"x-misp-object--01bb1781-57df-43f0-ae31-30611e59f11a",
|
||
|
|
"x-misp-object--a43da60c-51a0-4616-a935-b8ccfecf6559",
|
||
|
|
"x-misp-object--d25ea6d9-0e80-49d5-98e9-489b46660622",
|
||
|
|
"indicator--5c6e6e82-94e8-421b-9bfd-4be0950d210f",
|
||
|
|
"indicator--5c6e7107-c568-4761-94a1-407c950d210f",
|
||
|
|
"indicator--5c6e738d-9e4c-41f9-ab6d-4e63950d210f",
|
||
|
|
"indicator--5c6e738e-acec-4ded-8db4-4c2e950d210f",
|
||
|
|
"indicator--5c6e738f-57fc-48bd-bd19-4c78950d210f",
|
||
|
|
"indicator--5c6e738f-c234-4da3-a0da-44d4950d210f",
|
||
|
|
"indicator--5c6e7390-482c-409a-89f7-43c9950d210f",
|
||
|
|
"indicator--5c6e7391-4144-4296-8305-41be950d210f",
|
||
|
|
"indicator--5c6e7391-2b34-4fcc-808f-4796950d210f",
|
||
|
|
"indicator--5c6e7392-0974-4001-b08b-4ff9950d210f",
|
||
|
|
"indicator--5c6e7393-bc88-49b7-9f9f-4f99950d210f",
|
||
|
|
"indicator--5c6e7394-dd0c-49b2-9a62-44f3950d210f",
|
||
|
|
"indicator--5c6e7395-aed8-4781-aad2-42d7950d210f",
|
||
|
|
"indicator--5c6fbdde-e650-4d41-89b0-4376950d210f",
|
||
|
|
"indicator--5c6fbddf-482c-423f-8d8e-4a05950d210f",
|
||
|
|
"indicator--5c6fbde0-8268-4747-b0f1-49b4950d210f",
|
||
|
|
"indicator--5c6fbde1-de30-43f8-8bcc-424c950d210f",
|
||
|
|
"indicator--5c6fbde2-bee4-4d6e-a824-4594950d210f",
|
||
|
|
"indicator--5c6fbde3-d9a0-4009-8a03-41d2950d210f",
|
||
|
|
"indicator--5c6fbde4-300c-464a-a542-4548950d210f",
|
||
|
|
"indicator--5c6fbde5-e8bc-450c-ac02-4a4c950d210f",
|
||
|
|
"indicator--5c6fbde5-dc84-4660-af29-4a3a950d210f",
|
||
|
|
"indicator--5c6fbde6-3cd4-46aa-bbbd-4a8f950d210f",
|
||
|
|
"indicator--5c6fbde7-a888-4f78-ab3b-43a7950d210f",
|
||
|
|
"indicator--5c6fbde8-f124-4ab0-9316-4235950d210f",
|
||
|
|
"x-misp-object--d782cd47-8d2f-44cc-b5ff-5179f2f1f2ba",
|
||
|
|
"x-misp-object--a6780ee2-559e-4d53-b571-df123fa7ade4",
|
||
|
|
"x-misp-object--1c0c430d-30df-41e1-9e1a-1e291bf92014",
|
||
|
|
"x-misp-object--ca5fadde-6d66-4478-9f89-15aee8ae3781",
|
||
|
|
"x-misp-object--bdd37f7f-ce08-4bf8-a7b6-378947ac1f32",
|
||
|
|
"x-misp-object--684aaa66-2785-44f6-93f2-08fe5ef56710",
|
||
|
|
"x-misp-object--8560e314-a454-4bcd-a2d6-3f2f948f85f0",
|
||
|
|
"x-misp-object--2e5a1e33-ce78-48cf-bbf5-67cde8b81971",
|
||
|
|
"x-misp-object--e1c9702f-771a-4bc6-9dda-605e62b64bd4",
|
||
|
|
"x-misp-object--c445863d-249f-4f4f-8a2b-f334a57cd879",
|
||
|
|
"x-misp-object--46a3f6a3-d2fd-4d95-91f2-63c200bcc518",
|
||
|
|
"x-misp-object--90a03b89-315c-4f76-baf5-270b8f50dcba",
|
||
|
|
"x-misp-object--e56872f0-2860-4b90-b6d6-e90e54a7062f",
|
||
|
|
"x-misp-object--404871eb-92bf-4226-aef3-e35dd843f916",
|
||
|
|
"x-misp-object--db87582d-4bc5-44e8-bb5c-692c0a1675b3",
|
||
|
|
"x-misp-object--65a677a3-16ab-4e76-aed3-ecba7abc12f2",
|
||
|
|
"relationship--87ac1cfa-413f-485a-a968-1c8b3c19bfee",
|
||
|
|
"relationship--486450c8-d407-4a0c-8801-5366144e9567",
|
||
|
|
"relationship--995581e3-b771-40f2-91fc-0a8205cdb0df",
|
||
|
|
"relationship--a0e01e47-6eb3-43fc-8bba-e7f9393c5804",
|
||
|
|
"relationship--f971e341-fa71-493b-89e7-c23bd331dcd8",
|
||
|
|
"relationship--707902a1-5723-45ae-87aa-3c3cc9544a3b",
|
||
|
|
"relationship--8895514b-8083-4406-8de9-69823a4fcb2e",
|
||
|
|
"relationship--1431935b-73e5-40ee-a37a-e44ee3b530ae",
|
||
|
|
"relationship--896dde70-9273-4174-8ce9-2c934b691ed8",
|
||
|
|
"relationship--4cdc8fce-5c6d-425f-8518-a0b4fa80d7d2",
|
||
|
|
"relationship--0042cc85-e91d-4d30-b83d-b20d2477c67b",
|
||
|
|
"relationship--169e49ec-b063-4d9d-aa71-6fcfcb4550df",
|
||
|
|
"relationship--bf9fc089-411a-47ef-b117-8e0905e984ff",
|
||
|
|
"relationship--6c704288-a1a3-478f-8558-9e9abb0d4b0f",
|
||
|
|
"relationship--394bf2c8-cd41-463c-a90b-83037561be1b",
|
||
|
|
"relationship--acd2415e-ec73-4a25-afd9-53bef636b47a",
|
||
|
|
"relationship--cbacc7c0-6c13-481a-9adc-db18364f1620",
|
||
|
|
"relationship--703711a7-13ae-4fbe-aa67-e2a791e6feca",
|
||
|
|
"relationship--dbc6380f-6c05-499a-97df-5694d2c5ea45",
|
||
|
|
"relationship--156d2f49-9cb9-4ea7-8f7d-f61ad2df0a58",
|
||
|
|
"relationship--01ff68fe-38d8-4f49-9d88-27fadab7a12b",
|
||
|
|
"relationship--35dbf801-88c6-4344-b9b3-f0d67418e756",
|
||
|
|
"relationship--b879133c-8bdd-4427-9095-481ddd1ed751",
|
||
|
|
"relationship--c914887f-e8db-4384-8260-cceb48ba8817",
|
||
|
|
"relationship--f32a7fbe-1447-4e0a-bde5-02725fe40adb",
|
||
|
|
"relationship--697bbe14-c4bd-4906-bdd6-9d10419c3ff0",
|
||
|
|
"relationship--7e40c52d-c306-4fe8-b284-2f4bee2fb1db",
|
||
|
|
"relationship--83e74d0b-ab53-439d-ac34-9f6a6682cfa0",
|
||
|
|
"relationship--3a588e0f-c0b0-490a-a09f-fee0ab63c09b",
|
||
|
|
"relationship--94206def-9239-457f-886d-c8dc8e74de7c",
|
||
|
|
"relationship--486554f5-2109-4e12-a252-46f2ca423f1d",
|
||
|
|
"relationship--5c8eaf0c-0cf9-4124-aa4d-59a39a062607",
|
||
|
|
"relationship--aa16a024-835d-43af-baf8-189f9e9372d7",
|
||
|
|
"relationship--756e450e-1776-4ae5-83d3-33d10e035680",
|
||
|
|
"relationship--7e76a296-fb35-4fc4-935b-fcd680b18ddc",
|
||
|
|
"relationship--91466298-fa3c-437c-8569-34454afe3886",
|
||
|
|
"relationship--ee01e902-7594-4681-852e-a8d0c9c905ba",
|
||
|
|
"relationship--fc78b96d-d946-483f-9943-23cc8f670905",
|
||
|
|
"relationship--495a3e80-e1a9-4a22-81bd-e0e2701db80a",
|
||
|
|
"relationship--23e8fb9f-9dfb-4a60-b03d-bfe531644860",
|
||
|
|
"relationship--24069fce-65cf-4fa5-b622-99cbc85a420b",
|
||
|
|
"relationship--01004c6e-e28e-418c-b101-a4f150b38a77",
|
||
|
|
"relationship--b272d464-2ab5-4546-92b2-694aa1263d1d",
|
||
|
|
"relationship--74555e11-a30d-4f31-8db4-324707733774",
|
||
|
|
"relationship--fe480d95-665f-4b55-91d3-1e96864941f6",
|
||
|
|
"relationship--5219e1e6-875f-41d4-859e-414cb30e6922",
|
||
|
|
"relationship--91024cdb-21c2-4521-b89e-1374e0c9e46b",
|
||
|
|
"relationship--fdcf720f-e144-4177-ac77-c748b12eb059",
|
||
|
|
"relationship--6b0c7ca6-afe2-45dd-9f7f-e9c1c7e69b14",
|
||
|
|
"relationship--8928112c-74af-4604-9fb5-d749bfa42803",
|
||
|
|
"relationship--1e01af9e-3224-4de8-be59-d431f8852a1a",
|
||
|
|
"relationship--383467aa-6df3-44da-8d4d-d6a336bb2d10",
|
||
|
|
"relationship--cc7b6c8d-276d-43e6-a1d6-cdf1fd6cd4f8",
|
||
|
|
"relationship--5c6d5fca-9ebb-4df5-bd08-401765dca40b",
|
||
|
|
"relationship--12abc147-3038-4bb9-aa0d-0527c7582b7b",
|
||
|
|
"relationship--8f14e56b-649b-4e2c-8857-2db81b5776e0",
|
||
|
|
"relationship--7b613e9c-8239-4468-9102-96eea9125102",
|
||
|
|
"relationship--e394f6cc-cab1-4018-a5a7-169e43bc0cb0",
|
||
|
|
"relationship--4df301fa-2f0f-4d15-8e78-08fb8387fcb9",
|
||
|
|
"relationship--f26b790d-3778-42b9-a185-ca256fac0f86",
|
||
|
|
"relationship--c520483e-1967-4b3a-87af-bb979fda6ad3",
|
||
|
|
"relationship--6267311a-97cf-4903-b4ab-5ac104115d5e",
|
||
|
|
"relationship--e4047c99-ad48-4f46-99e8-a31e79e8942f",
|
||
|
|
"relationship--64324339-40bc-4f83-a4f7-7a60b5d67cd1",
|
||
|
|
"relationship--ad00c751-28a7-41ad-be7b-4d473dc26954",
|
||
|
|
"relationship--54e8e0bf-5867-4ffb-98eb-0a093b22cf44",
|
||
|
|
"relationship--ddbfcec5-867c-4d49-9d28-bff5e4fe5520",
|
||
|
|
"relationship--49184f05-62ec-4348-9a4b-9c3a12dc586a",
|
||
|
|
"relationship--3f6ffd46-6089-4b83-aa58-f1724ad9fdcd",
|
||
|
|
"relationship--414cb189-2eef-400a-936f-41c90172e2f4",
|
||
|
|
"relationship--7ea27add-9a9c-47bc-a447-548b1fa7bac4",
|
||
|
|
"relationship--cea425b0-4c7c-4fb2-b72f-b237724411df",
|
||
|
|
"relationship--6899bcd4-d5b0-445c-b741-a9ecf3b15d5e",
|
||
|
|
"relationship--d7a24555-7416-466b-a547-354e6711864f",
|
||
|
|
"relationship--b3a95435-61e6-4de0-9d09-f5fca57ff751",
|
||
|
|
"relationship--19aa83cd-51d1-491c-94d0-d4933f51caec",
|
||
|
|
"relationship--345c5b74-880f-46ac-930b-294644b365a7",
|
||
|
|
"relationship--c4b2b311-fb29-4dd2-a2c1-6d838b0ee0b3",
|
||
|
|
"relationship--bbe5eb56-0ed8-4d62-8000-ee0519bca478",
|
||
|
|
"relationship--e45ac432-8873-450a-bb0b-58bc41aa901f",
|
||
|
|
"relationship--aea348c7-4987-4276-807c-027d0ca0df2a",
|
||
|
|
"relationship--28d6b686-9a5f-481b-9041-b08536dc736d",
|
||
|
|
"relationship--08cc1af4-29e8-4057-a709-2c072482e452",
|
||
|
|
"relationship--b8fed001-cef2-4f6d-bea9-c0e6511fc935",
|
||
|
|
"relationship--f7ed9ac6-ed92-4f8a-b15a-f07857c30bfd",
|
||
|
|
"relationship--ccbd1757-69b9-465a-9099-d4f26562a32c",
|
||
|
|
"relationship--b642d1c8-13bc-4130-bd96-8a90a486561a",
|
||
|
|
"relationship--bd898bbb-c447-48ec-a3db-ff9558b376e1",
|
||
|
|
"relationship--cc638376-a93e-453a-8630-a7ec82fd3951",
|
||
|
|
"relationship--516134fa-6903-4524-8c4d-038ab792c4d5",
|
||
|
|
"relationship--d1d918d0-28af-486f-8eb4-3fab6de35f0d",
|
||
|
|
"relationship--b6574e82-0f7a-4231-9fda-92f882d539fd",
|
||
|
|
"relationship--e1769741-0bc1-4183-bd36-ed3c54292e6c",
|
||
|
|
"relationship--1e9f7364-5d74-47ad-9122-a61db07710d6",
|
||
|
|
"relationship--3a22154b-4c12-4d08-8d90-7c60353be86b",
|
||
|
|
"relationship--982079a7-cb10-44c7-ba75-b7196ae4d9ea",
|
||
|
|
"relationship--7ccb522a-b8ac-416a-9709-bcb1c9b92c90",
|
||
|
|
"relationship--72851d34-41d6-49ea-adb5-e41f7b60c7d8",
|
||
|
|
"relationship--bdf6d090-1d33-434c-b2a0-49b888401cee",
|
||
|
|
"relationship--d9abc2ff-c947-4de0-aa9c-2a3f322bf0cd",
|
||
|
|
"relationship--755d15b1-3143-4839-ad5f-0ce26f351613",
|
||
|
|
"relationship--efeb18fd-6d2d-48e6-a1c7-d1dc0259bd77",
|
||
|
|
"relationship--3ed913ca-1db8-4108-b398-1f4c80af69d8",
|
||
|
|
"relationship--ec085fc9-04d7-44b8-abcc-ce588dca56fa",
|
||
|
|
"relationship--ae6274dc-3b97-4827-be17-cabb545b8a8d",
|
||
|
|
"relationship--c82d1bc3-5673-4887-b88a-bc24dd371aca",
|
||
|
|
"relationship--537a3a72-09b2-49e9-8954-91744cb1959f",
|
||
|
|
"relationship--30e522ed-3d05-4e65-874b-4cce7fe92b93",
|
||
|
|
"relationship--5a1746e7-bc04-4fb1-894d-863cc3e72a50",
|
||
|
|
"relationship--17027316-8b98-4264-8f1b-9c462e934861",
|
||
|
|
"relationship--6bc08255-eae6-42b3-bb59-93476ca8aed6",
|
||
|
|
"relationship--fbccdc45-b298-4b94-9851-35030738b55d",
|
||
|
|
"relationship--b4359a75-bd3b-4363-8a0c-c1f43054acb4",
|
||
|
|
"relationship--4bf1d73a-b33c-4d5a-bf7e-b711ee64ce47",
|
||
|
|
"relationship--21d9b65a-eb0d-40f7-b8e2-cbfcde9b5965",
|
||
|
|
"relationship--22675c5d-3ee9-4bde-91df-76a75972047c",
|
||
|
|
"relationship--d8d95f9b-ada0-4816-b4ef-5646dd13e210",
|
||
|
|
"relationship--bbce4acc-21d6-4d67-bb44-b49343c87213",
|
||
|
|
"relationship--5b1c98fd-59b1-43ac-9ca3-ef6a1d0782fc",
|
||
|
|
"relationship--f6480439-3d39-4dde-a8c4-5604e405b49f",
|
||
|
|
"relationship--0a561843-0b27-4941-aa7d-275bb2fa8927",
|
||
|
|
"relationship--4d667216-52e1-4d40-b90f-762cc7ca33a4",
|
||
|
|
"relationship--68f26f3f-7077-4354-8945-a36ed2ae91dc",
|
||
|
|
"relationship--5bebe745-1352-400f-899e-a8c92033e50d",
|
||
|
|
"relationship--1e9ffabf-65a0-4ed4-bbe4-f0433d230edf",
|
||
|
|
"relationship--af731da3-241e-4cc2-a8ca-9e8174003540",
|
||
|
|
"relationship--c8b22ca6-18b6-4b98-a00b-dfdbd7e51085",
|
||
|
|
"relationship--6e6402f6-ccb1-4411-819a-093162c48362",
|
||
|
|
"relationship--bc30cebf-70a1-446d-8fa0-f37f34c07ea1",
|
||
|
|
"relationship--809a819f-a975-4ee8-bde3-6468d82e1718",
|
||
|
|
"relationship--3c139f26-ebc5-4672-a351-57fd59f50c82",
|
||
|
|
"relationship--4d1a5af0-5bf1-4beb-8858-8bd278b18b18",
|
||
|
|
"relationship--d703e537-20fd-47c7-bacc-3a674518d113",
|
||
|
|
"relationship--2248be1a-a931-49fc-9b73-2fd3dd07299a",
|
||
|
|
"relationship--d107d364-fa8b-4e39-bbe3-62ba6857967d",
|
||
|
|
"relationship--723bb4d9-1904-4be7-afd6-84a9c53c1ae2",
|
||
|
|
"relationship--de05a408-0f53-4c8b-9009-f6abbc22cb09",
|
||
|
|
"relationship--768251f7-4e40-4078-9578-4cd0dc8c502f",
|
||
|
|
"relationship--72f3dfc4-0073-48d9-9716-64d2deb52815",
|
||
|
|
"relationship--3c22de5d-f78e-455f-9245-5b5a8ef3b1df",
|
||
|
|
"relationship--be0a523d-defa-4aa8-8eec-355510e40b1c",
|
||
|
|
"relationship--705e4368-9024-4830-9936-66d395850100",
|
||
|
|
"relationship--d2db9580-9a66-44c2-b3ef-cb913b3cb02d",
|
||
|
|
"relationship--11859613-d48b-4f00-ae78-1002025a4771",
|
||
|
|
"relationship--2c6a8b76-0846-4ebf-bd06-900384c43167",
|
||
|
|
"relationship--530467aa-cc2c-411e-9b57-17b2f0ee0396",
|
||
|
|
"relationship--77e92bef-a17d-4dd5-889d-2dbaf1b162fb",
|
||
|
|
"relationship--8d0dbcdb-32a0-45e9-804c-efbe05a67eeb",
|
||
|
|
"relationship--6fcd86b3-fc78-44f8-9ed6-0b15e0f0bf99",
|
||
|
|
"relationship--6a3ca17c-42bc-4399-9aef-776a615b8c7e",
|
||
|
|
"relationship--cb89b7b1-aae7-417e-94b9-999c6db7da2e",
|
||
|
|
"relationship--7e72b942-f5ff-4824-b634-768cfa074264",
|
||
|
|
"relationship--f4efa4ff-ee60-4f23-8b8d-17729c814d5f",
|
||
|
|
"relationship--0e022ffc-ea9c-43be-abdb-2d8c0d330f44",
|
||
|
|
"relationship--bd0a4865-d5ab-4629-aee4-ae5d4c76ab61",
|
||
|
|
"relationship--eeeb3535-b954-4da0-9e06-6955c0dd7200",
|
||
|
|
"relationship--4633c3d4-1f3a-4014-b97b-23956f1ff2e5",
|
||
|
|
"relationship--103b26c8-14e8-4c9d-be33-4863cb108c2e",
|
||
|
|
"relationship--44f6e829-bf3c-4026-b0d0-60e309d64fe3",
|
||
|
|
"relationship--e9ae7b94-ca62-4a7c-a897-49387d68fca9",
|
||
|
|
"relationship--5af98b0d-d863-42bc-9ecf-e95beb4b6773",
|
||
|
|
"relationship--670f64ad-c804-48c5-badb-f8836231a9e7",
|
||
|
|
"relationship--74b29455-97ae-4e82-8fa2-d4b6031fada8",
|
||
|
|
"relationship--6d954b60-b844-4bb6-b68d-cffb9247c68c",
|
||
|
|
"relationship--d23928bb-61e2-4abb-a343-5f1a9c61c347",
|
||
|
|
"relationship--e2a37f9a-450e-4e87-89fd-96f07a04f476",
|
||
|
|
"relationship--66d6c044-8405-428e-8e71-ccb9c8ac380c",
|
||
|
|
"relationship--183415f3-8d63-4c99-9145-b2f293acf4ac",
|
||
|
|
"relationship--dcff23ec-da92-4352-a6aa-3637cd5b99cd",
|
||
|
|
"relationship--983a613b-c00a-45ed-ad7e-c83672b79518",
|
||
|
|
"relationship--dbe11594-08ad-4ddc-b370-2a09fd37c780",
|
||
|
|
"relationship--11e122d2-073a-413d-a1eb-a644973b0029",
|
||
|
|
"relationship--b696542d-460b-4a56-8cfc-30f79f5cb66f",
|
||
|
|
"relationship--1ba8a831-035b-4fe8-8419-868bbdc88248",
|
||
|
|
"relationship--3574f8e7-9828-4c37-99c0-d98e9dbac28a",
|
||
|
|
"relationship--fa83a026-fb5c-4087-b789-51aeb0aa9e32",
|
||
|
|
"relationship--eb3988a4-783e-4fdd-82e9-a1eaa61596d8",
|
||
|
|
"relationship--bcff4da6-024c-4a1b-89d2-0db9ccae35f0",
|
||
|
|
"relationship--c6ff6a1b-51af-4fcd-b66a-b0051da684c9",
|
||
|
|
"relationship--45cffa85-0138-4774-847b-6abfffd443e2",
|
||
|
|
"relationship--32444441-4abb-4bec-8192-2b6c46ac4019",
|
||
|
|
"relationship--f3ccdd5d-7f3a-4039-9f03-fb864e364213",
|
||
|
|
"relationship--acc90b4c-59e9-4dde-bb55-f982b59284d7",
|
||
|
|
"relationship--fd395944-cdc6-499d-b0f6-f8f4ceb52323",
|
||
|
|
"relationship--cb95475d-5abf-4a05-95d8-4d433e617d93",
|
||
|
|
"relationship--0ff7a19a-8138-4991-8459-ada43d4f574d",
|
||
|
|
"relationship--e1dcd7ea-cb59-4b54-99fe-9667ab336fbe",
|
||
|
|
"relationship--826c28e0-c46d-4163-85b2-4cf25836c628",
|
||
|
|
"relationship--4c484acd-dabc-494d-b889-c8da4fc0c708",
|
||
|
|
"relationship--2d0e2ed8-8c24-4881-ac7f-09d856ebf5bb",
|
||
|
|
"relationship--32da0281-133e-45b4-bd5a-7917dff1f8bd",
|
||
|
|
"relationship--091ff929-3ddd-4cae-8526-f114af156107",
|
||
|
|
"relationship--264ee688-8179-4b99-93bc-c719a638d73a",
|
||
|
|
"relationship--d381d67e-803e-4ca7-bac0-4003ca912686",
|
||
|
|
"relationship--1abbd61b-0d8a-4671-9cc9-877d2f15df61",
|
||
|
|
"relationship--44cbc1dc-4fa5-4148-a42c-86e691e8ca97",
|
||
|
|
"relationship--5eca2629-abe0-4124-95e4-10f7768c50cd",
|
||
|
|
"relationship--aa02617a-3cec-4865-b522-b36ac3cf0da7",
|
||
|
|
"relationship--4b5a986c-d5f1-42f4-b7f6-344f6036644a",
|
||
|
|
"relationship--152df8b2-5a37-4376-88f9-42cd9b3d3999",
|
||
|
|
"relationship--f89a215d-1704-4c56-a56b-047a4e0cda5c",
|
||
|
|
"relationship--5f4b4584-5f46-480a-96cb-64a468208fd5",
|
||
|
|
"relationship--167767df-b2f4-4dff-86c6-368b1a0b78c8",
|
||
|
|
"relationship--8f969f24-fece-434b-bbcd-ff242142e195",
|
||
|
|
"relationship--07a30b59-0931-40d6-add9-554fe0016656",
|
||
|
|
"relationship--6c4cc1c5-7a3e-4142-8610-dce2e8e0d010",
|
||
|
|
"relationship--953e3dfa-5f22-4010-906c-4f6c4fdb7524",
|
||
|
|
"relationship--2ac59e52-09d9-4b11-a9ee-bbd345ae9c7d",
|
||
|
|
"relationship--c536b331-53ba-43b3-b9fc-04b1cba8e766",
|
||
|
|
"relationship--e078d76c-2dd7-45aa-bcc7-b8e33a9de40b",
|
||
|
|
"relationship--67187b08-9473-4d8b-9e45-91ab634f8cfb",
|
||
|
|
"relationship--f7538637-a797-4c7e-a174-5bcb45bba1de",
|
||
|
|
"relationship--626224cc-8eed-4508-b19e-c902cfccee1f",
|
||
|
|
"relationship--76ace74a-617b-4f0e-ba72-e1badc12f2b4",
|
||
|
|
"relationship--5a9ac5c0-5f3a-47da-84a7-bbede05aeea5",
|
||
|
|
"relationship--4fe4fcf5-ca6b-4fbf-aa93-198c7ad451ac",
|
||
|
|
"relationship--01d54be7-b26b-448f-8940-8f993c4f91a2",
|
||
|
|
"relationship--60080cdf-7c77-4459-8763-0f91ef2b25fe",
|
||
|
|
"relationship--a004ab06-4857-469f-9d85-c25247667c30",
|
||
|
|
"relationship--33506e18-4ff6-47d8-bac6-3cfd78f4b6e8",
|
||
|
|
"relationship--49c9f32f-ba05-42ad-8595-c6fb8a45d7bd",
|
||
|
|
"relationship--2b844f27-d9a1-4d73-b1ae-b8805ebf4234",
|
||
|
|
"relationship--eefe1ff2-cf77-447d-8ef4-c3dfbe0604e5",
|
||
|
|
"relationship--ecdd67fb-a5a2-40da-a12c-f12aa4fd780c",
|
||
|
|
"relationship--bed21be0-a0a4-42cf-80ad-914b45bd587d",
|
||
|
|
"relationship--a9030ed8-4b18-4336-a9d4-cbab5a5771b3",
|
||
|
|
"relationship--4cba7e7b-5868-4753-afd5-34eb4d9699c4",
|
||
|
|
"relationship--3f074284-cef7-4001-94bd-056f39eb8f31",
|
||
|
|
"relationship--99360380-b593-4752-8c79-1ec628795430",
|
||
|
|
"relationship--b12ef13f-9da7-4e21-875d-d18073df0772",
|
||
|
|
"relationship--5e6dbca9-0121-41c2-b6a7-64849972e9a9",
|
||
|
|
"relationship--b917e5ac-792b-48c0-8f81-c8e4a706a2ae",
|
||
|
|
"relationship--cff2cad9-3a1d-4394-871a-1054461a1ebf",
|
||
|
|
"relationship--c3232a2e-8c85-4d9e-a993-bfa0eb8709d4",
|
||
|
|
"relationship--d88b27d7-9e3c-48ff-b333-7e7fdbc81a5c",
|
||
|
|
"relationship--8fed14ed-ec75-4f96-b7fc-4f33a26b2642",
|
||
|
|
"relationship--3cf6fba9-2b32-455a-9db0-d8d4b8a325af",
|
||
|
|
"relationship--0e87d71c-2a03-406c-8c50-f7932c2887b6",
|
||
|
|
"relationship--11a3f5fe-250f-4556-bbc0-0a111158225a",
|
||
|
|
"relationship--d105fa6d-b9b0-4c38-83d7-433170abb483",
|
||
|
|
"relationship--faede6e5-7c53-4e10-970d-4c65d54399cd",
|
||
|
|
"relationship--19b30927-c045-4152-a9e6-93428c520703",
|
||
|
|
"relationship--b4e125c5-a6bd-44b0-8b64-7f1850e0b3fd",
|
||
|
|
"relationship--d50d81f9-1fd4-476e-aaf8-0e5739c38f5d",
|
||
|
|
"relationship--53db6dea-cb5a-4b11-92f6-04434fef850a",
|
||
|
|
"relationship--df9c80b7-6226-490f-9f03-e7eaac4466ef",
|
||
|
|
"relationship--e98ea4c6-8da7-42b4-9c11-54b8c432b49d",
|
||
|
|
"relationship--d19a658f-f152-483c-ab69-8f22676103af",
|
||
|
|
"relationship--b80d4749-cd62-439d-b01e-6503cbc29adb",
|
||
|
|
"relationship--1bccc6bd-0c7f-40fe-a042-43448447d09c",
|
||
|
|
"relationship--9d168969-0a13-4896-9f33-6ad2cbabbe75",
|
||
|
|
"relationship--fed96d62-fed1-4f34-ab2c-a9413c7a8cd1",
|
||
|
|
"relationship--b90792a9-6897-40b2-8bb3-2e3829488c8b",
|
||
|
|
"relationship--78655f6d-8599-46d3-ba0e-11f683e5eea2",
|
||
|
|
"relationship--749a0063-73f4-4f7c-a903-9aaed7b94378",
|
||
|
|
"relationship--75cbe419-3402-463d-8b66-a3e192686d7a",
|
||
|
|
"relationship--ae6e5891-0bb4-4ec8-988f-7c20ed924469",
|
||
|
|
"relationship--6b3487fb-6ca7-45a8-b8cc-8abd8c2581eb"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"osint:source-type=\"automatic-collection\"",
|
||
|
|
"circl:incident-classification=\"malware\"",
|
||
|
|
"misp-galaxy:botnet=\"Gafgyt\"",
|
||
|
|
"misp-galaxy:malpedia=\"Bashlite\"",
|
||
|
|
"misp-galaxy:tool=\"Gafgyt\"",
|
||
|
|
"adversary:infrastructure-action=\"take-down\""
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6d24bd-d094-4dd6-a1b6-4fa3950d2111",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:58:21.000Z",
|
||
|
|
"modified": "2019-02-20T09:58:21.000Z",
|
||
|
|
"description": "Delivery point for the malware",
|
||
|
|
"pattern": "[url:value = 'ftp://185.135.80.163/']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-20T09:58:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6d24d5-3f18-438d-b77f-40fb950d2111",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:58:45.000Z",
|
||
|
|
"modified": "2019-02-20T09:58:45.000Z",
|
||
|
|
"description": "Delivery point for the malware",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.135.80.163']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-20T09:58:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6d25b2-491c-4c4b-9ed2-45260add7fba",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T10:02:26.000Z",
|
||
|
|
"modified": "2019-02-20T10:02:26.000Z",
|
||
|
|
"pattern": "[url:value = 'http://185.135.80.163/DEMON.mips']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-20T10:02:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6d25b2-b900-4180-80a5-44e40add7fba",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T10:02:26.000Z",
|
||
|
|
"modified": "2019-02-20T10:02:26.000Z",
|
||
|
|
"pattern": "[file:name = 'DEMON.mips']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-20T10:02:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6d25b2-aefc-470d-8c36-477d0add7fba",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T10:02:26.000Z",
|
||
|
|
"modified": "2019-02-20T10:02:26.000Z",
|
||
|
|
"pattern": "[url:value = 'http://185.135.80.163/DEMON.mipsel']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-20T10:02:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6d25b2-9da0-4f41-ae71-4bc10add7fba",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T10:02:26.000Z",
|
||
|
|
"modified": "2019-02-20T10:02:26.000Z",
|
||
|
|
"pattern": "[file:name = 'DEMON.mipsel']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-20T10:02:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6d25b2-8418-4512-ac0e-429a0add7fba",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T10:02:26.000Z",
|
||
|
|
"modified": "2019-02-20T10:02:26.000Z",
|
||
|
|
"pattern": "[url:value = 'http://185.135.80.163/DEMON.sh4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-20T10:02:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6d25b2-3214-45fa-9073-41200add7fba",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T10:02:26.000Z",
|
||
|
|
"modified": "2019-02-20T10:02:26.000Z",
|
||
|
|
"pattern": "[file:name = 'DEMON.sh4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-20T10:02:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6d25b2-6ed4-44b1-b235-49a90add7fba",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T10:02:26.000Z",
|
||
|
|
"modified": "2019-02-20T10:02:26.000Z",
|
||
|
|
"pattern": "[url:value = 'http://185.135.80.163/DEMON.x86']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-20T10:02:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6d25b2-6040-426b-8539-4a520add7fba",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T10:02:26.000Z",
|
||
|
|
"modified": "2019-02-20T10:02:26.000Z",
|
||
|
|
"pattern": "[file:name = 'DEMON.x86']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-20T10:02:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6d25b3-c9c4-493e-b0ef-4a910add7fba",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T10:02:27.000Z",
|
||
|
|
"modified": "2019-02-20T10:02:27.000Z",
|
||
|
|
"pattern": "[url:value = 'http://185.135.80.163/DEMON.arm6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-20T10:02:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6d25b3-fc3c-4326-a26d-411b0add7fba",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T10:02:27.000Z",
|
||
|
|
"modified": "2019-02-20T10:02:27.000Z",
|
||
|
|
"pattern": "[file:name = 'DEMON.arm6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-20T10:02:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6d25b3-f31c-4575-a603-43d50add7fba",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T10:02:27.000Z",
|
||
|
|
"modified": "2019-02-20T10:02:27.000Z",
|
||
|
|
"pattern": "[url:value = 'http://185.135.80.163/DEMON.i686']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-20T10:02:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6d25b3-f5ec-45b6-9664-43aa0add7fba",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T10:02:27.000Z",
|
||
|
|
"modified": "2019-02-20T10:02:27.000Z",
|
||
|
|
"pattern": "[file:name = 'DEMON.i686']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-20T10:02:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6d25b3-56f8-4ba5-896d-4d4d0add7fba",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T10:02:27.000Z",
|
||
|
|
"modified": "2019-02-20T10:02:27.000Z",
|
||
|
|
"pattern": "[url:value = 'http://185.135.80.163/DEMON.ppc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-20T10:02:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6d25b3-858c-4985-bcf5-45e60add7fba",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T10:02:27.000Z",
|
||
|
|
"modified": "2019-02-20T10:02:27.000Z",
|
||
|
|
"pattern": "[file:name = 'DEMON.ppc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-20T10:02:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6d25b3-e6f8-404b-b245-488f0add7fba",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T10:02:27.000Z",
|
||
|
|
"modified": "2019-02-20T10:02:27.000Z",
|
||
|
|
"pattern": "[url:value = 'http://185.135.80.163/DEMON.i586']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-20T10:02:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6d25b3-a0fc-47eb-bb93-44ec0add7fba",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T10:02:27.000Z",
|
||
|
|
"modified": "2019-02-20T10:02:27.000Z",
|
||
|
|
"pattern": "[file:name = 'DEMON.i586']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-20T10:02:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6d25b3-8090-4aef-832a-45840add7fba",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T10:02:27.000Z",
|
||
|
|
"modified": "2019-02-20T10:02:27.000Z",
|
||
|
|
"pattern": "[url:value = 'http://185.135.80.163/DEMON.m68k']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-20T10:02:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6d25b4-118c-40a8-95d7-407c0add7fba",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T10:02:28.000Z",
|
||
|
|
"modified": "2019-02-20T10:02:28.000Z",
|
||
|
|
"pattern": "[file:name = 'DEMON.m68k']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-20T10:02:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6d25b4-b64c-4df7-9a9b-491f0add7fba",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T10:02:28.000Z",
|
||
|
|
"modified": "2019-02-20T10:02:28.000Z",
|
||
|
|
"pattern": "[url:value = 'http://185.135.80.163/sh']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-20T10:02:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6d25b4-9a00-4467-b95e-4ef80add7fba",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T10:02:28.000Z",
|
||
|
|
"modified": "2019-02-20T10:02:28.000Z",
|
||
|
|
"pattern": "[url:value = 'http://185.135.80.163/nut']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-20T10:02:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6d25b4-a64c-4623-bf7e-41bb0add7fba",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T10:02:28.000Z",
|
||
|
|
"modified": "2019-02-20T10:02:28.000Z",
|
||
|
|
"pattern": "[url:value = 'http://185.135.80.163/apache2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-20T10:02:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6d25b4-381c-4a93-84cd-47410add7fba",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T10:02:28.000Z",
|
||
|
|
"modified": "2019-02-20T10:02:28.000Z",
|
||
|
|
"pattern": "[url:value = 'http://185.135.80.163/telnetd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-20T10:02:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6fbe6e-eba0-4dd5-8e04-4881950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T09:18:38.000Z",
|
||
|
|
"modified": "2019-02-22T09:18:38.000Z",
|
||
|
|
"pattern": "[url:value = 'ftp://185.135.82.116/']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-22T09:18:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6fbe88-6100-4d4a-9efd-42de950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T09:19:04.000Z",
|
||
|
|
"modified": "2019-02-22T09:19:04.000Z",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.135.82.116']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-22T09:19:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--ab5f0c85-5623-424c-bc03-d79841700d74",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:46:24.000Z",
|
||
|
|
"modified": "2019-02-20T09:46:24.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "NULL",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "be442f65-789e-44f5-ae00-336eb6c32d78"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d297f64b-74df-4f93-a9eb-bb8780fbdadd"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--4f5d6000-e3f0-4282-944c-8ab3f686c973",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:46:24.000Z",
|
||
|
|
"modified": "2019-02-20T09:46:24.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".init",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7f3bc4cc-4323-48d3-9190-bc02c31ae268"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "29cd4320-fa69-44bf-a770-7cdd4a6e31bd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "af3172dc-e50f-4e00-9e8e-6e7483a84183"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7b964085-e632-4767-b1b8-35dffb9aa068"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "24",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "61d181d5-65e2-49f0-af81-e02f8fd427b0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.136842188131",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b786eb3b-8b39-429a-908e-f7687050ad47"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "7fcf78111133a7c68de5cd192adb4131",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "50022e4f-414d-4fb1-9f35-d680c8381622"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "7d047261e5ef5b461ceaa73a9e18e4d0f33ceb7e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d9e97ba6-1f67-417d-8d5e-5d0ba7c6cfe2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "b0fd3b5c5e3ff1b290e3056639ea0bcf9ab17ab0f7c8449ffe1027866bf03ca4",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "06036345-be1b-41cf-a67d-187bd097b66b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "9460a4051ef0944b0e343ae72251661aa9f29b4cf2f7dea5cae5d2358060f0b208ce42c851cc0aae33a993068039236153f61a3e6ab8e7c62a5d02de596eadf9",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "51e732a1-0132-4211-bf24-307ba3d61077"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:4FcMhZUfRn:4+gqfR",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ad909b66-fcd1-4220-b2a4-893f853f227b"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--dc897614-58b7-418c-a6d6-fee0515c8e7a",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:46:25.000Z",
|
||
|
|
"modified": "2019-02-20T09:46:25.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".text",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "076d86db-6e17-4698-97b4-6b742eb0a1e2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "273dbb6a-0d0f-4e0f-be2b-50ce6e4c9778"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f9b360ce-aa6c-4c8e-9422-f09ac948c01e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7b33caa6-c8db-4f7d-bb8b-136de53d7074"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "54128",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2373eac4-47fd-4037-afa9-b937516ec1aa"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "5.8219803146545",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "933e9131-3ac5-4ae8-aa6b-af39649d53db"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "b2727915ee1b50786e800df94a3a32c6",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ca78217a-4850-4948-bfe9-86044531f004"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "be8dffaaed1566eb68539de3a3404a6107c359ee",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "765a64ef-5562-463b-a9fa-29e4190f3c07"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "2a7b18183df9d53ef109e28c3e0904b656829a920203676ba6a8926b476b35ac",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "04ae3427-7379-4434-a59a-865bb713fd39"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "dac4da211e3ddba824ac8bae6ce99b1ce5023c27911a8e6964107954b14aaca7ce906440600df013d5a3ebea907b17145fe8c73647fe78f342557eb667ac618e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "8c278b0b-5405-427e-aad1-903a0c926232"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "768:pqKdk8huF9bB2POJ+/aOBZn39uM+bRwLMZSNEySU1c2yk1mpSUu+OfVOrb6u9:LVkFZ+ywx5+b+yaaU1cBkSSUAfVOrd",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "333c9b01-5e98-4db3-9031-4e5e91346733"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--7f64ad39-cff6-472b-a6e1-7bf50d613d3c",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:46:26.000Z",
|
||
|
|
"modified": "2019-02-20T09:46:26.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".fini",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "868e2c5b-4ab6-4bb8-a414-d65d09918e00"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "35ba2611-29f6-4299-9eb7-dc64095a832d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c3a2d40b-d645-41fe-ad65-76d40d94f036"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "237ceec5-fe13-43c9-99ab-90265ae7f678"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "20",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "25e170e6-1278-4ea0-8cff-e9bf5193932f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.1219280948874",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "bed2e4b4-dce9-475f-a6ef-f50ff616b3fb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "114aae478b5d88a5f0770c5e5d62bb70",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "4871badd-904c-470e-bdf7-3b4ea45f4cd2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "e9ed5e3da1b579e48267b372158bbe3585d04852",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "471701d4-761e-494e-b763-bb74b8b19a9b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "b3fb85776b5cf20e2cf31dd564dccf3f6fb705b2285ed93dcf2de6df48cd866d",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d8f312d0-78dd-4b8a-ba64-e71da7e8d639"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "0885c81c2bb8cd14fcad351bfb622dd64f9dd49ae94b5d7195fcb8a9b8d71422a4b1cecc572c5285a172e20d6ac77917288674d89e8be1110cd2808a935891d6",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7e92d079-4b58-4534-9a5c-eb63f58f4970"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:4FcMhxvWn:4+gQn",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "9898b158-35e8-475f-8e0a-0484236bed73"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--5d3c8572-b1e9-4af6-9067-34d2c9359651",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:46:26.000Z",
|
||
|
|
"modified": "2019-02-20T09:46:26.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".rodata",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9b36a0dc-8602-453a-97ae-889753cf0983"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "10f5b5fa-f716-4753-9b61-2bee2d855954"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "38ab7636-c318-4588-9ec6-f01f57e2cd22"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "7784",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f1ec4a52-a1b9-4b91-88c0-ee874c450a0a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "5.267949278575",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c4d35346-5421-4090-a771-48d30a2990d8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "4fc2d310ce12b14b23e1b1e40e70f0b5",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d34eb0fa-8647-4fdf-bbf9-d39dd7fbfc11"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "3cdcaac9626c6b2c6d9ee17e3b4f0c0c1ba31fc2",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "44785872-30c0-4495-bf6d-9e448f97d939"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "68cf7f0e95df07d75930ec6b9b7ee20abafb3836c381fe666ca50d80d7220916",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "433b15eb-608b-4bfd-8070-7673f0ff9db2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "d23a80f6cc7c5f5154b13edd48f59ff061927d336c3b767d1e27038910485e20b98e9472bed70c741458df36845e38ffb210b36e6a7b354870a7deedaabc5824",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "fd0fc14b-dce5-4448-8b8e-275abf2ed661"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "96:r+DaaXGxBMHHVR8aQusnT7lRGNm6SgiW0dlOVXikjx8xkB3FpuEx7yWMl:q7HH8aEnlRum67bqlOVyQSWB3tuf",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "10a976ec-a368-4b77-87de-50477c5f7a04"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--1c18e4e0-8fb3-4d11-ba91-63c60ca95981",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2021-02-18T08:45:31.000Z",
|
||
|
|
"modified": "2021-02-18T08:45:31.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".eh_frame",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e4b67033-b026-4033-af4a-4897f88ae306"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7a1f66b7-9a3f-4f14-ba9e-d7d3c32e3cd3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f0a1f498-787d-44f3-b762-913cef517d9d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "4",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "faea281d-3e32-4335-b6f2-e75f7a44a6f6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "0.0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1eef1b9a-39fc-4ad1-9c65-af572f30ee30"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "f1d3ff8443297732862df21dc4e57262",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "400b974e-2548-472a-bac4-757e00396b45"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "b0d3cee7-200f-48e0-8462-fecc603ee81d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "1570ba1c-3d40-41d4-9e33-da1645bd6ed5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "8a4a133f-0b33-4c8c-9354-e7b7089f9e4b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3::",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "1e804e0b-4ff3-42d5-bb5a-90f2a3f9395c"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--2198b5e0-4891-493a-8a0c-19452f7d5702",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:46:27.000Z",
|
||
|
|
"modified": "2019-02-20T09:46:27.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".ctors",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "403687f2-8185-4788-bc13-ea405acaefff"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6bbcf346-564d-497c-8de7-9eb6112f3b9c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "175f3cc5-910f-4bd9-9d2e-9637b421172d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8ed746de-bb18-4d67-aae2-b9591147cd2e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c3bb24bd-3cab-42df-bda3-2445e0e63b94"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "1",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a56a3b2b-fe33-455f-9896-926bd8ef5dd5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "0a3cba51-3712-4fb1-8169-ed346b588241"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "3741d0ac-8710-49b7-8706-c1608d86a62a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b66ec7e4-047e-48e2-82c7-fc0ec73bfdc7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "e8012a24-f895-4eb7-84e5-dbcde423b9ca"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:RRtl:LX",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "93038606-5ff3-4b72-a1e3-c6b6544a79b5"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--4f3aeec4-3cbb-42ff-8caf-9b50e6e172b0",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:46:27.000Z",
|
||
|
|
"modified": "2019-02-20T09:46:27.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".dtors",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f7720289-bba3-4bd7-ae1d-d96eee7402d5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9300fa55-eba6-41ef-9489-32eb17f64093"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "48906445-ad4c-408b-af4e-81072e0ff680"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "50f5566b-c68b-44db-8aa3-84c51593e582"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9361142f-41d0-4616-b129-ff242ec42009"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "1",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5accaf0b-84e1-4a7e-9220-d19c926066e3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "52a8356b-54f6-4365-8550-a29cf737bdcb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "bcc13eec-3fa4-4734-8d87-07fe18de1f3f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "8005d037-3283-424a-8d74-b172cbe553e4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "3bb73d16-906a-479d-837c-69856fb4f752"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:RRtl:LX",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "e6d1f38a-5b43-4d26-940f-ca59711e4b56"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--9d4b06b3-e506-4b63-991f-fdde148494b0",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2021-02-18T08:45:47.000Z",
|
||
|
|
"modified": "2021-02-18T08:45:47.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".jcr",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7d69ca98-4516-4498-b2ee-14f85692b22e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "518447e6-066a-4238-90c4-7a33a031311b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7747b0d9-5ec6-43b1-91c1-8b6dbdd03a46"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "eb148f1b-f0fa-44c3-a4fc-79b6582d7952"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "4",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "76766e20-ce7d-4d04-9197-865150107910"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "0.0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "55b55b06-d4b9-4a90-b753-879d4c21f1be"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "f1d3ff8443297732862df21dc4e57262",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "99ce2343-dc04-449c-bb70-871102eb1b70"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "e647b17d-6524-4a22-8164-369d72ea0799"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "d3138419-ecc1-42cd-9a2c-c268b0a77c6a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "e9bd3fc6-d9b3-4586-88f9-c1de3daef483"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3::",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "4d7fbe4a-b596-4f59-8a47-50c36c13f808"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--1d9b9f2f-295e-42bd-9793-e553832e940c",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:46:28.000Z",
|
||
|
|
"modified": "2019-02-20T09:46:28.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".data",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "960675c0-e95c-4b53-a3fc-fe5b14aa3975"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c24bb547-37d2-4a88-bed6-6d2731786ee8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "607e0155-46b2-4856-b411-e2f976ef9cb5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1d0e60b6-5649-4a9c-abeb-6ebf21cb0725"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "900",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4fa61095-b0a2-46c1-8dd4-3453fa0aff96"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "2.6059574728556",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b2bdd1bd-f42b-4593-be33-eb6dd7c1e32e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "7c58a62bda0bd293d1a3e52a77139412",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "31c63aa2-2a28-4424-bf4e-18d205247ffe"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "2d0cba7fa9b84b39c82ebcf240d21e5707727df2",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "eb958850-68db-4f0b-8c8e-efe45cdfc1e6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "14400e4bc661442afd3d6ed5b165869f5ed9bfcc82a3808c1986846a4a72f656",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "33cc0bde-c851-456b-b0e0-a6573b055a80"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "74d09d6fb8051a9db1b4a42d80f7a2b681a1e3d52ca13f0543a6526a72b1d9e573a5a70434f4eee2ab41aedaf3c0c32a7f5976f142f2cd5fef4194b9e93d75c6",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ab8da0ac-ea91-4975-aefa-7b0f1f8c134d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "12:6lXklhp3DjqEURysyw6E9RQlybSvOH/YJck/:6lXklr3DqRQlLn",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "fa61204a-8eaa-4003-9d94-05a8a17bdd05"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--7a8106f1-71ea-4f5c-8835-74ebe31688fd",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:46:29.000Z",
|
||
|
|
"modified": "2019-02-20T09:46:29.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".bss",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "08501e81-bcdb-4930-a644-3fe4def300ef"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "NOBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f4d225ab-6d7b-4f41-a182-55bcdc9d2d69"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c9308835-501b-4d4e-a384-eb1b50fc57b6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5504521d-df08-4ccf-b942-d4ab7ffc19a8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "25428",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "02f81347-adc8-4686-b20b-ff34a9066c4f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.4616320662107",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c9ffa735-8c35-48ae-8f40-6e68de82e7f6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "049c57bed1d4b94d2f1da034784efdca",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "0b989dc6-0160-4ba6-9dc6-f215a99e1dfc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "cd25d95009ea7ffc3f58289c63e1fca83677cb43",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "0ab56cc9-1fa4-491e-9371-37729b3db109"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "2ade8278d6c7ed7aa6c57d2f4584ac1f5fa08bfbb8368af3fb388c2bb2ee379f",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "15ff56e5-bfcb-45d6-aeb1-37a5345e51fb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "935e0b93fccf755e8e1a5d49e4f2190b34e5f9a249e0896605251b651b1d894c07b478b28bdb3fdf149defa9ab816990fc48a251ed98074bef96229c599a3bba",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "a1c859fa-b11f-4508-bae6-328f7ebd9296"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "384:Z3L+2hJCe4/X5MY8ERd6NIypVwOd8fHwEPoorJG5hqdc7IyeMiDIQ:Z37DAv5BRd6NJgQEPz05bM",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f1a6ce1a-d8ef-4d41-afc5-44b5b0026025"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--1f6dfa85-e357-46fc-aab5-c7f886092666",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:46:29.000Z",
|
||
|
|
"modified": "2019-02-20T09:46:29.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".comment",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "353c479b-5310-4452-b9ac-831f9aa4ab46"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "fba0aaa6-3d54-4e7e-b105-46a84b1e4839"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "2920",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "77a5bbec-f9c6-4241-9ae8-54cf8ee0caa4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.7316466793579",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "df63c7ec-044a-4867-8118-683d67c49f12"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "02eaba63128184570a4bdfcd8c29d929",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "07517f90-586f-4a0b-b2f3-a571abc051c8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "9f8b551a43fcd110a2e5eeaf4c613ccb928351b8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "47baeb77-8088-4ed1-9e86-29d5d3b146bb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "cb592889f9a91adb49129a3bbcb3492c6e81b51da830e5da936e0e00998b47e7",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "8664ebe6-525d-49f8-8c31-9d998bc7468f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "98dff98a2e5e0c016ac00b0d0054d555ae5801b995bbbaa0f22ebb5fa7d6b9577ace852ef7b9b1097a411000d2dd272a233d517c6822167745fb091befc4d40c",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "954f3451-a1d6-4e97-adf8-36e0819e7e5e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "48:BVCEoUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU7:fRNRw",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "9c5598f8-9945-44f2-b066-11baabc774ca"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--9bd89f5b-da48-4fbf-bcf6-722baca2ea3d",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:46:29.000Z",
|
||
|
|
"modified": "2019-02-20T09:46:29.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".debug_aranges",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9c080fcf-a5bb-48fa-9121-0fe7fb0d40e1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8d4d4f2f-b0cd-45f6-8540-a1a5bcf17e1a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "160",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "61b2c35b-4393-41de-a0b3-a407e21115c0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "1.7902674546964",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "17def925-5774-4a55-870c-9ac5faf4e2f3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "f015e144f701d50ce89068e7fa331a1b",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "66f289a5-57e6-43c4-bf3c-39bdde10ac3d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "56e2148c28a2a39d0232d86fdbecae0c07bb0b25",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "27a517fd-f719-4fa5-ad97-227a0965b801"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "baa355978109a6025bdda65b4a0322dbbc4f624537f8a3b37453f3b72de2616c",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "e4f8b399-3001-4bc7-bf9c-af6cc9d1d580"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "0ab7249c0b3931a73e32c2dd76731b902a116000f3f5cef0886b4960dcafa4527bfaa976a8e46ed46d3cd96081c8a647183790a0015572a6c22cadb249d43341",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "19381cc5-1cd5-4fb1-939b-b06d566c4916"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:Ll/5lNlxl7Ltld1ltzlmpXlhw/ptzlipltlNJ7tlllhlNlrlBUM:Wpkx2pCM",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "33d77d2d-1e29-4166-b41b-03d829bbc553"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--1bf32510-81a1-4ade-bccc-d0044cb5267f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:46:30.000Z",
|
||
|
|
"modified": "2019-02-20T09:46:30.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".debug_info",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c3c60f59-d3cc-477d-bfb4-02161fa3d9df"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "72b49d6d-9582-4685-a393-048c9402f03c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "780",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "46fcaa48-3ce3-4caa-87f4-12fd63cc7270"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.9243659663662",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8ed4706a-1ff5-4e85-9c0b-271b172e2d79"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "b431c9505e908a3f10bac83965ea12e8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "35df83ce-4451-4ef4-a21e-ea70e529f014"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "75d4fd8544a7b3d6b840829cdc369dce0564ab8b",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ae71dc04-513b-4c11-8c7f-72d23f9fedf9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "01d09e51d9cc706500d935b16365cb1e37566b870ebae68389d3278d5877f9e2",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "08c4762a-813d-4e1b-bddb-2dc54aa65456"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "c0c0d044bbcf1cf580c9dc3c5a6c698512a1cd318d17f3b82c012dea2ac8d08c4ccbd6b24e7b444d065f5e7c25771f597b4772e4eae0d1f266565e469c076407",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d97e45bb-bd55-4c52-9577-fa6b955d3677"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "24:9B6QIBS/MxsB6QIBS/4B6QIBS/lB6QIBS/IB6QIBS/a:9e0/MGe0/4e0/le0/Ie0/a",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ad031654-3a95-4a7d-96a6-46c7d9a50759"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--c873cad9-ab04-4a26-a0ee-fba9a8a4b27c",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:46:30.000Z",
|
||
|
|
"modified": "2019-02-20T09:46:30.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".debug_abbrev",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4b53735a-36ef-477b-b53b-fdfd2d8ae0af"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e6b92e93-4acc-48ad-ae50-631999147abe"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "100",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d9093bf7-5654-49c6-8ff8-69f213e7d154"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.346439344671",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8fd29c68-cfaf-43f6-80bc-a74e11d428cf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "33b343ca5f1b99b9b71bb47f32af43c7",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "3d096422-0c24-4911-b4d0-4bf12030a213"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "c42a7af88fa0ec92c922e5de03e04ceaaf720c33",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d150aa40-b97f-4c04-b2a1-9fa862827568"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "2ae6cf8a42f2768724e77dbeb2915eb89199d3239de2817fa014df1d15008e67",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "e974587b-5e0a-432e-952d-a53cff185523"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "3d1c652cce7e8cc98a52f8d6f3281195382dd7a604424b92f20351f8b3812797d8b62d24957f5105ea667fe57037298d7ac12f30853ab7aab77448890e3927ae",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "4fcf0bbf-323d-4e4e-8d9a-b2119bd5859f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:PU1utPU1utPU1utPU1utPU1utn:Pk6Pk6Pk6Pk6Pk6n",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7d01c06b-86fa-4ba9-8d49-2214d28aef83"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--0070abd5-c842-4a8e-8b48-54138e4136b1",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:46:30.000Z",
|
||
|
|
"modified": "2019-02-20T09:46:30.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".debug_line",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f58a80e5-569f-4173-9d3d-4187cba350c7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2a32a5e6-20f7-46db-8302-a8c1d16bcf33"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "743",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9dba2566-9035-445c-9388-3e2040f437cf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.887536564754",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "dedb6c31-7a4d-4094-8128-d9fb35a92ef5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "69d9284ed6901a87af0051300d956cdf",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5c4a1b12-6768-4197-ab91-21e14c1a1dc9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "222a15246c0f13f04c794c69f2e68627ce66add1",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "97a2b176-4839-48bc-a94a-f0aeecb9ceaf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "71df03c5f8358902d27d73bd2e88df56039f3669c706580f9b97a19ecc9a12e5",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "8909a202-db74-49af-9a73-32a685de9687"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "1f79681f1db74074fbc734c2461f90bd0a315075878a5ae08e8aef890b2bbb424128e9106fca2670ed2138edac101478842295f14c34e27d9da95974a36e144b",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "4065048e-678a-4e0a-8d5e-f0e21a494244"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "12:I4OBc9XA0HuDh+v3Bc9XA0MMRcGy1Bc9XA0esTRBc9XA0v6YOBc9XA0gAZ:FOB6QZ9+v3B6QJMRzyB6QDQRB6QXYOBA",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "efd9099a-09bd-4ba4-a3ea-1c27dff43ebf"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--321a716e-311b-4023-a02a-1980cc3b3d02",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:46:31.000Z",
|
||
|
|
"modified": "2019-02-20T09:46:31.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".debug_frame",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ae692cad-c4fb-4baa-a786-d01959164d25"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e6d99329-46f1-4a62-9631-e3abbe5ae647"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "160",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "10db8ec0-3224-4ab8-83ac-2afe729fcd8c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.3172090733526",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1d83e041-f49d-48bd-86f7-87807586b476"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "4dd554071ee04e7381ad5c2e8a285101",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "bff40f0f-68ae-447a-a6fd-1531b928cf9a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "93448591e1ce61e79b6f65fcb202a7f4fd27373b",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7f128699-8bf9-4881-8d19-f56f781a245b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "be90f778602df804336cedc5e9177f6378aa9a1b7063392d0b451d470ca90cce",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "259ed473-5b1f-4343-b95e-4d81c433c388"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "ce60eb027a2266369124353dbd34ccd776eb4a96999b42c07c8dbce9266f8b1da82d9c26bde5306a263161b17f8df6cf2a0c8ab415a820000baee325175f1023",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6c165f79-061f-4546-9e17-adbaaa538545"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:NRCxajlpRCxXHxzlthlpRCxNSlp1hlpRCxIUP7:nJCFT9pUz",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7653b0f0-e290-452e-977c-77c548086143"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--de794f38-760a-4c03-8514-98ddceeeddc5",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:46:31.000Z",
|
||
|
|
"modified": "2019-02-20T09:46:31.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".shstrtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d78ae6bd-c7da-4e47-8db2-af30015e15d8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "STRTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "02104cb4-9750-4e12-8509-bf104ca7edff"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "168",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5cf54643-ad52-4754-9f0f-b26641885a1e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.1672851010934",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "068f4d80-6863-465b-935d-4814c73b3a9f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "3c77484bd9a7a5025d604b50bcf6d0e8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "64505efc-7853-4443-951d-4f65fae7abc5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "219c22469be20c3183270f148c6866c569955439",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ede72363-2172-4e9c-a51f-21745dbe332b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "07254bdbc45884f0dec220bd72d26adbf2ee1e7ce515b19ecea11e14505ef01c",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "cdb9ace9-f633-4bfb-bfe5-924f1975bee1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "71117837c8e3be5e401448ea31a16c289428e920d9dee5cae7e1ddb0ed32790e6581c8a02aee7292b014ab327c95f5c6f5a95c62213104956e4d246553d1757e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "dcd23140-f31a-45dc-8196-2be3357c274a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:mqWxRuRWExqMLwlApLQ4lLaCMLn32cxlLPAl+K2iLTpeWnz/mI9l1AHQVhA:EXwWEgMF84MFTnfniLTpttHKwVhA",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d1ba82af-4955-4394-ae9a-e4a5dd78fbed"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--320625e6-bc23-4868-967f-ac3a684997fc",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:46:31.000Z",
|
||
|
|
"modified": "2019-02-20T09:46:31.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".symtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a37568bf-a873-45bd-a791-fb9287499109"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "SYMTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "fb0c81bb-2eb2-4543-aef9-77e982d539ce"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "17168",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "842fbc0b-bdc2-4548-883b-d517dd908de3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.4057620227265",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "93d5e253-7e7c-4071-be0d-b959c96d2c30"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "b9245a14a250598ab3d36c79221cc5b0",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d08a47de-5de2-4b0d-bbb7-3f623d27703c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "5082108e4a56f55e9357270c6d17f4989a2186fb",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f46b012f-ddb5-47cf-9311-85661e064975"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "685253e1a019dc51d575e6a7c752752cac9ad2ca46c3e9295e84c31f13de81d8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d22ff689-f1c9-4a29-bdb2-ac609fc30213"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "5b26e6c3f23ef486bb0e9e90032fec1af849dcc15926766c43b920a3204ef5974a201086831456deacc3ae5bc4309f5f20b983f842280c33688b5964bbd4e6c1",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "8d206ac4-cdb3-418b-aa40-49bcb4f0bb5f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "384:b2hJCe4/X5MY8ERd6NIypVwOd8fHwEPoorJG5v:aDAv5BRd6NJgQEPz05v",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "96430308-973d-4130-8920-1ac7ea9e633e"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--504ec11b-59f4-488c-bd75-ca4d85c57f37",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:46:32.000Z",
|
||
|
|
"modified": "2019-02-20T09:46:32.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".strtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e9416d1f-8447-4207-80a7-4ea34e85efa9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "STRTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "dd8dfadb-1c65-4f97-bd20-80147f08d742"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "9072",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "863e7c60-acd1-4a6a-bfc0-6088aa87dea0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.614460837061",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "10c64b33-d82a-411a-8fd7-15e406ecf793"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "eb8ef1a8c28ffb7ff2aa237fb5270b14",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "cc9a6f63-25ae-4abb-a107-f34eb2bca7ca"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "cd7c15cecfecef1dfffcae3cf61445d9e8490930",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "45cb5587-cf58-4ef2-b1b2-b022ecd98a31"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "2a1addbb03f2742a2d3d4b8b6c0e7680615f51bfc99308c0753cd82745926d81",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ffc96348-a140-4506-8c5d-c8abfcd3d662"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "c1a5acb8300cf752617f8eea7e11eb63b7c16a77227f3bae5c2128ca1f7afba4779acaebee8a78676248ca28f6da28ecbdd8cbcc5d310be433a73797c8950a76",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "43cbcfae-50ff-42b9-8bd1-5b7a43308bb6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "192:pqdc7IyvCfXMtivDIQXZxwmX8px5s4v/MqQFAENCyx9XtYglf4QPVhDrqIUOwuIh:pqdc7IyeMiDIQpmmX8px5HvEqQuEUy7g",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "9eccea07-8587-4057-825e-f34873f2dc16"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--23275e05-c202-460e-aadf-819c417fb326",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:46:35.000Z",
|
||
|
|
"modified": "2019-02-20T09:46:35.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "EXECUTABLE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0b355673-5932-4867-97c6-aa6b4980b623"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "entrypoint-address",
|
||
|
|
"value": "33168",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "dff88bfa-a42b-4bdc-9234-139fd94dcd24"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "arch",
|
||
|
|
"value": "ARM",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5d1ead93-0876-4f67-88da-027d6307a631"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "os_abi",
|
||
|
|
"value": "ARM",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "78f98e18-6afb-466c-ae0e-cfe75f4dad8e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "counter",
|
||
|
|
"object_relation": "number-sections",
|
||
|
|
"value": "20",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ceacb2aa-25dd-4a54-98db-29e04fc812d5"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--3f183dde-981b-468a-b9ed-5c4c3e16b42a",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:46:35.000Z",
|
||
|
|
"modified": "2019-02-20T09:46:35.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '00208302a81fe252b3713555967846bb' AND file:hashes.SHA1 = 'f4232c9d445f0ccbb6eb3a443818d5a643c89124' AND file:hashes.SHA256 = '97f9347d6721155d72f6c592e662c905bb462c96aad23a9c5be3b5c95088150a' AND file:hashes.SHA512 = 'ac2e3ea46cf06abc8f4f921cc987a929074158cc48b95d7a0741e021d2a21027afb94b58f4f748a69e77796eb388fde2d1d6d13f02f3e35b7e531275fa363a43' AND file:hashes.SSDEEP = '1536:AVkFZ+ywx5+b+yaaU1cBkSSUAfVOrdu+37DqBRdYgQErSmE3cqQuELrDPO0S:h+55+qcBzAGu+37DqBRd9N2mocqQuEno' AND file:name = 'apache2' AND file:size = '95104' AND file:x_misp_entropy = '5.8718833659276' AND file:x_misp_mimetype = 'ELF 32-bit LSB executable, ARM, version 1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-20T09:46:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--0efddb66-b6bf-4244-8fee-2cba6be0f5a1",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:47:19.000Z",
|
||
|
|
"modified": "2019-02-20T09:47:19.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "NULL",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7761fd48-bcee-43d7-807c-8957337bd931"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "eb44c112-d8c5-4a73-9d08-b253da8ed0ba"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--ae12d82c-b919-4527-b625-8c178fd4f30a",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:47:20.000Z",
|
||
|
|
"modified": "2019-02-20T09:47:20.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".init",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a532b626-3c30-4240-b10f-d53cea33e799"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4752a659-c627-4180-a83c-28edc54d231e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "cd42b57c-b971-4a69-b4de-4d40e706f605"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a7ce93bf-199b-408a-b991-d7df385b9555"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "16",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2243b998-47fb-440b-8ec8-7d900250b396"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.75",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9a8d65ee-7ba9-4261-8119-390e8b5a47da"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "a940b2bb9e2ac31591e26da5bd8f1005",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "58008e9b-01bd-4f4c-b5e6-37565e351bf7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "de753d372fb57887d310174fe8302ba87e08f8a2",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c90b8de4-8e30-41eb-a527-90912e7c7e11"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "f56cbc1b12ec231a28dcc9d8d2cf67ab88aed9094da3914850694c8c0877fc28",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "9d6c9bf0-b191-4ee2-b227-9d9ea600b2b6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "a3cfbe57a58527aa2e7fb5e925c8613f1985d8262c8941382006b8aaadb26d243ee257e3d5e7b5140f99bb8088564a193e35b32ada93c07c61c1a9c1c2dbcdb6",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7fbab0e3-f0d4-4b65-baee-746efd0b2b9f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:4FcMhE:4+gE",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "a3522a4c-9f99-4247-aabe-afdaf87f586d"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--91933b10-68ce-4a57-aed6-5f379af1b5e4",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:47:20.000Z",
|
||
|
|
"modified": "2019-02-20T09:47:20.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".text",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "290034ec-7aa4-4dea-b442-2de201471e20"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "27c8c4e6-487a-4bb7-bb49-1a158510294c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ab1202db-3a73-4054-b323-765948fe133a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "45c53067-5e9e-4f3b-ad5e-8ae5455491da"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "68740",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "09573d15-71fa-4781-bb23-642e82df9295"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "5.9302386292455",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "02ac4070-e6e5-4b5c-bff8-e5b335dfbb74"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "13f884082313f796f2361d7665914c3c",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "4b8a7fef-0312-4806-bd03-48ce6b152b05"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "217480d8d7d11f2166f848c9bfeed65819f45329",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "9904b1ef-8f49-4898-9c37-b7d267e8a9b8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "3ba287203cef5b2d64d2c10c57f82410c2fcc6ccd48879e77e96cf7a7cf5e6a8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7094555b-003f-4413-aa35-4632e43e23be"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "18712cd005b99ac82eb16b6c9c7833f2c699525b9f39c07fb8c924b9ddd125ac0ff405039ac9f6dfd9d543d5f0d003d3ccda661dd80cdd8681425788a73fbfe5",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c48cc2c4-b29b-4b6d-81aa-abe71d3309f5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "1536:jonKqgqzIXijf9ai1zhJipNi3EDBIFm5Z/nBY0:9ijf9ai+DBGm/B1",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "21240662-db56-41a4-8c8c-38ccf1be1e3a"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--b4c0cfbc-93ed-4be0-b4fe-b644085f4463",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:47:21.000Z",
|
||
|
|
"modified": "2019-02-20T09:47:21.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".fini",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8db56d45-e146-4524-a441-7a0f2324e48e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e0ef919b-7717-49ac-9b07-8513ee41e91d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b34afaa3-6715-4d15-b30a-a5aa4ff71cc6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "24661e10-cb8e-4c7f-a33f-96a416c8be68"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "16",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0ce42d8d-ad37-43f8-b600-96a122e0dc58"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.75",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "009399fd-0d67-45b4-bffe-c9bbeee37933"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "a940b2bb9e2ac31591e26da5bd8f1005",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f02e0b00-c62c-4c2a-9de5-1836f261f421"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "de753d372fb57887d310174fe8302ba87e08f8a2",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "2cf45ad8-527d-450b-898b-8263fbf6fe12"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "f56cbc1b12ec231a28dcc9d8d2cf67ab88aed9094da3914850694c8c0877fc28",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c3033c50-4f3f-424a-b48d-e44db6d7118d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "a3cfbe57a58527aa2e7fb5e925c8613f1985d8262c8941382006b8aaadb26d243ee257e3d5e7b5140f99bb8088564a193e35b32ada93c07c61c1a9c1c2dbcdb6",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "4f1a6104-1e5b-4b6e-9f5b-1da3b31ce646"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:4FcMhE:4+gE",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "1973b277-d44d-45fb-a857-827cbd0a5f98"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--38ec7e98-19ab-4d57-bb9f-7986d2c6a038",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:47:21.000Z",
|
||
|
|
"modified": "2019-02-20T09:47:21.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".rodata",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "44e72cb3-5d21-4120-a1c7-11393158db33"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d81fdbc5-0962-4bd1-af3a-de0c5f6e6a2c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5dc6eeba-cc41-4708-9538-3ad55db13b80"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "7860",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ee56a26c-c575-4462-ac22-e6a39e019c2d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "5.2582401007226",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "dbc4cc5f-992d-42c4-92d8-7a5d218a071d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "3e8a73f5351f424263e40209a5a8f3c4",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "364b30e9-77a8-4402-8c65-8f0dad031f0c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "e1af90ae1ad15f1d04ed1a83fba861132ed4f2b4",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b755a674-a309-42d4-9b10-b2fe3269cf84"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "b15c4b646fab5c9c8b63676c8c6c73cf1eecf414db478bf3cf8cfe9e31071bf8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "4b475072-d06b-4034-96c3-c413279544e4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "7793deb784b15a0b2cb463fdd79674e2b306ddca0c4f964e811df827c59d880a1e8e94f8998f64357d6b70ecbdf690a4817a990368aa9bb8cb47b8bd884fe0c0",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "a95c6c75-62dc-49a4-b0b1-ec489d681154"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "96:r+KDtxBMHHVTqaQusnT7lRGNm6SgiW0dlOVXikjx8xkB3FpuBmSMl:DWHxqaEnlRum67bqlOVyQSWB33",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "1d0e0a27-4466-400c-a4d8-bc0581f5915c"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--a4a5a544-d184-49c3-9682-0b8c96d98c69",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:47:21.000Z",
|
||
|
|
"modified": "2019-02-20T09:47:21.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".ARM.extab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8451644b-5f48-4c86-a163-b23b6e675384"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e82a7840-6700-4ee3-843c-1676d19fc382"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f4449d10-f27e-452d-80c3-78b5d0fceece"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "24",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2dce9705-b1a3-4137-a3e6-f259cae47a9a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.0016291673878",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f0a35645-2936-4094-bd87-707c6266cf94"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "eab9a803b5d9ef7708222fb7122be618",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "a3b2ba0f-fae3-4352-8300-074f665b6adb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "50024cc82cc38cf63fbaa00c5af5a2fb6e9b52d2",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "3f313bfc-5d64-4bfd-b66f-de2f531ec790"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "fc82f14c90d817b5b41a16b677858f26c2a57052eaf2d445516c21bb82974ece",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "213937b4-3041-4db3-97ef-82250faf8d47"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "9c35a0a10512e8a9a3e77fe293360f477e6101e0b1cc5ca561e688a5de4466696a2393095489201580051c27e61afde2de29de65aacc6041152bfc73c2f73e41",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f06725b3-74c3-4004-bd4e-228334ab0323"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:9q/ztS/:I/ZS/",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c4174b38-255e-408a-9a23-bfc4a4294140"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--632a229e-d0b5-4524-a97d-8816e5792f43",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:47:22.000Z",
|
||
|
|
"modified": "2019-02-20T09:47:22.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".ARM.exidx",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c496609f-236f-4f0a-8b9e-21c6d836f27d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "ARM_EXIDX",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c3c286a2-b62f-4336-a23d-73e7707f4880"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "LINK_ORDER",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9b0fcf17-b9f9-4f2a-afd1-922dfbd8b53f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "57a51764-e305-432c-9eed-1a2120e8f2c8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "16",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "25ee44a6-4951-4536-9fc4-c5bdd8f3c99f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "2.4056390622296",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4f248957-ee58-4b23-9d53-351a0b0e40a3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "d5d9bc8a082a4dd89fd04187630a5e49",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5ea3e9dc-8435-4651-8cbc-e5cd8c45ddbd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "04a48afb83c2935c3dfd31751c7ec4f18c750aa5",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "aefa2581-e2b8-482c-b945-0d397c4df6f3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "82b34e5092acd07bd2dc178828a7cc1d8c44de3781be17f6be15fb64e1dbde97",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7ab497d9-6e54-4de1-a457-612625de178b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "8508b306540998c3e922c524ae5c733427f3a090af21b87730fbc73170a6b2e2c82d84578a8c59c6c2b5599cb85ccbc6a267d6edbcd19bb3ca84e8bbd27e24c7",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "32b94631-4217-41e7-8579-b374a1b8ce83"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:KntaG8:Kt8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "0b4006e1-c25f-4b7a-b4a8-261174a37ff2"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--e90c448e-ba4c-40cf-8546-cee2c43613c8",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2021-02-18T08:46:01.000Z",
|
||
|
|
"modified": "2021-02-18T08:46:01.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".eh_frame",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "027da1bd-4bfa-4a0a-88c4-c0ac7e499608"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "abf31f36-f39f-46b0-a2de-56cb681a61d5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "026abcdd-08eb-461c-9e4a-7e3f449fdf6a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "506d35ad-7739-424b-8e4e-3c2c6aece48e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "4",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e13c43a3-c96c-4281-8c8b-244ef2ebd7c5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "0.0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "954e0904-60bf-458a-b736-0693de6afe87"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "f1d3ff8443297732862df21dc4e57262",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "cf0d7bcd-ba1e-4621-9dbf-a07944b2cb8a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "5486f06d-04d8-4644-8edf-7147380f84fd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "d70f95fd-a7f8-4d18-b074-3e856b15b9ea"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "eab3866a-f9e3-43d9-a2f1-42686be263f4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3::",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "ffbd7781-6ac9-4db6-9279-bf7606e519a1"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--c8acbc26-1989-4f19-abde-85f8ca74b0fb",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:47:23.000Z",
|
||
|
|
"modified": "2019-02-20T09:47:23.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".init_array",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8de8f04a-1d76-43dd-8571-8af5e1064e0d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "INIT_ARRAY",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "281cbe7a-8f21-4f28-8958-4c5d5a6925f4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "72141cab-74ee-464c-85f9-1a7a507ca8a9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d857ab1e-2c3a-48ae-bd91-42cf2f443593"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "4",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a3f5e1fc-2b47-40e2-bfbf-44be61ea49b3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "1.5",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4d0ab4ee-e631-44f2-b6d6-f976d48ee2f8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "625d2455e43ebd504cceb3a15c339683",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7af0e744-e213-4572-bd4c-ac03208859bc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "889ac316c6762b553b47fb03f3f7b9916696f475",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "03863982-7da7-4827-9dba-d1782519625f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "edbcd43def2634634faeb8967bb01da7f6057a5d0c0f940308c38bd2ea01f0ee",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "dace9297-b65c-46d4-915a-ff10b2f752ed"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "1a7dd6b98913e1296528a78dd336ab36af7d96f7ffab6250963c39613f9b23b5ca0729c29886420cd38dc0bad63675cb96bed488dec45057ebe81df4c02f0fbf",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "aa0b782d-ab48-45e6-b985-33cd1f840286"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:qln:ql",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "9dcf8287-2913-4828-bcaf-45e9b2fc59fd"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--cb41f2a5-6432-4a61-a25a-b54abef32bc8",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:47:23.000Z",
|
||
|
|
"modified": "2019-02-20T09:47:23.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".fini_array",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "555d64a4-039f-467f-91ef-bbfc2d953d20"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "FINI_ARRAY",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1eab528a-280a-4a96-86f3-0d61d6c5c6f3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "bdd0bc40-acb4-45b9-bf1b-a165acb3385f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5f458834-fb5b-49b9-b73e-099da76b23c3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "4",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4cc6b4ab-0c50-40c8-a0c7-f8f0b6ce50eb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "1.5",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d8700d4a-ebb3-4899-b812-f86fc76354d0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "7113160d313627fd88f1b76409f34123",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "728ff8db-e2f6-45fe-b284-f30fa617906f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "a8bd109d4bbe3ad31627bfc58cc4a0d2acdf09e8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "df62af7c-c403-4e74-82b5-054aae9cc9b1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "081b855a147a9920e8e304342baec9417cfe47a15e019b468ae04c42fdbe19fa",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "80f8ac30-381a-46a9-a7cf-ddfd1611ea90"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "15874f1e8c17c8e35a19707a3daa49920a8f0e8d3ebe568dda7b8162795fcd121a32519eaafe4f1a7596614285093ba78d6840f97d6cf1f2c3d2b908d464138b",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "918a1c11-8fe2-4251-a773-654c58e71778"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:K/n:K/",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "21afa090-59e0-4d58-bc05-5b5cb9b938c8"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--51c1d7f7-0362-43a7-8a81-cf5d558e36e3",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2021-02-18T08:46:17.000Z",
|
||
|
|
"modified": "2021-02-18T08:46:17.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".jcr",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ef79f5fb-250e-4e16-9754-61097e5f7e90"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c6c7818c-dc73-4b64-95c2-22f60199118c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a0abf342-8c88-44ee-a2a6-ad1f9c7b61ef"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d23ef51c-ab61-47ed-9994-eaf431d4d069"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "4",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c96c253f-1fbe-486d-bd99-399df62d2bbe"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "0.0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f5c3dcaa-3f90-4c14-87e0-5e6b7233e507"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "f1d3ff8443297732862df21dc4e57262",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "ec22d8e9-5348-4ceb-be30-d35587ad7076"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "1d9a2f0a-c36c-425b-b78e-d2cca3377e78"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "76233ffe-c887-4b8b-8bdf-dfa958a3c3e0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "f5e0d080-9bcf-48b3-8df8-308752bceb0f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3::",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "859bd537-89e3-4159-8d4e-b87579972471"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--39c43ea1-e61e-411a-b531-553326d63b56",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:47:24.000Z",
|
||
|
|
"modified": "2019-02-20T09:47:24.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".got",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "81e5c01a-4cbb-4fbf-9e1e-eebcf5fadb1a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f7aa8fae-d77b-482f-8ea8-927c30644de8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "40d8957d-ccd2-4ce0-a33d-bd2658bd64ea"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3796d342-79e4-4451-94c7-47892e76fef2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "124",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "fe9edad7-574f-4919-97fb-bb213155befd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.677846635341",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5ae68205-244d-4531-b8d4-ace55e6bcaf3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "c8c3b8f50e0cc61ab53e674aff414d04",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d7bc8e39-ee27-4555-a116-d8621601950f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "80e07d1922ec6a8cb1127511a8d68b5064da6f43",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "adb5cd7e-f34d-4544-9f7a-434751ef6c57"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "bb14a8a707ef3ab9665c4bc3911793da7ee31db7b403ce91964e145de2413870",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "1b9005f9-e7d2-4ce5-8c0d-2b89a3af54a2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "6ed7f106d9dfb1892621c0f71152efb50786d1c40b9e670dffccdee3474e7a522d4a5ab52e30222c95828a542e9826d41667c9c3b15f7323885a050ae8540a48",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "1a0b27a8-97bd-438c-9023-b60a76a103cc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:CJ3csIK6sjJlhgXVtSUTCAZrWkl1ZvXEOmVPV:KMsIcJlBUTCAZrjvZvX9mv",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7d47574a-7d53-448a-b7d9-8b8beba43a41"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--1fb60859-3d2f-488b-a56f-1cb8ea504f54",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:47:25.000Z",
|
||
|
|
"modified": "2019-02-20T09:47:25.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".data",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "abed9ee1-b0ac-46fa-bc9f-5cbe394d0d1a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "62fde3e4-8de8-4a48-819d-242f2b12e59e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1a012851-8dda-471f-bd54-4f0b4aeacb0c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4a1b067c-490f-4ce8-8809-e00644177f8e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "628",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "279f2ee1-9095-4b7a-a3f5-d57243c23083"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.4752016560863",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "636ebef8-e98a-4f4d-90ad-00c09fb87c87"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "ab6367a5dd576384d8bcf54886755409",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "0797af29-2d72-4a07-b0ac-ab98d1788a8d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "b47c304a3318e1cc6b110e3fa9293b1d3537745c",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "8e7c5ef0-3fc3-4b62-a5f9-3ab5d97b8dd5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "b71cbed031ada5d98ec338558778a8903a3fb605057389588ac5305ff58b92c2",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "8444b634-7874-47a6-ace7-3d17ee4ef017"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "2d3f35fa9cf1c12da3a3dcf899a6c92e303e008ad31f8395a506b9f1c28b2947ed6905b2eab3fc5fb74878e3d7e0df32d4903a665b98edbf52fc850c103e6a6c",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "dae08d18-9bad-41ae-8d44-c915f672914f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "6:98czuEY/UTEjrjmF/kymiEEE9cydxrgdlXHoUOHdFuszJobuhwSS5Ps:9uEYcTmXOkymiEE1ybSvOH/YeeU",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "76e5bfaf-43f2-4f14-871a-45072cc192ac"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--9dbf82e2-a659-4f65-a1cb-1a4c1917a005",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:47:25.000Z",
|
||
|
|
"modified": "2019-02-20T09:47:25.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".bss",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a08b469d-3de1-43cd-8d4a-0925dee71260"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "NOBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "481ba880-e415-43e3-b0cc-9034a28df405"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "25546aed-a579-4ded-bc06-00321e719cbc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a055e5e6-68ed-418c-9478-ca3fd29c6e87"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "26212",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3b6d0254-7883-4836-b1cb-544c61b17c66"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.2629806400624",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "02749158-3aea-4736-9f4d-8f3f155890e9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "b86cf82cd3399e85992bd1740cf10705",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "12f15cee-0462-41c5-b3a0-c9c9c46e43b6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "9cf2ca983a99d95717f0b1049c53504c9f1d0da5",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "30da2d40-d1d2-496e-b8d2-ec5e30a3c850"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "b0efbc744e461365758fef001836639e47d6162f88b9573de88f923dab5504cd",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "07816138-b823-42ed-983e-3600622725d5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "9f136cdf5e1ddaacbc8eef70d0d2de639287554ddbd7784f26d1f0f4390f6cfa7b5f166d621b010e38fb5e8f782ec126430321b85575d37e9840751088e2a308",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "27f9cb06-60cb-4cc8-8f15-cc12b4389cd1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "384:Z3OEdMEnE6WFcWF5WFzpWFZV1N/+j/+y/+3/+66NWYRmTgBIhiLF8UQN3plPvy3B:Z35KbG/NdS0A++j3nPqpiy6yoi9K2z",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6f6d1281-0881-4bf5-9c30-62451c0fc733"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--4dbada84-b2ff-42b0-9263-5f43ec5ce1a9",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:47:26.000Z",
|
||
|
|
"modified": "2019-02-20T09:47:26.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".comment",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2553c0e9-00e7-45f8-87a6-50c5360cdc4e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "75844e38-7801-43cc-aad7-72a6ac1dbe66"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "3244",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5c79668f-eb72-4051-8ff5-8936af2b7c5f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.722201329874",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "308c0eac-5fc7-4492-a820-efbdf32cfa9c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "f71fed316ef3ad116b3e0486fc92501e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "680a7a34-9a98-4127-99aa-b2802c833513"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "d2602117e3c660c6728d70a3509436689d70f424",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "964ef34a-94b0-4598-b606-28ac4f502d48"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "b3bb89777224fe5101e8364b78c0844fbe9a2f1446084260b0daf25f66bfda34",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "41ee7da2-6cd5-47ba-9230-78e464b393fd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "bb69cf16a1493453af8aa190db42a4c8875c780b7e3a9a813797a465fe5169217353fdce593a03399e1d9f282023d0a97a4a8cb0b0b4b113bbcc215d97b0de69",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "18f6f1ec-6729-401c-a27c-9806d8b0941e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "48:BVCEoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD:fRNRw",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "8d582be3-d6d8-445f-bb9b-23252430b00f"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--1608b5e5-da24-49e8-b0c4-8609562bce1e",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:47:26.000Z",
|
||
|
|
"modified": "2019-02-20T09:47:26.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".debug_aranges",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "89168e56-f90c-4c92-aa56-75436923d015"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "dec276ea-ee50-4971-ac93-9ba0a0042afa"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "224",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1379cb68-1d79-426e-80f4-ae1ce4c16286"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "1.9583901975117",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "cdff1b30-03a8-4426-84ee-919d5161cc04"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "85361ae5f37db466ee977e3bfcfac56d",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c24704a1-ce51-4059-9a76-3519870cda45"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "8ae12ea6d066057fcef75e14707d66a9208e35f9",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "1adaaac6-3b1b-4106-830b-29514426d297"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "0c293038d1f5b926fcfea4077d9d9c8d24ac4a947dd292f8947c983e40059d33",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ccb8e916-51d4-4348-b888-456527474d93"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "753466e30c9c93910f9f3030d82388a113d1d2cc0c0bb22a92a3260ea98223a96d218b4d0d4e325cc01dceed91e637e6159db8658094d7d221b28a4fb5ed82ff",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "0adaa9a4-899d-472a-91ec-ae913669686b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:Ll/5lpx+JlrllhXlFEZlGlz/lhkkg/JlxlrltTlX7l8lhtlBis5jl7lu5lljkjlI:QWalzoLlmLEs52Rh",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "61d27af2-c9c3-4db9-a081-ca28ca210d0c"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--67da960b-1262-4850-8386-de665b4e1399",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:47:26.000Z",
|
||
|
|
"modified": "2019-02-20T09:47:26.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".debug_info",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "01c08101-3e49-48b7-912d-d10bf24ab7cb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0e934129-ab17-4012-89bf-70418dabdb57"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "1200",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e738727d-46e3-457d-adfb-50e5e70f120c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "5.0580539204891",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ecfb4a6d-e1d9-4a6c-9558-c3f8a3a0cd93"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "eefadc760ed5801e70798b70a761d84c",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c41645d4-7d44-492c-b66c-82f22daea306"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "7055303db7995800ff3c754816ddae8f9e3810df",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "cc179ddd-f4a7-4496-9c3a-07ff12e6678e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "c51146fcdb185d5b5c4977d97b28475ca6f45046d51a23e72d8beb02aaf4fd2a",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "91ed3ae9-d4b5-42a6-8091-cb41b409d2a0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "ad2fda5cff9437a4e49d2c358887e777a4d1938759794364b4919aebe52c6ef157472189831eed04894517bda174477cc6b0e43215b14887f4c70944140a64b9",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d16e54e0-8c6e-4f6a-8ccd-baba01bf290a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "24:XFQQuWviMQQuWvTuQQuWv00QQH1CFWvFFBQQH1CFWvoQQH1CFWvirFQQH1CFWva:1EWviMEWvyEWvrhAFWv1hAFWvohAFWvR",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "feeda8ab-b075-45ad-bec4-9bdc5b9ae53d"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--af6f3841-8a1d-4348-8e26-9b0f175c048b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:47:27.000Z",
|
||
|
|
"modified": "2019-02-20T09:47:27.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".debug_abbrev",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "bb6d7760-090e-4756-824b-16342be2aa74"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d8922f05-9b5b-46a3-bdd6-23ac2eb34386"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "140",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "50ec776a-63a8-49e6-8c48-051b94db9766"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.346439344671",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6a592726-6c88-4256-8701-dd6e1f838c30"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "5aaac7866cfdcaa91634e0de61a4985b",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f54a3b42-6adc-4739-b2eb-8f31174b372b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "0d24a41bae150ce46eb53ee00fc41961f825226f",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "98d6b61b-777e-48a9-b9e4-784768c948ab"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "d0a0a7a43ecdd135f1c78d9aeca5f6feddd7d462a00266ab2a6c693673f93e22",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f5f0b3d4-9b7e-4db9-b2b4-b346916d80d5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "dbe3cdf3d4a623903bd870704e0a4790164210eaa18aad3f34d595a97c1e3d90b6d748a00ec32a61ea6999a178eacf23fe3b460c337afbcee291c8f28dfe3d6c",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "80933b87-27f9-4065-8012-c2996b726e83"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:PU1utPU1utPU1utPU1utPU1utPU1utPU1utn:Pk6Pk6Pk6Pk6Pk6Pk6Pk6n",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6a1e121d-2506-4a97-a360-ddff5e87e590"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--ce498a1e-28d1-499e-afdf-799d6da13d3d",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:47:27.000Z",
|
||
|
|
"modified": "2019-02-20T09:47:27.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".debug_line",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0a35c291-ac4f-4775-9c17-ffb814cd66f3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "903250cd-f645-4ded-961a-86a0e19ced24"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "1621",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "41a8a5d7-0794-4b5e-a4d4-44bbd474302a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.205743427437",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "159b6824-8916-459c-95b3-674083ebff8b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "a42a12d7c3f887ba30d32f1d9b0946ea",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "4857fc9b-c9ee-4c13-8918-8a5b7cd39409"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "3eddc0d5233b8e278be59112341f8d54ceb0626e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "576611a2-233c-4372-a74b-8ec932b4de17"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "6ad0187f76061f48ba30bbc57c02bb00d9b71504cc850bb4170c1af225f04d5e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "fa204c1a-1f5c-4b31-a1a8-e51c921f657a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "c9483e844d9254d004b29ffc850f822dd74025624fb1b9a320f592c1de1bdfb841eba20cd569b466bd59bfb5cd5ffc3565250f1a39c6c4dda4ede6823d3cd328",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "2447cc11-f159-45df-a039-9645d97cd4ce"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "24:/QQ4gQQTzQQrQQy1C+ZEYmghksR/QQy1C+Cr6nuQQy1C+HXQQy1C+C:/qg1N0A+Zrh0A+Cr6u0A+30A+C",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ca6e086e-bd8e-4997-924b-e9a12edbac77"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--4d9a9254-0873-49bd-9cfb-62a1f0848a58",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:47:27.000Z",
|
||
|
|
"modified": "2019-02-20T09:47:27.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".debug_frame",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "93a385ba-65c5-48ac-8a58-bdf18d5854d0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4176b82f-44d2-4eaa-80e1-3ac2e8c49389"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "88",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8c8c2797-8c76-4dbb-a33d-4631dbf79af6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.3454151753098",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e726ae83-a2e7-4f69-ba79-d93cd13c680c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "779b09db89100ae14e02cfcc4837d92f",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "223dbf44-cb05-4000-b2c7-d82012400d01"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "4b8984d1fb7c69115f9f919fc88023abd01c8e54",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "361073d3-1770-43ec-b9d6-cd1cda75bc4c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "d9ac041de17d5be8cce6d6218ba9b7254576ed6f3e97e2e1d7c7bb8985db65dd",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "e52d17f2-fcfa-4bb2-bc9b-1f47d612dde3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "04f71132255c4554813513c719c85d2cc6e3a466199ee4f9e6a4af9a127c35d48068c88709862c7a926d5597377a542d5468b91797a431669de7f3f85f6ee128",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "0d4534ad-a3ef-4039-b02f-beb9ef91aa31"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:NRC9/lvtLlNRC9/lxlI8Cbjn:nqDqo",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "241cbbc1-c766-4e16-b0d0-9ba326a497fa"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--2cee848c-2326-4854-9d96-93a7fa2cf988",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:47:28.000Z",
|
||
|
|
"modified": "2019-02-20T09:47:28.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".ARM.attributes",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "710541f7-a179-4485-8bcd-ccd8d416691d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "ARM_ATTRIBUTES",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "af809bd4-0b8e-47b0-9304-94e6fd365983"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "16",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a8bb4cf7-f48c-464c-8c6a-68782f0a658c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "2.6467822215998",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "db277fb7-547a-49ba-9e2d-ea05b0f00e29"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "37005ccd253a7a5b850ecc3bde4005a4",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b2b0677a-8fa5-41b0-b5e6-05cb293f4f71"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "15745e02a709144996f57ce897cde63620a498f8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "fd9a590f-7875-4701-b604-1cdbbd4cfd82"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "e379f18122d9b562947e07b84e12e6999a0e0650abf259033b61a22ba02cc26a",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "511e0233-349d-4523-b520-d3f581a6be6d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "c0f96443ee0bc3e45180942ce87420f33cf794558c75bc0892ab6a6eee01dbc6d40faf836a588fc980714d95c47b967e14a2b98c71f3f3f975f6948b544b998e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "75997c4c-be64-40a4-a8ed-8ce6be8b939f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:Zlmiln:Zlxn",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "39e93057-60c7-4dba-a9f2-40c943948e0a"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--d8d201a0-3149-42b2-9513-34b447c1c13f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:47:28.000Z",
|
||
|
|
"modified": "2019-02-20T09:47:28.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".shstrtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "519dd448-7e83-435a-9210-ce168b9808be"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "STRTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5e44f1da-55c2-4a84-b30c-20ec86d721e4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "221",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "53d665ce-3256-41e3-b759-efc0854a4c2d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.2882323145373",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8e3700b4-8cc5-4f51-b295-127d91405b95"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "e8ba6938803aa080ca9909ae33c56ac2",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f7a4ac8c-17c8-4422-88fa-842d8f40fead"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "f6aa549f26a05df9ff80db7fff11297412e88330",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "616b1f56-485f-49ba-9698-d80b17dcc904"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "8143605c420ec27d09c8b42bc386368fdd56c35bf33b8fb59c150705869a7696",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f050ac40-afe1-4f36-810b-276c9fa78994"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "661405d6b27ff98ffaef04c470c027944029620649bfce996f11abffb6f7580f0c242acbdc47f968de761d7efddeb450a1082b168cad3af02b8a53cbe0fd23f1",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5c76f254-9ef3-46ff-9a6a-365f0a8a5cd7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "6:EXwWEgMF84MFgiuqL+j2cKJAiLTpttHKwVhr9KI:IE/HllqieJAivptxhL9KI",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "68c60fbb-93f5-4d3b-827d-7514d3576dc1"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--1926ac04-ef31-4e89-911a-345958a68ede",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:47:28.000Z",
|
||
|
|
"modified": "2019-02-20T09:47:28.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".symtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "932a420a-d7ee-47d8-92c2-a8a9985f2e61"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "SYMTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5074c667-12b9-4092-a828-0e0da8d23e68"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "19888",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2f9bb81f-5eb4-4fa7-ae94-cb02a0485d28"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.4615886959378",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "810ff960-734a-45a5-b4dc-814ae2102ae9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "1020b195070f7e479b3d80ce29213e4e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "628542bf-f651-46f8-a1db-b4608c2b9e50"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "b86496d09cab9e9386b279771c10d297e06d26b6",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "fb678a2d-7fb2-4212-96d3-25062def9d9b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "01290465491452b65bc2d116279fe4a62e99c09b21e608f49ea0838b7a8a3a5f",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "8cfb28bc-b669-4d61-afb4-56bd32abcb4d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "9142145801d893be87dbce6400cb1ce94cba0ca08d3d3f6ab1d3e6870a8e517cd23f559ad9b9b0f134dc5fad2a08501eaff2500fc8026212d0c998adefa27938",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "019874c9-f602-4535-b9df-6769462bf314"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "384:ZNWYRmTgBIhiLF8UQN3plPvy35NUXy6yoi9K26QeI:ZNdS0A++j3nPqpiy6yoi9K25",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "bbb28afc-bc76-4afc-9cb8-530d6765385c"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--e10eaa5e-938a-466b-8710-99628dd0f5fe",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:47:29.000Z",
|
||
|
|
"modified": "2019-02-20T09:47:29.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".strtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "defb79cc-402d-4f36-9a70-0ddcc6a428b8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "STRTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a69b37d2-4b55-4a99-944d-8a5d9e821094"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "10690",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a8a68824-61a4-40af-abe4-28fb9f78a202"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.6191733359721",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d457b57c-2b71-460d-b5a0-8f8696aca9f2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "0f6c2014469d4d94fabc49a64dece60f",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5d073706-63e2-4e3c-87ab-5b66b0d96955"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "1832c65a16ad63f677b90d7cb329f73c761c39bf",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "e502acff-fff8-4efc-a14c-3b0cff2f39fe"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "1823ef919a83c315c253dbf31361468320d7c22ae7909966dfb4c41484ff18d3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6485fb6e-a080-4687-ba8a-171fda88d69b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "9a5b7f00decf17775e9a9961ff21eb733ed8629e9c896f08832c8f98492a2bc8dd04079a640765e98fb956fad7a7dd7d9027ca3fd7d688c922510096cee62dd9",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "a9c8fc17-f79c-41cb-b634-2b7f50e900c0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "192:XqnYJN4FfXSV5a804WKzxi8lmWrqmRYYQFnGBNsJM9zJjF6XrRQMI/hDsSpe4SBw:XqnYJNa180DKzI8lmWrXbQABaJezD6Xe",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "dd3c5ed0-a95f-46c7-b914-68131fc69818"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--6ff6a916-e131-436f-95b6-6266d38a16fc",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:47:32.000Z",
|
||
|
|
"modified": "2019-02-20T09:47:32.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "EXECUTABLE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "74132261-0290-4041-8814-3457725edc21"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "entrypoint-address",
|
||
|
|
"value": "33200",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7c223161-0d54-4468-bb16-de95a5ffb5a6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "arch",
|
||
|
|
"value": "ARM",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6f783d8b-18c2-4a40-a4cd-20c031383b9b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "os_abi",
|
||
|
|
"value": "SYSTEMV",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4f95c3c4-e542-4606-8a91-fdd582a77920"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "counter",
|
||
|
|
"object_relation": "number-sections",
|
||
|
|
"value": "24",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "01dd01ff-4920-478d-8df6-4c73d3fc30db"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--82185331-b6b4-4731-9a54-341245df56f4",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T21:26:09.000Z",
|
||
|
|
"modified": "2019-02-22T21:26:09.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '5c1e43382c73cf79f559506b32d65f05' AND file:hashes.SHA1 = '234736ebd1f1a33680e21653a70b4d537a1fb0db' AND file:hashes.SHA256 = '9bfa55698985096343655c5c2bf7c33f6ec8460c636922437d5109480c60fc8f' AND file:hashes.SHA512 = 'a6517bfc60f5f6d8cb6bcc70da2ef5b5c3d33c1a813588be3bf92f5164e6b410b4e0dcdaaa182402fd2a3361692faab8f5676fad0111832871e85de61c86a467' AND file:hashes.SSDEEP = '3072:mijf9ai+DBGm/BRM3/S0XniQrmcQABuXmbp:miD9aRjBRM3qcrmcQABQmbp' AND file:name = 'DEMON.arm6' AND file:size = '116894' AND file:x_misp_entropy = '5.9260047584658' AND file:x_misp_mimetype = 'ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV)']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-22T21:26:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--470171f6-6891-4934-a348-9e23bb444d58",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:48:04.000Z",
|
||
|
|
"modified": "2019-02-20T09:48:04.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "NULL",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8ecf6198-b083-441a-b187-edd585912be2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9d2e973d-1b60-466b-904e-3d199c6c9ddb"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--ea29e220-832b-4092-a670-d3959c5e6f05",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:48:04.000Z",
|
||
|
|
"modified": "2019-02-20T09:48:04.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".init",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c479b94f-c67d-4c34-8962-437e3b236290"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5328aac1-7412-4670-8488-53ffb8a97661"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "423eda5b-ebe1-4408-a51d-297a1347044b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2d56dc63-fc74-46a6-b081-9d65fadd689e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "28",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "996f2aa9-3a95-4723-880b-0abc10ee1f5a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.3797060488063",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9fa37b52-a2b0-47cc-b318-7b6c0d0e76a8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "7b5095cf426d60336a0dc670fd1e7fe9",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b60807ba-5922-4b8a-a19e-47810290ccd9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "5d3428b2f91e0d9ee90b9916fe46816c1620fa1c",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "98fe4596-a81a-4871-a448-32048b5bd1c8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "77c42d0381b80ab4206c6276d2386078dd05122f9b1798349dbe3e056fec73c9",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ac0da871-ef30-4632-a1f9-00969eaec250"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "c9ff28ed2fa673cf38e3640bbd61fe1cfe371b6713ccdd752d41e84e78bd8ac4bb9fd18ff5b62dc5ea550a95ad84334ffd1e42dc12b9f206ced6462f27e5572b",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "0996ddf4-44c0-4232-b403-52e6cf94e54c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:ZB1eFMlG:TG",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "e2e4082e-c4da-4471-88f8-191f77b7d19c"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--8e75def0-9d85-46a9-b3a0-766442a23aff",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:48:05.000Z",
|
||
|
|
"modified": "2019-02-20T09:48:05.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".text",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2bfc83a1-33db-4f3d-b05b-7a0252ce2ea3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ba750e8a-8a65-4411-85f5-0c50658983f5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d199f6e8-4d72-4abe-b35f-ee1793f911c3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c166e799-44ea-4961-8614-2fcc4efbc56d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "42584",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4b11ea9a-5f1d-4df6-b8e1-7195e4051e58"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "6.4651391837168",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ab562f16-713f-4613-934e-2c266d0ceb7d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "4df6caf5ada1d8ff9fc73bbb65f3608c",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "abdcdcbe-cd53-4975-be0a-ef07641e2fb0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "0f73a1a13f3998a9cd1598983f60d686bb9b7fe3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "148b5fc4-7b34-47c3-a215-f9a1f348ef24"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "cd8ff60074f4923499aa9bbc5b809d4144adf6bb9aeebbf5a6ece10098329a6e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ce510258-3cad-4809-91a6-6269f5e05578"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "fba07faf38eb056065f023876a91bdf38e5199e0b0fcc655fb836004c8a4fa3ac9ee118724fc9ee20afeac73e9e46f70bc19d6de18de494a70ea6a079c843b07",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "62d471df-a6ca-4f53-ae1b-21afa393f4f3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "768:ZMiEYbgEoCEjyhdsUnO/e+K0Z4X55fjLO5NhbVxcEWnb8TYZ1jPY5Fi5gA:GiEYbgsEjybsUnJ+xCJhMNhVxcEutZBv",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6dab1633-f3f0-4dd5-8ea9-0b712342fc13"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--6283cbe6-5c69-44d0-92a5-f9947fb7f579",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:48:05.000Z",
|
||
|
|
"modified": "2019-02-20T09:48:05.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".fini",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b211c48a-702a-44a2-9f76-4e34ed9bb6cb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f094f6cb-fec8-4f31-9bde-e8ac11d5991c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7e69e953-caa9-4b14-a3ee-565948da55de"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0bff5077-c111-4ac8-af2b-97d00514d9eb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "23",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7f9d5947-731a-432f-b6e8-c745815d0287"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.827909782144",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c545367d-8afc-491e-9bf5-eda65c1e806c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "a1f90a45b7c061ca8a989911deccc442",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "28bd872d-3ccb-4528-a60f-63d144808323"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "ad9665406c07f4fb8c3f4b32ba5b22e95ef1ffaa",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f21ab09a-5749-4149-8bfe-7da94d1086cf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "4fce64af87b4e0e741cbc682ce42bfb0b2d8dbb4c5cd7420e667e189b925a29d",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "33ca0c99-1982-4f11-b2b4-1697593202b1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "5a8fef6eddee73b71c81bac0f22199f2e2a442bbeeb92141a8df7d2699632e22f4e9ea4d6949f7ba84868e18fa3bd010697b6a20240492ba381018d629809a4d",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5ad29a4f-2ae6-47cf-accd-341b5b8d880e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:ZBXCRkvrn:Oevr",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "e6828a17-e690-4ad6-957f-d4f8ce5855ff"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--857bd85d-cf7a-4c31-835a-d33b78de4309",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:48:05.000Z",
|
||
|
|
"modified": "2019-02-20T09:48:05.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".rodata",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "aa9b97cf-cbf0-47e7-b13f-500f3327dee7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9c5d8f23-7548-4bd0-ae82-45874dab34c1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "dbfda02c-3843-4235-b3e8-201447b4368e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8480",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "09ab5625-3725-4173-b8ac-5aa69ecc339c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "5.3919382668249",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1c31b6d1-3f68-4848-8e33-130af8135f09"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "01b85af6860c10b5ee05f56d9ce7d5d1",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "2dd8310b-0c68-473a-a291-3aedc58a3ce3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "089f03232f08d5840a94bd9378e7e6d949e0e025",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f156d177-e365-4388-8b4c-a0276e2ab0f8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "b5ca1fddd3543dc64cef0e53d94c14c2e79c9b542279f99597cdb7859d9593f0",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "9f1eb3c5-08fa-46cc-8647-427b8719c57e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "4607ad659e4ace973bf056675f2ca764ece0cf28a33dca76f2a2ad0d97b2f24adbc86b18ec111c20ba91c8075398f00f0d988303eaae5c76f0eb6ff2206ec426",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7917fa9c-6453-4dd1-9bc9-1dcce9236756"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "96:7+McqAcsBMHHFUaQusnT7lRGNm6SgiW0dlOVXikjx8xkB3FpeKTQQHN1Ml:FT1HWaEnlRum67bqlOVyQSWB3fY",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5c9e67c5-f64e-48c2-b9f1-8230d038a992"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--10cbb692-f777-4e40-b3a3-1530d159680f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2021-02-18T08:46:30.000Z",
|
||
|
|
"modified": "2021-02-18T08:46:30.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".eh_frame",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b5380f13-27f6-4cb7-a1fb-82e4224758ad"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d19c2152-cf42-4450-90cb-7c4baeef5dcc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "38554155-673c-4a19-accb-e8d4c89e84b1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "4",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "64c88973-cc2c-4c6a-be90-ef2a4bb6eccf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "0.0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "30ab91cf-079f-4c02-90b5-6e2675c5b78c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "f1d3ff8443297732862df21dc4e57262",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "5d49e603-f310-44bb-9e03-d324567cfdb6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "3bd57d0a-8238-44c4-bbf2-a97a7e74066e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "419bde57-f7c8-4921-a332-a05ff359a78a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "dad77b72-4527-4daa-b8b9-531e7dc02464"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3::",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "faf90aa3-910c-4118-a145-547cf37ecfe9"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--f5bb7808-71a9-480b-8be3-5a131cc7b14d",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:48:06.000Z",
|
||
|
|
"modified": "2019-02-20T09:48:06.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".ctors",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "61149387-0c24-4270-ab94-ea50d66bcaf7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7b331311-0595-4599-ba82-2d131ae8ffea"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "284ab2c4-8fe1-4d65-b542-f4c1b411acd4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b5ce2093-1d9e-4334-bbe2-334de739ec42"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "54526d25-c21e-4808-93c6-94adf8ca1eca"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "1",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "94c11b92-dded-40d8-a567-239803c0e52a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f8f0e0b1-e0d5-4ac2-a3cb-e34936526615"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "79179c00-8d1b-46ff-9824-8df0584c4daa"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "3baf10fb-ca2a-4208-9324-ef40dc05967f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6bcf4770-19b4-49cb-974e-c5361285cf5c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:RRtl:LX",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6ed875ec-82ec-4976-b379-722c16b433f6"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--54d38ffe-220a-487d-9d9f-4c9601bcfc26",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:48:07.000Z",
|
||
|
|
"modified": "2019-02-20T09:48:07.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".dtors",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2e47dfe8-e9c2-4143-8b55-6c2c64780275"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ba327eb4-1ed8-4c00-a293-256d19d2d582"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "77aef4d8-b48b-432e-a3e3-6f21fa8bbcad"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c7400dd3-b9b3-4f96-baef-c86a1d89d526"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a05644bb-ac52-48c0-8bb9-b6db0fdb5ace"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "1",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f16cacee-5b94-4e5e-a126-4a43172204ef"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "040f4860-1df5-491e-8f8e-4156ae076a6b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "10327f76-7d84-4fc0-a5c0-a4c363004c6c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "bf5746f9-e2c3-41ab-a876-1f2f2119f36c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "da4d3d05-9e48-4bf5-b438-73a383683a74"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:RRtl:LX",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "1e263b55-7b6a-4247-99bd-e4be9406068b"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--2b50e37a-113f-40b7-83db-8d7cecd7445e",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2021-02-18T08:46:43.000Z",
|
||
|
|
"modified": "2021-02-18T08:46:43.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".jcr",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b7bc20ec-b0c2-48e1-93cd-99c4b062c294"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "616befff-800a-44bf-aa16-ce1aa9af8f90"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a5ec2fee-0e50-468d-8fcf-fea8c2aa30ea"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "adc9ce20-feae-449a-b90a-07bd45c884c9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "4",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "76021a7a-ebee-4e77-a60c-899a4cae08e6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "0.0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "25ccd956-5c36-4371-b9e6-474f1ff22dc4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "f1d3ff8443297732862df21dc4e57262",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "421cd903-e77d-464d-855b-9ae551ddcb80"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "635042e2-9a68-47b6-bfd9-d9f762859812"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "999e1aa7-5c95-4873-8e5e-fa1d6ec6957a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "21fda47f-fc17-4f02-bbdc-76746f945077"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3::",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "7f4ad22e-e15f-4242-bd4d-e3f3edbeb7ba"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--686654a9-8744-4acd-8c99-882671eb86a5",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2021-02-18T08:46:47.000Z",
|
||
|
|
"modified": "2021-02-18T08:46:47.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".got.plt",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3f9da1be-ad09-4dac-86a3-42f4ce9feafe"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d3f344a1-821e-4ebf-adc0-db024050e563"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b751bc12-657c-4f34-8817-6a4f147dabb5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "42158372-9fdc-488c-a31f-ec247bdd7db1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "12",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8c4e9754-533e-40a0-9d65-d057494bc908"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "0.0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f33998b1-d642-44d0-90c3-341af0129621"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "8dd6bb7329a71449b0a1b292b5999164",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "471d28c4-829a-4ebf-bef5-a7af565f5c41"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "2c513f149e737ec4063fc1d37aee9beabc4b4bbf",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "d92dcea0-3d98-4d34-896e-f5c775f55216"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "15ec7bf0b50732b49f8228e07d24365338f9e3ab994b00af08e5a3bffe55fd8b",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "5c6114c5-aa82-45e0-9c57-b96590223285"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "666a9a1a7542e895a9f447d1c3e0ffd679bbf6346e0c43f5c7a733c46f5e56c2f65e69dfd4769a9cad2b79b31d282f1ca2aa296ef41bd9833947ada194f46940",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "537070c8-e2b6-4676-b88e-d16a63b1cd95"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3::",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "b74db7fa-28bf-4181-8dc2-d9d5156d7fa7"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--ffa1f4b4-6c33-41bb-a9c6-8497c56cc1c1",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:48:08.000Z",
|
||
|
|
"modified": "2019-02-20T09:48:08.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".data",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "93a43be8-42db-483a-88dc-fc0008dd0b1d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6b764ff2-2d28-46a2-9b00-dd6ae72259fd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "02c57a94-f73f-4e75-b131-4157490fcd6a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "90dbb44a-2dfb-420d-92cb-992ae6177bfa"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "672",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8477facd-5a98-40e5-b81b-06b9a83fbda4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.4715707722781",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8d337d26-ef50-4e33-b0e3-7b77054101a7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "8b2a3aed3797d81a16c6f5fbb738c2b5",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "821565a1-d223-44cc-9bc4-f20817404b73"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "defea42a4680abc43ea846bf1205fa09eeb1ea8b",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "1197264f-4a58-47e9-99a9-845c39aaf228"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "5ad49fbd97385bfe9d2ebfc1b36d30c80bfa9d740f4aa65749f09ee716af290b",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "8e5100f3-7203-4a98-986a-50690cdc6c70"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "8b6164db46a2511a3f5d290666a7177e4dc41d75da4c63fb3f61a2e94d7640bfeda4d76bfe67a31c447d471ff47e1241be8606467bde816a5e0e7e88d04e6438",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "480e0601-008b-4b8c-ad9e-fb290bf15929"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "12:Ur33E0/n33jzxkyEEEmhIKybSvOH/YJ5lqq5o:Ur3h/n33nxThIKLn5o",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "a812fe64-4e58-4e60-af6c-e06dfa8690f4"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--076dfd16-0873-42f0-b06f-fbbcaae6b7c8",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:48:09.000Z",
|
||
|
|
"modified": "2019-02-20T09:48:09.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".bss",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a4685876-7e2e-4f46-be21-11a8e9a0ed85"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "NOBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c7810771-2537-47b5-ba5f-362392f06a13"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a4234691-b6cd-494a-9f3b-677e5440d243"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4d02f7b7-0d5a-449c-a2ad-2164703763fe"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "26340",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "11d97cbd-9a8f-45a5-ae65-3fce42022e9e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.8831267428962",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ffd24734-52a0-4b1b-9c77-b55cd49fb54e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "8ebdea94dfc33c68d0f044a4231e55df",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "1719ad6b-163a-4da7-8fe7-88d9657b830f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "b8cb6b23536ef7836b093ef0b911a18a6c576a1c",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "656daebb-7bb7-4f9d-9e37-e799a5ddecee"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "77b5b53101e857e476d030e6d6455b5c075e67e430499f99aacd05dde9648f20",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "0626f0a3-3321-4ce0-8ae1-22eaa8f7dcfe"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "c00e894c475d10031358d4c37289ac5abe6640a4b03c616772d9fb4a0356565df9d89cb59ab61cf8dcf9cbe9aea9cc22cc0d7d53d46b80a1a1b861e67a4634fc",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "53dbaae6-e846-46eb-9465-b322f7e446a0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "384:zxBfhND2Cnci3q+ir1/d3OKkdc7IQ+DIifmmX8015HVMVcFUe/tRfZe/Olo9:zvfrVe+4BmXn1JSVcFPzfE/O69",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "3a4de677-144b-4115-80b2-bfc95cce9210"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--af66b768-1c00-49f7-a4ff-803d8ab37233",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:48:09.000Z",
|
||
|
|
"modified": "2019-02-20T09:48:09.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".comment",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "69f60deb-826d-4d80-9e4c-a8705733dd20"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "df175fe4-b793-4b41-a51c-bf242867c571"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "2970",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8e4484ba-d74d-417d-9a9d-aa1c40e80939"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.6143694458868",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "16731ecf-6971-4cf8-a86b-5793b6385652"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "b1cd8554072473955f4f920916a223cc",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d25adebe-1f0f-451e-aa43-98788ae80805"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "20f0b0f41ba3869658e81d7269a8f28c164f7d94",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "db146db3-c876-43d5-b667-08f04dd2fdd4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "e394a3cc2e99cf74ad01a38ee5bb9431fdc2a4d816bce290e39a887b914a12b9",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f8dbfcef-d2b9-400a-9c6b-172668c68dfe"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "8fd36402cab1a8c9203924267185190a18fd1cd1a7a31446c4ce43c59565b2978888567441e6328006d432cd8d70b3b03afed15b9781b7fe6986f34d1a90ad89",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "82974676-b0b9-4376-b833-0735bd651953"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "48:BUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUg:u",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "40df97f7-9d99-457f-9893-8eb9885d3b74"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--dd6bb24d-60aa-4447-a2c3-53e4719c1a6d",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:48:09.000Z",
|
||
|
|
"modified": "2019-02-20T09:48:09.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".shstrtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "418cff54-489a-4b7b-ab36-e89d5a2631c4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "STRTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8b3d83c9-79a5-4787-8499-804e3a5b6ab3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "111",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "cffe6b27-aaa4-4316-8985-56bb2dfe405a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.9464055386973",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "72446b3c-4416-4197-aa40-b3f862117333"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "d45c87701f772bf923c5372dd4be4e5d",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "be1c2399-5d29-413e-acf6-3a650fc298f8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "057410d34e0ec72796d60dc2f8b41a82acdd466e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f7070a06-86a8-4bf2-90ee-449a247cdb42"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "5095f212da7a3bdca84036162db03dcdcc7bee4a14f70e9592d1088e8f8925cf",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "cc64b092-c32d-43a1-ab29-662384c95014"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "a1397dfaef694805c577db98e7e56d8d954c0e1b8a406e7ed0bab482acdd7ea0fc4640011adf0970fdb1d39ffef396d2e7b3fc108f1fb633b300cea41037424e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c80b045a-0162-4cad-a4bc-f0f7a59af97f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:mqWxRuRWExqMLwlApLQ4lLaCMLn32cxlLPAllZBJR2iLT6:EXwWEgMF84MFTnsRAiLT6",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "56412861-3ad8-47a9-a117-fb248ec8354e"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--d17533f6-f053-4ad0-8ac3-e4640059a3f2",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:48:10.000Z",
|
||
|
|
"modified": "2019-02-20T09:48:10.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".symtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c5972de8-0292-4e3f-aab8-17813197d076"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "SYMTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "62b69575-93c0-4677-b148-d55db3b24880"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "11536",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "54b98580-6cb3-4236-9a61-46bb89ae5090"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.0884626585658",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "fda3590b-ce26-4ea8-b679-8845c9765670"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "a958885a14d7846239acc28de017a758",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7101b705-95e2-4622-9476-2f8d700369ed"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "85652dfbd122f20c53be1a166b6c9f8f8673bb20",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "843ef774-9593-414c-b740-f97f4e7ce0e4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "cd2122a9a94dd37f0c5894949db58bceab065ac50acf612210500500affcb629",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d559cb08-f140-47e2-9216-2e4119f67f69"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "5fdd24eb11d4552fd58af62a37582522995a8b39fb95e85fe89894261c92fe39d7578f92563501f5e30ce6a0ae32533acccac2f15eb039cfbd5b87e1d042f4b8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "681977e4-7f54-444e-b1eb-e5460757e3a2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "192:I0ftB/npfN8BUSnczOVCnELi3g/+i/j1/d3MS7qBA2kL:dBfhND2Cnci3q+ir1/d3OK",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7a72d2f1-29be-47f8-b47d-0a82932b8757"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--925757a0-52b8-4622-a57b-ec05a890b587",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:48:10.000Z",
|
||
|
|
"modified": "2019-02-20T09:48:10.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".strtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "bba83b5d-b4da-493d-90b1-7608915bee47"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "STRTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f96487de-a300-4e83-a963-003f06ca1a18"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8702",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4c3d3f0d-ef9c-4d2e-879f-bed2a3b43d22"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.5989040501762",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "22646b45-98af-4a10-b5f9-c8e356addda3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "f9bb61c340ab6be7b264a3517d7993b4",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f7e7680c-dba2-41b1-b137-fb04c9698ddc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "88fc8fd3bb6bd323a93f80a902d77e09f94e76e0",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "0f372455-002d-4d5c-96be-6d638372dd9d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "a8685d9604974fe9f31da544b400117e0fb1b086bf30c2a4aae6f20c70ac99ca",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "041ae994-3f84-4ad8-bb61-84450823f227"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "3f1692027cb22896355d4b1eccab8125ca769719cfcf9426ee1bac1ff5306e44bfd10252237854c38a4f5065b5092eaa1f2cbe12db32b79c20293dfc46cf4cd5",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6cfd13d4-50d9-4e2d-8d9a-d5aa5fbff719"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "192:udc7IQfXpVqbDIiC+xwmX8015s4S2nMVfE0kNCe/tShQlfrFe/OhDZqD6aEJ:udc7IQ+DIifmmX8015HVMVcFUe/tRfZv",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "39645af8-27de-4a3c-a11e-6e0038f44d6e"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--519d047d-55a5-45d8-ae55-1f511b364c39",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:48:13.000Z",
|
||
|
|
"modified": "2019-02-20T09:48:13.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "EXECUTABLE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "52800c76-a043-4338-ad2a-bd3f96879053"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "entrypoint-address",
|
||
|
|
"value": "134512996",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ee421d6a-ae10-4297-8f38-a0f00d8a092d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "arch",
|
||
|
|
"value": "i386",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "bea16ebf-5ff7-4ff0-835b-1398ddb1d94b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "os_abi",
|
||
|
|
"value": "SYSTEMV",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e9b7c65f-0d69-4e10-a72c-ff7a2e789e95"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "counter",
|
||
|
|
"object_relation": "number-sections",
|
||
|
|
"value": "16",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5910b2eb-4dec-42b6-a2c3-ee472baa3f08"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--ee88ac4b-ae90-4c72-9d23-ea171d52a814",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T21:26:09.000Z",
|
||
|
|
"modified": "2019-02-22T21:26:09.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0755c04f9f428ade09cd6521ecb21510' AND file:hashes.SHA1 = '512dba9737600b1a9beebcc2b32b1392dab3d20a' AND file:hashes.SHA256 = '85a118a21531fdfdc62ffd2f39376fa67644d8cd4041a288b770def0a4f5f5d7' AND file:hashes.SHA512 = '3e4f368ba6c7ce75ae1e1c6b7aa4e59a86f190c7603a418302f20063b10ceb65952d7ecacd5739442a1176537392e444e7436dc57c1e0170242bf76f1ebb4246' AND file:hashes.SSDEEP = '1536:HiEYbgsEjybsUnJ+xCJhMNhVxcEutZBY5FLokXHrqm37SVcFPLE/n9E:HiOjDUJVJhsvxchtnvk2mrSVcFjE/n9E' AND file:name = 'DEMON.i586' AND file:size = '77914' AND file:x_misp_entropy = '6.2564628860216' AND file:x_misp_mimetype = 'ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV)']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-22T21:26:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--e826781f-d8c9-432f-9e69-4d36839e3633",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:51:17.000Z",
|
||
|
|
"modified": "2019-02-20T09:51:17.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "NULL",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "15b98676-5615-4daf-924d-fffcc6416d46"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7d5363c0-1912-49ed-92d0-3a341d55f434"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--3986c66c-514e-404b-9e28-7ab45578994e",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:51:17.000Z",
|
||
|
|
"modified": "2019-02-20T09:51:17.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".init",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "343fee90-7eb4-468d-8cb6-1d393562f894"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "fe7f27b1-f805-41b5-9c5e-090604ddb3a0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "efd985a4-15fe-4796-b684-f82646770ada"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "78f74560-c4b1-49b3-bdbd-171476bb094c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "28",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "be52dafa-0e46-4d85-aa25-6e2d003213fb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.2813172094433",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "64c8f766-180e-4cdc-b874-637a8fc2f81d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "946453b1f624469c9e68fb21aca320e8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "65e2d7ee-e7c7-4bcf-902a-4e6ad99360b4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "93b5f942551bd90358a39256eaaa2eb534b25338",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ed67f8b7-beee-402c-be4f-136d8f44112b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "8034e5a1d7bf01476c236e4fd422f053806d2546781678b83d3bb3cefba943ca",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "8875dd5e-6eda-4445-a613-cfa94565c8c8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "92110fc32858adf02d6f91d6d1ea199481b119d64ab2848ced93b498a09abd34bd7cdae3b5acb02af0e17db85de14be793aeaf79b53076d1a4964ea704770777",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "a73e8684-047f-4004-b484-7ce6a0718603"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:ZB1eFhlG:slG",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "60ce0d7c-eb34-41c9-a56f-4e94357ac1dc"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--bd803983-4b03-49b8-ac03-9d349ce2c233",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:51:17.000Z",
|
||
|
|
"modified": "2019-02-20T09:51:17.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".text",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "fcd0af55-9138-4694-92e1-4a7c1d774ad4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "dc65544e-4018-46dd-b2f4-6c270ff79d06"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "33972c8b-a038-4294-8ecc-aa75c7b7126f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "65e86eba-d975-4057-a904-0228f0f0dcb5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "43508",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "63bab65c-1e40-4568-9d5a-c0956a43be3a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "6.4008500745915",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "773aef0a-4b5a-4a48-b8a9-3f82d94f9a65"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "2f0c8d67abcd9fd170fa90b68406ede1",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "e08f0f8b-fdb4-45e4-9cb2-585289afb8a6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "2e0d6ab0388b790660a2e8019f5bc5f5513d1f1c",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "e1eb9a52-f6b5-4fa2-8f87-21af813973e3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "df266130264a3175ce8d9cf9f531f930ec82258075381fc505ec760a674a2586",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "460a57a5-8f0c-4b68-8e73-b88332736c92"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "3cce3276ecf8cc3d529d2b8d3c9ca6d3ef1517ed4a651b85264896b110fec96f8c6b3285e0fc4b84c78d5cea4d3eb02d50feb0d17b3c2b43434b116b275207c6",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "a84aa478-4bd8-44ae-98d7-54d08a9c64f7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "768:Qmbry54zxxo6vRpFhGQ5l+fjxvAtW6TpRKp1Nt0bNqprmzqEswpQ8egCBFGtRE5:jry5upt/5IbpYWGKXX0bNK+ImCBFh",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "aace43dd-a5ce-4117-b74b-df3e35833c26"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--c0d75914-c1de-4526-a7ff-48062734a6bc",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:51:18.000Z",
|
||
|
|
"modified": "2019-02-20T09:51:18.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".fini",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5cfeb529-2512-4c91-aa1c-362135ebe595"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8f41cbc0-bd69-475c-8e61-beb7fa9238c1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1eb231f8-a297-4e12-a378-c9d27b72c6ea"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "492740e1-7493-47ae-b5c9-a9a3e0261174"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "23",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6ebd9949-2306-4fce-86f9-a631b74bee65"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.827909782144",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7d93a74f-a2d8-4af1-a8a3-ad39fe1f990b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "7ce407009e96c80aba9fe31c0c06592f",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5f9ddd28-d711-48a7-9d47-0407d9bd1daf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "d8639c8ac95afcbd99e1749a971493d20927c81c",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "fc3a2408-bddc-4fb3-bfbd-91b4996fe10e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "457c01283d10bdda529f14fd58d061fd782b7c34de72de35f32372935f5c0256",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ae4dfb17-39a0-4f55-afae-10f99eaf5c11"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "a74e506546d13e5b742f7e2828a916f62e453542e21d7e52187dfa28e0a2b49aa5438f6df5e475165df822009d7b3c2a0c08ade784150d37b3f2b82e0bb4fdd1",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6aa69585-18c6-462d-b93f-11f8030f110b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:ZBEaaxG:YK",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "da3c3b89-b131-44c5-8b1f-0f4a6ed619c1"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--56631f91-e310-44a3-9ffc-5f87beca5393",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:51:18.000Z",
|
||
|
|
"modified": "2019-02-20T09:51:18.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".rodata",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "05dad726-6f15-4f8d-b9f5-054a8fdafcd8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "41e60890-00ac-4ea8-9f51-c18f72b4054e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "29adf672-354d-46be-9e90-7c5e5c5f1fc7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8480",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "be1c7774-4a04-4dea-bf06-5246d4f759e4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "5.4139520501754",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "48004fdb-3675-45b2-b35d-bd2b4b6ae82b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "ca320ffcf251ff07dcb6d7c045eecf9c",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "4b2f4bd7-d192-47f6-810d-76499e79f1d3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "88baa0a5a26d68a1a3073a4068f05c76564bc1df",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "2cf9af4a-c82e-4374-a8ae-c0b0bdb56d8c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "b52caf136b40ede2f5941bc11bdf7145e2b2ea2fb854151f65b0a097ae1dbc53",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "55874e44-e451-4480-b87a-27fc5b4bffad"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "6ce034c83930c50840d402522a70cbb3b85a8070bd38a3aa6e0c914dbd17a29175463486e358854ae2d850b4a32c562f94ce3d01f65777a1032a312b051d5217",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "68287fee-2efc-4ed6-a6cf-c479de35324f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "96:7+McqAcsBMHHFUaQusnT7lRGNm6SgiW0dlOVXikjx8xkB3Fpej2uvQQHN1Ml:FT1HWaEnlRum67bqlOVyQSWB3nwY",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "9b59abd8-a2a4-4e8f-8ccb-4c6a2b48dc65"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--fec33774-1305-4cf9-a062-9695c3c0b2f8",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2021-02-18T08:45:02.000Z",
|
||
|
|
"modified": "2021-02-18T08:45:02.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".eh_frame",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "545a6936-ce56-4c76-beee-600baa04873d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4c84a3c6-6117-447e-83f2-4615a1a21800"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "29c27bf5-f615-42f0-8a6a-fb518a7849cb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "4",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3f80712a-c25f-4781-a6b4-dad3931cb28d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "0.0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "636ece13-6266-44e1-89c7-4e7e8c30de7f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "f1d3ff8443297732862df21dc4e57262",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "df11d52a-28bd-45f3-95e7-46393bf91425"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "96475519-a8b9-4854-85ad-ed03ed6cb3a4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "1d4e8495-d810-4e2c-a354-360313b7c3de"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "0f6a301e-969b-463b-a8e3-d7f08a4f1692"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3::",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "95b65b11-1557-481c-86b9-049d7409a2bc"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--8a8f8c42-4139-4fbd-8e47-95c67bf44b7e",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:51:19.000Z",
|
||
|
|
"modified": "2019-02-20T09:51:19.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".ctors",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f069be34-867b-40fb-a957-f17eef48e466"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "50e73624-06c7-46dc-b51b-62d614902324"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a4e723ae-5748-434c-8aed-d3c11b36f0ef"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ff5bae1e-a925-45aa-8451-1c683c6fa63b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6d4668a7-7670-4e2b-bf9f-980191f35942"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "1",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f242094e-b290-40da-96f3-108b4819be13"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "baa53f5c-ad95-468c-9fb2-493922b8d620"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "00bcf0bc-13b8-44b2-a702-4d875e14d05b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f6d861c2-eb4a-463d-8113-dc0ea864f02c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "182d380d-5ef9-42ae-a554-fdc94898ed99"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:RRtl:LX",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "dac6c66c-9e26-44e1-b1f5-1802a88085ef"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--06eddc48-a6c1-4ee3-b93f-59153e8d07e8",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:51:19.000Z",
|
||
|
|
"modified": "2019-02-20T09:51:19.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".dtors",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "97f1ac5f-2bc9-44cf-b20c-d912b958f610"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "73f2b130-fc2e-4bbb-bf03-a7f57b2c5b6e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "090c171a-4324-4e20-bc8d-c7c797eeb0b2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "33fe90a6-24d3-4042-b0b3-226f9035898c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "714bf7e6-4c77-4d08-811a-dcd4aac9483a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "1",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "afedffad-709b-481d-ae83-92d9b5060d69"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7fcef0ad-a124-43c7-aa7c-068f7f0e7fdd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "0b2ce364-69ae-45de-8c26-806227e5d4aa"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5514d363-baa6-4b53-b85d-0548f15495e1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6ff84d9e-0c6c-49d8-a1f1-294bd2019f67"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:RRtl:LX",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c3b5c7e1-2d68-4917-a887-5bcfb3838345"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--65ea31ac-3e42-4d1d-b488-ee8a30e3ddba",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2021-02-18T08:44:48.000Z",
|
||
|
|
"modified": "2021-02-18T08:44:48.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".jcr",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "48331a38-45d5-4cd9-b78f-c5d2b107bd13"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a45282b8-9b8f-4f5b-8532-a35c09b5fb61"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3cab8c3f-b7ea-419e-a107-a1996f56e618"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f4d0cae7-2637-4666-a441-3149025a496b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "4",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8f75dc9c-30c9-453d-8853-6c962bb3bd54"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "0.0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d5ebe091-95f6-4754-ae2f-cc9fbbb8f65a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "f1d3ff8443297732862df21dc4e57262",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "f3871d21-8e1a-44e2-9719-42f7fe1a9833"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "be820cfa-2145-46f9-96a9-6f36bfa49199"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "7b1e6e26-09c6-4809-8a96-7d61abc84431"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "c5d5c34c-35ad-4ea6-8ed7-a454cb7a8972"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3::",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "7d85f922-28cb-4ec3-ad5b-e7912e829528"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--c02bb6f8-3bd6-4cab-af0f-d4175ce1757b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2021-02-18T08:40:21.000Z",
|
||
|
|
"modified": "2021-02-18T08:40:21.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".got.plt",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "810c859a-4dc3-4540-bca1-a7ddaa6fba4f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d4e73946-00de-4881-93fe-36df537bc8b9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "48c653d2-ad66-4063-b62b-5524f0b127fd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8c6b9cfb-5f15-4e2d-8ac5-764e05d400a2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "12",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "547de2a7-994b-4c46-9ee5-256a58a414dd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "0.0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6f8ab835-9365-495e-b3af-894fc5d4d22b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "8dd6bb7329a71449b0a1b292b5999164",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "9cdfc299-e2ff-449e-936d-14c3fddd34a1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "2c513f149e737ec4063fc1d37aee9beabc4b4bbf",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "00a81644-aac1-4058-ab8a-04c56555b94b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "15ec7bf0b50732b49f8228e07d24365338f9e3ab994b00af08e5a3bffe55fd8b",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "e69a1796-3103-4ee6-85ee-f570a548058f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "666a9a1a7542e895a9f447d1c3e0ffd679bbf6346e0c43f5c7a733c46f5e56c2f65e69dfd4769a9cad2b79b31d282f1ca2aa296ef41bd9833947ada194f46940",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "8c595343-a26c-4370-8f84-be2cd79d1220"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3::",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "085f4b73-2331-4864-882d-89b5948cc30e"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--8e061ff5-a705-494a-8cec-a45f3aa7b0b4",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:51:20.000Z",
|
||
|
|
"modified": "2019-02-20T09:51:20.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".data",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "53f501af-8f58-45b6-8f1a-3380bcbee7e8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5746c72b-6c4e-43d3-9e88-ade93637de4e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "857151aa-c532-42e5-82fb-571152518101"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "32ee4f00-a33c-42ea-8a6f-211d45b66750"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "672",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a9a2282b-2193-4239-913b-bfb3a14f3d13"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.5158060441528",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "763376fa-5336-489d-b15a-cdb2650ab986"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "495baeaab088b47da9a43293adf82bf5",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "2b9e57b3-03be-425e-9185-5feae003c465"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "7507239d7423f6a2678522615b3e00382f654dff",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "eac78f21-c401-4360-9287-cb36cadace5c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "fe8c3dccfdacebb0075af3ee243e912019199498bff86025869cbf20620cf3bd",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "472f6d25-f846-4b47-a347-8b44006df6e9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "90ccda823874d344bf7e243f67ae7aba1752b9322fb8d0c985e25374e940b229b480a8867fd725a25f956c4a6a021626383f06e627e3bd9c100e335061d57ebd",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b16ed96d-f2b8-492e-9339-7969cf61f3f0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "12:Ut8E0/n33jzxkyEEEmhIKybSvOH/YJ45y5t:Ut8/n33nxThIKLD",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "64998020-148f-47e1-9b3f-d50071ad5215"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--a30e6ecd-679f-41c5-9535-9bba600cefd1",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:51:21.000Z",
|
||
|
|
"modified": "2019-02-20T09:51:21.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".bss",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "bc9b6dba-b7dc-40d2-b02f-c3653e1ef8ed"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "NOBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "71672956-34c6-44d2-a352-30ff41739533"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ef4a436f-522e-45ce-8ff8-f4c4a4cade4a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c1aca3d1-5526-4cc2-bad3-c2d6bde6723c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "26340",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "26e918e1-6c34-4ad9-9236-785d0d0d49ee"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.8838687170362",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0eb0d829-f3f7-40e8-be92-44c973dc1f4b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "1f9055b62fe4f941595ab4f1e62a2e3c",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "08c615ec-071f-426a-8a70-7cc3cb5fd63b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "1f6e1b03ada08a5738acd9f949bb910461ca0ded",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "50cd1f1a-3bec-412a-95a7-570b8eec864d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "bed25eedec6353846ad15a3e778d20345411ed785a30ea6ce2e339380d93418f",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5f32ae6f-b4ee-4cd1-ab78-2d25284dd43e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "7343a0f67bc1409a106e66e5b6d3227db4712729ad2e4d0ecced34d685593c930809d66c9e089c1bea9577ffc266d2882fc7c17302c2f132102eb244366bdbea",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d753db69-5bb7-42a4-8aa7-b46d3ea603ee"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "768:QEW+mFlVFvuBJ2TlmXn1JSVcFPzfE/O69:QV+CABGm37SVcFPLE/n9",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f4576550-9d4c-4808-9e9e-8f7be5806243"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--4fe89ca0-8d15-4412-9c39-907e06000097",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:51:21.000Z",
|
||
|
|
"modified": "2019-02-20T09:51:21.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".comment",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8a77aff4-0ac1-44a5-bab1-9ef0bba66b26"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "cd18b5fb-1e75-4db1-b175-5c7d0dfe3cbc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "2970",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "177815e4-a1b3-4ffb-b78a-2d5bc50fd570"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.6143694458868",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "70456af5-777a-4886-8736-aab1d9f39d7a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "b1cd8554072473955f4f920916a223cc",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "0edee7df-03da-4d69-83c9-4613341e1cac"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "20f0b0f41ba3869658e81d7269a8f28c164f7d94",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f8a06288-d1c0-49c3-ab06-543efde013d7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "e394a3cc2e99cf74ad01a38ee5bb9431fdc2a4d816bce290e39a887b914a12b9",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "e2f3fb0a-11aa-45b9-b4b6-81911999db37"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "8fd36402cab1a8c9203924267185190a18fd1cd1a7a31446c4ce43c59565b2978888567441e6328006d432cd8d70b3b03afed15b9781b7fe6986f34d1a90ad89",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "9944338c-68ac-49aa-af52-2988eadcbf8a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "48:BUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUg:u",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5daf2e37-8e8c-4052-8ce6-14e77a0ce403"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--14ba151f-dbf3-4567-86d9-a7ef3a3a92a1",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:51:21.000Z",
|
||
|
|
"modified": "2019-02-20T09:51:21.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".shstrtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "68fcc396-a53b-4c22-b878-ef1673a18fb9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "STRTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6f5494c6-fdda-466c-8def-c915395312fd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "111",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "af9800c9-4a10-4d4c-97aa-a2bae60b6494"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.9464055386973",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7a7ca466-c18b-41f0-ad7d-c698a3b15a40"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "d45c87701f772bf923c5372dd4be4e5d",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "32d478f5-2fe6-4355-82e5-11f4902ee31e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "057410d34e0ec72796d60dc2f8b41a82acdd466e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "3d6058e6-5f18-44d5-9526-110dbc5b4f2a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "5095f212da7a3bdca84036162db03dcdcc7bee4a14f70e9592d1088e8f8925cf",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "66d08dfb-45ba-45ea-b807-6966f2455594"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "a1397dfaef694805c577db98e7e56d8d954c0e1b8a406e7ed0bab482acdd7ea0fc4640011adf0970fdb1d39ffef396d2e7b3fc108f1fb633b300cea41037424e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d0e82ab1-61a1-4f66-8da6-bd8a1ca3b5ac"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:mqWxRuRWExqMLwlApLQ4lLaCMLn32cxlLPAllZBJR2iLT6:EXwWEgMF84MFTnsRAiLT6",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "32b4ce9d-503e-44cc-916c-13939037ace2"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--ab60dc7f-1824-4330-ae97-d4fd35d8b19d",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:51:22.000Z",
|
||
|
|
"modified": "2019-02-20T09:51:22.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".symtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b9e4937f-0618-4734-8043-695883e57fff"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "SYMTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "47de8b69-1967-4ce8-80ac-eb8680260871"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "11536",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e6907ca0-f7a3-4506-b004-2e781111b66d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.0869338685196",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3391160d-7602-4bd4-b87f-cb4a6aae025c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "bea0764dfbb8077eb389b0f9dc892808",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "83111866-2e66-4cb3-a71e-3a168970d86f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "1d73427fd3aa3d03409e2797b470afbd7e19954c",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "de8d1138-0b5d-42a1-8e08-633015632494"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "7c0b08b83d7ab9eacdf43858dd4b8821e3d6da350ac4b2370a8c03c113c8370d",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "e7851e0f-0fa9-4c24-9084-52ce05320ce1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "fc604165e7b4c6ad671f2aecdbc8f79dd27143bba3f9ae969bb8f415a86b2d63a3922ced7783a2dc932d0ad39ff3eebf71174e144b461721346d74705d6a4695",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ade09b45-70d8-4a69-b188-2250af24d497"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "192:EB/OQrqB1AVi248/vZS3jzVljvuy4uzG1l9KMNv7VS7vN:EBW+mFWSjzVljvujuzG1l9Kf7vN",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "70ba2316-5ba6-4dba-8e26-2ea691d0576d"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--8c00983d-18f4-43af-924c-52e733a3ba2b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:51:22.000Z",
|
||
|
|
"modified": "2019-02-20T09:51:22.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".strtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f6d4a4d0-9180-41d5-9694-6903f979e978"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "STRTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2ed3f4ae-0397-4682-b298-ce373caa3e0d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8702",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ce168d64-08b9-448e-8089-b0799e1acb4e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.6002506022584",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "24ad1579-ba8e-494e-b572-ee93d1fb3d0d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "bd65edfb3834377fddf6069a3497afb2",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b4f913d7-8f90-45f2-9454-33dd9644eeae"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "4ad0fe87fb2e0027a427317a303deff1d7358fde",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "25a3b62c-04fd-46a4-b197-80cdfe312364"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "bb24c45c7c4b2472d45e73dd0dd1538f4adac9d7f3d759fd83f57d394113bd82",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5bf54a78-237f-4290-9bee-1fa6a1d212b3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "bcc8fad6e3c5f076204fda6bfad9d2ef5b2dda1ba32f48702729af629295365a698495a2a899691298c0c1118396e1a6f1784768aab67442a4a515be42515095",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "decef655-c8f2-4ded-aad7-814f201746a6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "192:udc7IifXpVqODIiCfxwmX8015s4S2nMVfE0kNCe/tShQlfrFe/OhDZqD6aEJ:udc7IWfDIiemmX8015HVMVcFUe/tRfZv",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6e991ce9-6096-4648-a88d-af7479b4b77c"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:51:25.000Z",
|
||
|
|
"modified": "2019-02-20T09:51:25.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "EXECUTABLE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d6fcc0ac-5216-4aed-bc66-485534870be3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "entrypoint-address",
|
||
|
|
"value": "134513000",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "302663bc-8f1c-4aa0-b3a6-c7edfbc73c4b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "arch",
|
||
|
|
"value": "i386",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4676d6ac-d66f-4d99-b3c8-9103ee41ebf8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "os_abi",
|
||
|
|
"value": "SYSTEMV",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "36cf7203-46b6-4f89-8e5b-365b7f083f5a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "counter",
|
||
|
|
"object_relation": "number-sections",
|
||
|
|
"value": "16",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5f23d28b-fac2-49e1-8f99-4887a8c64e8c"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--9fa78408-d5e6-4e34-9133-e6b63f8ccb00",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T21:26:09.000Z",
|
||
|
|
"modified": "2019-02-22T21:26:09.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'bde9386fe86ee8981c2eaf2bb37d4847' AND file:hashes.SHA1 = '151be1cdc5a490710853abb95f453c367e4ba568' AND file:hashes.SHA256 = '7eefa483e23c0ae2e67ce3c3a399527b3244c6d23af4401842bab88276b26840' AND file:hashes.SHA512 = 'd25fcdd1f684f8b4fb0bb01ce137efce29280adc73410381693910689a93c257c37307d4d5f594e45335f4f2955b1c58684b93216a70c954df2c2141a5a584a1' AND file:hashes.SSDEEP = '1536:jry5upt/5IbpYWGKXX0bNK+ImCBFzklV+CABGm37SVcFPLE/n9E:xpt/G/DHiNK+Im6zk6GmrSVcFjE/n9E' AND file:name = 'DEMON.i686' AND file:size = '77914' AND file:x_misp_entropy = '6.2701582913484' AND file:x_misp_mimetype = 'ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV)']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-22T21:26:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--1d2a78b2-cca6-497e-8d34-e4aaf48058ab",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:51:58.000Z",
|
||
|
|
"modified": "2019-02-20T09:51:58.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "NULL",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c6596193-03af-46cc-af5c-7008b212515a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e9f5be66-b6d9-4f0d-89af-097038d93044"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--3736e5f2-fbf4-4c27-9a64-1329ce50e0ff",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:51:58.000Z",
|
||
|
|
"modified": "2019-02-20T09:51:58.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".init",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "af1a8a12-8768-4b31-b5d7-1efcf77dfd9b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "627c9b20-dee9-4fed-89c2-7f02ddd8820c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f29738df-db7f-4f56-8638-0cc0c15e7a2d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9138e674-d586-43af-bcb1-ad39bf843b10"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "20",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d5db1b52-0b36-4c31-9dd8-3e013714028a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "2.901609497059",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c03aadda-62e0-4ae8-b17e-9106475cd2a9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "a9c9be8d9eb9e77aac33aa7bae066731",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c19a1606-ed8d-43ef-a388-8fcccd5af20d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "0d47d0e8abff08dfdc6dfdf6dc414e7d5aa93637",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "e8a22765-665d-44fc-99d6-e289f8ca780b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "4706dd1cc5c80f6d5477304e8e04168891327edae60a4154e2f3eca3001891bc",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "51febb2f-a977-49ec-b562-1b04687ea4ef"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "9be82bc735fc25d99f1bf85f09b6845b49933341f069c9accc22862319ba712eb0ec9bafe1d1ff726038619a60143df3f402c9a1a960b510c0ef1ea878cf7455",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f78d6880-1efb-4830-b57b-5b503bd08f4e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:lBXVQ:jX6",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6fa51a47-bf2e-45f6-88eb-872cd9880e8c"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--053151e3-420b-4c23-a820-a05687c79638",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:51:59.000Z",
|
||
|
|
"modified": "2019-02-20T09:51:59.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".text",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b36554f7-7d7f-4429-b401-234476953234"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "df4e1586-0720-49af-a037-78455a3065d9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "98b41c44-bf85-4abc-987e-d9b5fc6938d2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1e01be64-44fa-4040-8580-e83a763747a6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "62064",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a8718a27-0c0a-484d-8193-8c452561ed7d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "5.9094029077613",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3757587c-4773-45fa-b2c6-c30c4e696766"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "a029a30f3ee421b5f5785bee5f816471",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "1ca2e4a7-d8ad-4bf2-9bd4-b21e4654b1f1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "f5636d01aeb86593f57604285593120303f7fc94",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "97c36135-598b-45fb-96ab-20c783f645f3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "757f8d44119cc1943044285a440966da712312fc3d478005d0c66e7813c01516",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f6ffb77b-f75e-4644-b67b-793097b2383e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "303707055b7993d86f733366ef9093b9e684c759b83534899531c1f34bcd2bd6fe7203c47158b0a0d1508da989ff844577d5e7599ada8a3a851e86d6bd0b2f68",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "695cde3b-e4a4-4973-8402-3d922b091f8a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "1536:YuKREOV7Djjd8FHvlpaq1706Tbv5lrOXdyChY3:hKVDjjwveqhb/6dywY3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "bc594ca6-6455-4b41-b05e-4b966d92fe3a"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--42057437-daf0-47d5-8ef9-1265ca9c3bf8",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:51:59.000Z",
|
||
|
|
"modified": "2019-02-20T09:51:59.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".fini",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e14b483d-9878-4bd6-896f-14e13cf46f05"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9a93e3e6-9d45-4ab9-9c5b-1d9a2dfb5d14"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8415555d-0652-4763-9476-d0523e4328c5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a5a56362-2a7e-4979-9490-61efac7efac0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "14",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c543de52-d03c-4897-b23f-6217c45205bb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "2.9852281360343",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "bbfdc929-57a4-4b9d-90d3-d1e115c17574"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "cd7ad9d42e23c4ac3279db8f33c762c3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "25cc4f8f-ced2-438f-a9d6-3b7578c28ac5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "0ebb8cf53d2cdc48d66038659e80686533c52ccc",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "bb8b99f7-43a2-45f2-90ad-6ee8ede8a046"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "e3c4978704e0676fde8d695de54a2241bb17475548cb4547ef223f19a3a97915",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "3ac94502-16ef-4938-81ee-dd75799a880c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "5456c1ac5abc12196ed54c61865e6d1bd48cadabc53960e10921cfb5f30d221b4c931224b1f5e3f4b87e648ba9a9ad9d019f0e22ed1477cd14ea6b8172317e60",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "37a2e3d7-4738-45e8-8f5e-30ac5715c87b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:l5n:v",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7cfec836-b12f-4c4b-8087-74441422ca22"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--55e74daf-857f-4346-9f69-051c3955ecf3",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:51:59.000Z",
|
||
|
|
"modified": "2019-02-20T09:51:59.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".rodata",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e4543b76-e7ac-406c-8738-6af84f16c77a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a8815bc2-ed7e-42c8-bb35-630b6b7efee6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "63e9309c-6029-4e04-90b5-265f09873637"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "7764",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ace0e900-23c9-4337-862f-60c5117e719c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "5.2855067265611",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "cf0f8efe-0c23-45a1-b607-043690ea7a9d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "1624b5940285ceaf030d8db4a39b12f9",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "21b8c03c-3108-43a9-87c7-8bbfc05f5ecc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "6dd0586ef310836cc490a09428dc8572de4707cb",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "14916cef-e8d4-4f6c-941e-1537d56861e7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "c1d23cc4c8757bc6f027d2ccec23289e5f2564dc72916b235be15b7e1a887b2b",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5e1f651e-f825-4d5e-9127-6b66aa9cd5a1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "69f565c6b426cf01b75a60427473b58021d1bb54ca6493a782c563fa4920134d3c9615c3158e284c46df6aa899836c82744d1958ef7fe2d698f8bd54ccc2167e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "18ac6938-2226-40e7-8e76-29e22a0276f9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "96:5ocRscsYZHHxWaQusnT7lRGNm6SgiW0dlOVXikjx8xkB3Fpc8EqeZn:59lHMaEnlRum67bqlOVyQSWB3YD",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "e03944cc-3cf4-4a70-badd-0f9be8b4ac20"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--db355308-9731-45bc-bf64-a51def874d82",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2021-02-18T08:44:35.000Z",
|
||
|
|
"modified": "2021-02-18T08:44:35.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".eh_frame",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "25e8ffc5-ef53-426a-ac93-b18ff01fbe36"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "55fc047f-022f-4133-b86f-8445bfe11f04"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c6460ea2-5a4a-480e-be4d-ba4ed5b84256"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "4",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5fe25115-b0c9-459f-9681-a7134f9f0c8a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "0.0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3770d9b4-fe4b-4ec6-9c40-085d4e307c18"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "f1d3ff8443297732862df21dc4e57262",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "923427eb-c493-4a97-ba98-580f252a0af4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "4456296d-194d-4cdd-a367-a3a5d2ec9689"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "b13e4814-a784-4af8-b7c4-c146eb00edd6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "760e2e87-3bd7-4afa-bf0c-509676c569fe"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3::",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "7f62a66a-a0f0-485e-9c27-4aa921c39b17"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--51a41008-1ed4-4a5a-b4aa-d61c285491d5",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:52:00.000Z",
|
||
|
|
"modified": "2019-02-20T09:52:00.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".ctors",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "dd659746-7b2f-470c-9fde-38d85758c4cb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6ad66790-2e39-4fbd-8dd0-ffb5d3990240"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1eaf1aaf-a4c1-4bf5-8a72-35f72e475ddc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "97409492-3bc7-40b8-8bfd-40ec18299672"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c6c6a408-4214-461b-898e-9ef340145a54"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "1",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "fc6865af-0bdd-41ea-bd9f-1d16a38032c2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "e7434aac-b0fa-45a1-8b9e-f649cc388671"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6e65546d-e913-4317-8d30-1054fe12aa14"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "db72d7f8-44de-4029-9b73-f8cdbd9e86a7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "199644ad-eebf-47db-87c4-7e60a6ce16d0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:RRtl:LX",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ed7bd03a-c5c7-47a4-bc63-1870dc6c5c94"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--b2e6ff07-699a-4a1f-aca7-3a21fc9300ef",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:52:01.000Z",
|
||
|
|
"modified": "2019-02-20T09:52:01.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".dtors",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9e135c8e-64b7-4684-9773-8e866ea7bdf3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "df86f49d-3b0f-41fa-9bf9-b9e2366b503a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a8bd8e54-ba96-484e-bcf7-0f294f36e791"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f25c15cc-657d-47a0-bc0d-f4fb7b46f1ef"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "09e1b018-35c9-43ac-ae06-24e97a97b8d7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "1",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7f64c459-6284-4bba-8f80-089caacc55ef"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7584e310-d961-4bec-9f51-ff5e4d3da93b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d4190874-5dc1-43f5-80bc-9683369fd12c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "878a492c-5284-47bc-8975-9c7574b276a4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c11b6df7-f812-4c4e-917b-d4d70f4c3990"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:RRtl:LX",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "0a4f37fa-7911-4b14-a8aa-b31385083436"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--7ebf77db-51f9-4ccb-8d44-0900b626feb1",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2021-02-18T08:44:20.000Z",
|
||
|
|
"modified": "2021-02-18T08:44:20.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".jcr",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "324f4609-1b91-42e8-8547-a8719e673ff1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d2241e26-505c-401c-8fea-040e67923c06"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "54b94f6b-032a-41d7-81c8-e511f7940c6b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4d0e6ac8-f54a-4650-b483-5d03372d9ee6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "4",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f9dfbc94-4bd8-42dd-88a3-fb72d90a0e33"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "0.0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ed8da5d1-49d1-4a9d-8d08-a93d49b36b96"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "f1d3ff8443297732862df21dc4e57262",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "b353658e-d2b4-48ad-a754-473d9d0e8c28"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "40992669-aa1c-4ed6-9678-359b65c6180b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "160860c2-31f4-406d-aef4-5780b1b25ea3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "371e782c-d1e4-4a35-959f-b806eeb09d2e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3::",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "99e84016-17c4-4496-8b98-a595bfba224f"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--31451acb-ef2b-4981-a413-52be999c4c77",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:52:01.000Z",
|
||
|
|
"modified": "2019-02-20T09:52:01.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".data",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "570d5337-30e2-4b6f-9e48-83a68a129680"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "fa845967-eaa7-496b-8d8d-b586e2c6ac06"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "eae6cc43-48a9-4e53-a6cf-836a45226fc6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "cccb4a71-f731-4e96-8a6b-df0c97cdf910"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "892",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "733012e6-4e24-4faf-800f-4def560873e7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "2.8135496342242",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6b0d1ca9-9b43-4e03-a725-dce74dc99b30"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "8ae59cc88bc43e75968ff2ff86e7be5e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "77a4fdd8-9dd7-43cb-ae84-351ebb925200"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "74a1a296b0e13ded5e2f156fe32bc6013f682043",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "caf3f07f-84d3-4f49-b696-b92edf91e843"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "d07cd306bae6845ff3e1e980b61297eb03e78c9659e1c31c7fef6db5e65775bb",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "66c54ce2-0976-4472-a418-70da41e4b0f9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "2d18ffa8d3c9c30a4d51a6f1ad3f0263cea33247c2c013af1a31918a963c0b863a277084495f7095c3a03b955d9e721564c943566b7af9a96eaf78bba2b0ebb5",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7f1cbc98-7cf5-44e9-afa1-fb1a7f36ee7e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "12:3cGScjsgBEkZqKlbJJCKyN/0CfdPYxpGS6lUl68EZ:3wcjsgLABNd/JYC",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "fa57fddd-9934-44f9-adb2-69d9245707e3"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--843e2684-e148-4805-8002-5680f152c755",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:52:02.000Z",
|
||
|
|
"modified": "2019-02-20T09:52:02.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".bss",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ea44ab3e-dd0b-4141-aba6-36fd2b24af6e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "NOBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "99257de7-9ded-4ecf-aec0-2e2ca3246768"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a3612b9e-4f5e-458b-a486-1fe286420d41"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3c6d82d9-d3a7-46fe-add8-64c25d32019a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "25428",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "795d44e3-6d1f-488f-a061-c7ef11bed662"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.9661637892007",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "fd043e4d-ffa6-4c6f-8beb-c965fd42587d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "1474d7f22cd0bccd7b9450c2d0439836",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b4160aae-94a8-46a4-aeff-244c24cffafb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "c37c7a1184e0d080a0ed28e6b747766345d28b04",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "22534e2d-9e12-448f-9b7c-360394426e71"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "dbaafaf47bcb61e4535ffd5a101f76e2aacba92a133f1abf91c4408f42bf2c74",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "0bc8baa2-3dd9-40d8-8da9-319e11b5278a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "d1aebce6f492eccb8ef5c510a390cc53193d8d4ec4465d5d29893740828c9d2cfbdeb01234a0ef32b0c6b184100a41808c5aae94b5c2f1a77f876bb0200801e1",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "435f56de-f138-49b6-aea7-8578048c3c78"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "768:TD4Sp5y1ZM9h4ba+omX3xJFVYQP4fi/H61:TkC412Xlmn3FVYQPui/a1",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6798a573-ec00-4b5d-9876-747a07d59773"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--32380cda-a18c-42b5-9842-d32ed0ac8899",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:52:02.000Z",
|
||
|
|
"modified": "2019-02-20T09:52:02.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".comment",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "54157889-82a8-4cfd-bcf8-b906ce8d91f8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "68c987fb-c175-4234-8f60-9b5790151b2f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "2916",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "36ec25fa-44aa-423e-ae35-3cb347aeef7b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.6143694458868",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "64e43193-21af-49e4-8307-0102f113082a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "02ec578b208182bee3aa6e8f4d673139",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "13d4b4a2-2288-4124-9169-d51c0e004de3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "7025d6106eeaa93a1c0544e495fee06fcfcee6ae",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "8544a19b-8dec-497e-98cb-b067fbc5716e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "cecc27f1ecb1563a8becc4fce7a9dd06c09d02faf18d387572455a50bd7f3e8d",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d009e2e3-8f82-4075-b211-860ad0959c29"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "6ac98d2b929584994bbc2e2739ee269e586b762740a945800e2b76fd423f23e142d5a33259b94b66e6567cfb0f30b13fc1992dd35e594320a9f20040f81ba842",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "4a0870b6-5378-497d-85d7-62e0b8502639"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "48:BUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU5:j",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "af260f8a-3d07-498d-9dae-ccc5af5f23d1"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--b79752d2-5f10-435d-aad3-88d65099277c",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:52:03.000Z",
|
||
|
|
"modified": "2019-02-20T09:52:03.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".shstrtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b0168304-e523-4b64-ac5f-36ed7fb30ccf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "STRTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ca466cbf-505e-4de5-bcfa-5ec5b402673b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "102",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "859d907e-989a-4766-a117-ccf1642e1fea"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.8692077817787",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c8af890d-e343-4341-a17f-6e66506d83ec"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "b748e0aa34cc3bb4dcf0f803be00e8ae",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "84f947d6-fc0c-4d1a-bc72-471f0c598421"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "f8afe25d02e36248d719e04aafb2f3edb98bf012",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f9b9925a-0f83-438e-a5cd-c15389595c98"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "c42f97c90874af8fea59609c9455cce16e13d894c3279c7d9b799772b2cebdfb",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "57936286-288a-47a4-b159-8ecf9422b55f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "7328069d7164d73b6c2872e2b88eb1f18023c6970d9b2f2e1f6c288e027de32b1990862e14f216957de41c4f427f7fbcec9dd5f98ca7162c3a3973a2ef6b623c",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "602b840c-5d94-426e-b311-3b90801166ed"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:mqWxRuRWExqMLwlApLQ4lLaCMLn32cxlLPAl+K2iLT6:EXwWEgMF84MFTnfniLT6",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "803e6dcb-4cc0-4ceb-89b3-2e1d843a304b"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--75289f6c-02f1-4bc1-bdcb-c2f34d6f534a",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:52:03.000Z",
|
||
|
|
"modified": "2019-02-20T09:52:03.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".symtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "52a698ef-51a4-4a86-8fa3-00a716d617d4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "SYMTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "faeaae8a-97cc-44d0-a3f0-eb3c2dac3db8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "11680",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c036e659-95c9-4d9e-8d74-6e71c53694e2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.9799401998576",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9ed5ba20-ec65-488f-aa1c-d09e094e911c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "6afd5818f1fabf222e823571d8a6d922",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c5b464cc-c8b2-4e74-995b-e3d5783bbcfe"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "c152bbd2c76335dd125466923ca43e15cdca792e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "2151b969-df9c-441e-a0e9-c00b7638a11f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "0c55d734ad1913d90b9888e02e0f178ccee3b7f53e3414f887ba84ecd893f08b",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "a099eac4-e434-495f-bfe5-d800d9899cb8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "f9f28add8127548ba8a8f1c79934770acaebee0b3b5ac4bf585646cc4903f24dda569f01188a3d14c422ed89fdc811f2bb4643116d915228dc571f0147cfbd05",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f0ecca29-3ce8-4f43-a5dc-bd7379dd83e7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "192:h4EDzTdYbjoCVdfcdMrY/BB/R2fAN8GtcR4gR8KIKcxPKNVc0CLZqPimleYJvT:h4ED1Ejndfcp/HZyg83RLMPy7RC9B/Yx",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "85a38e62-c0cd-42bc-b8af-673666711af9"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--6483f9f2-8ef6-455a-adb4-ee92998a2d8d",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:52:03.000Z",
|
||
|
|
"modified": "2019-02-20T09:52:03.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".strtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d1a00aa8-80ba-4b5d-a884-1eeb2f6b8b08"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "STRTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "fcc3fc3c-b90b-4f16-9721-ca6162a14d62"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8909",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "cae9933d-5bde-4256-b858-61349e3e6ade"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.5796209525534",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "eb0c1ac3-93f2-4033-b4b8-cc0d613e0b1a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "ff7d890651974fbd5cf32ce52f799864",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c3d12b2e-b200-4dc8-9a18-4440b61b02d0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "f8524bb31f4b4c2ced2b7871a5669a10064129f6",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "350f4086-58f4-40c6-a51f-11ba13aec618"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "d1736559f7d0670362948b07f333f5921535dec89ced5423c3c99d8a08585b8e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "531bbaaa-bf20-497d-a046-b74199489f7e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "868ab4aa314e91fd9c1742772d58e0842e1203ba4178cf624f23a3612e0b2611779fc385a617392d45db37043d350d5926942c34815a4ab0fde7210054ba9255",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "1fc1284c-3736-4f0b-ae24-f5b971a71397"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "192:03Bc7L6AfXpbaX0cDI2nYPxWmX8cx5s4vsMVfAQNCexCtSglf4oe/HhDZqLCaIfJ:03Bc7L6gpbaFDI2YPwmX8cx5HvtVYQUc",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "cc803cd0-6a5e-4d57-a03b-cf008e5acd5d"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--2510904a-8b31-4775-b820-c2118673d768",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:52:06.000Z",
|
||
|
|
"modified": "2019-02-20T09:52:06.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "EXECUTABLE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ff4c2b4f-efc1-4f0e-bf7d-74f5f066ce5f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "entrypoint-address",
|
||
|
|
"value": "2147483972",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "bd8b9cdc-d551-4435-ab33-e4ddb7b8fe46"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "arch",
|
||
|
|
"value": "ARCH_68K",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b8beb835-545a-4267-957e-d2cf27a569d4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "os_abi",
|
||
|
|
"value": "SYSTEMV",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "05beafdb-424f-405a-a0c0-f54db93eb4df"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "counter",
|
||
|
|
"object_relation": "number-sections",
|
||
|
|
"value": "15",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5610a753-d171-4929-b379-773a28ee862b"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--6a28fa02-9b7a-4619-ac64-780383067644",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:52:06.000Z",
|
||
|
|
"modified": "2019-02-20T09:52:06.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '48f3a536cbd7f835451bd2617c2aa80e' AND file:hashes.SHA1 = '626e8c23d36212f1c6d353929e087c4a69ff9839' AND file:hashes.SHA256 = '40aada8be181329f7a46854276889c41db3f5bafbf8e9febc458d43a6c164225' AND file:hashes.SHA512 = '9025a93c5b73dbf63b5cd212836289b1b208da3927a1b6354979ef4e103e204c629f631cd1394cd1b7171a035b012a32bdd7ec45d3395f3cb5bd0d7f36b2a909' AND file:hashes.SSDEEP = '1536:CuKREOV7Djjd8FHvlpaq1706Tbv5lrOXdyChYruykC412Xlmn3FVYQPui/a1S:7KVDjjwveqhb/6dywYruypm3FVYQWi/j' AND file:name = 'DEMON.m68k' AND file:size = '95137' AND file:x_misp_entropy = '5.9836813448116' AND file:x_misp_mimetype = 'ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV)']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-20T09:52:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--12e6d593-a557-4c6f-afde-5691fa98d03c",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:52:31.000Z",
|
||
|
|
"modified": "2019-02-20T09:52:31.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "NULL",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e56123f3-0aa8-4cb2-b632-b1b8ce0fa38c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b9f68e8d-97e1-40ed-9a51-ba0087a80739"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--626c678f-ed94-41f2-8bdb-5c22a0416ce8",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:52:31.000Z",
|
||
|
|
"modified": "2019-02-20T09:52:31.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".reginfo",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3092d6f2-234c-4abe-ae78-f29e9ea30dfd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "MIPS_REGINFO",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4ff6466d-754c-4046-96e1-be15fd240cbf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "863c4c39-85f6-4f09-ac9c-138be28c044c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "24",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "042bb414-a3b7-4201-a358-86050dc778fe"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "0.98335575498169",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5694a074-3020-4fc2-8648-2f7b28bfac68"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "8d0dbc5cc209bcd3394e883eab88fb9d",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "73a3af83-0542-4cea-a4c6-ce1463cc26b1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "cb075809ab484a86da7a05eb6cb8ee73691dab9a",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "1510d779-c598-4b9b-ad74-9c4ff1512ea6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "d655eb7c6161df197741ef604391f67481156a0d8d97d5a336e36f5569ecf2de",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ed5f65a8-e535-4009-9dd4-09d1921fd99a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "e04a2a01ab91703af95773e35cf0d74e07fd79ca8d95917649882a99f9b6007a8ffea94c105d53cce94999a1e31a087a54e63014d2078001838518661e445563",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "3ec4752e-1625-4da6-bf8c-0d4d7451c8a2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:H0F:UF",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "59006a8d-208b-4e1c-ae46-cde99364437b"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--68122fa4-5fef-452f-b5c7-65856255d959",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:52:31.000Z",
|
||
|
|
"modified": "2019-02-20T09:52:31.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".init",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3d4d9229-f853-47c1-8a85-5ffa3b5fc4e1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "33814b10-4b3e-4ebf-bf2e-8dc93b6cdafb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "53adbf2d-5a20-4a1c-b3d3-72e20ecd861c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "91dfc356-4608-4bec-be1d-0dda372eabf8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "140",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e9f5728c-7b18-4c56-a2da-e7e852b38306"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.0273977714589",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b8f7a151-9990-4fcd-adf2-e5817925370a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "77d4238a19b265b210efa24d402eed6d",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "28232ec3-1042-4e3c-a63d-fe769cf43b38"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "35cc8fa3c819c54ace716b64ee0de3dba2b1fd5c",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "fc8c4aeb-ab06-40a4-979d-2f7d8837decc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "5b51e8a42c9db45c5fcdcdbc413a51e35361e49912a697a23a0ad1bd5832356a",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "40011551-2763-4d4e-83a6-de46e7354f8c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "59ca155f7f7190db3f9149f1cd481632424796d681883a94569ac7c25a27b3f114662a5b2d6a9391b5b22b6432b7bac3917dc7fdb907d5bd1c9e5e71a7c7bae1",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "fdc8ddab-45a3-49df-a08d-9c53669cbde8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:rxvC8niGdVz0ftC+DyvlT0GdrFEF7/knM6vlY2lUF3C4:rXld50o+OvyGdREFzcM6v62lUF3C4",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c81e6443-7a80-4859-a4fe-e953e988ea8f"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--98dcda44-bc1c-49d1-be0b-0b84a84cf09d",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:52:32.000Z",
|
||
|
|
"modified": "2019-02-20T09:52:32.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".text",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f6c90cc7-b493-4a6b-bb37-08e059466a99"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "377b9c11-7d90-445c-8288-cd9e7402dcb8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "abde6e30-d1ac-41f2-8b9f-9eddcccacccd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "00b6dcd6-a362-4084-a038-0fea1d54ddcd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "76560",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c2c532bd-229c-4b40-92fc-4138aa7d8a41"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.9479106240765",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d5e99be2-45ef-4b61-bf9e-4d319b04f491"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "b80eaf5697f668ad090291a6e4818764",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "4388d4da-29d7-4e3f-b4ee-f3ce689cbe3a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "6ea230750fe8164634f4251d6a201dbdc06f154d",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "65a3967d-2571-45da-87ce-5d47bb611c71"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "44979aee8f152d8f86b21711a6df357dde3b56d73373780f7be585a35b632392",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "75da06f1-2013-4865-b087-e2db1f7eb24d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "6a2055e1ca09e78a903e409a6a871d17ceec9aba73792f4b7d4e4dd8da7d29d687ac34e999e9be3db3df8e5f5c058ecb17d7ac73a01195fbc2300fc1c1e60236",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b4d9203c-a03e-4468-add0-1404f3bcb39a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "1536:sVVNS7KmprxYSkKR2vNRhRdBCxBlUOw2rKwCgbsoq0elFaw:R8F9ulbpqjaw",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6551135b-c74e-4d81-b916-edd6b28a8e68"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--8e4b1b09-47c6-497f-9e3f-f3944b9072dc",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:52:32.000Z",
|
||
|
|
"modified": "2019-02-20T09:52:32.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".fini",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "238658f0-d7e2-4efe-a56f-3a2b3e2742f5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f5f34758-70a3-4772-92ef-6bc9814cd438"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4480f9ab-4e5b-48f2-b6fe-b3760b89b1d7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3a0ea3dd-2ef8-4183-9c5f-38e9a58b6b14"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "92",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3df47b1e-f1f1-453b-995d-1008848e0bd8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.1123020826728",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b5920a4e-5a5b-4a51-a81b-70d1af8fc4a3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "5985b8027c0c6f4384e40f145c7bcf5a",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "fe9e9c96-7c8f-4c1a-9efe-c271f84741cc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "857f410ff3a78dffe74e36702d0205b84fa7598e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "39984c7a-3b34-42aa-9766-0596ecc38884"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "3c1d7e8668ac46b94dc1577da106925841c242ca16109aa439bab5024b92be8c",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "0f558e5f-a153-45f2-b854-e2d7527299c8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "92903cd5cefcd21445ce2aae2dd8cfe7ce0f1d61de2603154589d7df75d7c4abbfe6aa425308c9de0f5ea15aebdab6bbc9f9c6e9c4a1b0a6b9eda49b4bea8003",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c13d1bb8-c99e-416e-8a73-d018baffdb0e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:uMOC8niG36WlftC2M6vlY2lUF3C4:uMglTlo2M6v62lUF3C4",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "dc0e7ef0-ca10-4b94-a3bd-c649cebb9e60"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--c5228190-32c1-414a-9cf4-679d7b6c5278",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:52:32.000Z",
|
||
|
|
"modified": "2019-02-20T09:52:32.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".rodata",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f8cc8075-bc5a-4cd3-9df5-2fdb30e872f9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7aded904-e2fd-40d0-b6ca-99df721d21af"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b787ef95-98d9-4778-9c1b-cbd73c743032"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8080",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a606fb43-c1ac-4219-9360-4431f86a5608"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "5.3032736629034",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "90b4948b-8443-4696-a593-ba2c52dc32af"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "92d1b4c42886e41c8426c4129af782d8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "0b55b922-e241-4ed6-9c49-5a96317b26af"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "0b78a20514d86471719809ec790931a9d1711c32",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "663d6518-fa01-42f2-8ac1-9f84057cec5e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "16bba26a4892a37456a3e490cea77501eb6b9fd9667572c78dcb02f344cda665",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "17effb70-9d87-47c2-b3f1-57eccebad3fa"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "0c49f44420cbf3d667656b274d0e400b02b6fa8f002ae08e0ad3bf0227073779f85cf80c29baa63eafe129b426ac3b0f526d85c02909b8b34342aa149df6e8e9",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7b3eeaf3-06c2-4c4f-baa7-2aeffda5159a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "96:uuLxgZHHRhK+kaQusnT7lRGNm6SgiW0dlOVXikjx8xkB3Fpe1pnCyNZn:uPHrKXaEnlRum67bqlOVyQSWB32PP",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ab0f2bf9-1556-4d5d-8a94-c50080ea88b1"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--708f5d2f-37cb-490b-8273-aa0d60d45e30",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2021-02-18T08:44:05.000Z",
|
||
|
|
"modified": "2021-02-18T08:44:05.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".eh_frame",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "639473eb-6915-4a6e-acb0-e666fcf6e800"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "24b108f5-bac5-44a6-b147-4d3a93d8ce84"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "441014f9-92ed-432d-a8c1-b0cc05eeb2e1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "4",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a56ada1a-55cf-4829-8cc5-b7109ec41396"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "0.0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "29313669-13ae-419d-a590-f11e78ee1469"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "f1d3ff8443297732862df21dc4e57262",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "237427ef-f24c-4b9f-8e8a-a967c94f754e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "3281f3ab-154f-4e0f-a0f1-2c7be83d42aa"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "c3f5ea58-f79d-44a2-9c3e-266b51976ae2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "b1386c4f-afb8-4fdd-a180-e989d1dc34dc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3::",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "f103f342-5723-4f3f-8f06-e056aeab13b8"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--17269a28-42b6-4d6f-94e8-f1c16976b19b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:52:33.000Z",
|
||
|
|
"modified": "2019-02-20T09:52:33.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".ctors",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8a59c909-ad9a-4fae-b3e4-98123735e5a9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "25ad33bf-d077-485e-a900-981ecef281eb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a2fac2d6-6f73-442b-abb2-c40373ec7bde"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2157bb87-05c4-4526-8b2f-0c20ba6664ee"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "661f8100-345c-4011-9ee2-f9fe7d151fd0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "1",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "84772b32-6b29-4772-8608-62bacf870137"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "22d50586-af5e-4173-acc1-616f537e49e2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7f4e98d8-5d37-404c-8de2-5c1fce0272dc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ca8a5927-49ba-4c31-bd3f-9e0309ed6d2f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b0ed3831-926f-408b-9c2c-b81357a70931"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:RRtl:LX",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f8a26364-351f-4d25-866d-ff8660241b23"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--c28ef437-adb6-40bd-a96b-c3decc193b3e",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:52:34.000Z",
|
||
|
|
"modified": "2019-02-20T09:52:34.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".dtors",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8ca462a5-7b1c-43b4-bb46-1935e5b37eda"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "685f763d-9191-4191-b0fb-4083ca7ea39f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "32d759f7-9ba0-4db6-aed4-e969eb37ff98"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "cde2bfad-17b7-447c-9793-ca38657a67b7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "69905603-02dd-4034-ae0e-a87e0d61cb5f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "1",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a27bbbef-95b4-43d4-8448-91f0a87951d0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "4fd7eea9-a502-4bb0-8d55-e9e784bde6df"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "aef4dc65-b08e-4739-8a41-6a65c8bb0f0a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "441e9682-3d60-4a85-9547-1f6ebd12db1f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f2ab3041-887d-417e-945c-1402b960c5b5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:RRtl:LX",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b0bfbe0a-a2ad-4141-8538-d653102a861f"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--11a4d35a-907d-4351-abcd-dfcd4c4d0aa8",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2021-02-18T08:43:51.000Z",
|
||
|
|
"modified": "2021-02-18T08:43:51.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".jcr",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8bbdeed5-74a1-4c52-bb74-45c5802a3b60"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "02ec3d74-da4c-49d4-8b69-f744f5763743"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9aa1ba7b-c8df-4e8c-bce2-9dee267828b8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "cd92463c-f7ce-4514-a63b-538a57f0f9ea"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "4",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "09421dce-e127-48ca-8dde-0538d9475222"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "0.0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b39b45d0-737d-4d1d-b29e-341ee7764ed7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "f1d3ff8443297732862df21dc4e57262",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "fc9d3647-5683-4d17-9382-e39a3d0ef715"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "f57a5dff-75ad-4cb5-a24e-00185d514006"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "e94c7516-47c6-4ed6-afc5-7ba13b0b304f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "940cc9d8-7a58-444e-9992-db5b5d35319a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3::",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "8808f57a-5543-4852-89ec-11948da005dc"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--c3c71253-50ac-4d14-9d85-8f08cba16df3",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:52:35.000Z",
|
||
|
|
"modified": "2019-02-20T09:52:35.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".data.rel.ro",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2755e795-459d-482f-9d61-5bf48b37bf61"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d3edad3b-12ef-4758-98e8-53d16f199a56"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f1dab8ed-bd36-4117-bb03-79078dcaf085"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f3143442-f43b-402f-86bc-d8667a41e5ba"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "32",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "fc135407-5191-4870-b61f-6a469399a38d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.125",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e4771798-2ab3-4943-85a9-04619cde6499"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "f3976df7ad2b2a30d1d8be891961adc1",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "3368fce8-2afa-496c-ad9f-720aaf41959c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "5195afae0ffb549668051675e120a6a19b917ff6",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "a7644dcb-8b40-4bf8-b3cf-774067f317e6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "07d121ccdf7ccae17a31ea11ffe8a3341e47a7a61e2e53b9e286984f856799e1",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "8ad90df5-8ec7-4a9d-9816-a2045a62fb75"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "8b2b23268ea11293b52d79b639c490db1dae5405a198c1abaebe9eb019af60fe02f0f351f63023a45b2b64ae4cd1678726e04bb0d93646c1079398b77916b656",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "1f1d8721-5e44-4d1a-a9de-888f7265b5c6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:rdYwl+GkWffJ:JzkWffJ",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "4a5a1623-1745-4805-8cec-78edc0728ca5"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--db63748e-1bda-4748-bdd0-64159e4eb3a6",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:52:35.000Z",
|
||
|
|
"modified": "2019-02-20T09:52:35.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".data",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a69642d8-efa2-42c9-895d-72ef5d1d7dbb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9a83239e-6605-47dc-8d1b-fdc60ea5cd81"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4faa9d73-93f1-4763-8240-f86579ee1357"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ad2b9c45-a4c8-46b7-a4cc-deda85248013"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "1072",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "304c55cf-4800-4047-a9ff-1d326634929f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "2.3076413930576",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "97f59552-ab03-41e7-bedc-b47c2c9a5088"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "0ef08d65fb5be2b36476b7827c702cb3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "9c153736-fdb6-42eb-b31d-359f09d8c3ac"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "3fd78c48643636535014ec1c7ed2814ac24c5099",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "15370b1f-30ab-44d8-ab01-5c1d36bf2139"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "4d9a24acb8b19ae5b9898fe62b379d7e7fec099e430356f9f3b8a4b59f91b034",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "0e3d2e66-d75f-42a5-8582-1abe6239ec16"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "15cb1f55850d363b1648b66a2d43013910206fa288a585e74d07966762ef2c7b31f28fccdc6a71c5450885c6a7ab580965f82c67a9ce9ca62dd4ac088c06ccb4",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "36bc28dd-be21-464f-b4ac-e66a554cf092"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "12:81ALMfERFetJJodD554yKHkPYxpGS6lLSRfCIkMk:86MeFetJJCD55d/JLSRfx",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "31923083-d5be-48c6-9e11-bcc8ed4f99f9"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--3ee50d25-47b5-4e5a-bfe1-e6376f8e7e83",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:52:36.000Z",
|
||
|
|
"modified": "2019-02-20T09:52:36.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".got",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f16e17b6-4ed9-4161-9bb4-3596ab2653ad"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4d25a431-6031-4758-9631-0b3bf570359b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "HEX_GPREL",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1e55cd37-e1ef-4c75-b213-26a033dc10ed"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "592ea206-6761-4c72-b4be-a87965fa11b0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "35df7b06-e837-49e1-a228-0baf18a117a2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "MASKPROC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "76a4978b-a27e-4118-a285-feb96addca3b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "1192",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f7b587b5-605c-44e4-a20f-946717c0e8fd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.7004378302978",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f5dae0ba-9f3b-417d-94d7-8dd601016c72"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "fd8e494e642b43ba998d4c2dcb3a3149",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c6f6493e-ad79-4f15-ad7c-466294138898"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "76b374aff8381d9cce49c396531182424ad8d460",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "47587248-bc81-43ee-85f9-154ab45f095f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "1fe1e8124d44a22a1f9170b8076f7b75c2321bb7e7436635e2eabc4f52017d04",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5e41a53a-98b7-445a-930f-72170356519d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "7a1a5d734000ba130106a7c030126b93e86afdeb7e8798e30070c028f74e33a69a0843069ed91d4c868412de504d5cafc733607d7b920aaf6aa3e054c9d49312",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "699b646a-bf42-40ac-91dd-598cb5707f6f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "24:pZ2pMBvEMxS+t2NTEoYy+c5untKNXsyrSdZ90bZ7:KMZEM3yT2A5qtKN8yOdP0bZ7",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "66e4a177-b3cf-4ab0-8a4b-a6fb3a1db805"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--a9c5f0eb-2b88-4b62-b69a-6de7f6682586",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:52:36.000Z",
|
||
|
|
"modified": "2019-02-20T09:52:36.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".sbss",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7a0c4e3d-96bd-4809-8618-fb90ec86e0a1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "NOBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a0882bdd-3c53-42aa-8de1-2b51a3f0ab7c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "HEX_GPREL",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2b4e2b67-30ea-461f-96db-f949e1ebd4d4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "be1ea1a5-4c58-47b9-80df-e8c9844f9a57"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8315cf3c-87ba-4e05-84a1-31903f766f09"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "MASKPROC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0adfe3c4-82ac-493f-829d-429f4f9551ac"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "28",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c9275dfc-308f-4b4b-8777-2c41dd3f1c57"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.4677201004745",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2626bf53-600d-4ee6-b698-93095fb95e13"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "c7e412f1d671fd40692fc38e8bed5165",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "3c303ddf-5064-499d-b20d-3b9ac896e16c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "61e230d579d72bfd5051cb4b9148b3dcddecdada",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "1f607953-5405-4a5b-b48f-d141ede3c65b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "a8ed9a374ae1bd36c560d480a67cb987589b123e94f0c36f9da2317b9aadab9e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "54f6242f-3330-4f08-ba00-a9a8a8f7bbfb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "0b7dbc7d5e0f76a28c8ef1e0098a40c29c80a2e52dbb8880f758e3fa8e07db17c07377816f61e4a826ba50b1ea9835c2d93d6126a37c037d14064d24cb258e2a",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "63746c33-20a8-4479-ad04-c6802ca16866"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:yfY5FJroYw:BFi",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "200eb2cc-59a7-4876-8d84-ddfc58084205"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--96b539e3-df21-4c39-b770-a222dbb1e1a4",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:52:37.000Z",
|
||
|
|
"modified": "2019-02-20T09:52:37.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".bss",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "66da7c2a-200b-478a-b1c1-2ef6b7958129"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "NOBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3eb07d20-94f8-48c3-881a-56b151d12edb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1ebfd882-cec3-48cd-aea3-67c2e33ae257"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d093073b-173d-4bb6-8895-483884391df9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "25492",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7c3b22d9-2259-47e0-80d7-2a2fe40a5410"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.3428583477087",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5200d670-11c5-4e42-98ea-f3efb2f433a0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "e131d799a97f26fe6cddc1caa0866212",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "bd9564f5-8a50-441b-b26f-1c6414a28d0a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "6a998fb15de45fef91f61cd7023e19689f8f273b",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "08a5da11-4c66-4841-bed7-6d3dba9b677b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "5a819d191a6455e4dd116fef837c0133c49a2a295ca94f1d2047c6d310a88f92",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "0a3f825b-078e-48ff-895c-6d1116e915fa"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "64ddf490be79f45dfd4691ef1919c0a64eb9cc38ae592ee85716bc72cd411ef1d6dc106cc8872daf334097bf405acafaa1f86049cb8cdcfed39ec6583c8aef8d",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c2ce1e49-dee5-4948-8fb7-9ea31af70d5b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "384:pZK7yQFIpG0jwDG4dhA3ZAIZyAMSDDISa:pIteZ4dS0SK",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "93026993-01b6-4701-b284-2ef9eded03f0"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--551ba26a-581a-4c53-b192-ec14f254250f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:52:37.000Z",
|
||
|
|
"modified": "2019-02-20T09:52:37.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".comment",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3aee350a-6c37-4d0b-90a1-53ad006d60f0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f9f53c4d-28eb-4746-8a9e-627daa6a0237"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "2934",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "940a5454-ab74-426f-8861-ccb72b88e0b0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.6236162569046",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "21bc8d21-2f78-4ab8-b652-91cd6bf389b5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "b9413e51dbe36380bd17e86d8c95597f",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "026d6242-1b99-45d6-9d8f-2a0a2d79879c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "61fb02dfdb2e71306a38d48ae2a65648ff3454a2",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "52c4aebd-3556-4ffb-9916-2df8b1cc74d3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "881478d60c29771ee32339c566a6c43d9157f99b23d031a4f1d342bd1e4254d9",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f56705cb-749f-43f4-b26f-a352c9a1c0b5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "bacf90b46d6451e9ee5acdc82ff20957dfb62b463cb3caeb10642d1366f7c4fc13f8ec18e03356e960f710ab0691f0e90c7e08784b2d7efa6b5d7d4f913acdbb",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "902a3a05-a58f-4680-b2e6-e7d01ecec486"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "48:BNUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUz:a",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b426e081-4959-4ff9-a142-4ef4e4d60e0f"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--e9c37e32-2ab7-4409-ae3d-23b6911f98a5",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:52:38.000Z",
|
||
|
|
"modified": "2019-02-20T09:52:38.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".mdebug.abi32",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a32708dc-e5b9-431c-9ee5-ec41092d9470"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "432f9fa3-5d19-4617-ac72-dfd854a49f52"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f99e6f64-de1e-4b9c-b25a-8274fc32ed6b"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--491db90d-b576-4739-bfdc-15c82825d4c2",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:52:38.000Z",
|
||
|
|
"modified": "2019-02-20T09:52:38.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".pdr",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e40d8b9d-6941-497d-88d6-89e335df46c2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0e9c8e9b-9eb5-41bf-9ef4-80edeaaf23c3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "7392",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "299725bf-ff7d-40e8-8e80-a8897f839909"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "2.3625590532624",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "aa87a06f-e664-46cb-92b8-53563c677cbf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "b84e4223b0d5f6b39d52bc80a7c3bea4",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b1cdca0b-d202-47e1-8832-08926118bc1a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "a18f0049e72723b7ae5b251426a48a7022f07bff",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b52fb306-db57-4b89-831e-0622b10bb4cd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "9bd03ad1339f25832d304c8955b236c3b3e50332efc01a9a709580d897a6f692",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "61d372ba-7018-4b69-8d6c-946ff9919900"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "bba84495ae6bb5bd92f35406f2d466377816efd7f7f88fbc23a902527cb7c587590a681e2c32fec2e7bfdaedac8b4542a5e167d3cd0fc12a72dbdcff58395f4d",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "a8e6f994-f550-4255-b4a2-930657fd87ce"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "24:hLWlER8lMDMziKrUEkE1pfc/5KcsSqIxRxwKJM0ucBxy2yl0pMIUQf8cgTTjdx6E:hL1R0MD3EkE1Fck7q+KJDy6dOjdey",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f0f9bcb4-be41-4964-935e-e8b8d0853155"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--0432ec5c-2735-4638-aba6-74383c250015",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:52:38.000Z",
|
||
|
|
"modified": "2019-02-20T09:52:38.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".shstrtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e626bce0-0752-4740-bf6b-3bb58044014e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "STRTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1987548f-d8b6-418c-bbc2-5e030a13e760"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "154",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "87c85c03-8d10-4c1f-859f-ce3ab0282760"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.0531923876455",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3a8970e0-cbbe-43a9-84c2-19af32347319"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "12071c1d10e788d633c06c50dad937d2",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "fbbcc479-08c6-4b14-b60c-c1989f2f03ad"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "4e330bc5132262c6f7700030e1d37ee1aa1867be",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b51bb474-05a0-417e-af5c-0a81e89b4e76"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "82735c98120199d69b1893c6fa072b6611625a462fa44e37de1b1f19e47bae27",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "497bc0c9-3133-48fb-8b8d-8d85e32a6ad5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "5b0b1e1fd30069337dfcaa8a3d256366331f6dd7631d2a819c776c9b0ce1fd61808b07ca78d0537088e90bc1b840613484ad6cbcf500f8beeff343700fa5a5d2",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "743485d1-2a90-463b-bd8f-9e8264c544f9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:mqWxRuRWExqXnMOLKMDlApLQ4lLaCMLn32cxlLPAl+5Jj+LxNi2aXTTiQIuxVBXl:EXwWEgBKR84MFTnf5JjgfaXTTzICVB1",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "70a973ec-773a-467f-95ff-1c99fb3b2502"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--eea5d69c-5686-4b44-adc9-6d4f0a46c4ea",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:52:39.000Z",
|
||
|
|
"modified": "2019-02-20T09:52:39.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".symtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b2dd8732-cbdb-4ee3-b9d5-fe35398c3300"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "SYMTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ae578fd3-76d6-4348-ad9a-8db28c7696a9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "11536",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8cc79dfe-d5c3-4b0b-a339-6607e0ddbe04"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.9517252645434",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9289b62e-6a70-4b22-965a-d4f88cc00b01"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "0c697d15648cb43a606aa2c679269728",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "028d5967-2fa3-42e3-87fc-93f3b1385ca4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "4be20b111b69a583571257e71b79a674be2090ef",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "9a6c7358-b159-4929-b87a-ea43bcbbcd94"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "583f8624a1fe7aeb33832a8f060d7262594fe20cdbdad9bcf68df5dde4472a47",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "05938690-d3d9-46a6-8a6d-a2959f04624c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "0bf731c955982dfc7f92e6597a002e800dcb9eaccea023ccb456167ca4aa3b577c8ce2c74384b1d983c227f8298ebcd82218c76bfbc159c8832b08bf349924a2",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "14dbf715-1dd2-4beb-a7c8-784a6767393c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "192:aJN9Q6iUH1UuVH5hIAykTkqANuUIfOwsgRpbprKgyod9Jj5zAF5:a7yQFIpG0jwDG4dhAj",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "233435a1-9907-4b19-91f1-5cd2e58ad8fd"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--85b5e80a-bbea-48d8-b54f-72e758c59ffd",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:52:39.000Z",
|
||
|
|
"modified": "2019-02-20T09:52:39.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".strtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "cb54f558-5cc2-44d2-972a-decdec155eac"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "STRTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "01ff48b8-4723-458f-8171-5f6d75e7bf23"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8592",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0c2a3503-8f67-4e7c-bcde-1b4106c06df8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.6041092439817",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ac3ce127-6bf0-4d45-84ea-4c999da5c9c0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "34e109be0d34766858ddf711553e189b",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "dd4a17a8-8f66-4a03-b41f-2d3381029692"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "1ab433c7198110f6f293dae9bcdf1d29f1682fd7",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "e6fcde13-c86c-4977-9e81-06a479a8df08"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "23eda5502d9afd40b36661386fedfcb13d21093cc69636685501aa6d30d98858",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b2758f16-5e95-445b-864c-9dc8c3858e3b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "8026cac01a659a62ced7666ff5c542b02c8f2ae5e4165a3b67e1d3813f5e0473cb6b55ab7d5fbd996e6f9829bd2b2b6af03e4bcb344da2e24f7f9bef94c71ee2",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "8237abb8-dbe5-400f-8db4-d3dbb38a6ddf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "192:TZAIZygfXMSX0sDISCkxwmX8QlJvtt5s4YbMFfb7he+X1l5QckghDZayBrIfJ:TZAIZyAMSDDISfOmX8a9tt5HYIFz7hBa",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7ac4ef97-9f9c-404d-b448-a8f4ae72c69d"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:52:42.000Z",
|
||
|
|
"modified": "2019-02-20T09:52:42.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "EXECUTABLE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "00c9af09-b1cb-4d29-8874-68f774a3d082"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "entrypoint-address",
|
||
|
|
"value": "4194976",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0b3fcc00-4635-4b94-92a5-50cb84373ddf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "arch",
|
||
|
|
"value": "MIPS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9d3fdb1f-038e-4dbe-9d91-ac56e260b641"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "os_abi",
|
||
|
|
"value": "SYSTEMV",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9ed935d6-4219-4787-b612-a03614d93376"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "counter",
|
||
|
|
"object_relation": "number-sections",
|
||
|
|
"value": "21",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c50b4d13-ac57-495a-a003-abc37ef551d3"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--0b58e05e-34ee-4211-9c13-db3d9083b852",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:52:42.000Z",
|
||
|
|
"modified": "2019-02-20T09:52:42.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '3995cc79b53f95cd127bd9eaa96ea867' AND file:hashes.SHA1 = 'a54d5e32c544c29469090019b90ddd098b69b40f' AND file:hashes.SHA256 = '414b488aa5fd5d2c97b5479d5d9405a308c35b60c185ca16f1e23f8a00b5cdf5' AND file:hashes.SHA512 = '03ab83e210d01a303977de108caabfa7e5ccbe5d41eb787646fdb57cd9d185de96bfc82e54fdc552dead1cac203a8c2e3ccb8b327bb8d1ea37254377f9fcdbc5' AND file:hashes.SSDEEP = '1536:oVVNS7KmprxYSkKR2vNRhRdBCxBlUOw2rKwCgbsoq0elFagKIAx2m3tDVFz7Vw5L:98F9ulbpqjagKbx2m39VFz7Vw5cS' AND file:name = 'DEMON.mips' AND file:size = '119796' AND file:x_misp_entropy = '5.1922888146583' AND file:x_misp_mimetype = 'ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV)']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-20T09:52:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--461050ca-2a51-4f11-99ad-ec7a63b03ff1",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:53:09.000Z",
|
||
|
|
"modified": "2019-02-20T09:53:09.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "NULL",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "97e86bde-5826-4549-ba96-006429ebbd66"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5c059e7e-e475-4add-be9b-975003cc64d4"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--df522c29-c65b-48fb-afb0-d3a4932b1bdb",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:53:10.000Z",
|
||
|
|
"modified": "2019-02-20T09:53:10.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".reginfo",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "681b80f0-1802-45bb-bc60-c4edccf7fe83"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "MIPS_REGINFO",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d718bf9f-0e3b-423f-a389-83ac4f7541f2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d1c560ed-498f-413a-bcb3-d1c6192f5a9b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "24",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "37ca0023-adc9-4bee-acae-ae65851a9f58"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "0.98335575498169",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7a6b6beb-67c0-4f0b-91c0-9f95efbf52f5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "2c4f9f97ef8e3ca925cefe8eab60ff8b",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "4e8130bc-1e5f-4818-9a21-847cbb491c6a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "323d4336bcd5a98ecbcf906b6ac64606a7e9ad7e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "88262223-19b7-4c20-83d0-b62c4e8efb21"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "c03e5f5f10bfdae31ac499310ed043273dd2ed9af03aaac3f535ec497406a8c0",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "e14a6c0b-635f-4d15-8fc8-3499aec8f5af"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "e0722964c30fa73fd1a2af55248540f7adc83c61a1f61056b5f3441382dfc44c8c0c6c1f90939146eb63fd90a6772598ad8a8101a1af6b934a26316cbcd5798f",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "14db7d37-5f0c-4b64-8c70-5d158105985a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:1sn:6n",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "616ccc12-9077-41af-beaf-ef8c85e6c281"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--45c8b70f-1502-42c0-bc02-f1d0ebc460d6",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:53:10.000Z",
|
||
|
|
"modified": "2019-02-20T09:53:10.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".init",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f1670415-6e76-4ae4-8b7e-c8b8151ba815"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2d06b6b5-ca7b-4ca3-9dde-17fb68f03858"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c9def7b8-758d-4428-86b6-5241bdb38854"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0fb4b435-88b5-4d94-97c9-f015fee9db73"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "140",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6fc7fa36-f22b-44e9-a8b4-5c77228a5d31"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.0779122509381",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ca7d602c-9328-4428-ab29-5703b6f79acf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "9a9b3bd4fbc6cdccf71c91ac983bc155",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "477d874c-2b35-4f5e-8972-7670896f31f7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "7ff3b2aedbac15cdefa908440d3a7e87a10768d7",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "05083b62-893e-469c-967e-2880d4970d2d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "aee98ab84f19bb8ebd855b4af645a41867078fdbaa4e3dc1e61dc5cf7da562f2",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "9a3881e4-4bfa-4b16-8b64-d1240a02de27"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "e488656c20d28ec15fb2dc0a1e0620f41ba3f091737803ab32cc239ebfd65bd2284e18a45f17a9279f80feddebdb739a44cfd5c0ece3dd5c50d76ee500ea5b81",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "03410093-1304-435b-9564-b9c837c324af"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:2l1TBXl0Lt7o77llZsHW/Ulbl74FdlW8/UlnlNmFBn:2lNH3n/KWcgz3chl0FB",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "0a92f587-20e7-4b48-b3bb-3521f1d24a09"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--33b1ae23-3cf2-45bb-88b3-3af9b3643cb9",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:53:10.000Z",
|
||
|
|
"modified": "2019-02-20T09:53:10.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".text",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5de42c57-13cf-433f-a83c-1261a3df2fa0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "95ebfdc0-3295-4a35-8a8f-40e1651ab9c1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0219fae7-eb41-409d-943f-556015d0ae6a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "627e066b-5a33-4a2d-8da6-aa8cb2d3d172"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "76656",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "16e0a8b5-f4f4-46cc-839b-2c5b45d5bb6c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.9479821951636",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "17d5ef63-14dd-4ef6-968b-11f108e56000"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "55b9218e28b6cfb13db1c9aa4a1bf471",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6723fa4e-5d53-4623-841d-c6ea2beb3af1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "3ec5ba1e4f8e4fdf21b5b0067732be82345e19c2",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f96aad67-e99a-46e6-8e11-4dc0aacc1524"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "84dc73291fcb8fdfecf68c8d811975c79794c30453793da64a4f806b70f57ded",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6e5b16b8-0b57-487f-9336-8bc938cd22e5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "e00fc9d0221adfe3e920da1f06aec7598bc4f36b9c44712f2490362e7fdef9b2131b89d6ac000ae9627c48dcf72f201c43a1b28b09057e9bf0d3291c8d938427",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ddc2be15-84ae-4ed8-a6e3-b9cb90b8bfa9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "1536:6xJfeTWfyZwcmYAatKGP4yefZ6xHNBHkxMyaDo:YSDHtlP4Ffm0Gk",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "35c68687-48bb-4f8d-8f02-a143560159d4"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--6675bbb5-046a-4034-adfd-d70db36993e1",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:53:11.000Z",
|
||
|
|
"modified": "2019-02-20T09:53:11.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".fini",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3e0e1ae4-d54d-4abc-b0ab-32070bedce97"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "57d20246-ebfb-429d-9d44-8b9fc60c140a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "12750b99-6788-4a7f-b697-15787e2ddc02"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b79bbc13-8c19-4da8-9042-20396a779f62"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "92",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e4ef4cfa-5c03-455a-a89d-1fb109d80640"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.1123020826728",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5450ec4f-0efa-4b42-9d22-206a4bfa3c85"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "0fb8c6cbe52ada3c85afc7021ca20d97",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f4165d4d-e2bc-4e87-9de5-ec2297e19459"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "3974940b73a3481c401ff216c7c4003b2db6298e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "1680f707-6d08-4638-9abc-e453b4a67ce9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "a30b8fd5e2d2d888c24ce6c9ac4e341fce9c518c49106d8db9888ce4a7e5c513",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "4ca55fb6-12af-4e57-962b-281f727bc011"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "3aeb5c35f12fcd7ef88f3490629f161ff93333064043656a51b0b8e831b6f832d332a3ce7f7b0c86d36a772f65f27d956607bf240ee54b1e92b33ccbfbb86927",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d630ac89-b281-4f6d-b683-bbb7b0ca7392"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:8ZEmmFTBXl0LtO5ZJFmf7ll7e/UlnlNmFBn:IEmmdH3Hjmz/ychl0FB",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "64c23f44-a4e6-46f6-b3a7-6cba1747d301"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--b4262ef0-03fc-4efa-a3b2-8a44fc89a4de",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:53:11.000Z",
|
||
|
|
"modified": "2019-02-20T09:53:11.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".rodata",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c5902fc7-c549-40e3-abc6-1bcd767a3bf6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7f9fc926-498a-4ed3-885a-6d2ac4b8a705"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0f3dcf3b-b949-4c3f-be87-5186127aa49f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8080",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "529c8fbb-015a-4610-96fb-ebb3b612d9ef"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "5.3020576154413",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "de4c12bf-0ffd-4563-a3bf-237b6bf59667"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "59633d814822f4ddcd57c2b55cfdbf30",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "56473755-af30-4816-8ee0-10179f152cf0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "03df894d6511359ab991516106524faa20af0267",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "1b403a03-09ae-4029-9855-15d36f11476f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "0f8bce553abd1e4fe60c172a624afd4b36ec0f3f86d03781d6ff439d8bbffae8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "762f6071-48ac-4e81-b7d4-870eb06f108c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "a15c5c4b1f4c6e567b7b81b3d19f3bf89e26b3d9a7de2490672d5399269f19bd1df1fb870695827bdfcfe4050bc18c28bd5703fca8b760da2be04e7c20915030",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "9085ea48-25cc-4ced-8514-842b16df69c2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "96:r+xuLxBMHHVRs+kaQusnT7lRGNm6SgiW0dlOVXikjx8xkB3Fpc7qyGMl:0tHHsXaEnlRum67bqlOVyQSWB3KP",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "9c341170-e3b6-4c0d-8d64-a3c5fe18e5f5"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--05b17a24-12c5-4980-a8fd-d8d54f8d2a5b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2021-02-18T08:43:36.000Z",
|
||
|
|
"modified": "2021-02-18T08:43:36.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".eh_frame",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "26f519ff-d670-4951-8689-54b1a72507f0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a7cf3201-cd65-4656-992c-abd0ae17f899"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1271c48e-1d67-45fa-846c-4fc3e5ab2cc5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "4",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "fb8861ac-504a-4fd8-b505-564197ac440f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "0.0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6d743d8f-e436-4816-894e-6e6281dd5089"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "f1d3ff8443297732862df21dc4e57262",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "59aa51de-2421-455d-b4e2-0b12ccb77bee"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "35c9488d-2668-4b65-9c1e-8039d4f37b41"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "786115de-4709-4f8b-878e-bb6308a81ced"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "30cb0490-aea4-474a-a4a2-043f3dbeec24"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3::",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "56f55fd6-928d-4aa5-9111-2a4312177d87"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--14689a10-2a7f-48b4-948f-824efe79131a",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:53:12.000Z",
|
||
|
|
"modified": "2019-02-20T09:53:12.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".ctors",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2f34d985-77d8-4273-8e53-3efd77cdf021"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2d77f6cd-ff48-4c4c-a023-037fd0299f97"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d10bc5e8-e33d-4dc0-a2db-557a15df6dd0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8a4a493e-0d43-4f6a-bafa-f187a8bbc4b8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ec74b061-858a-4b32-ae48-ae31e02e8e64"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "1",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c070fe76-0805-41e4-bd67-6985e7745fd7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "00c92abf-60c2-4366-87ac-dec196a023a2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "21c27ad9-a40b-46d8-a8fd-e780cc1aaaf8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "eecdc7d1-295f-4a98-9e6b-d92d7cb92f25"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "4106fd3e-f8e5-43d7-9637-148ada663214"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:RRtl:LX",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "e8328a0d-116d-4796-888f-032364c412ff"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--652eae67-7686-4363-8583-b31aaed4af30",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:53:12.000Z",
|
||
|
|
"modified": "2019-02-20T09:53:12.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".dtors",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8c66d0a3-da27-4de4-b9c1-84a89153e16a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "917bb394-28db-40e8-b161-082ae3b618cf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c9a1348b-175c-493c-8e86-7ca62523da1f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1ee74328-7c5c-4501-8244-e360988f7162"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9041b69d-4c4a-42a8-afcc-2426d23ced45"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "1",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "183d11ac-7a36-4925-b52c-6eff2c7704ff"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b5c08299-599f-4b81-b311-85805f3c8eea"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "071b81bf-d908-4bc9-9e6d-f90e5897e474"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "60222676-e8f8-4f56-8b30-b8041216eeae"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6179eb31-c303-46de-84bc-4d2d0d2ff04d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:RRtl:LX",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b9f4d1bf-6936-4400-9b84-6a102b9d70d1"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--60a5f09c-c861-4eca-9448-5e7bd592ecbe",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2021-02-18T08:43:22.000Z",
|
||
|
|
"modified": "2021-02-18T08:43:22.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".jcr",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a316819d-268d-4c30-a61d-dfceffb281a9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4efd6e7d-bd9a-4607-b2ca-7ff72330a85d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2b34b558-a3a0-4bf6-9fe6-0f97f73c0678"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1aaca676-456a-4f88-91cb-69cc21116157"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "4",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "786f743b-9fe1-4e2d-b254-57fef94f104b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "0.0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4820fbfe-94b2-497b-83ed-048bab790a6d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "f1d3ff8443297732862df21dc4e57262",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "4fba4282-90f0-483b-bf71-8113b98fbb41"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "468777b0-eff1-49f9-a04d-05b1cae8c21f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "4dc40f77-d3cf-453d-bf15-ed8d07f874b1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "66d2fee6-8434-465b-ba17-dd096edbbed8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3::",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "fc0687c5-ba17-439f-a8c4-22756e8d0e3d"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--5d8e7117-335f-491c-8980-53cc0c20d4bd",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:53:13.000Z",
|
||
|
|
"modified": "2019-02-20T09:53:13.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".data.rel.ro",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4e7d349a-6e1c-435c-8bf5-1ccb7c185c98"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b58d1234-084a-428a-8fb3-2f2ecb915386"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "de490408-d193-497f-ba79-02f0bc72be5f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "032cef1b-e073-46d7-a629-c8b9d316d772"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "32",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "76e17823-6f21-4f74-b70d-eed307591a61"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "2.9528195311148",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a86069a2-aea1-4384-9651-4fbd034bbcdc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "09942060d6582b717d76fdfb4f795982",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b4c23386-de0f-4794-8d80-2b153140a4ff"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "5b6e1e92b9b7f666d304694315c8d282340f0093",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "3698921a-7bf6-4ffd-8541-6dab7aba17da"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "023b10be8da0ca9bf046f5b85466a8dc0788ca77a7af7d37be6131af268c47de",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "9086e4fc-3341-4a3b-bd4a-eb931015fa93"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "b28ec1a6ec030a682de5aab732ef12e28e409154a5a7a7ce2a70e74e3fda8f2e5e45f3032542582743c7da29f67a500be002d94327b08d89ab61fb1e7c22e486",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "2fe579e0-d8ef-4ef1-921a-602267063550"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:+XogcaO/WQn:oMh",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "fb4ce7f5-fa87-42cf-99f8-39def926bf61"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--11bec101-ea69-448a-ae53-247c2f25a01f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:53:13.000Z",
|
||
|
|
"modified": "2019-02-20T09:53:13.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".data",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6480ca18-49d8-4b2f-bbd4-9172a504961a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a0ebb548-35e1-40a3-980b-3c3971717664"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7f057c8e-2714-4f07-9c6a-199517d124b0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1d057486-8f2c-4823-bfff-03aa3d5a1b1b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "1072",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "605eebab-24ca-4ce0-8bd9-683b77da5135"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "2.3024085194807",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2689ff1e-42c7-46b4-8094-3ace570d9e80"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "d9e26391868cf999a81f61128bfbbc18",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "cac0a576-2b26-424b-8747-868de65d9333"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "821174cd08ee4e8e93c39dc2745054330ecc529e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "8dc0f1c2-1090-445d-b7c2-fb6858bfbbb9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "03f8b28b510e94a7b86ec5c021b953868d1cab747c7c10b510e1c7bbbf8f7c93",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c45e34a3-b762-41c9-b393-0e0be2fe5d9b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "b127e19e2e306d0a89b608c1928096b9f057b1efe4a9d62084baf1b13b1e69d567ef14a9800012eb00556ae63e73268ff4502707e36524e9216d7828f94dc123",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b15ed1d7-3192-4925-9134-af11e09f902a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "12:MN+s56ErpJZUh7hhZXkmySQM1ybSvOH/YBjSa0k:MNR5Y8+Lzj",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "83c61936-829f-4e02-8af2-7d9d11e6f0ba"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--8d079804-d695-4435-819b-3f1a65812d66",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:53:14.000Z",
|
||
|
|
"modified": "2019-02-20T09:53:14.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".got",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "42e70839-9f30-4916-90dc-816f3a945b82"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "bf5d2ae0-fba6-4054-8dd8-f82b54425cda"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "HEX_GPREL",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "018c0f07-17cb-4fe9-8a5f-acec8c006660"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "24ce63e9-5f65-4302-a479-c393bc51ebb9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8c3fc2a9-a734-4143-af70-5b248e3577e2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "MASKPROC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e534c4bb-9935-4786-8d42-8d334bac6a1f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "1192",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "47004aee-80b0-4cb6-9d77-b4b19f0b44a9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.6866290623977",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d6fd7867-b9ac-44a2-855c-ebfc7754127f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "b0951c5d786e331d1d7f9897c279f4a5",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7f97cc65-adc0-4037-a48c-9be68be9a66a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "19a7f9b5ba7f42a5448e3dcbe2fef50691bd0222",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7ae17e90-a6b2-4482-85d9-8fc1a763b30a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "5399971560a867b98aa90a268233908ecd156a80cdb68db8e734b2af5a7db809",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5e904bdc-4a40-4e77-881c-d060f664668c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "9f41ecfba873d30f78b82385c39de8cd425d7c35d6e4d58dc3e26f5ea84dfb0b90da9024587198e80393184a46316d2c33b0cd63e6084842913d0b962ee07be8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "2b2ed636-e305-408c-b8d3-29b461857529"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "24:4Xzo4Tl6kyjqk8PVqKGK+yFkv/H69ONcGa8gMHT8:aoqlXOqFql1yFkX69ONcGIMHI",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "32162cde-8361-42f2-a784-e33d6c5934ee"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--c2730fc7-ccd3-4ce5-8fba-da72a3db38c7",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:53:14.000Z",
|
||
|
|
"modified": "2019-02-20T09:53:14.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".sbss",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2a813783-9427-4aa2-b707-c77d4047b9d0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "NOBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f1b52bdd-3b33-49af-84d1-7d5993113581"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "HEX_GPREL",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b8c027b0-00f9-4a12-be6c-c319f0819114"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "fcee84ce-e0b4-44e7-b9cc-a2e21adb2f6e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "bd260e17-8b86-4922-ad77-73daaf8add52"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "MASKPROC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "db2b5886-6bfa-43ed-9ceb-052ddcd8681a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "28",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "699b9748-0d3c-4925-8c88-f62d1575ce42"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.4677201004745",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "35389024-b042-4c83-9040-c827b2b79c6c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "c7e412f1d671fd40692fc38e8bed5165",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b3757ed8-f95b-4ff4-9054-3c8071a75349"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "61e230d579d72bfd5051cb4b9148b3dcddecdada",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "14bdc1b4-ea7d-4b00-b1c1-67def2c677f6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "a8ed9a374ae1bd36c560d480a67cb987589b123e94f0c36f9da2317b9aadab9e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "0c65972f-810c-4313-9c58-99afa0991038"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "0b7dbc7d5e0f76a28c8ef1e0098a40c29c80a2e52dbb8880f758e3fa8e07db17c07377816f61e4a826ba50b1ea9835c2d93d6126a37c037d14064d24cb258e2a",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "fa0ad455-424e-4cf3-83e4-e9b62fcc3078"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:yfY5FJroYw:BFi",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "210f86e2-8cdc-4981-a865-87d82d163205"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--f75edb72-2a39-4aac-934d-4980703c3a9d",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:53:15.000Z",
|
||
|
|
"modified": "2019-02-20T09:53:15.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".bss",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "12bd7a20-5aa4-4e9b-a042-f9dd39420f71"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "NOBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0aa719a4-12be-4831-99bd-4205740a620a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "40b7ee22-aeca-43cf-8fdb-152bd9501391"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ff8978f3-6170-45cf-82a0-d1184515c6a4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "25492",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "aae648de-9d12-4d1f-b140-829dd65aaafc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.3356456944418",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "74f89792-7221-4baa-90dd-b03236ab9356"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "2f6024fa96d8cd11b5471717175759b0",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5c793c21-4edf-4c89-b19a-e2b3226f4d21"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "857ab20f0a8caf75233339a1ce6dd5df583dd9f4",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "97849e3d-4bae-4788-b4e7-6f073db8c314"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "4e5321401028fb1189575d64c172399b1a08f90cc7ca1554f81bc10eda4612a0",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b8b245cd-b2d7-4c21-85ac-81f3a62c979c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "acff23ad76b7f804c2d949c65d6c3c208d81cee452383db933e6716f87dfaa8d25145ffbe481e6356d9a337846d2cd177745f20a56cf1cc4188b7544184cee60",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ba513801-060c-4497-971a-447517a3a170"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "384:txgGVOasJHvaF90WduzlS7p/QrrOKaI1CyMAnFMNaZrKLIPrRZAIZyAMSDDISa:txg5asF5sIIyhFMH8raSK",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d0694c63-9200-46d6-97e1-71fda3b6581a"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--bb14a9d1-e11d-4590-83d1-0165d6c59aa7",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:53:15.000Z",
|
||
|
|
"modified": "2019-02-20T09:53:15.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".comment",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "82875da9-c023-47e8-9f6f-17345dcc23f1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5a42d501-f2f5-4276-8ebf-ece7acae100c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "2934",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1757e0bc-7e33-4e73-bd1c-2fd1b6467a1b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.6236162569046",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b0da490b-6fb3-4a0b-9fd4-00ccc9fce063"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "b9413e51dbe36380bd17e86d8c95597f",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6f72e5a9-2a0f-4c60-9c09-82a88b2ef0af"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "61fb02dfdb2e71306a38d48ae2a65648ff3454a2",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "4bf59ec5-3d31-4fc8-89aa-82c0497cbdc6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "881478d60c29771ee32339c566a6c43d9157f99b23d031a4f1d342bd1e4254d9",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "964e839b-e2a6-4846-ba89-de84ad84344d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "bacf90b46d6451e9ee5acdc82ff20957dfb62b463cb3caeb10642d1366f7c4fc13f8ec18e03356e960f710ab0691f0e90c7e08784b2d7efa6b5d7d4f913acdbb",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "8c73c63b-92d7-4764-86e0-e81a93fa8f7e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "48:BNUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUz:a",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "cb6de510-5e15-40e7-9664-455b4fd90588"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--4a1d8145-fb08-41ef-80d4-50120ea92a11",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:53:16.000Z",
|
||
|
|
"modified": "2019-02-20T09:53:16.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".mdebug.abi32",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "046db483-6227-4d2e-b9a5-2e9a49019568"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ffc7ec7b-979d-4bfc-ae1c-5c5c9bf420a8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d670c0d9-1836-4632-a03e-df5e1deba644"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--609bb5bf-21ce-4df3-ac3c-7c2a3a16fe6b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:53:16.000Z",
|
||
|
|
"modified": "2019-02-20T09:53:16.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".pdr",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "cab47cb0-cf3a-4e25-add7-399fb88b1b5a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "66bdaa0d-0318-4af7-814a-c939f2d93285"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "7392",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4fbde04b-67fe-4523-a45a-af6b35c26e07"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "2.3498995477571",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a8933021-07fc-48c4-b0ad-df7cf086c9fc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "fa3db47d8350d41cec2eca1e3379567b",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7650d2f5-62aa-41e5-b542-d6dda1db585d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "047c92caa51964e301fb442a667bf5d9fa965ef0",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5a998584-832f-4bb9-a14e-fe30071be377"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "791c3efd39a6969054367a031bd42463adc3d70f278cd0d6b30875ae8076f71e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "31e69cc4-6b05-4dde-bfb7-2337075ce3da"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "7cf6679f0ac3a3510e8742c3132c7fc54129b5ad9b0c5c06ce5cc7cee92d9ff8693c4d691f4f1aad5ab73ed6c4e0aa43b569b84351aa74af42550f6313ee8739",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "3c674346-58c4-4257-a099-3b8a249f08c5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "192:RKxB8GDQiqgBgBJLkloWfYzWNZFotH6AHD:wxgGVOasJH",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "e73fcb70-b7e3-489f-b46b-048fa4c1f306"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--96e3297f-ce4f-4c24-a681-26b10337c17f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:53:16.000Z",
|
||
|
|
"modified": "2019-02-20T09:53:16.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".shstrtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "111801e2-d632-45ae-abf6-2114536a9a8e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "STRTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8c3bdcfd-2fb0-4e77-a18b-6103b4b8a0b6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "154",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "54c28c94-df74-4918-b0fb-e85a31ef4851"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.0531923876455",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a1bf4216-ac6a-488b-8755-2dbdd46b7d81"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "12071c1d10e788d633c06c50dad937d2",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c1ef12ec-f097-4df4-af01-ad328e852257"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "4e330bc5132262c6f7700030e1d37ee1aa1867be",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b29cd056-a5d4-48ef-9da4-0f2fa268f85e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "82735c98120199d69b1893c6fa072b6611625a462fa44e37de1b1f19e47bae27",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d6ececb4-5b4f-4122-a20f-c13c60b169bf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "5b0b1e1fd30069337dfcaa8a3d256366331f6dd7631d2a819c776c9b0ce1fd61808b07ca78d0537088e90bc1b840613484ad6cbcf500f8beeff343700fa5a5d2",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "233741a1-2a7e-471e-ab66-d83027cb17e5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:mqWxRuRWExqXnMOLKMDlApLQ4lLaCMLn32cxlLPAl+5Jj+LxNi2aXTTiQIuxVBXl:EXwWEgBKR84MFTnf5JjgfaXTTzICVB1",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ac1b326e-13e6-4082-9585-15748c5ae899"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--f7f0af2d-7551-405c-ac2b-f1f347b83d0d",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:53:17.000Z",
|
||
|
|
"modified": "2019-02-20T09:53:17.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".symtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "60951006-5655-4e0f-a1e4-0dfe557dbbae"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "SYMTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6f5321b5-3f53-4432-b888-4233d79cf16e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "11536",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "057a3ae9-bae0-43a8-935b-3625fc748816"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.9437004026463",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c0c85f60-5f09-4697-a43e-0d818c0e89f0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "36ff0ced69d50b1b99e22bfc2cf24ec6",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "e23b76f8-2f21-4d5f-9857-893537c5a3e1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "37290dc8ed649463d9890d5ee7f028c3d26ca6ef",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "fcbf8454-7c79-47af-8ca8-2266789c5cb9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "7b1464ddaed2586f184f77ca365dc3b83ff9758e69cc78254655c5303b149335",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "731b1628-c440-4faf-b5b3-d0a2f377c586"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "246138f1ad13d8290a1b918b83e30204b5fdec238ecc79ac7b02cbe0ab6dd57d4eae227413301d1dfc134c96a08efcea9d9d829fdc431ac70846080821663cc0",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "4ac0be2e-058d-4447-868d-1680364b2dca"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "192:qF90ZkduzlYt7p/QrrOKaI1CyboAdx/vrgCMNahDrjeK2wVGwFsWtxr1:qF90WduzlS7p/QrrOKaI1CyMAnFMNaZF",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "76aa32c1-d569-497d-b901-a744cc87e71b"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--7dbd1012-551a-4944-9652-28e708774042",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:53:17.000Z",
|
||
|
|
"modified": "2019-02-20T09:53:17.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".strtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "756b15fe-e3d2-4eed-80af-2fd46762fcb2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "STRTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2ed7aeb3-1ad3-4129-a93b-fae99c548ac0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8592",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b08eabe5-2b89-4e08-97b8-a001eac17b53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.6041092439817",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7071bd39-de4b-4e41-b6a2-0dc42403b23e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "34e109be0d34766858ddf711553e189b",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "99d8abf8-ff31-495a-bda1-a0de99fc34a6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "1ab433c7198110f6f293dae9bcdf1d29f1682fd7",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "3602a827-c1b0-405b-941c-e192711e2ac6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "23eda5502d9afd40b36661386fedfcb13d21093cc69636685501aa6d30d98858",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "2b68c8a8-24a8-4d4b-b497-09796f9c1ba2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "8026cac01a659a62ced7666ff5c542b02c8f2ae5e4165a3b67e1d3813f5e0473cb6b55ab7d5fbd996e6f9829bd2b2b6af03e4bcb344da2e24f7f9bef94c71ee2",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5a0f0af0-4354-401c-8a30-404fbb3a06c7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "192:TZAIZygfXMSX0sDISCkxwmX8QlJvtt5s4YbMFfb7he+X1l5QckghDZayBrIfJ:TZAIZyAMSDDISfOmX8a9tt5HYIFz7hBa",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ff82ef52-b09b-468f-89c9-fff11eac33ec"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:53:20.000Z",
|
||
|
|
"modified": "2019-02-20T09:53:20.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "EXECUTABLE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "76bd84b4-8635-4410-9487-e4184a596096"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "entrypoint-address",
|
||
|
|
"value": "4194976",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c281b64a-43da-44c9-be40-034bc9ca8ead"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "arch",
|
||
|
|
"value": "MIPS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5b1c3a2b-340e-4f4e-b9b9-b6c4298aa5c3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "os_abi",
|
||
|
|
"value": "SYSTEMV",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1666ba94-d156-4336-bd8a-0c0a04c0df94"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "counter",
|
||
|
|
"object_relation": "number-sections",
|
||
|
|
"value": "21",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1bbf95e0-f896-47f3-9394-2dc51027f96e"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--ec4f8e6e-5a17-4c5a-adce-434e99f66868",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:53:20.000Z",
|
||
|
|
"modified": "2019-02-20T09:53:20.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '07868f062433f7a90849e365a3005195' AND file:hashes.SHA1 = 'b4e14664c9730e94d248be7696e36f88fcaf9c87' AND file:hashes.SHA256 = '150e4bf4435c1023ee12ec488b828441b63571ded559d3afe5f3c60f7f97dae1' AND file:hashes.SHA512 = '90d7e17ea7e292d902dd7d2123448a6f3c0b798ee0dbc1a3c71849f522149256ba6029521b80aec6a0979c0c1c951f470886e514d85b09723cd3010b4a7e0913' AND file:hashes.SSDEEP = '1536:jxJfeTWfyZwcmYAatKGP4yefZ6xHNBHkxMyaDiMxamyoM2m3tDVFz7Vw5cS:lSDHtlP4Ffm0G+uam62m39VFz7Vw5cS' AND file:name = 'DEMON.mipsel' AND file:size = '119796' AND file:x_misp_entropy = '5.1927499473932' AND file:x_misp_mimetype = 'ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV)']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-20T09:53:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--56573e90-319c-4ca3-ac05-7a9ac20743dd",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:54:01.000Z",
|
||
|
|
"modified": "2019-02-20T09:54:01.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "NULL",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "df9c0726-8645-4180-b71b-a0bffdb14ea1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f3e768d8-c105-4f8a-9117-73c2a332187a"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--e896240e-1257-4cec-bb1f-90ca909285c4",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:54:01.000Z",
|
||
|
|
"modified": "2019-02-20T09:54:01.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".init",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f5e7d89f-942f-4ca4-8f9e-4486f961db55"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3ba3f2e6-ef65-493f-9881-059b1198df39"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "fcd53396-05aa-4bb2-906b-cd18ed073272"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "38aa2043-acce-4cab-8e09-2c30428ec436"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "36",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c406a84b-17ae-4b5f-97c7-449d6305ed7d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.1240504332644",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "bbd13943-336c-4300-99e5-bbc66160aafe"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "2e1eccace3cd3a0db4874520f68bcc98",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f554d020-8d7d-4fc0-b81f-0bb01d5f0e6c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "124419317ba53dceabdc4d61955a5434fb388d11",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "df32d27f-a94f-4bd8-a35c-394857ef956d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "993195c25c1cde6015b0945ffa0a9059e58148cefda3bf202ac8e7e962de97cf",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "89692c70-227b-4a58-a2f2-d9073c5c3aa2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "b3bdca4b19935dce9f0d1be1e7fd0d950892b4d52f7277a6868d05917944db702a9f8402bff8a0262072f501e843e9dff68412fe76d1be4f08613c69df12c9db",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "928e135e-d90e-42be-9d1d-33fe1bc16524"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:dVpkrlSlsQlFSfn:dVKxuafn",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "882cc5aa-2933-40b5-91a9-4e5b8e227301"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--3e5eaa70-dd1e-45c8-ad6f-35ad3b7449ce",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:54:01.000Z",
|
||
|
|
"modified": "2019-02-20T09:54:01.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".text",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1b6b662c-d9d6-445c-8f3d-0ac1d81bb20d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8aa74f68-ef97-48c8-9686-46e48724edb4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0d832d0e-6ba4-4976-8be9-e8440fb34d43"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c6247e97-45f6-43da-ba2c-16a63b91df2c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "56712",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c8705832-d6ba-4216-9dd4-352f967f9f30"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "5.9430284993611",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "766bbdce-d02a-40e2-8ed2-49903d297752"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "4dc715b648f2929ab7efa044b138a809",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "914f29e3-6b7b-4570-8d33-0a888015a53c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "6851768b67741f9e70df5e8b5f273b49da6b0b91",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c438efaf-ac85-4544-b4b8-745aef9776fb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "b307c6f6430056f17af842b74172955e9fb02c75f7f199cfe0fc61b988bad7a3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "a9c8e558-4ca6-4477-b68a-3f06a2d4d8aa"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "c52c567a9c7013adf63a8ae93c6051a80aaa467ebfee660b74b61000b0b6aff60393766610806ad9764cb8cbfa079ec6461743cd77377b8175beed366f03c4a3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f97f0e65-9961-4461-b888-8e9a0b18b31a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "768:PUt0yB41XbzcZXVvZv8zrJSi1LbF9/OgS7cZxnZmcjzVLF6sthMiSdmdAcHOon:nzcNVvE1Lbr/dSAZxZmOx8sbHMmO2n",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "dc641953-cce7-4f35-bc9f-963fe09edccd"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--1d17b468-ce54-48b9-a8a0-99af923ffe3c",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:54:02.000Z",
|
||
|
|
"modified": "2019-02-20T09:54:02.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".fini",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "dc7fc3b8-1e4a-4413-9af3-3a384c54d9ca"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "bc5807a7-41f8-4450-b005-c7b91438e1da"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "46828901-0f18-4a7f-b7a3-0bbf5dec1fb9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "eabd2dbe-c75a-4942-98e5-989a3abcbf42"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "32",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "08bbd100-ed55-43f7-aff3-7b63883f1691"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.1875",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d4ec07c9-dca0-4db2-90b7-a75bc6b8fa81"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "0d3573e94d1db3a75d8eba28e8418743",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "1b8fe123-07a3-44c5-90d1-8046518b1f68"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "47c976c05a6aca61d6b72e5c74291dfed7302669",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5a6965fc-9f1d-4856-baf8-7481ceb5277c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "925bd6375293daab50b8d49cb158be1e2bf5871aeeb7e4d6aaefce080d980a42",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d542407f-70ef-4ed8-a137-0baee11a1420"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "81391c8d16e7cf33e42aebbd7bad756544200d1993ac8d9fa1eb380d417b134bbbe9be2183de6b050b24755ca674dda2a8c6fbb0cb3b68586727c17bf47df254",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "cf0eb1fd-77c8-4fca-afd8-10abf51497a6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:dVpkBo+alFSfn:dVKCafn",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "239badab-c1bd-42d8-996b-840b5e5cd7cb"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--622d5d53-20d6-4c02-ab1c-ed562b45155e",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:54:02.000Z",
|
||
|
|
"modified": "2019-02-20T09:54:02.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".rodata",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a3a2fd26-e763-4697-8694-e9e572d8bff8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5ce30d64-8073-4480-869b-25c0ae02eff2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3aec3c02-2687-4668-a6f6-bcc509212b64"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "7832",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0522fda2-f0d8-4578-ae04-218b1d363711"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "5.2676941229779",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f10fea8a-3872-4d2b-a4d2-4be0b129af90"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "e777f986670d349450db3790533f6550",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "8051166e-4c8e-47ac-9936-72ca08800912"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "b6d273bbb6cc1cf360e02633b2948890a8b49ba9",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "1933d707-530c-4ead-a388-9b1374ac0a93"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "49dc0c717af879e633e03a3bde39e6cadfac8e885f8d570cac390d8da5b04971",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "9b484a30-42dd-4588-8d8f-4fc0c4e0a537"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "c7d20735a195e035374585ace95e69f4ea16c272c7d906d0e333a5a41e4251b7f49b6379dfa08ea6a6997a5568e5923b3e897a8d432a59cae553a401ea83eac0",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "0807ac87-44da-4933-b7f9-10925df33932"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "96:9HeI4xgZHHRheaQusnT7lRGNm6SgiW0dlOVXikjx8xkB3FpkB5ydZn:9HesHreaEnlRum67bqlOVyQSWB3Nf",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "743c3585-1ea0-4c3d-95e5-080705182633"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--c3b033c9-8301-4eb9-a7c9-042bf5a2947a",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2021-02-18T08:43:07.000Z",
|
||
|
|
"modified": "2021-02-18T08:43:07.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".eh_frame",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "07326300-772b-43c7-9fc0-472727db3831"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3a7a3da1-2c03-431c-8a1f-ec1fef2789c4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "61f536da-a45a-4297-8828-bc2a6baa8ffd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "4",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ddff8b55-1ec6-4932-a6f7-6edb7b0842c6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "0.0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9243b1f9-7f05-4d1f-99e4-c99f3db8351e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "f1d3ff8443297732862df21dc4e57262",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "77432f27-a068-4e51-ba51-da7bf1915a05"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "a284458c-1150-4100-94f2-faab51d30a35"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "e87f6ac3-56ee-4c16-9dbf-2af1689536e7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "9e2976db-147d-4d2f-bbda-b1b1ac71178c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3::",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "ebaa3080-c51e-4213-9155-3b751dbc93d1"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--2595727b-8ac2-42c0-a335-601eb9968f76",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:54:03.000Z",
|
||
|
|
"modified": "2019-02-20T09:54:03.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".ctors",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9ae2bb96-89d2-49c1-a85b-b08b8b7a9c3f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "14c28292-8244-4b7e-916d-844887c9f2d4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5cb30d73-38fa-4605-8391-6e4f8cae57b5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5605b459-5a46-494b-9a21-202d00319d9b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "de0236d5-6a26-4dfe-b5bc-8705ba4002a0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "1",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "93711513-3805-4cbe-a76c-91554b88436b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "02985e69-c2ba-4f0c-a4f1-9e9fc7e5736a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6414f005-8f1d-48b9-961c-4dc6205c6c99"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "38996803-cd2e-4f03-ad3f-c1c373531ed8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "eb85947b-a4fd-499b-8df2-fff18eab2ec0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:RRtl:LX",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c4641792-c91a-45d3-9f9e-f82a45c3537f"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--c805be7e-462a-4067-bdac-5a2da1a49d53",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:54:04.000Z",
|
||
|
|
"modified": "2019-02-20T09:54:04.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".dtors",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "672fc06a-b0bc-4259-a173-bbeba8b08cdd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8ea3388e-8e49-4617-b90c-c5c6e66c39d3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "95511729-9fad-4d4d-9f13-abb5b48c241c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6e1e643b-9554-457e-a107-72e0d7ef2bac"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "81e971f7-7c08-4b66-9955-980b97803f4f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "1",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "497cc97e-de47-4f3a-80a2-c423f61ccdbc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5041fe56-ba0a-4606-a281-c6314ba2b73c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d3df4b46-2bb7-4c91-9e88-0ce272ad1bfd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "fce1c987-7e21-45ad-a1f6-505877c6edef"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "a09d1778-3873-45a2-9c99-f5770162e751"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:RRtl:LX",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "22d7d139-223e-41dc-841a-c03e1fb0a999"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--67665457-214f-4ca0-a9e2-1caa8f1a4c1e",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2021-02-18T08:42:52.000Z",
|
||
|
|
"modified": "2021-02-18T08:42:52.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".jcr",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f519e92c-201d-479e-95c6-5571a26639f9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f6f727a5-fff1-4ecd-9ba1-7ae3adb389fe"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5a2f0433-9682-45ca-a1c7-4f44fede0156"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5a42b4ea-7cdb-43ac-ac02-953e6649664b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "4",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f453bbd5-10d0-417d-9ff4-a54d5f9a127e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "0.0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3ab2052e-fb52-4b13-89d4-8f23dd75d651"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "f1d3ff8443297732862df21dc4e57262",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "9ace464c-7c57-4afd-a22c-f84c1cb0a263"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "37ec6b1c-a630-40cd-bcbb-695a79ecb89a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "3b53226c-b7ab-4398-8bff-fc3c8ed18a2a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "620a5bcc-79e1-4fb7-a03e-697a717721b0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3::",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "d0c94521-a81e-44a3-9311-e809200ab76f"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--4b8a75a1-68c0-498d-bec0-ac8af7b192d1",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:54:05.000Z",
|
||
|
|
"modified": "2019-02-20T09:54:05.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".data",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c17e971b-2829-4e52-9997-30bb8e75af3d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1e667d6c-acd3-4646-9d63-f856382d6555"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "253ceb8d-f14a-4adb-ab9d-b2da798b17f0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0f49b58e-3da8-4a20-af6e-5a663b4b5106"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "832",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "de7a862b-8f1b-498b-8de2-59a5723a9a43"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "2.4410465132468",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1bd96f70-9d59-4cdf-9c52-2bab43b38e96"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "8dcf185f399d2eb71dcc7247da9f73cf",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d392ca33-157c-44fd-a71e-a63735db95b1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "07bf9f61aa36d88b7df64e39518044d0c049faa7",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d9cffea8-eb4f-41fc-b812-bc52cde7ba3e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "9109b8548ced721ab13c8b52e06e00f978b9e1d6b27b94ad001ad72b375e7ef6",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "89858c0d-292f-431f-b5a7-74a47d5f9a52"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "bd3fb78b127ba830880416a271bd418a39c298da9373aafae8bdce070c7e8b732f2102228141a15d80e984fdde70759aec2d3481ef15e8a15e3ba92d8cea7775",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "bee9feb4-01e0-4eb4-9817-5291aded1def"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "6:0XlkEC//Sk004yCWP1HEEoKy6SyjSRuen6PYEqknNuTQud3Ova5xz6lUc8E:01kECXWyrzy6SGqH6PYxpGS6lUc8E",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d3c79086-d5e4-4a53-8990-3eab94e95187"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--fdfae2ea-c125-4b8d-85fb-34052ca74b95",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:54:05.000Z",
|
||
|
|
"modified": "2019-02-20T09:54:05.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".sdata",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5eefdaec-9d57-469d-b751-9c8954d7d30b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e55b3c68-9d03-4149-a61a-941f514e26e7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b51e6d0c-6a37-49d4-96ff-c46da2d9a521"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "aaa569f6-ad17-4b4a-9d51-aa48db45868b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "68",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "dc921e65-5469-4081-b87a-6f64aa92656c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.3800181402741",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a0670cba-4c10-4317-9b32-cd8c02c998c5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "9565360592f39f7fcbc1c036b903c8d9",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "736fe0bd-8c3e-4679-bf48-83824d08abcb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "214f6bceb3de17ed05670dad06472cdc209e72f4",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "2ba0fad4-ec9e-4e82-a550-41e5f765cc45"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "8de50173729cbb4084343b7a697ef9c87e70ee01f483a6b1be9359fc9111e7ff",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "fdcc9e24-e093-4d13-a960-99b42e86ad86"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "61dde8799b101498c817ab9a9d3e7b9e213d9a992c57f0dfecd955a111b20cbd9193a300fdbbf94a514c519dfcb70f0702edab38667a193d7e75aa5a2ea97abc",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "efbbe0af-29a2-4b49-8da9-b46f5b6a4567"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:5RR14evr151FmGV1lfdv1n:9/rZICv19",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "227fdf45-8c31-4e77-bd33-21fbd7dbfa5d"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--c5ea61b2-3a24-44c1-b223-d7405de29f18",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:54:05.000Z",
|
||
|
|
"modified": "2019-02-20T09:54:05.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".sbss",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e0780ca6-4b91-4cec-b52b-554ba2c0ba26"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "NOBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "91b6f36c-e17b-4a56-bd75-a63dba12302b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "94016cb1-8e84-427a-8011-c89e636bb575"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8a29bdf3-a91f-49ce-bb24-540cb320bb9e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "120",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3d11831f-9442-4147-8a48-d83a0dff3ddb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.608382925976",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f9360430-faee-49d4-9f1d-83a6aca79fd4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "74dde6fb505f230ebc52d0b1dbf5aed1",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "596d8ea6-d2d8-48b3-8d18-69340017f2d3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "4f26671e106436a5881bfa8e19f5258bd9dc6376",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "82eba3da-d684-45c8-b043-7d306377b970"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "27e7be1f328c2e806a74fc698865c23cf92be7ba2d007d59c4fabaf3855644c5",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "0bc4163a-13f5-47a7-ba7e-d945841482b4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "290d3a2af947b8b72d86fd2ef488e928315230d93a9db08f09c16bc00ac9a5c6175836815680592e93df5462c7f29eaf69b1cc686a09c5ee842536367e445f6b",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "a2737138-22a2-4cdc-8a7e-13a47a768fd4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:yfY5FcoY5FcoY5FcoY5FcoY5FcoY5FcoY5Fn:BFmFmFmFmFmFmFn",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5ce78c3e-6195-4a12-b64c-cb6dd12df0cd"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--521c8b9c-76be-4a62-9dca-73e4c9b9c218",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:54:06.000Z",
|
||
|
|
"modified": "2019-02-20T09:54:06.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".bss",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c4a03422-39ca-4854-ac78-4ac716927138"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "NOBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e65a79ef-3463-4407-a51e-0af98f99fd5c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9d321669-1f31-4c96-8138-c6a58ed52c19"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "cb8d4c44-e7cc-43c6-8692-40cf457cc5f9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "25312",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "fad992d0-8c8d-44c9-8858-fd26aa799789"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.8941435322883",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "703e6d72-3b0b-492f-80be-a67d6f82c2ef"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "bfa4b01747ad7fc1f7607438534093c4",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c5e17999-7399-4ec9-be95-fb347da5d052"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "fa2158b7f875effcba47d7b3c9eb51f5dd39ff33",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ef51b39e-e417-42b8-85fb-48bb1fb1c735"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "f3b3078fb5e41bc5db64bd8f5d5941768949c51eb740b2259cdfcaae0e36a185",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d242547b-a0ec-4ed6-b103-293cf2e30b5b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "16ce5d1ddba1c9ad989f06bbf4ddb087213e695bd10beb7b6ded8df1b873e45909b9d38f554ce2aa9f991834c70a89363e9f95527d7e537c6c60062c9ae9dc7d",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "540a82da-e259-4a67-b7cf-e01d48b4dae6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "768:49PNVFTOg9aZSSkWmX3xJFVYQP0Cs/H69:491jOuaHRmn3FVYQP1s/a9",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "8d9caaca-c95d-4464-9bf7-9beaeb577c5e"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--c2b4cf8b-9b6b-4149-940b-11d0d691318d",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:54:06.000Z",
|
||
|
|
"modified": "2019-02-20T09:54:06.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".comment",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "70450538-3164-4079-89f1-9219113780a7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3c812164-21f3-4d3a-b378-5ad154c42290"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "2934",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c14a03dd-bcd8-4e41-b9f1-a2eccfb8f470"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.6143694458868",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "bfb7db88-2eb1-4129-bf95-5ed96e018700"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "3f6134f42dd3dcce96f346b89e536733",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "081d1766-e165-4076-804e-79f7f297eddb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "98c8c140c01dd71ac3ded4a5fb00e21d2866f6f1",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "68c8d7fb-7fd6-42fc-9f2d-8707909d0ba2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "a06d6ebbe98d3d9cd389886557806d5a3c4f26c5b118882280c83a91eae847c5",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ece4a824-f72a-4a10-9932-f7931728effd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "ff4458a4c099f2da9609780a583382ba6cf8e29afe81955cf15c5bb94a5ef70c86a3fa93fbe9b3c8668bc5482127ceba698cdd867154fc0fef79867f555111a5",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "308b7349-cb77-4b8a-9453-8c809bebfb27"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "48:BUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUc:6",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "a5887918-76bb-45bd-8e2a-a43acf425ba9"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--d137929b-9eb3-4c34-b326-d9a7014b134e",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:54:07.000Z",
|
||
|
|
"modified": "2019-02-20T09:54:07.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".shstrtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "bfa4f2a1-acbb-4b1b-ab72-30f703f3af46"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "STRTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "68142592-cd38-4778-8690-25f8eb0a101f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "115",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "17461f94-a735-4e4b-9b8b-215255e1ad13"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.821145980503",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6e7b5e90-b020-428a-b8b9-516a89749137"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "ae9e4dae6918a0243132b1082e3b080a",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "1ca050d6-52b2-4c1a-b80a-1c182f8ccd94"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "53c48b73f63eb3e977bb720ac986b17d250d45af",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "fdfe3ef8-cc53-4ad6-a29b-dbcae1e667c1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "314352c3771ede484f1af7aabe81b86ad458b0e58f3785539ea8452fc60adb44",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f8ecbe54-993f-4b25-b4ef-889572997ba4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "1ec3ef91c7563cbfc61039bec6d056ed6f13f130143ac31569bc75a7d73c4c3a936c9e2455ed90104382f76927c983ae0121c8df3c2c90cb70154fc665528398",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "625582f5-ac0f-43bf-b04f-7c2391866c83"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:mqWxRuRWExqMLwlApLQ4lLaCMLn32cxlLPAl+KdEkXT6:EXwWEgMF84MFTnflkXT6",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c47c7ab0-ceb8-43d2-9ace-964fc82ff178"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--3555c174-555f-4e29-9da8-5a6bb5018d8b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:54:07.000Z",
|
||
|
|
"modified": "2019-02-20T09:54:07.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".symtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "820dc061-4291-4496-a5c0-46d02c71082a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "SYMTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "611091dc-8c9c-4dc4-8664-e56e3ff2885a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "11456",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2817039a-7033-4a2d-930e-5a95e6ba4a4e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.88084309271",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8cf6a754-530d-40f0-827c-eb5ac4c6e9a8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "cc97933cd3211ae741c843fdd32cd18a",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "30a45d0a-293c-4084-a940-eb2895de677e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "79da2efdcaaefe3a4f7b18c2e1dc706f6978423e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5071e415-e68b-4d5c-933a-0bee35e671c1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "28a70f6b3d62f766c5fee21714597f4a7d960f502a15640111ca9f057fe2b149",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "10016ce5-4927-4966-8456-f576d1752271"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "9fc5e3131542bee71998c28e17eb088f6102474541b04a6f6ee6ee76993482979162536b03a9b59afcad1e596ff24635729d63c51f7c56caff25d13b4249efca",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "757e03e8-99a1-42e4-b932-a059385be0a7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "192:Rc0E40I8REkoLSIOCEFm9HEcEeClJkG4b0ubWaNXJUi:6d40ZR/oLyCEFm9kcEPlJkG4gubWaXJB",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d4be8dbe-19ba-47bc-afff-b426665b7ce1"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--760f1ed0-af91-44f1-a78b-2860b083a1ad",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:54:07.000Z",
|
||
|
|
"modified": "2019-02-20T09:54:07.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".strtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "27068a38-655e-44bb-aa8a-281be7a43620"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "STRTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "501b8f78-826b-4334-b425-6cb24d198875"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8662",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d69994af-b8b4-4cb4-80d5-ac593af4bdfa"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.5944060969025",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "96047220-8187-4776-a1a1-2878fc27eaea"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "9b31ad6057c761cc49e96cb1cfbb25f6",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "4f85a602-9f19-471b-9dd4-2cb2ec382d6f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "10f1592b6fb396a5a5e4a248dd2aa56d0db9115e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "67a68406-b0a2-4cf8-9441-bf624583a871"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "f252b92fdfc85c8b22672144f21743a8e3c6908f72a37373a6d2cbaaf3ad5b07",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6b5cb2b4-27cd-4c4c-9937-96e2ae44ddc3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "275071f023fd09a1f7c41ed41d1d0fa691aa7c59945ef17dfee57dff684a6a0d3437151525cdf570ce23d2ac9fa8d8503efce0d98f5a1301d9a49b1ec88d01d0",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6e7aee21-0a81-4627-afb9-35380505c115"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "192:+Xc7IsfXMSX0QLDIhH7vxwmX8cx5s4vsMVfAQNCexCtSclC4me/HhDZqLCeIfJ:+Xc7IsMSLDIhbvOmX8cx5HvtVYQUectL",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "72633fa8-c04d-44ea-aecf-1670213e94d3"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:54:10.000Z",
|
||
|
|
"modified": "2019-02-20T09:54:10.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "EXECUTABLE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a150d100-412e-4a81-847c-89fba55590b5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "entrypoint-address",
|
||
|
|
"value": "268435952",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1582c2fb-2eb5-4f8e-84cc-0317e6585aed"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "arch",
|
||
|
|
"value": "PPC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6012520d-d31a-495d-ae5e-1702e11c8b05"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "os_abi",
|
||
|
|
"value": "SYSTEMV",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6bd20793-61b5-428b-8d07-f4e9f330cfc4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "counter",
|
||
|
|
"object_relation": "number-sections",
|
||
|
|
"value": "17",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "df593aa0-c0a7-4e7a-ab42-d038b58b35ec"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5dc63b80-216f-4ae2-9c4e-c0d92e1608f2",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:54:10.000Z",
|
||
|
|
"modified": "2019-02-20T09:54:10.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'a60266b9cc093e773c60293efc5263c9' AND file:hashes.SHA1 = '9de9e897c3190ad441bcff2955e7f281f560352d' AND file:hashes.SHA256 = '9db4a8c633657ea325473b1cad48381819752b5212c393a35aaec5fb901c5d6f' AND file:hashes.SHA512 = '3eb5beb725e6e5ca366f6a163d730644dbcfedfeb9d85f63741f6ef33455e1be6b2c9b58ac7a01e0481f49ae96a9f17f573d26c545802f9326aa940eff775c3d' AND file:hashes.SSDEEP = '1536:VzcNVvE1Lbr/dSAZxZmOx8sbHMmO2xb91jOuaHRmn3FVYQP1s/a9S:NOmBj8GZmOx8sNb91haHRm3FVYQts/a8' AND file:name = 'DEMON.ppc' AND file:size = '90310' AND file:x_misp_entropy = '5.9767377179887' AND file:x_misp_mimetype = 'ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV)']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-20T09:54:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--7bb5de32-42dc-492f-9f15-dcc7b301e494",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:55:05.000Z",
|
||
|
|
"modified": "2019-02-20T09:55:05.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "NULL",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "fbd3b5ac-60d8-4b09-9990-87b2daed41e3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3b028ea2-9690-42d3-8dda-635dbcabaa42"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--68eded72-59ce-4d08-bef1-668df62db58a",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:55:05.000Z",
|
||
|
|
"modified": "2019-02-20T09:55:05.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".init",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c49e310e-0cc7-40e2-be50-19dc3ca0759c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "732856c6-6fd1-46a8-983f-49ec9489d551"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9b4d0f73-ff49-429b-b43a-ae9c51d0ff74"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "181ff3a6-3e77-4730-95f9-aaeba1230678"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "48",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e269ad4d-340b-4d48-8d4a-99e01e4fc749"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.3656015629507",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d2f0e1fb-4833-4cf9-ae3a-c0d92a863c26"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "781a401b2deeb96b8895f724f09c8caa",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "a7a9b1b4-6500-4944-97f3-cbf43fc0e247"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "ca844b28ad7a6e81cfd45ae9d76e5e8a10121ab9",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "8a4604a6-0fbb-48e2-a206-343daffd3fe9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "9d6a74edac3f403b2ec5cd6e7e8e2f0bf0a5c72a146c78a0111bcff3a41a18e4",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "9634781a-bfdb-4dff-aa86-6e0e98050a2d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "ae9a73bc2f835c831647033758d9c4345c772ec5317d9db5eb7a016ebd8bf32f77725b0a506ca6702dc129f7b587ca3c503662385202aa95e527c18d13a008ac",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "2e6611b9-2d3d-49e1-8ce2-ca5ad86951af"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:kcr0nlk/zn+rl7Mln:kI0nlkj+x7Ml",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "a8ec15dd-59a8-4e0a-ac0c-f00ad52cce26"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--09c61fed-920a-412b-a271-ce02a84a1545",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:55:05.000Z",
|
||
|
|
"modified": "2019-02-20T09:55:05.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".text",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "fcb97818-68e9-49c8-9f81-7d656f4cd703"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a1582a46-a279-411e-bb95-1b5e3746ce95"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e8648993-13a8-42a6-8ce1-d70b0a7ffee9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "91100d22-852b-4649-9abf-9a4d4055f702"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "49184",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c1482ef3-e3ce-40f7-ad9a-0ec1f963f020"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "6.9092838224984",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d4471cd8-97bd-4c0f-bb41-bf59f9980eaa"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "1d033654260071f53ff4a0b1632a5774",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "2cc1ce44-033d-485b-8093-6522fe7bba16"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "72206f7190dff946f596505a0e3c2230da655f79",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "9a15bede-932d-43e1-925a-3852ed31f994"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "5aa4a563544b4a08a59e0bb08c172bc6b712a8d3df51ff6666f3ace2db59a8a2",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "aa117e37-ad4f-43b6-8089-f23f0bb791c3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "d3d7e67f5d08fe6276b8c877058be308b7a30fbb1a98fc4b64cd6209057ca4147e28478066f753e294e7a7082c86ea245a3e7481e14855c0b2fb2ed29177cebf",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "77d74826-cfbc-4d43-9786-157dc2458b7b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "768:b2zoqE6VaXXg+RL4ElYnhDKHgm9gHaOoaBXSPVLsVBf7MOtxh2mhbUCw:Tq/aHJ7OBKHgm9LRa4PVSvh2xCw",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "2a853b61-8c9a-47b3-aa14-9999415c7593"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--6f2f215b-e90a-407c-a890-9b4e7b6ddc25",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:55:06.000Z",
|
||
|
|
"modified": "2019-02-20T09:55:06.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".fini",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6f4fdcee-e081-4a01-be13-ea45fffd71a6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "fdf8a2f1-6650-4209-9b12-e3b9831b169e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d40bd6a2-a0bb-4c8a-b318-cdf9903ec60a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0369e3ae-5287-414d-ab12-889e7b4dba8e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "36",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f3fcba1f-2982-4a65-ab0c-3817cfa90cc3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.5588138903312",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "aa500e09-c439-49da-863f-b1a8de085e88"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "b5e73849c1480f79295374adff5639b2",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "937c8d88-ecd7-40d8-bb8e-a83e2550bce9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "b1071f74cccbfa9f16200d54f5affb9ba0a2c5fc",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "38e55e60-52e7-4fe4-8a00-1ae968045983"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "d48918d3e8a6923717e3fc01c99fc71d92c4f73b7045155bdd1ed5569c681a9d",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "1e63c9f9-1c5f-4080-b960-9195caaa8602"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "20b9505475503f05c0673e05f90351cf8b149beefc9f6fad1426b771fbaa9173d27736922535c4b461bd66be500533ea8fb20ee15a5aac4fd72b84483122929d",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5140a9e9-9523-4ca7-b9e3-632672d40d2b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:kcr0nlkrXK9Mln:kI0nlkTK9Ml",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "da217aae-57a5-43ac-8cfd-5d232088d9e0"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--ee43fd41-f5e9-445a-b64e-591bae9edac3",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:55:06.000Z",
|
||
|
|
"modified": "2019-02-20T09:55:06.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".rodata",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f722160a-b731-40e6-a251-0ee99094d3ce"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "cbb6f2c0-c794-4ce0-9a49-830edaf5d263"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e1228a07-37e1-493c-beeb-3217f05a305d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "7752",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7b2514b0-1b12-4170-a6c1-963d5606e313"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "5.2574679852852",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e4246228-1a0b-4ca3-b67a-1a337970426f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "cd2ed1165b1de1c5f856c9a59a765250",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b71f00b0-9351-466b-8f31-eac1145c6b0c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "3541f46428482a3a45d3089e8f59da89d70c8ac5",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6188804e-7d49-426c-9f1a-ec183869a344"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "152045c5a9a1d9b6df328d6a458a62b7aaef1602c28dd8dbd7aa3c332425f3f5",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c71ed914-39d6-4619-8c3d-63e0e5961e77"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "f734289f2a0eec28ae7376cb4bd0bedec13c0010d75dd882d3dc3fdd0e758fbac6cd17c3a00b1e3bd2e9c902e75216e4d5793c485fac2d77b10917916e6bfcdb",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "346ef457-f6df-49f2-b163-848b757ecb5f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "96:r+kzI+xBMHHVR8aQusnT7lRGNm6SgiW0dlOVXikjx8xkB3FpuEtyWMl:FOHH8aEnlRum67bqlOVyQSWB3Ef",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7c69c3e5-ee18-4222-8dac-fd2476cbe0da"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--1a82c8d5-cc26-4b68-87a0-34c96ed9245d",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2021-02-18T08:42:37.000Z",
|
||
|
|
"modified": "2021-02-18T08:42:37.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".eh_frame",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b1a739fb-8f22-40e5-9d89-ef32205742c5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "cff6002e-3c4a-4207-adbe-67a0c70042ce"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "af5791b8-747a-4b03-a4fe-9277cde8dc8c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "4",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ca8a6f18-8f5e-4dac-bf33-687311d4cfc8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "0.0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "356e3831-c311-4036-95cb-50363911360d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "f1d3ff8443297732862df21dc4e57262",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "bcb00aac-6951-462f-8445-fa9fc65fe9dd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "260c1ef3-5ace-4100-bd01-6c3a85f485c1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "3ddb38fa-c30f-4690-82d3-48dd89f88646"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "e3be2487-626d-477d-ab7b-f09b531695b4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3::",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "a4145af0-58aa-488a-b2e8-b29f0b50a805"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--289f1b4c-540f-4f29-8969-e9ebcd0e670b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:55:07.000Z",
|
||
|
|
"modified": "2019-02-20T09:55:07.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".ctors",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "133a5a73-7657-439d-8533-622342e1606d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2d7d1eb3-c743-41ba-882d-7c1049e00a85"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "71f06ffc-1a4e-4311-a033-9e88ef859abd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f080baf0-a6fb-44c6-beac-17d30db89351"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ae4b55c8-9cd0-4f3f-bc09-2352b06d34ab"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "1",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ef63ef58-d53b-4124-b286-305d62a98ffe"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6af6f850-776a-4dba-ad48-6de0a6c6d5f2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "edda075f-c183-42ec-80a3-c012d4937558"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "3d8c3969-19a0-4b74-a948-353e146e982d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f604bbf4-a335-4fac-b04b-d8f25a6d3ccc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:RRtl:LX",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "3f411d58-71f1-4a5a-b391-4cc2a52f4afa"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--e30070e6-2fe3-4492-9dbc-8a6ba6399a0e",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:55:08.000Z",
|
||
|
|
"modified": "2019-02-20T09:55:08.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".dtors",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8adc47a1-1a77-418e-9433-449ca08ec971"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6f90f006-3d46-4b59-b6f6-540ec4c18316"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2daabb41-fa0f-4910-bf0b-7336bf6a6128"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e346d441-40fd-4373-919f-a2e769c7fe97"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "974d6efc-3b44-4eff-bc21-03c827e28bed"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "1",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e29530f0-19d5-42f5-9f20-dde703ca70f4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "4dee7705-e281-4941-8fda-ffb95aaf767a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c5e1f384-0faf-4889-bef6-a631be14b75b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6fb20699-7b6b-4a1d-b1e7-4f50bbf31fe6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "0aad3c30-7bcd-4d92-af8f-f21d5b11dece"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:RRtl:LX",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "778d5a1f-bf3c-4ff4-825d-8356db352818"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--8aba5cf0-1929-436e-b447-dc91c761dea4",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2021-02-18T08:42:22.000Z",
|
||
|
|
"modified": "2021-02-18T08:42:22.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".jcr",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c324eb26-fbcb-4bc6-aa44-9e63feccc778"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d18eb355-de9a-4b04-876b-589e5795eb05"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a4788044-4970-4b0b-af4d-e80cf8f1d581"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "96546037-ee6d-48bc-afd3-ea48aab816c3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "4",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "465024f3-a0f3-4100-a4fc-cff8be41bbf4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "0.0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2537d4b0-d3ff-4f36-8689-29fdcff977b8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "f1d3ff8443297732862df21dc4e57262",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "9269cdd9-7ea9-44bd-9f02-0aed1a1b1469"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "2df008a6-7a50-4da5-8e2b-7eb1a0a9b1ea"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "e2d18b9f-d83c-4a1d-a4a5-36898a291c12"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "a4bb6859-615a-4f4d-aa91-ad426accec9c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3::",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "5eb46e60-90d2-4703-bd72-3048f1697fb5"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--14cb1917-5119-4963-a18f-dac5e7d2e59f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:55:09.000Z",
|
||
|
|
"modified": "2019-02-20T09:55:09.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".data",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8f7a0040-f8c5-40e7-828b-d3585d18849a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b4c81eb6-d5cc-4212-8d9f-9c18ec405178"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "64d171b1-a5e0-4f77-9959-1004472fa5e4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5b8ab3eb-ccd7-4146-806d-0d187662dd5b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "892",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "cdaef1f5-08a5-4d15-be4a-1f8f475670ac"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "2.6846998401111",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5879c5c0-8e27-4ed0-a57f-6a6354ec657b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "1f42bf1a1eae4d4cd658394273d856bd",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "a49a8da2-751e-4ca1-b450-ee09206f8413"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "f66b9f058b711179f724b25abb392ca724263ac4",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "bbe966a7-8db7-4d91-8d72-5b0e9f1569c3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "e530eb79ad22a9cb617efeb676de60ffbd2355a7abe1b4a212e46e931f799cf7",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "028497c8-adee-4b41-b8b5-f586cebdce6f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "417b65e33da3b947f6597a4b8dca67856bf13fc4805d5d139b5f7edcd1850d1b3f4f3cc156bc8fdb2cddd8f8ca2477227de63e8a5803e7bf13752905865db82d",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c7aa6d03-04db-4812-9d7d-de2d461bfac4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "12:AxMEUSXC8wGyJ6E6Bg5dybSvOH/YJAk/kn:6MB5dLwH",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "feca3cb5-443c-49aa-ab96-ca15895e74e5"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--daaf43a3-100c-4fe3-8e89-4adfd9057efe",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:55:09.000Z",
|
||
|
|
"modified": "2019-02-20T09:55:09.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".got",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a451d2f3-4691-47b4-a19b-a82bb0c23426"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9a9669f8-4ab2-4847-b5c1-51e68fadb612"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2a548edb-9c3f-401b-a8a0-64230060df8f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2e1f8bdb-1409-4548-98f1-b2d124cf14da"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "16",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "eaa33483-f348-4957-aac0-ebe3d38693a3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "0.99339272901036",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "38a4d235-31fb-42f2-9cc8-8838fc44c9ee"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "3b6400472dc206037788539e9acb4d45",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f0d4d27b-9dbc-4e9e-9390-8b7047c06a39"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "ed3984a457b5a2c57cc1a929a6b6b63110e04173",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "eb8701aa-3be2-47c5-8b7d-cf1ccb38d3ab"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "296b4428be76f5b2aa62dd6d09bf6b207e2f6692bccd765842514029348b9d01",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "13cf0499-fdef-4e5b-a4ef-23c63ac5919f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "6603115e234fb94190367963b93097b2712ab2a4a6cc41ab7cad9ff3793d96b165139d07baf713e7dd7be8877392a2d45920972c73e261835e22d7c67f35a30a",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c8c99c68-b72a-4342-85aa-36cfef95fa06"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:H:H",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "070d7857-6509-4e2c-90e9-333439d99864"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--e92fec30-1048-41d7-adad-639103eaa63c",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:55:09.000Z",
|
||
|
|
"modified": "2019-02-20T09:55:09.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".bss",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "413737c9-a6a2-418e-89d0-c0e76e667fbb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "NOBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "948bc352-d93b-4d41-aa47-c003cbc75475"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5333d49c-2474-40b3-8531-840a96e429bc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "fb77d865-3f94-4913-b9cf-a668131b7c72"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "25428",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "35edd3bc-7cf4-4e19-abd8-8c169fc3bb9f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.8752630053652",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "97027bd9-f4ed-4ec8-b33e-e6c1b69dcbf7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "e8ed22b372d91ebcd32e2e3921163b28",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6a5ca404-694a-4e7b-bc4a-ed6fef81fed0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "fdee3f84993fbf88ae7dfc431f525b6b881af4bc",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "9d1a7e82-d22d-461e-bc0b-8cacf5f484e5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "aa8b7229c17bee6cb52fb5c8c9ab5af80cb59e73b10277f1e6736a418b7d5abe",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "25a49040-62e3-40b8-9fb1-ecb599fce4dc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "dbd574d733f4a2c3681b30ecb0618cef5a3304aadaf318a3ea50add78d20489cc0453d06c3400775af6301fd76bd414dc9bbd471c211915efff22bcd4d88c7a0",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "fbad6565-3ab6-4b64-b09d-e13f17acef08"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "384:AK//V+aR7SvmO3CjZ7IeQM5DI75mmX8fx5HvtVYTfct3fZe/Hloy:AqVpSvmLHmX6xJFVYTf4fE/H6y",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "bd4521cd-329e-41b9-9887-008954c5173f"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--020ca0aa-39e9-4f7b-982d-0ca840149593",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:55:10.000Z",
|
||
|
|
"modified": "2019-02-20T09:55:10.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".comment",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "53bfb2e2-4ae4-4af4-9adb-7afbfd7fed01"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d87b218a-afe9-4f06-83fd-14ed5444074a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "2916",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a00577ae-912a-4873-bc32-fd8bac11c8ac"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.6197042079518",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "00a5a0bc-ebdc-4ed5-a8e6-15f55a0ef879"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "fe5bf2f7d18d9eb5abeef8f8ee14c891",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "0505ce5c-fbc7-4753-a231-4e89e007ab96"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "c9dcf3394e02ee96f00f3f138b57e1a74d57dd70",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "0d9cabbb-8d77-4263-8d93-78ef2116b8c6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "42ff8a77054fde20fe4cb61c28478f70c0244984850d95492668840356d0efa7",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "4bab5f12-083d-4901-892c-45f82de3f2d4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "b38e6660f6263c6d23f184d55a8306ef4e967b3d376fb17603481c347c9f8e27caf2e98c85c50ccca385e623c2906ffa4e4a9638842a53ac7142c931278ed290",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5f862e8f-e1e6-49ba-92ad-1c50d2f72b6e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "48:BUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUi:M",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7e3f31c2-2549-4ee6-847c-5c262b540872"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--23e9bde3-6221-41de-943e-87d5c9c1d128",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:55:10.000Z",
|
||
|
|
"modified": "2019-02-20T09:55:10.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".shstrtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "07f2dcbe-a13e-456e-9fb6-b69f776674a8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "STRTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f5af51b4-76a2-49b7-9c2b-870e96e8e358"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "107",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5893878e-1c1d-4d23-8da2-08b1110e3936"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.886961236137",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "39a591d7-f777-4804-a7e7-1851adbf76f3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "be26005c18aabe4e53f62df4db48b00b",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "48da199b-0895-46c1-896b-e410057f2dd2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "99df1329249536e4ec2b83ccf1fb21436a270e51",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "46d8e7b8-6dac-4c88-9181-156248a3da52"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "108bf61e358c1760deddb88c93545496bcae9301147b293449975db078bd53a1",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "a3c34295-03ee-4196-a1aa-59a5f740c7cf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "8ef6df32dcba65c1bdb5fb6762c99a74cecd6c6c3a5518195e06918df209672bd444159ad53f746b1bc44f986c4e388ed328af20e75e3c37938eb91d286b2a14",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d52d778a-5a2d-4dbb-b39b-0d050c93fe4a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:mqWxRuRWExqMLwlApLQ4lLaCMLn32cxlLPAl+KNzXT6:EXwWEgMF84MFTnf4zXT6",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "69a26a9c-573a-4290-9f36-0efff56d2486"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--614810d2-58b6-4b26-a507-2ed5e82abab6",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:55:10.000Z",
|
||
|
|
"modified": "2019-02-20T09:55:10.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".symtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "03c40427-e501-46da-9229-a0445a702444"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "SYMTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "64acac31-745b-4524-9c15-7b8f19bbb285"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "11472",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e79bc1e6-d216-405f-8230-3af274e15858"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.9042769327508",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "05fd1b7f-76d3-478d-b203-7239fb4dfa14"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "64d8e22c3bcc75b77327ca1c47a72a64",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f8b75341-5a33-4d38-84e9-23dc5dea5f44"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "a5d2e2524b71a5abfc2603e5583f52523914933d",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7384fa9b-4305-45e4-bb0a-72c09d86fd91"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "93a2bb8082f94d6dccfef242166b4c04773f1d9b74e8f5c6f3fb8b7905783344",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "a46d6f32-9f2e-44d1-b177-4cfb634782b2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "7eb3e33f952e37986e5f042136c94bfc8a07bea0b4c58ff114c881bf4bf3d45fce5e1b9e0c34e0a3612cbf353a1b83ca87d43889f0cd966f963d080f4c95892c",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "14eca97e-4abc-4b25-8753-a720445bdbe9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "96:rNCwlNHTdDlwQGqF1u1e8p6lxRy4whbWWnqhoo7ihpjmEm8UNZizA0gPDqG5:EwlpJS1e8gV+qhR7S0c1zFgPG+",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "0a6b6b86-0df3-4d46-96df-40246d32f258"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--0b73ecde-d78d-45cd-8c84-be00190cd1c1",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:55:11.000Z",
|
||
|
|
"modified": "2019-02-20T09:55:11.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".strtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b3879411-4117-48ca-834e-550632582a00"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "STRTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "adc19d3d-62ba-4f3e-a27c-80f5fe859d37"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8657",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7e2cd560-bc54-424b-a122-566f75e0f757"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.6059623866442",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6f437dc1-d828-417f-b50c-33bc7d2bd6a9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "6b28078938fb4e8c16c8800a75132225",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "661cf444-463f-4a2c-a2e2-58f4e4f20f5a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "b001485eedc408968a0f1a1bae6324e300c8d9a1",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f471e038-72e2-4851-9cff-5da55d689f82"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "22ed0701da14c3d8c41b87699171eeb20da6e47bb016cd5a23e36135201e6ece",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "772de10b-8e5b-43bd-bb9f-48d85f546cd4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "edd3ddb76fddcee3b6c588abca6902991f9042ea2a9fa70ed580150d579fef928dcd065ceaae5aeb7b75612d2fd7c3e9385f9ba008b39dcfa31ab2b2c93e9cfd",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b7447180-5300-4ebb-ab97-8d95f5c2d53b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "192:MCjZ7IeQfXMtikDI7COxwmX8fx5s4vsMVfATNVxCtSglf44e/HhDZquCaIfJ:MCjZ7IeQM5DI75mmX8fx5HvtVYTfct3V",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "4a42cf76-edb5-4bdd-9aa2-9def37efec03"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:55:13.000Z",
|
||
|
|
"modified": "2019-02-20T09:55:13.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "EXECUTABLE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1f2bf26b-a5a4-4b9e-b1b0-95d258eb242a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "entrypoint-address",
|
||
|
|
"value": "4194720",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0f7f4618-b272-4f58-a3da-57eaafbd3f89"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "arch",
|
||
|
|
"value": "SH",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e60b43d9-cc30-4aae-a9e6-2460127ec8e4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "os_abi",
|
||
|
|
"value": "SYSTEMV",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "bfbad028-65c8-4741-88a7-82ebb712bc17"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "counter",
|
||
|
|
"object_relation": "number-sections",
|
||
|
|
"value": "16",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8a1bf0a8-09c1-46ed-81fc-35754f9c5446"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--bbe86c8c-5387-4624-b3db-0d287317db87",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:55:13.000Z",
|
||
|
|
"modified": "2019-02-20T09:55:13.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'afc3c9b08ea495b3c2701dd3d62de906' AND file:hashes.SHA1 = '1ca6eb84d4b96c02eb74cc2e3ddee51caa0a45d9' AND file:hashes.SHA256 = 'bb567c020b859c5f371433324fbffbbea0d2fafc7674d39bca493685372d30bb' AND file:hashes.SHA512 = 'ad2e390cccbcb0f9407f19bd390e5ff6e61266713a117066bb31f62554d2c92599996c0f2bf778d55416d1b3ef9efef1a6ca85e99cc4eaba9789687a691dbfdf' AND file:hashes.SSDEEP = '1536:Fq/aHJ7OBKHgm9LRa4PVSvh2xCsPqVpV7mq3FVYTfuE/ayS:o/qJnHra4PTxTkvm6FVYTmE/ayS' AND file:name = 'DEMON.sh4' AND file:size = '82065' AND file:x_misp_entropy = '6.5598416757144' AND file:x_misp_mimetype = 'ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV)']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-20T09:55:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--9551bb88-fa96-4aa6-b707-cfb4cd8623fd",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:55:28.000Z",
|
||
|
|
"modified": "2019-02-20T09:55:28.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "NULL",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "43209772-35d1-443a-a956-bc929efbf1b2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "dfcb6195-d7b3-4336-b99c-e7ab73c13935"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--2fcb8fce-1cef-4ef9-9efd-7a0b98c6a106",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:55:28.000Z",
|
||
|
|
"modified": "2019-02-20T09:55:28.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".init",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a5dd0b59-c7dd-466a-a41e-9f5b4457c2d1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "871ae425-eba7-4ece-a197-92a1e1b1e0bf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "88eec833-1cba-4077-be87-b585224add6d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "53989f73-d521-4afa-9c23-360f7387f897"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "19",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2ce4b688-ddd2-46a8-9664-b08fd16e48ca"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.2158411726838",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9145c96a-d786-4161-ad34-f03dfac8f91a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "87200fb4223b81c55490c9cc36314c65",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "98b1b36f-c316-4b2d-848b-d2ea79eba91c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "84e128e36ef1900da77feff84848132dd232ea6c",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f56540a8-131b-47f9-82aa-87d37444daf2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "7cd558581d563131a3bd3d9cd00395090295481f94c159e7b7e1fbd6c5e12719",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "08a8539b-27f4-4ac8-a1a4-8c7a221e9f45"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "6d39530c7eff6c1c337af40cc7b32744fbf1f3bcc3ab9c96a2126a387c57842c6e3f1918b12605141cd33a22ab6b791be5e4ba8baab839714d19f6ead025327b",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ab8bdbf6-2e54-4c54-90ea-ffec3982c86a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:4o/CYm:fqL",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "78d2d9cb-d7a9-4e60-a102-93c7df2a8916"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--1aa3230b-657e-4e2d-9e07-84564e79d11f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:55:29.000Z",
|
||
|
|
"modified": "2019-02-20T09:55:29.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".text",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1b35328e-ce77-4950-a7e4-6da45b4279f8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8fbfe0ac-54eb-4d1d-a60b-4ab061bd63a1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "46478e66-37f8-4a58-9d06-cf8ffb8a1ca8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8904600a-06a8-4019-b7f4-dfdca1a02b86"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "49160",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f8acc62a-c1b5-4cd7-8c22-20c3879a7606"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "6.2779611812814",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "38a901f9-e36f-463d-bdff-944c1510a3f0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "1010ccfdf40c3802438864352ff7f412",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "83afb1db-a6ca-463e-aeed-010e755220fa"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "83dcab928a97717f96651fabcdc130529e843dab",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "3d64b00e-2155-454f-943f-539df19ba1ed"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "3d47cbc3155f56a053bb30ae68863656d656be54852299490e6400334a9d6c11",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "e2233613-d319-4164-a64f-af3f8db85296"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "4f6c62453e5ffdbef028efa1bea5bc287846b9d9beaa9da7439c14ddce11758094a2c4961ec8ff7226b331bdf240ddecf9dd9dcffcf94e870bea5f092b64d14d",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "754bed83-c238-4e87-9c23-fabbe61d2525"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "1536:zqdcFQuHZ91/0iiMsaURZoNbDLfacTmJ3J:zQcFQG1/0iiwURZEbnacT4J",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d262fc06-0b44-4e87-813e-a2387f8f4be0"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--d9cb1d67-bc67-4288-843e-fc58b2bcef1c",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:55:29.000Z",
|
||
|
|
"modified": "2019-02-20T09:55:29.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".fini",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7063bdaf-a46d-4a58-8066-ddb2bd5ef499"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "be4b8f33-ad09-4fe0-90e8-1e9df9b1433e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a43d240d-02e1-4318-a8a5-7945668387db"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "cc808986-5216-49f1-9437-2c87c4098001"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "14",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "db640d2d-47be-4e70-b3d2-efd042aeaffa"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.235926350629",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3e5d6a44-816b-43e3-bd08-77bd95da1e72"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "2f7e66fa9961933c506f9c37f03a1ad9",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ba976c78-3dbc-47de-856d-922fc71ece9e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "246a56cff84b97ed1fb00d25f0047528ea53b8ca",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "0ec8d85d-c8a2-41ce-948e-661f6556276b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "2a3d013513a85f2ee97a564567a365e0bf716a0736780a7fefcd51cf313af785",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "e9b45e03-a95c-4cc2-bea9-955fe445b9c0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "35bc30c6a87e3227189e98313ad4c6918b9a8345a86512d4817219591a48e14b6320375d94e6397a0678e48d2535953c458315a2bcc5b97d6e7dc255e9510e6c",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b5458974-c83f-41c7-9d02-329d32f377f3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:4YRatd:v8j",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7b644af8-ce83-4a5a-be63-ae1b44b6a41c"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--1a3da186-1bbc-4a48-97b1-6440eca59723",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:55:29.000Z",
|
||
|
|
"modified": "2019-02-20T09:55:29.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".rodata",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "71cfd0ce-712a-423e-9cf4-8e434d9f78cc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e39ad123-eb85-4cb3-be70-9828e2c11377"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "aee32467-66ea-4d1d-ae2e-86597eecce38"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "10304",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4f74aac4-3514-4c59-a243-8682d1bbc01e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.8364258622742",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ea7e69ec-8bb4-4970-b687-ac98c2f871ec"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "375e0e06002a56ad532ddba8976011af",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5c8a32e2-03e6-4991-a21e-abc30ac05797"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "23b7c61df88025caa97d84abad2d2d1219c68061",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "96294027-3771-40da-b60e-0504d0b22fb7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "73a5591a69d64b32883abce071d53a50447bfc7f6ba96c9675c796cd8f5a4990",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "da0fd398-4e1c-4451-b758-d42d77457055"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "927d7e2bc55ecda9c8d72ded1225a45dc3dd348f016d1cbb844cc7fe0487c46433d82911fdbf6156d64a4e193b55acb649378ded439b075671deb2e7f68aed25",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "8012360b-70c6-45e4-9f1b-040dfd11d474"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "192:NElHOaEnlRum67bqlOVyQSWB3ey96qjpdd9dvf4ejMh:K0ePuhqnMh",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "99d88773-7f51-48f0-8ef7-33bc07087019"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--c216228a-4acb-47a3-8d5e-3f4a1beea28f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2021-02-18T08:42:09.000Z",
|
||
|
|
"modified": "2021-02-18T08:42:09.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".eh_frame",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a2deccac-98fb-4d4f-b0a0-1fdc53aa56a6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "854684fd-3821-4365-a7e4-12480e177459"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "dcc2b0db-be0d-4e05-a0c6-231556f4061c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "4",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "018361a3-25d2-4a97-abdc-9838684fc31b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "0.0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0f48231b-c3cb-4429-a263-89e24fd579e0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "f1d3ff8443297732862df21dc4e57262",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "6bb83bd1-4750-47c5-8259-4bca23c3fd39"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "dc40a038-93d1-4e62-b939-5fc21144d24e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "058b7b70-3bfa-412d-abd6-385320558199"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "ab642d87-d462-4596-bc63-bc290724da82"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3::",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "a2bc3d62-232a-45a8-888b-c711a40afede"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--733971a9-763b-4866-ae77-1700627e83cc",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:55:30.000Z",
|
||
|
|
"modified": "2019-02-20T09:55:30.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".ctors",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "acc2b674-42f2-417f-9356-b544be3d6244"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6e922750-66aa-4e6b-9159-7278f323c728"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3852b5b6-d56b-47cd-a5e9-ac723c98708f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "68cdebea-fed7-4b11-8232-f377d7e9482f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "16",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "839e706d-4ccb-4827-95db-8a79a704e65b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "1",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "de51c211-f917-445c-acee-a1cdbcb47b24"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "f858d36231ba743ad8c898d86a67a864",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "73ab86a9-c3d6-4e70-954c-13dcc8fea3f9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "f7fd9f0c0324c1723e1eaedd80f457bdf62aa9dc",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c1baecc6-5651-46f6-bfda-1cd6c97c40cb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "60c69a3e87bf5c4f1e546bec45f262690bcf5494c4ecac2616bf2f731afa152a",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "cc5bf08e-a6d0-4d24-820d-3534915f75ed"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "2e68bf09036a490ce0e8d579ab0247a5cccf12f6ba44c3727ad22420e13e26c588a9fbf7b4dceeeced9d7148d9c29ef33ba6ca174596a65b1d297d0d7169bd6c",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "e49ece9a-fd00-4839-a29e-7a20ee350c12"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:RRR//:LRX",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d2ef3aa6-e57d-4d54-b359-61f425fced05"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--f9aae507-1a91-4b11-aafd-2a42fbbc55b3",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:55:30.000Z",
|
||
|
|
"modified": "2019-02-20T09:55:30.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".dtors",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "05771ce9-7477-4aa3-a13c-870b987cd0f8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e5a12335-3753-4e6c-988d-d0f100713541"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4a28337b-dc60-459c-8f61-f86eb59ebbb2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7bd7e77d-6cfc-4e70-a065-19c76e0ebed8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "16",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d2ada2ff-4a0f-470d-a06e-d54cb0008d00"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "1",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0c24ace2-2376-4e40-90e0-88f78942667b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "f858d36231ba743ad8c898d86a67a864",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7caf4296-310e-4652-8302-34ea33a3cfd5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "f7fd9f0c0324c1723e1eaedd80f457bdf62aa9dc",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "9ce91a4a-d134-4b88-8812-93c9141c9b94"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "60c69a3e87bf5c4f1e546bec45f262690bcf5494c4ecac2616bf2f731afa152a",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6b74ceeb-ee73-4393-98d6-461ccc071787"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "2e68bf09036a490ce0e8d579ab0247a5cccf12f6ba44c3727ad22420e13e26c588a9fbf7b4dceeeced9d7148d9c29ef33ba6ca174596a65b1d297d0d7169bd6c",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "baa70a0b-91b2-49b1-af2f-e547fab2a23b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:RRR//:LRX",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "3b578bee-c28b-49ef-9393-6c37dd9f18ad"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--a494e224-56b1-43cd-8678-60dff775e87c",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2021-02-18T08:41:55.000Z",
|
||
|
|
"modified": "2021-02-18T08:41:55.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".jcr",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "22eaa771-a2a4-4fed-bc1a-ecfa65034912"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6f2e0c55-4cf6-4973-b4c0-bd982520ad2f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "51720b37-1f3d-4ce6-ba1b-1656e344f7bf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6340786f-576c-4b26-9777-eb6af33c4e4c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f6b27588-27c5-4968-b66a-ebaceeb8a522"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "0.0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9aed8f08-d7b1-4531-a7cd-704a723f348a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "7dea362b3fac8e00956a4952a3d4f474",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "d967b090-1885-4517-ae9c-82f162d122cf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "05fe405753166f125559e7c9ac558654f107c7e9",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "219ee904-6e40-4b11-bc87-723a7e75f41f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "0afaa2e4-d6b6-47d4-84de-91742b2fac66"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "5bfaf501-4cb7-43e5-a730-e7d2ae36ee98"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3::",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "bdc979de-d348-43eb-8310-fec64b85745f"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--4efcbd17-7421-4e61-a49d-ad3da379ac93",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:55:31.000Z",
|
||
|
|
"modified": "2019-02-20T09:55:31.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".data",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "03270424-42d3-41bb-8d2f-4cf7bfaa3738"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "875ca0ee-54ee-4061-9a38-d0d9d2af0498"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2197e177-376c-4fea-ab92-d1c81ec813c8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2019f7f3-e941-47d3-8a77-615cb6bf37dc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "1176",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2afd5c28-b8cc-4c8d-b053-93480098b504"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "2.0387950584364",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "24359137-8ae1-4238-9ec1-8d4a473f61be"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "9150c6ec104815f638a724d27670d5da",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "1c842187-3384-49be-997d-2eb9c0aad250"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "784886a8d099d6f9ac040cdc281600198a232c09",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "243dd9a3-99d3-4d70-9a2b-139352e0b0e6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "89ba94b9a12cb88ce514c84b65bf6dc0daf0bec255264acdbf326770c65b37bf",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "18360691-5595-41b2-bbe2-4b8c7cb565b8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "b1538d443d02d608cb7adab3302dc00f1fcdd1f94262b4eb91b4d4431e6f5da69696111fe2580211aab83923ca4b5a90bd64f1f9f8b8292dd1b10cc4ec7f43c8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "1716d97b-3db1-48a9-9e22-acad8401aba3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "12:SXEQZkfk0TfSEkkugaybSvOH/YpxlEkwmt:S0QZkZzaLL",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "cfd60db9-4824-4017-8e16-afa4376f539a"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--9ab8c8f5-6fa8-4f4a-a71b-3835066ce15c",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:55:32.000Z",
|
||
|
|
"modified": "2019-02-20T09:55:32.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".bss",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "20faa440-bb51-4fbe-90ce-bec1892c5bfd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "NOBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "38de6c6c-e8ea-43b7-af53-b3b7a1f19ff4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5771b9de-5cbb-496e-a5a1-90f2dc0eb6fd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a1b1951c-4bd9-4e6b-85b5-5bc2981429c1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "27504",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c285183d-ff79-4831-9be5-a47eb0b4b770"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.2147603464837",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e42ef729-6d40-428e-9c5e-a55b7f001d0a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "5559a0ce323926dc510afb3339da6229",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b406a7b2-e430-4070-b9df-dba640854755"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "b02987eec671911d97cef05e8addcc19558145a7",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b34fd44d-9aca-44de-8899-9f2b4ac64839"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "f1622ed7cd5cec84ebac5d89d7d27dadd784193ab5494673de8dffd01216586f",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "84075bf3-27ea-4a6e-b745-24f891f95382"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "dfaa2d9cfdda5d6bd625607b610294b38083a51c85f8a68357603a62c72058f3eef0e957dd7c93381f798390d65d3b2d6ab4102a365383eb2994d4a2819a8568",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f73ba742-63a8-48c1-8741-816173bf0754"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "384:ddpMllAkT+Wq9mrBqYaPwHq2Tdc7IkUDI/2HmX8p15HV+ucEUect3f5:xMo727K2nmX01JUucEP4f5",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6899ea4e-231a-4db2-be5a-7078c8614ad9"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--4f972a14-ad50-49dc-a95b-26939a450cb2",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:55:32.000Z",
|
||
|
|
"modified": "2019-02-20T09:55:32.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".comment",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "59fe12fc-112b-4aac-aca5-8828180ae588"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1e2678dc-daa3-4651-a9a8-8d822cf09343"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "2808",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "49c6c061-2f78-4218-9285-69eeb5f1c54e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.6143694458868",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1f5af388-d63c-4d21-919e-03716066acac"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "8b9823b5371fe7899822e5e5395d9197",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "da2b1788-7406-4eac-97dd-b39c66106f43"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "b6deb8982d33fc22cd79b7be3536b891791979c9",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7e11d206-68de-4197-987a-2beb892ea24c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "d18b722c6ea9212db8e347a7991b36f1460e3c69cba8aabddadfb3f1829e1dcf",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "cf4aa99a-4915-4cf9-81b5-5814885db586"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "2171a443ba400a03a4543b2a46f7483cba3a7ba28dab68191dcdd6e9d9ac3c9d9f96440a9a746a8a69ca6b842c231209ff74a760b60d269bced14c3954f2492a",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "22c94778-af73-4099-8707-5313ca080e6e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "48:BUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU1:P",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d5a0fa7b-3087-48f1-8f92-637ad8c01467"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--dc0ed1b0-554c-41b1-98bb-de6a6bd8363c",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:55:32.000Z",
|
||
|
|
"modified": "2019-02-20T09:55:32.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".shstrtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8b55919c-5b8f-4dc7-add1-f6ab1e2ada6d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "STRTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6f8f2574-45ad-4f5f-854b-b24ea35e70c1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "102",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f5572cb6-e3f3-4c7f-aef2-0f3e0ea7a560"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.8692077817787",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4d797f65-495c-435c-8832-870c8d89780e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "b748e0aa34cc3bb4dcf0f803be00e8ae",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5f7d4bc6-b197-44cc-b145-f9e3243ce0d2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "f8afe25d02e36248d719e04aafb2f3edb98bf012",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "181ddd47-b1b8-4e43-9d56-bb962284465e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "c42f97c90874af8fea59609c9455cce16e13d894c3279c7d9b799772b2cebdfb",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "07521035-3454-4959-b9d1-571d1daa0de5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "7328069d7164d73b6c2872e2b88eb1f18023c6970d9b2f2e1f6c288e027de32b1990862e14f216957de41c4f427f7fbcec9dd5f98ca7162c3a3973a2ef6b623c",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "3c4f6633-e05d-4ee7-9972-24963605b05c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:mqWxRuRWExqMLwlApLQ4lLaCMLn32cxlLPAl+K2iLT6:EXwWEgMF84MFTnfniLT6",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "89625f83-3033-4e39-8a9b-f999ce300a68"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--7d20a574-f708-4c7b-83a2-4b1e863e5034",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:55:33.000Z",
|
||
|
|
"modified": "2019-02-20T09:55:33.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".symtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d4c1dc27-2102-4b77-bc1a-71f918b0979b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "SYMTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ad36041f-e3a0-4573-8b20-abdb3bdf45b8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "17328",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ec003f16-b73b-4353-a5d5-cbb8009c0be6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "2.8699228419081",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0f54a2db-df56-4298-86f7-15a8548f25b9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "9867543465622991096c27d1c5fcb92c",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "fe4fee40-70f1-4751-9c9f-0b967610406f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "43aa13a5855811f9fa6a617de495595f7de85dd9",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "aa5741de-cd4a-45bf-9bf4-2c52d0def8e7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "1d5215f34e3189b498d2ed94e5ed2f0c4407910e76686cbbe5a992bf943aceca",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "3be0c50e-11f0-45a5-af2b-dd71617e9714"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "6f1a769ed7d4eab5b8a98e772a4810294348aedeb0a69518f93eea5188dded188a4d2d07e9afbdb0265dc7afc9565a263a6af50bda21bc24880b2ff458c8f482",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5b94925c-508f-44b6-8354-72b6e9b62f4f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "192:34dzV1Yz2HyNMOAkTzbgZYf/pEOUAk3mTvHgxeVqYnB0PwHq2:odpMllAkT+Wq9mrBqYaPwHq2",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "33db3576-b55d-43ff-b47d-e3cd9b57861d"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--29ee112d-4c89-43d2-8ba2-eaceb48e47ea",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:55:33.000Z",
|
||
|
|
"modified": "2019-02-20T09:55:33.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".strtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d19631ba-33e0-4140-9f96-513b7d73d47d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "STRTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0a180530-7343-4fb6-b8ec-73c41177274c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8813",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f387ffb9-605b-4b6e-812b-29f059a2822c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.622286223545",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ce917ef9-4a14-4d9d-ac83-8a0abac82fbf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "f1624940a002473c30ed4abb631ba982",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "176ced50-1e7c-4dfb-9e40-c811355ebe47"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "7231e9abd6864460086fc108090f8e5ad76b3714",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "8ecc60ab-ed89-4f72-81a9-77ecbc477d5b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "113874644738cff75aff3545db73618d85ab59472708351491d40fcf5bfbbcf7",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7ab89d80-b425-4f47-88e5-9eb0947e8263"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "896e0893db2288f63f99b9cdf62488f5b247fece6e6a8c0f68514db55899aa85c7629ae2561bd71cad99ed48dbf99a98e34e9ba72361564a90feff36b5a6a4db",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "23bf7642-d831-4fa2-b2ea-1806672fc1fb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "192:9dc7IFfOpVbADIWK90x5mX8p15s4S2BMufEENCexCtSglfQWeBLhDOqDMaIfJ:9dc7IkUDI/2HmX8p15HV+ucEUect3fpF",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "9f09d368-cb5a-4452-949c-9c1ab366b7f7"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:55:36.000Z",
|
||
|
|
"modified": "2019-02-20T09:55:36.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "EXECUTABLE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ada8a58a-c908-4ffa-8d32-9c3a262a9ad9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "entrypoint-address",
|
||
|
|
"value": "4194708",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2d0f41b9-1e64-44a8-beb4-059d8655576f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "arch",
|
||
|
|
"value": "x86_64",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "434bba83-a363-428c-a8dd-74420f6e5dda"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "os_abi",
|
||
|
|
"value": "SYSTEMV",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9daf2bfa-0dac-4fd4-879b-ccf3eb12b15d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "counter",
|
||
|
|
"object_relation": "number-sections",
|
||
|
|
"value": "15",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5bed9154-8045-4e40-8216-3eea3e83a258"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--2778da7e-f6a6-4dfa-8675-3b0214ba6312",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T21:26:09.000Z",
|
||
|
|
"modified": "2019-02-22T21:26:09.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '5cc7a387d8a068459271572741ffeefd' AND file:hashes.SHA1 = '929ddd0f6d45852e0037132b013eef2dc940df5e' AND file:hashes.SHA256 = '25eb40f52fbf71f729b4b7422e181e22ef19e38a461ce450446d47fa765cb153' AND file:hashes.SHA512 = '4a5f4b7990a6fa3ff5dbcc74eb021165ddaf58f90782adb9674d68db22d60ba0d2af2babae03e7184bc597dc57330946b99e48ac0edc83b7a9c1712b2f7f4841' AND file:hashes.SSDEEP = '1536:tqdcFQuHZ91/0iiMsaURZoNbDLfacTmJ3d0pV7/mE7UucEPu0BXPS:tQcFQG1/0iiwURZEbnacT4d0D/mKUucz' AND file:name = 'DEMON.x86' AND file:size = '90997' AND file:x_misp_entropy = '5.883945324921' AND file:x_misp_mimetype = 'ELF 64-bit LSB executable, x86-64, version 1 (SYSV)']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-22T21:26:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--3c4ed87d-5198-4427-8fb2-cc8522bd9471",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:56:28.000Z",
|
||
|
|
"modified": "2019-02-20T09:56:28.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '97eb8bc13daffaaf0c444d4cb4d79f51' AND file:hashes.SHA1 = '76b8913a2bba18b12906dffb3ac9eb8f9086fab5' AND file:hashes.SHA256 = 'd01d29951368399f26ecc648a58dd2b673135d7c9e4f6d0a02892aaf0061cc1c' AND file:hashes.SHA512 = '35adbba5ad9435a0e653d2b005bb8418be099a7e17dbe6c1438d1eaf3fe4fca05150794824611363c625ef412b7191334eec603965c297faa767b6b2d4c5c023' AND file:hashes.SSDEEP = '24:cE56l2nNfKJM3kg0Q0e8NIBRzk00z0sW6W0GP9Nml+3nU+y8m:J4g0wgSTRzU1x0F6+3G' AND file:name = 'ftp1.sh' AND file:size = '2334' AND file:x_misp_entropy = '4.878257245644' AND file:x_misp_mimetype = 'ASCII text']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-20T09:56:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--11a24eda-644d-4f56-b930-c983aac96f18",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:56:43.000Z",
|
||
|
|
"modified": "2019-02-20T09:56:43.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "NULL",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8ea85ea2-767f-4ebb-87fb-8dcaf0709147"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e36e7845-3cd2-48fd-bbba-faaee523ea56"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--bff723ef-9525-4a8d-bbcb-753601d37d1f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:56:43.000Z",
|
||
|
|
"modified": "2019-02-20T09:56:43.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".init",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6f796e98-01b5-4b24-aa75-63dc5ea007bd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "bdb6cbc6-9173-4102-9b97-91a088b06fee"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "fc7aae56-e157-4de3-8797-99cdca8e7785"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d39286e5-9650-4b31-ac27-a1c8d5013daf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "24",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "57381266-3014-43eb-98a5-8e2ec3ace61f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.136842188131",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "aa0720c5-e838-4533-850a-dfadbf9dfdb4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "b376fba4583df1cf6ac81c22437b8314",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "bf1a8a81-e835-40ef-9096-8cf244db02a0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "bd17fbeddeb6968e5175f1e9bb9091395d83dc4e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "01e0334f-e3ff-4838-a33e-6c81a1131cf0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "e53cf4123e45901504237a74da371c8004c7d3eda8c8fd84463000800f13ec6a",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "06c913fe-4fd6-467a-9103-d795ccbc41f3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "5cc7a39e19afd74d9f20c486bbe69790118aca37a3cbd376eb94a17c3209e1cc32faa68c69febe1b1b2d7daa12bf7813dc907ae5eca12be3d106925610f42a64",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "fc309c8d-b698-4493-abf5-b40de15ec410"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:4FcMhZU1K+Mn:4+gq1Kz",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "357fe9ef-dd6b-437c-851b-60ba759c319b"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--a49c56e4-b1e1-4a90-afc5-94f7685081b4",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:56:44.000Z",
|
||
|
|
"modified": "2019-02-20T09:56:44.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".text",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8761b170-b7a4-4bc0-a59c-4e02e1da0f06"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7c08fe3b-7dfa-4c1e-b4b5-2865914a76c7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "56998982-c1b1-45ce-a440-7d71b799c469"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2bb95de8-007b-400e-bdb8-5692384da375"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "57256",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "45024899-bd0f-4e34-8aca-33ea3f9aa62f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "5.8394386834036",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4b23609d-7559-4571-872c-1f21ce38ed84"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "5852a3062d2fd2f8e0a917b7658696a2",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "54533351-42c4-4a86-ad67-2313e6904c5d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "e4895043b923aa21dbbcd56f9c90da6179dfa79c",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "201e00bf-e0b0-46bc-818c-487afdd16f66"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "d3e811dfddb657b21a76d0929f9b7d69d2257c7e14742a13705d7e2221f4b066",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c74db223-17ea-4d69-9d41-20659967b051"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "f1b92f77d29dfc574d8fa249313d5812f38495860f696b9fadb9f9f7248360b99805634fef067bce06a8728734356ced8abe32579b34195b9d0eb347b3a4e68c",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "acec6f40-3bd3-47d7-a30f-7192c88f77b4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "768:pMksAduF9bB2PiJ+kemC7b3d5Me6pZwhMaFPM2Sq1KPVKXjrUuVCzZOSVzabSv/:uCoF1+LTPgek051yq1ggrUVzZOaxv/",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "857ddf14-6d3d-4821-8fbd-e7d5cd4406dd"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--b0776b62-9478-444b-9c3c-c2a23fb56166",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:56:44.000Z",
|
||
|
|
"modified": "2019-02-20T09:56:44.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".fini",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f3fd6582-9081-497d-9860-7cb4e0db451a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0c1272d5-67f7-460b-8432-b8d4850ca49c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "88ae57c5-dcec-4d07-8b4d-b5b857687dff"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "40d8eb99-6102-4bf0-8e65-a588df55cbb9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "20",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "60b7d75b-ea4e-44e5-bcfb-6dc9276b4eb4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.1219280948874",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ed2f1c03-75bd-4e3d-8a17-f894c3eecd30"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "4dcdd74dfb5b3a9b6432e2d3bccf9bf9",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d45ce5fe-610e-4e03-8fe5-9f0c39384d0d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "26087fe3c86e143e04aed6f10c777cb1f92d92c4",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "229e26ca-09e0-48ec-a6af-d5e992801133"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "1ed59b58f97e7b87ade6ce7151167d0723c5217efed1b310948f3d908eb3a7f2",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "0443eccc-9f91-46f6-b9b2-ecaa00121b99"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "b2ef06c1096f966e581bfbb9da5939d57d98de923f2c4d1ac7cc85240965fcf16f3c83ac12a6d124ed9d44286ec1cbb073cff82d16ca0f94bcabbdb1cc30a429",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "9065fcfe-24f6-4e5a-a761-508fbc9bc209"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:4FcMh4aRn:4+g4aRn",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "3e687797-ea15-440b-89cf-07c4536af645"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--ecbfe0e5-1dc5-4622-8b31-9936022825a8",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:56:45.000Z",
|
||
|
|
"modified": "2019-02-20T09:56:45.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".rodata",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ae5c0b5a-481b-4aff-a9ea-63b68fe6a82d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7b293323-60bc-4ba3-b509-e5b091a81b8f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0bd6d18d-0569-48c7-b7e4-45984dacb327"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "7784",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "caf5893f-b86e-4e84-a622-20038e9aa16b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "5.2632892424263",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "47fbf41e-2ece-4c76-8814-4d8b0e7e4693"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "a942180a7a94c475da9059f5fe46ace8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "bfb4c4f4-43a5-4376-af0a-257599c81929"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "ea72db677be8e79cf9b06e0cee1cbc15dd3208ba",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "728a1d54-a717-419a-9526-63e64dc89fa0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "858e5c9fba9870f69c8dbb7e38ef8f22df09e863b99b2554bb9393ba91949799",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "9377583b-0870-4838-8d8a-b8fc97659d2b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "bd886d1c24bae1c5c99923edea1781ce93649042d53ad4c7e7b186dd97a21b9132de18ff8ad33bb793a79d519ff273ee1f062774d83c0348b76bfb338be74cf3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "771e4fbe-88f8-41d7-ad12-cce39191a5e3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "96:r+fJUXGxBMHHVR8aQusnT7lRGNm6SgiW0dlOVXikjx8xkB3FpuEx7yWMl:uJ6HH8aEnlRum67bqlOVyQSWB3tuf",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "3430ca91-afff-4cd4-b334-5effc71b76f6"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--88733aec-0db4-4ead-919d-7dcfe9a62add",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2021-02-18T08:41:28.000Z",
|
||
|
|
"modified": "2021-02-18T08:41:28.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".eh_frame",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7fb74601-8d7c-44f3-a8a0-27707b7d22d7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9194b9e1-c45c-456c-aad6-397d1446593d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "cd7dcf99-beaf-440a-badc-042be21fbb2d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "4",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "152491d5-315e-411d-ae42-eda9361b1530"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "0.0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9ae9b27d-bf1f-4d75-83dc-aae237cf06b6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "f1d3ff8443297732862df21dc4e57262",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "e7cd5aac-0332-4b78-aa64-7e314288da96"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "1d83479a-a2a0-463c-af9b-34ae11d6d530"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "6e5d6e29-8f7c-4849-b549-bbc02f71f1fa"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "de49758f-4c6d-4f70-a225-d44768f0ee7d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3::",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "3a0b0ba0-38b0-4946-b683-0e8c16fa5630"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--d0db047a-afca-43c5-bd64-7dffd0f35bb1",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:56:45.000Z",
|
||
|
|
"modified": "2019-02-20T09:56:45.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".ctors",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "36f74038-0940-49d4-85be-bab3fa2e7521"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "64ba8a9c-ec17-49fb-8d40-75bdac3c426f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "568fb56b-6eee-4534-97d0-0423b2e176b6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "79414da3-32db-447a-8576-baad4e36b568"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "280f9bbe-5db4-4567-b6be-b80a384ecc84"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "1",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "02f8f7f1-a3b4-4521-a0cd-ff6465e23389"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d3564450-2d30-40f4-8022-ad5c804413c8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c708a0c2-8d7b-4aba-99ff-57329e4adf90"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "0ba7432f-85a0-437a-80f6-83264a68ed99"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "3032dda1-94df-4d4d-9e8e-14a8e7873072"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:RRtl:LX",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "287de044-c7de-4096-84a6-7000248b17fa"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--69f51d30-c609-4518-9971-33891e74a22b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:56:46.000Z",
|
||
|
|
"modified": "2019-02-20T09:56:46.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".dtors",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "076d1112-21c5-449e-b891-434881c0365b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7c18a458-6cfe-4505-b35e-c70c0cfa72a0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "121c9b8c-175e-46a3-bdb1-1b79dc7b0437"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1dd47322-770b-47e0-ba7f-9ca2662b10ca"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "bb3bd1d2-acd4-4988-a02f-a0db07f79d76"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "1",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "fcb17af6-c33c-401c-891e-4f5357362287"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "e21e757e-1ef0-457e-a11d-fc570dfa130c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "41ebdf6d-ffc7-48a9-97e7-248dd285e55f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "432afe99-24cc-4101-a67d-d864e6e4412c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "11993d48-c7a0-4d6a-8491-461f6a85992c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:RRtl:LX",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "3c9fb4b7-6aa4-438b-9d13-944c1790292f"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--928e4d64-d370-4ab3-ad61-288a74833311",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2021-02-18T08:41:15.000Z",
|
||
|
|
"modified": "2021-02-18T08:41:15.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".jcr",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3bda6dee-0625-4012-9e47-ce6611c7901e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "38f7d993-9ad3-4464-bc38-37c531259900"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "85fe7f66-b2b9-4b39-ba68-d1bf8e97066a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3de30297-0154-4511-8927-a2d167dfda9d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "4",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d1d217f1-541a-4b56-8a66-3bcf3ca32209"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "0.0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d56fa97b-733a-48bc-8e86-fdaaf927185a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "f1d3ff8443297732862df21dc4e57262",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "6642fad2-ff77-4f88-960e-82eca4294c4c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "a7976cc8-6615-44fe-9968-18f9c227964c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "b7087e26-80bf-4476-9cf0-c8d9fa2b6398"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "c2c4d86c-0aff-42aa-9b84-b5a4e9eca42c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3::",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "4a4651a0-e416-4b02-8136-40debf7a4d5e"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--0ff49c85-00fb-4092-99b7-c6e1b843f89f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:56:47.000Z",
|
||
|
|
"modified": "2019-02-20T09:56:47.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".data",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "acc0642d-62a7-44b2-8a9e-b2297c978adb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "60ac6046-d8f6-4641-9afa-f0e13616e1e8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "15f5176f-1b94-4ca6-9642-37a87660c4e6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5a9e98e8-b272-4031-9012-5effd0fc791d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "900",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4c624c9f-c535-47ff-b66e-d996e2250ef5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "2.5768685268986",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b50f1cd7-16c0-4fe8-b759-28f01ef43c48"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "a1b9a655df52fb2d4e8c0aff1b83c4aa",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "35f11302-6db7-4703-ac4d-e2daff708d17"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "5cdecafb0503e97a5dcba5ede0fa65efd5137b6c",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7816ae87-7a66-475b-b58e-193718a6f4d7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "e1bc0c8e6c9558f31d54b20218274cc98fc71545960c2fdb3040ebbf63697d97",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "470acada-9c3d-4838-a261-0a39628e204f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "f5fde0e4784f98607422e93c08a48482d81a2d2f2e91f6ba0eacc1b1a89ab1d03caf7a591dc0deaa10559857daf6685b9fc9bdb76362b7e8b9ea44e9e2017b2b",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "13b18479-221e-40da-8114-4aaad89a19ce"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "12:vnEUv/fnjjLiyCk6EFrEWybSvOH/YJwtk/:vB3jjLeWrEWL7",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "94b03c68-95e4-4689-899e-ef5a65bbcb70"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--7343fd4a-fcd7-4dd8-959b-7e502301d511",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:56:47.000Z",
|
||
|
|
"modified": "2019-02-20T09:56:47.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".bss",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "cd3c5301-5e09-4616-a9e4-375cef7e1dd6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "NOBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "cc74e4c6-88b8-4477-a08d-404f66fb45f9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b390ce8b-f5f0-4273-9768-bedf12dbe6c6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d9f130b8-1aa9-4c9f-a045-3ad06a5218ff"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "25428",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d87a00f0-7a1e-4de7-b2d0-4913671ed9b2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.3553697898795",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "79f60eb2-82b6-4251-a4de-139f398ab42f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "16e91875abc831cd719470372f9f602a",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "bc7506d2-1de2-430c-b197-88b2cb9092b3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "a57a0c322c8b8718adf00ad55367bf7244d470f8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6fc5db10-bbfc-4639-bd90-cb99f57dbbd9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "e20af18f77141d1038a6cef48b4ce7df5984fe7be8a3f2c9b43e6d5f83832ad9",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "8c9082ef-622e-4bae-8add-fe066c2facf3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "8c5a628c473b4812b20d39669440d228198cd50faa1cdcbbf6a670c7a4f175b786bd91567c0d6fcf520e53cf35bb958ed43717830f904a3b86081d3ea23b4bff",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f620329c-6fb5-4f28-8880-6c30180a6114"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "384:Z3Sws3WxJ+rvo+M+d+ETo2h9Ce4/T5IUAo0h6zvNoRojOZWuAUoAKTB4sJ2NrioH:Z3irBtkKlPAr5F0h6TYfKTBor7",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "8cc09bcd-a7d8-4349-aeb7-1be2a7a369c1"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--055a24f0-2875-45f3-a7ed-4a44945d23d2",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:56:48.000Z",
|
||
|
|
"modified": "2019-02-20T09:56:48.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".comment",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "aade4675-cd50-42e5-88c1-20772a8f0ea4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "62f13332-f62f-4e54-8bff-c48139fcedca"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "2920",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a8356bb7-c1f7-4085-9fd4-65b344d3973a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.7316466793579",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "bdaee407-978f-4ad0-9262-b1a1a4fcaa6d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "02eaba63128184570a4bdfcd8c29d929",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f24f1469-8403-492c-bd07-3a92c62c738a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "9f8b551a43fcd110a2e5eeaf4c613ccb928351b8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "dfd870c0-7b57-4de2-b076-ba96326373cd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "cb592889f9a91adb49129a3bbcb3492c6e81b51da830e5da936e0e00998b47e7",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5ac70a88-ad4d-44bc-87d8-3906bad68307"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "98dff98a2e5e0c016ac00b0d0054d555ae5801b995bbbaa0f22ebb5fa7d6b9577ace852ef7b9b1097a411000d2dd272a233d517c6822167745fb091befc4d40c",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "bbcd6265-c19e-41c7-8b91-1cee93475f49"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "48:BVCEoUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU7:fRNRw",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b6207c62-c673-44fd-af4f-02efc7bf350f"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--4788fcc5-b819-409f-a970-8e3fef7d57f1",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:56:48.000Z",
|
||
|
|
"modified": "2019-02-20T09:56:48.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".debug_aranges",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "876d05b3-7e97-46ed-9674-e9b801921d64"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b87d4a87-8f88-45b9-add1-b8da900bd96e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "288",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ea630f63-43ff-4977-a271-f5dbfe97b134"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "2.0203931890935",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "99603f4f-32f0-41de-9aaf-e9fb372b1e09"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "175057ec23e2dfc23a01800a8eb66a03",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7ab31c49-31c3-42ba-ac7f-b3a0366ffaea"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "d48624577124805a8136c14f90f21a52993c97d3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "57f13cf1-f063-47f0-be70-af823999a945"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "7dc2b7cdfa6373f02ccf0f5d68dfe69d0f62865f53de2ef5c7c542a3b1c19942",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "18d09856-04a9-4ee0-94bb-5986af068a12"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "392e9ff148fc7b5294a03569cb4724710983c02545cf9e6ccfbb276a3cd8dc379c44bf5d2cf8b24a31c544d3a732545e7735d512a37b8ffaa4a3c9b01dbc8964",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c2993534-12ae-4f81-8063-25bb6cb6b26e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:Ll/5lNlxl7Ltld1ltzlmpXlhw/ptzlipltlNJ7tlllhlNlrlRVxlI5lRRLtll7lb:Wpkx2pXMTvqt0meL/",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "8d9efc6f-d005-40c6-b85a-16a82a353d44"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--e13cf509-faaa-4fa2-8905-57403bcd10b0",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:56:48.000Z",
|
||
|
|
"modified": "2019-02-20T09:56:48.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".debug_info",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "05a48874-b3eb-4d4e-91a7-29f45e392289"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "efcde5aa-cd78-47f8-8697-d280ce3352d0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "1400",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7ba26ca0-f6be-432b-98ce-fad2db12906b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.9900825086808",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0ac33ac2-a6f2-4175-9b14-269a210e0ab8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "7e108f958296c7356902a9ae487a67e8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "849e27ed-1cfe-4255-9ccb-de89c7688669"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "a6e0f8dfa36d511773d5976482d07419adf5479f",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "36bda3bc-4047-4d50-8c4c-3837930b3944"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "ac5fae4e1b089faead8cf7cba0ffc8422f45521e59d9d45b6b93fcbe1e2254f8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "a18c39d2-7f27-4456-a35e-8172cfbce3e6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "ed07500f48ca0e185180d1a1d2743b576e46b4e119bd20e0bb942060b177838a4453fb99bb386b8fa134218c195eeb41718587972522680c19dd20ef55cb628a",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "15b4dfb7-99c8-4d39-b2f0-56a01e5a6190"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "24:9B0KQIBtMxsB0KQIBt4B0KQIBtlB0KQIBtMB0KQIBtNB0KQH1CTBt1aTB0KQH1Cq:9zLMGzL4zLlzLMzLNsATLSsATLesATLP",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "bb898a0e-0dc5-443b-8e21-3d53c01cf62a"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--fa037f31-83f9-48a6-a6b6-d705198c4000",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:56:49.000Z",
|
||
|
|
"modified": "2019-02-20T09:56:49.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".debug_abbrev",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9c6a000f-929e-4c36-a0e3-f5e64a6d3880"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f5ca1ce9-f7ad-4874-a2b3-d68dfa2338cb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "180",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3bc70b46-950b-4687-a6a8-6e8d7cc1276b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.346439344671",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e53bf730-0723-458a-b6be-6a8413edcbdb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "9c73dbc21d64061426888668129808b5",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "90dd3206-bdd6-40fc-8ffe-67c502603329"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "ca3a3f3d7cc917b499c7bc57495c2ee1ede15afa",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "665d0102-b224-406f-b5d3-9cb8d094ee57"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "f578d4fcbb990c569f82fbbc14d0f3e657a90eeb70736da6f19a6c5c6797e305",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ec1af63b-4fd9-4aaf-bd2b-f657688c27c4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "0d033ea0503ae5eacf60c84e7b7ded5740871f166a1e1d88cfce29de3b68f95b4d876edd473cd7dae4da3140a74144e15edc1e5fca532aaff4f781f586fa8c2d",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "770ac65c-d8d1-4687-97e0-8d8b4df4150b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:PU1utPU1utPU1utPU1utPU1utPU1utPU1utPU1utPU1utn:Pk6Pk6Pk6Pk6Pk6Pk6Pk6Pk6Pk6n",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "8977bc6d-089b-474b-b246-30efbb8a5d7b"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--c4856c35-6cb0-42bf-a9f3-d3ce5619e33c",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:56:49.000Z",
|
||
|
|
"modified": "2019-02-20T09:56:49.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".debug_line",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "38a37ccf-7028-4385-aab3-e50c09d5645e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "239e2da2-0b18-4e9a-a564-421b54d3d5a5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "2237",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4879014d-0a74-4cc5-91ae-5c23ad929640"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.6270747071739",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "cc4fd0a6-c5fe-491c-9995-4ccabae4bd48"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "2d1d5a1397c4afe8171434844af3d92d",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "a411d794-ae04-455a-bb72-f93377cc0a0c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "f1c0ceb62911615aa9b87c827731e8d54d0f728e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "75be8990-ad9d-4780-b580-96f3e532c99b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "b5c51c639542c8ea6beea8d708393e86de6dcaac09b530372c0872acee469767",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6f2fb594-2114-4269-8475-0b186b2e064d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "f004cdeb2f51ff0d5077dad3f563e0f04c35c3d57f79de1c11fe74e42cbada3d894108c3887189ad09f22bd2ee6b57b72fed3408dadfaef9df8e167b3e2b3318",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "58bf6dff-a61d-47f7-8060-3245aa3e3b76"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "48:FOI9U3JFyBRo567A+PlJvhF7A+i4m+7A+K37A+o:wRJFyBRO67A+rvz7A+37A+K37A+o",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "3485b58e-84bf-4b2a-aa50-64ae091f7a00"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--ef892eee-4947-4c5c-b2dc-02c4e857d362",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:56:50.000Z",
|
||
|
|
"modified": "2019-02-20T09:56:50.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".debug_frame",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e537decc-9046-47bd-aa09-9c5c009fb65d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "92c3f210-8961-482c-855a-7dfdf0af33c4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "160",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f81f7295-f105-4836-a715-5af4350ea7ed"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.3172090733526",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ef043340-e276-4640-abb2-605b3341676a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "55f5653b7f77adf1565329b1c8aadbd4",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "78f9bb02-c721-402a-b08d-c494c0c3e75a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "ac5a62ddeab1947ae93554d61613d098b4b759f0",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "681765cc-f806-449a-a280-309a5fd3abf8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "d093cc4f1fc52ee07aede570d3884e55082570707c4fa228beabeee3d154ed73",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "75945b73-d565-458f-8775-ef36cc0fd609"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "74b5e4d3b3d0a7a22c88fc37d4d5f77471c7690ed020990118a715907eb388d61241235722010134b9376e1e592fdb0b21ff142bdd529e117c9b1086590eed66",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "e61e0efc-6fda-4c63-bfa4-9ffba48bbbc6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:NRCxajlpRCxXHxzlthlpRCxNSlp1hlpRCxJt7:nJCFT9Qp",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "742c504d-37ca-436f-9350-aa823239e36a"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--07ea2ef7-9551-4312-9f4d-c35eb8644384",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:56:50.000Z",
|
||
|
|
"modified": "2019-02-20T09:56:50.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".shstrtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "de507fc0-6b95-466d-8401-aa52376abfc6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "STRTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5af5f200-e4da-4a67-a39c-ad1bc76221c1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "168",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "cdab58b7-d56b-43d0-968f-a7925b9c832c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.1672851010934",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "dea549be-030e-4326-a051-62f0673109eb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "3c77484bd9a7a5025d604b50bcf6d0e8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "84f42a01-af93-4da2-95f8-a1669895d579"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "219c22469be20c3183270f148c6866c569955439",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "dede0cbe-c97c-4e34-a970-1795a3f95720"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "07254bdbc45884f0dec220bd72d26adbf2ee1e7ce515b19ecea11e14505ef01c",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "10e08756-98d1-48ca-85b0-d9505f7fb6a4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "71117837c8e3be5e401448ea31a16c289428e920d9dee5cae7e1ddb0ed32790e6581c8a02aee7292b014ab327c95f5c6f5a95c62213104956e4d246553d1757e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "abab6286-afb8-481e-8f3d-cacd7eba2335"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:mqWxRuRWExqMLwlApLQ4lLaCMLn32cxlLPAl+K2iLTpeWnz/mI9l1AHQVhA:EXwWEgMF84MFTnfniLTpttHKwVhA",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "e094d38c-5c69-4a26-8835-42102111020b"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--3655f618-c369-48cd-ac03-09c998b3d4df",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:56:50.000Z",
|
||
|
|
"modified": "2019-02-20T09:56:50.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".symtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "eef1c226-a880-4cd5-afd6-5ff48f99de44"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "SYMTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0dee0951-7869-46c6-a433-ac5cd34beb0e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "17856",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "27e09af7-397c-4a2a-b6a8-ced66da2729c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.4286023008418",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "cf45333e-decf-441f-9f76-a225cfdd1c0f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "11356a4abdc60cc61670361c939d1e4d",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f1c73fab-ecaa-46e9-8528-161b317eebb1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "c6dd23ebb06d7b48dad82914ac9431afcec97138",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "935932f2-f45a-4ea4-908c-4ee869cb7e6a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "46cad2ced552c35a8eaea1232a4d07062a6db95e3ed29b7626155caf119b16a5",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ec4d7029-97be-4a97-a2ac-691be40e4bf7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "3e350a87f74d12c2da195f93c41334cfdaeab5d3b15b04f8939a97187b429c2b671bbadfce81b3a3a0691fceabb6f48f10f5e0e25419315d31dc4dc731ca865a",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "843a83f4-573c-4acf-827a-be240ad7e7de"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "384:22h9Ce4/T5IUAo0h6zvNoRojOZWuAUoAKTB4sJ2NriostJ:XPAr5F0h6TYfKTBorOJ",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "10be0efd-ad23-4bc7-a7b3-810ffc5d37c2"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--3028e64b-ce69-4bb7-9130-bf908c6d8a71",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:56:51.000Z",
|
||
|
|
"modified": "2019-02-20T09:56:51.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".strtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ed6538d8-3520-4f6e-a1b3-c109bf43921b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "STRTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ede6cc24-839a-4d48-8cfd-cedacb2869ac"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "9510",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b8188763-9ab2-4fae-90b4-90dcdc136920"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.6139060113974",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b1611a3b-c589-42a1-914d-87e46004838c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "7b6d2237526494b855fb5427b0d82a68",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ab5129a1-aae1-4f21-a415-4b5b7d82e6cd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "8e2c8145757decce58ea4d0df130f25e71430ed6",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "dcd95b1c-594e-434b-aaca-7ac5e769b3b1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "c89b6c2c6072ef8d4d0bb4e6966a2690c5f09f6ea85f158cf027faf9ed594ca1",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c92a249a-5d7d-4a6b-b780-f99df34d5c70"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "5fa22ebddb08400cfcfe10ee8ba3273a838902a58fce187316301bdd890ab85e869b52ed6645eeb70c7a1721b243a6e2bf24cbade850a26f09ce19647f7dcc40",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7482495d-181b-4626-a990-0160d8eb8c92"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "192:pRdc7IyvCfXMtivDIQXZxwmX8V+5s4v9AMrQFU0NXYx9XtLBln4PPHhDLqIUtJuS:pRdc7IyeMiDIQpmmX8V+5Hv3rQu0FY7d",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "94045651-f42c-47c7-ab94-4d084e97c3c8"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:56:53.000Z",
|
||
|
|
"modified": "2019-02-20T09:56:53.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "EXECUTABLE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f5c9cb33-3909-4e03-9066-f97223a5fdf9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "entrypoint-address",
|
||
|
|
"value": "33168",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4d1dad8f-2ce3-431b-9ec0-cfc565b93ab1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "arch",
|
||
|
|
"value": "ARM",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d8dede18-094b-4b77-ac0b-f094c808cb75"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "os_abi",
|
||
|
|
"value": "ARM",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3ea8a77d-fe3c-4f20-a1a1-adcb0693c853"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "counter",
|
||
|
|
"object_relation": "number-sections",
|
||
|
|
"value": "20",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "cdf5430c-6f40-4d43-8163-dba1eb00cc63"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--145938cf-4945-41a3-9bf2-5faacbf1f366",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:56:53.000Z",
|
||
|
|
"modified": "2019-02-20T09:56:53.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '1fb4305cbe1501aa2a8d1c500a0ab6d0' AND file:hashes.SHA1 = '6626d4541d58e81eb0aff4e5044a896d9c98130d' AND file:hashes.SHA256 = '1719b06c8160ae50e89a6939acab5906a7e1e0ef409d8976fcd88a040396860c' AND file:hashes.SHA512 = 'ec35e4435c11cca47760a7a4381f861f00b9ef6327bb5b66b0efe16d35b544d87d47d2a2694421284e46449ae66f5736c75e43263429d21b09964adf32fcd6be' AND file:hashes.SSDEEP = '3072:E+PgenIVtf93klPuF0h4cmlfrQu0yMPsqS:9gBVtf93kYcmlfrQu0yMPsqS' AND file:name = 'nut' AND file:size = '101978' AND file:x_misp_entropy = '5.8927938176398' AND file:x_misp_mimetype = 'ELF 32-bit LSB executable, ARM, version 1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-20T09:56:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--e35ab664-d370-4925-a464-f43cc09ca4ad",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:57:47.000Z",
|
||
|
|
"modified": "2019-02-20T09:57:47.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "NULL",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2a55d6c7-70aa-495a-a773-b5edca5c0e43"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "330304af-090f-4ed1-9792-c258f554f947"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--140ed95e-052e-402d-abe2-4216654b44e0",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:57:47.000Z",
|
||
|
|
"modified": "2019-02-20T09:57:47.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".init",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "2f0594c8-0d45-4627-862e-fb7ba52a341a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "62d84791-cca4-4c3f-b2bb-7796efbf2833"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ea9aa717-3754-48fa-8ff4-fb26ed8c2686"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "698896da-2ddc-4e9c-be60-b3987d340ca5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "28",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6eed29d7-5b43-411f-b320-5faaf0bdca77"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.2340067861644",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3d36d3a6-e827-4b63-8b88-0940e92299e2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "193cc5332b8e91293d228735f364d1ce",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "407093ae-e62f-4cad-b2f3-3d85669d19b4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "cf36e501c254068d780cfc7f8a567cbc38ed0aea",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f33d2c86-529c-4aff-933f-d3e54f9e2693"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "0df99d413c94ea0ff0cd40d02d38debd07ed372f124532267a9a6f5cff0ee5fc",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "a4cd2420-4541-47b6-800e-53f8c99e1c1c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "482cd453ecf0d1b1279515924fa9bc233e64aaa6a93ce00ff8900e859ecfe59df4829b97e0884193ee050f75d9eda68507d82a485702af813e648e89ac07857a",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "2eb2f4d5-fba7-42fb-ac68-47ff272c2aa1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:uH/YItkNll:2/9tMl",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "69227f1d-bded-45d2-8bf2-96d9d10aefe2"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--6cc47bbf-9bdd-4a5f-bf98-5cc516bbf0cb",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:57:47.000Z",
|
||
|
|
"modified": "2019-02-20T09:57:47.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".text",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6a742ec5-c075-47a7-8fa0-ccbeeefa7326"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f4d62f49-d10f-4461-ac9c-563c3a388f35"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "45c74ac8-5170-40d4-9ad5-1a6bd2b3674d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "07a80089-568e-4df6-8788-1e5ead94ff27"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "65220",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ad198b3a-fdcf-42ef-a50e-c02900c91f1c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "5.7721838744485",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b682b242-f67d-4e35-b239-c7fcb73a4963"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "8d611795e6daee6c5030fc23c34e0381",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5c8b17c7-5454-4d3c-addb-ba4534702730"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "f886a71eb41e74e3ec72ea5cdb96e6f1c42ef908",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7e02f434-dfd2-4256-a050-f8503c7b4e30"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "b2962da3a7b5d00371a7fa30f2fb2bc745e57418f5ebea815c0c134ebbb56ca4",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "fe94b41c-1acf-4aa5-9296-8178bbf2bd85"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "e27d06138420921e0047f20e001273a2437aec9231d27673c0375cc415d154e79846adf938cc42f2986ab1f872402b9e02d332b8a06c39dcc2bcaec9a0b5c570",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "1d886cb4-d5c0-452c-839e-11bbee11c6d2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "768:9EjFC1CYAsCx+Se+tq959+l66ePytaa1oN6O+N95VELJXtkSRNe1tB4rDYAJd:O4A3+Setwt99N95at8tBwJd",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ffab9652-e8e0-4807-93e4-a6a18ca3c6ed"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--69ed74d7-a7b4-4a25-8067-14b425cdfb18",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:57:47.000Z",
|
||
|
|
"modified": "2019-02-20T09:57:47.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".fini",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "144ef222-e28b-436d-b73b-f725a0d98ff2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6f846928-4478-4b01-82a2-4cf7e2a1d74d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9e41ec1a-e258-40c5-beb9-037a6a740dff"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "EXECINSTR",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ddf4d3bd-3ee4-400f-8b04-57b2dfd2cb05"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "20",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "efc40e43-1bdc-4020-bcfe-3536d3501a5f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.6414460711655",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3ecef2e4-d0ac-402a-b2bf-e988cc04b677"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "d7d1ff1d2c473eba73ee6176cd79bc58",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6d10bb42-1a81-4699-b670-892b4f49ad42"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "3ef633e4fd04cd312144aa1ef752f5048cc5e3f5",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "bf4b0cd0-1bea-45f5-aefa-4fb6de75ba50"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "eaff49b6b867e473cdef591176cf3c27153a3dff0b6df9e467f8a980d2e44314",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "fb28c888-d25a-4fad-8d85-16b2adacf94c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "126227154a2c8e10481c97ae861aba5e07574234f7673dbe6807eb45259ddb5fa0cd231163dd007d2724c10993bc498001d87809606b8e8ce3ec51c31ed5c56f",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c8adc2df-3e6f-4587-8a31-d8fc6e9a0c79"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:u4ksllkmtkNll:nlkmtMl",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "16efe355-4d4d-47f0-87b9-009c33d0eda2"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--7bd7974f-8307-46b8-b3c4-e4eb88ccd02d",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:57:48.000Z",
|
||
|
|
"modified": "2019-02-20T09:57:48.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".rodata",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6f4b7206-77cc-484a-8bff-8c66b414862c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "25c7ceb3-571e-4f66-98fa-ed541caebcb5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "187d9011-42a1-4f2e-92b0-5093a767dfe6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8152",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a5b4f241-006b-495e-8c3d-b6b1a86905fa"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "5.2443741656501",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "594fc2e9-47e7-4e39-8103-2b0554dda885"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "4256f7d8d727db036cb97a3ceae74f52",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f30de439-3517-4a6a-b3ed-3e9a08575f15"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "f82fea318bb42513d82480656d64a6d4e08710c9",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "51ec8123-42af-4f67-b274-90d112274b9c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "9ea77618a4b19976d5e96617269ac0ba3f4f3a6d5e65b0772b15a41082b95315",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "077619e5-f00f-41c6-8f20-506a34ae0aa7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "d2fedcb6567647b6eccba63b3ed62b5d4cd01bfdc2ad0bbea77c338dbef9d5092f51446b848540d88b4a8829831477c762acc9220aeadc2c484fc604cee671f9",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5c4ccbac-0c3d-4c09-a1f6-a8a8c810c1cf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "96:TPKYnWxgZHHxhKb1aQusnT7lRGNm6SgiW0dlOVXikjx8xkB3Fp+VVyNZn:TP3HLKhaEnlRum67bqlOVyQSWB3nP",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b6ed9198-4117-4e64-9ba3-dc7c9c26e2b1"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--baa88f1e-d75e-4a25-83ad-70258c54cc5b",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2021-02-18T08:41:00.000Z",
|
||
|
|
"modified": "2021-02-18T08:41:00.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".eh_frame",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d4f830ea-0755-44df-91ac-8b92fecdf597"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "16269205-8d28-4693-a434-b183c6af6b79"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b8875945-0f16-40bd-9cc3-b9552bae20b6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "4",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "23ef22e3-54f5-4ff4-b701-9d9ea2a98e4b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "0.0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ea75cb31-458b-4b45-bf10-d4263e9dc3e6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "f1d3ff8443297732862df21dc4e57262",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "92212c85-b358-4edd-b381-9285478b710a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "938189f7-23dd-4370-a8ad-b42681cf9eaa"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "dbed2308-3772-4657-ae8f-afeff5315b95"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "ca1be6fe-6b80-4519-8415-192a626a4ab5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3::",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "d187a2c5-9980-4fab-87e1-ea24299ffe91"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--77aa1ec5-ea18-40f8-823e-a7595a9fe702",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:57:49.000Z",
|
||
|
|
"modified": "2019-02-20T09:57:49.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".ctors",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "cbc66cf5-07a4-4caa-8eef-1a02ad8149a5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5a0d21ab-004a-4910-bb11-232344eab238"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b6abae48-224c-4137-b57f-7a763d5e7f66"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1a7fb25e-a852-48a5-84e2-6d167de2b80f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "20444453-8aee-4a5c-a938-32ae210392bc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "1",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8aa9a2db-d590-4dee-8863-15b58cd3b705"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b9a923a2-9468-45d1-8f09-d05e26480eb0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "942d2f52-ef8f-4fd2-a107-2f7419d90dd1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b656afa8-82b8-4971-9574-aaafabde5fab"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7fe24319-fcb1-4641-9ecf-723c2d8817ae"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:RRtl:LX",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "1c5e75dd-d6f1-48cb-b5c8-fe49e6487da9"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--310046fc-01e4-41d2-86a5-f515ca712b2a",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:57:49.000Z",
|
||
|
|
"modified": "2019-02-20T09:57:49.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".dtors",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c6207888-c36b-4253-86a3-abb3aa005ade"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4e76e3bb-d7d1-4b1b-ba38-f5828d992a15"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "816eb03e-93f4-4850-997a-f04deb664174"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8ff71dc0-bb1d-4441-9035-13d819ed3383"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ff761011-ef53-418d-89b5-709b90a72359"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "1",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "966ff7cf-96b9-495e-8c8e-9fb0a6e346c2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "14f9c4ad952bff03b2eb8fa9fb3aae76",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b6919418-d133-419e-a168-5efc8b43b7e8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "ce296b184763a332aca5193149245ab4653334e8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "4fcfdc33-3c8e-4c66-8592-1263f587c513"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "72a4fa3544e43a836ffcb268ce06ccdbc55d44d5e6b1b1c19216a53ea98301fd",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "3e5f99a5-9ad8-45bb-8183-4934e00fc64e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "7c403a4652234a853f476938085a4a0613f7540ea108da2da488812462f9479cd6af00d184ac313dcb9cbb0c7725342d0363aeff8e7ac856d9f45a2d1d05c4ec",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d088ee61-18ba-4cdc-8e41-c73602332648"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:RRtl:LX",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5e6dc2b5-afd7-4766-959f-0d8c6a7fa3f8"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--37c15adf-ea19-4531-8ab2-7adb7442b7e3",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2021-02-18T08:40:44.000Z",
|
||
|
|
"modified": "2021-02-18T08:40:44.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".jcr",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "bba06d3e-c21f-4382-8942-2eb4f61a1275"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c78e72cf-9af7-4493-ac57-db0d27aad7dd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "70b15ce5-20d1-4317-9adc-ec0c00de4c5a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0d79dd4b-6060-496f-beb4-90756f2a61e9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "4",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "fa0aad84-cb39-45ce-b5fa-87bedc3b58df"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "0.0",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "709cb8fc-501d-4def-9b11-fa47abe6746a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "f1d3ff8443297732862df21dc4e57262",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "dda24e0a-7fab-4a25-9713-fe8db41a106d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "9069ca78e7450a285173431b3e52c5c25299e473",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "9a825c14-09b2-4d78-aff2-32c5ea53da78"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "f10a09a2-73bb-4b14-be56-e758f5e78761"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "f8f7eaad-5d40-4927-af96-dc02e7632e93"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3::",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "b7acb906-ba2f-42a4-8eac-57d90fbae1ac"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--47a5cfb3-b3d8-4372-b682-a0192c36d11a",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:57:50.000Z",
|
||
|
|
"modified": "2019-02-20T09:57:50.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".data",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "91a57495-72ee-44cb-8fd4-5264772a16b7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ba2e4f00-c5de-498c-9628-c76c3f91cec1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "952bc5a1-3bf2-4a76-8ee3-0fc2f37c954e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "89b58e0c-9e38-4407-92b4-217e55f9c7f8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "900",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9000d642-50f3-4d8e-9011-2d4ca94b2686"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "2.6586127783524",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1758161b-5dd1-48b1-9825-add3781a6eea"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "6a308869c392d2f412f5e23055dc9d90",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "09a5cbd8-58b9-4dec-837a-d3b03d48a716"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "b4ac606de36ef4eca2087a5a2f234d4352da65ae",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7b13baf1-bb19-46ce-a7c2-10c29b38f541"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "94f1ceceb912ea6fcf3b28ee7605487f174d99d6638c9efe38f8c5517cb51c9b",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "9fd02e81-a7e2-42ff-9203-dee8295a79fc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "ef7e65d49d9b5f090a10541ded37ff5f39078877b9a90cc69bc6d0ddd1bd62a12e28e3ab0829fd5e85d849ae2366d69ce5fcff245b8ba0246db77db747443df9",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ab365e22-e10a-40c9-896f-e2a38848804e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "12:e/cG+/fdUEkJXJHryygySgjIIuL8Gh6PYxpGS6lU7t8E6I:e/cJ/fd0J1g6jDuLXh6/JO",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "8d068d91-25c2-4d9b-ab0c-002a675f8ffe"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--5a72317a-eb57-4df5-affc-4f4db6de49de",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:57:50.000Z",
|
||
|
|
"modified": "2019-02-20T09:57:50.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".bss",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "36ec14f3-bbab-4195-8e7c-29a4bd8d8d0b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "NOBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0756a668-1a58-426b-af17-3eb3e4a48e61"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "WRITE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f78a4800-c632-4c0a-b3ae-c3a645803c92"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "ALLOC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4b45c89c-e7ff-4c75-9222-29469f75e93c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "25440",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "572cd9ba-252e-41d5-94ad-cadca370789e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "5.0662340166805",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "befe5189-8b0e-4210-a85c-5b74b9b32e70"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "f9a3fa5cdea20de7fbc2ec16ffd53bc8",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "9c11c910-be0b-4f93-a2e3-ff613268434e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "20523e664605624fc5bb695a221a4fdc8498ead9",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "89e5b18f-5536-4707-845d-a90e7f59ca1a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "169bfced4039c8e6990a76fdebda0d03a97733aa176fa8023e2de25bff4b1855",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "aff0d627-97f5-47d8-9f2b-87902038ed9e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "971510400f04944f644afbc6d99c684191a033e3e675e79d9a73c6e73653c04e77a91e49f11d670d17c6d80a481a332bd2912ea3aa459d6c79f45ff0b2ea0bb4",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "409cf63c-c002-415a-aedd-3f97d7a60263"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "384:AgpV8Cg1mFqUJEVtYIfGMKKWHdc7I0MSEDIs7OmX8cx5HvtFYSUect3fze//umlu:fxOmJEYhKCSKKmX3xJFFYSP4fi/mmYv",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "1d7c8ad2-453a-4b5f-b770-a2e9fb119746"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--91040cf2-0fa6-47d0-9b25-3d469c7da8d1",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:57:51.000Z",
|
||
|
|
"modified": "2019-02-20T09:57:51.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".comment",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9be25a58-90ff-4ee1-b8a7-e88b4241cdde"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3d9f7347-7b33-4543-8f8e-08ae5a25e3ef"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "2754",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "305f3e9a-f45d-4a1d-94d8-0b2978a041d9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.6143694458868",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a5f0fd43-c35b-4ec3-979f-34b98761f1ba"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "78e58b49ff9bed85d5c7b23bfed7b3af",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "38179b5c-c978-4a05-9c95-8300750e8296"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "057b5c4934885ba4cd0ad3eb5a7b0ba4be35853d",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "0d5009ca-7bbe-4cdb-b2d4-969d4fc83414"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "83248a2fa585dab241b1b0d13b7e22eb17f0d115ba7c8b3caec2a1666637331d",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ab7a6da5-2e0b-4a48-875d-f520b2e974b5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "d4533e3af29b0c28f6699c7b5c89219065ddc1596a52adcbf2c64f2f3916eb4327cfcc0aea68f73251d94649f0e61da51bfc639529132e1e7f8208d37ba7d450",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "bc589539-a704-40fc-afad-38f459cdce3c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "48:BUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUo:G",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6d646cba-d85f-433d-8fdf-648870de12a7"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--3fd5d40e-c67b-46b5-a180-910ff2014aa3",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:57:51.000Z",
|
||
|
|
"modified": "2019-02-20T09:57:51.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".debug_aranges",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d9951311-6410-4b47-8a14-b93234d00252"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9acb348c-cb44-4574-9a2e-a8c670c58fc2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "32",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8573cf6b-c4b4-4496-8416-b6609539e853"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "1.3719873517385",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "69efad8e-facc-4ec8-96c7-66d9437acd02"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "ad3975afa0a6920dbaff1109fd4bc6d9",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "52d08a0e-c09f-4963-9662-33c784a5cf76"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "1e4725ff8c1b4cf56dc846eaa5125ddd286f883d",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "8a137c89-4c22-4996-ac9d-484f87cef242"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "93873f63eae8c7312de3948b7c59a35673591831fadf3d0912f0d06c6a6ffafa",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d7687cc3-4e86-433b-adfe-f5fefdd38c75"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "595ec11a47d4fc7e3844d00b305e1dec31a60b0632c5b9142e27730a22e821f1d4461594c4c897cd3a39a526a99ddd51b515a8a768db21ce0456719ac4063f54",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "99c79598-191a-42d9-b570-171ab9d16003"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:3llKlZ:y",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "9a321248-c6af-458f-83e1-9b43be907d55"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--1b8bf0c9-da8e-4ebc-8fcf-12f148cb8aa7",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:57:51.000Z",
|
||
|
|
"modified": "2019-02-20T09:57:51.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".debug_pubnames",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "077eff98-7cc6-486e-b9b5-6beede3ca381"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9e143943-9673-4700-b146-56d1e831ee31"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "31",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "52d2a625-3987-4a8e-907f-2116e2816a59"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "2.4684334063236",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "cbacfbc0-e744-4206-973d-10710ec6a130"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "34b241e6a826ac984f0407bda7ad6b30",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "a5fe62e8-1d2e-443b-96ad-7eaf5b33143c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "04922d47a35daaf06cbde672c10ef60fa9320f2d",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f3c5443d-27b2-42dd-915d-abe34d1e2cd5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "89b7e50012ec2920bd0525bfc3ad0854c423c45b6ca7e03fb44a0b15378e0d44",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6ebb5c61-6a03-4cb4-b9be-ab147b780c6f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "1fc9e72eef8071d509a8694ea42a82ace138e7937da1aa63a67d562a3126655e02ad65956f6c590b7d5b24e0fa1a3794aa16225626812cf0b1f52aca1a435da0",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "82b6dabc-237c-493e-93fa-b968640931fc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:elMlllI6oB1Xn:6M/O3n",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "659797f7-e33a-4c51-a9c5-f68ebb8df504"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--3bcb4d1a-66ee-48db-962f-a49a365cca79",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:57:52.000Z",
|
||
|
|
"modified": "2019-02-20T09:57:52.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".debug_info",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d0cbc460-4b3e-463f-bf96-6a576dac8dd1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "70975905-8998-485e-a40c-2fe9baeec5f9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "366",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "69775241-5706-408f-9538-2c4dc51f0795"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.9353456897612",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4a9ee7ee-c104-40a1-8928-0be286f38dff"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "48e10fbf640a36b91e2e2b5f02efc08b",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "90d50709-b6e0-4b90-b019-a71ccbe13d68"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "23018f6004ad9cfb6f2e8ad93a9e70b51d537b32",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "17a70e41-c7e1-4a02-a210-4ab8d16e05ae"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "c41a4fd791da4c6a736355030b6df23e5ce8e7856a5464d3f6ca211259e2b83f",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "28d1ad7b-b552-4fdf-b639-f54d10633e26"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "5c5227c724aa691d8200b3736f45e7ff3339b031d18c645c6edd05053d5dda6bc0d6fcd45750c99690123401cadd7bf7e15abca93f3ac24b19846e70734fca5e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "5cf3ba7c-2740-430d-865b-ff6d7f4f6865"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "6:uF5RLtVuf5tliWeFsSs/XFfe8EGS/vDCr8NnvzCSrEk0E9sJknysNTOU:85RLtVGz4jsSsNm8EGwVnjrv0RJeNL",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "e0aac1b5-7fc4-43c5-9e2c-ee11b8ac36e5"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--9c4329e8-ac6c-4b40-8b90-93c97d47ca19",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:57:52.000Z",
|
||
|
|
"modified": "2019-02-20T09:57:52.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".debug_abbrev",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3611391e-f5c5-459d-a861-5d89d7fd56b3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8939ca46-8c4e-4728-b21a-0020e95e22bc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "251",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "72f6e20e-c745-4a73-943d-ffcbffb2a022"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.2634000371371",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "1277f31e-08d1-4b85-9ce6-b898b59c8c8c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "60aff1cb0670e4d9e7921d43320c4e59",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "81c8b4cf-0baa-45e0-a113-41c5e006e76f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "6712b53d0fd00ea0f9c1f035fad48f918b16f8dd",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "25a8af4d-8321-4b53-89a8-023c12dbf653"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "c50a9accf537acb60283ee680466267739279800e9c4d7a6842a918be389ec4a",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "8f2489a9-1e3f-4976-9808-5093490d8858"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "c00cc278dbc90c49b2187fadfbebf36573a535765794e365500e7600b79aca8bc3cbc8702cc5de8b5f5d212f374f763aeed4b6a80163054e3c7171b3e15caa6f",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "d7bca4e8-a326-4870-9c95-513a17f57e3c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "6:AUQlYfaCfThdgKXXju/1hXl0grG/C+0lv3bP3iu1wGu3EHXG3bPll:+4JfHHjGz2grG/CH93bP3nyT3E3G3bn",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "b83585b6-2be7-4868-9a61-7d592b742d7e"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--48c25567-9566-46ab-bd81-b76a29f55869",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:57:53.000Z",
|
||
|
|
"modified": "2019-02-20T09:57:53.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".debug_line",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b9b09324-2b2e-4089-9653-75b1360f03ef"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8d65c0a8-c9e9-4723-acd0-a22dfbd5e0b7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "124",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "adfd6912-5f69-4cf6-82e2-94a1a66a207c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.5861322227218",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "05bf514a-bb30-4621-91ba-99e1cd402217"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "77f542cd9af05f3d21fe2230c1a51994",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "2b1f04c0-fb4c-425e-b79e-b98a2cd49911"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "e5998c3e79ef2ce05c7820c4319ec93b8a7fe21f",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6e1fbdbf-6cce-41a0-98d2-cd48b1a3de82"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "1cdb6e63a3121507ff0a9cb2cccdc5337604da65339db1b22c0427d6317d91ea",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "6c97d906-e76c-4c4e-9cea-7a43fab43f07"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "31ad60a0ebf7adc1c5e80a3f25aae6243f47157c4a11ee9a131c575b52e1ce22a204356adf61f694b17af53d47a9a3a9ee553afe02a09b02205f6aaec0d83bfb",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "3ea40802-2deb-4382-8fc8-414804e4d3b5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:NlKWMsqeMYAhI/BNDHCRX2k6iRX7sll6lJxrI:yB28xeix7s/K0",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "029fa29d-4514-41a2-8c70-d69a8e7778fe"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--5e67bb4a-3c5b-4fd9-bda9-52e99ec1a9ec",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:57:53.000Z",
|
||
|
|
"modified": "2019-02-20T09:57:53.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".debug_frame",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "323b5592-52b0-4cf5-bea0-3e37f13cc4f3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "437ae7cd-250f-4267-b162-39e6e0c9a201"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "40",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6b76d6d6-71e5-40f8-82c8-77aa3f151952"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.1658841998019",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ecd00c50-d1c5-4806-bcaf-c4ddc0611cf3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "dda5f868b60ce64d4f6dba0f6c9edefa",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "e092e9e3-221a-47cf-9f0e-c58759c31443"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "1b12b6f9ec7fee59ab9382d20e0560e9d87ca62b",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "e5d99e6c-d357-4e5e-b51f-98dfd4cfa98d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "b901f34a607b1f48624cf1954ac378ea73c751dfabeac9fbf86d7fc4f9b20fa0",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f5bd7525-fe9c-4497-8458-6230e44820fd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "a89670114389ec24f4ac64d209ee71f5c2d2c5a3b23dfc8d05e1b6d8da24bb1c5cca2bbe3496755f025a9ceb831c72c193dbfa65dd50df5cfb838eef9195a5c1",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "1f6f0dd9-16fd-4e2e-a6ba-6aeb84c64266"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:+R/hlil2T:+AcT",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "633e9e4d-7fd5-45b0-b3b5-b321994ed1cb"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--4c8a51c8-1527-4aee-a2f5-b1107db7deab",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:57:53.000Z",
|
||
|
|
"modified": "2019-02-20T09:57:53.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".debug_str",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d8a8ce07-4a0f-4127-8008-8d39c5c488a2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "43537fc2-ea6b-4e50-83cb-4ccb6d514726"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "MERGE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "02dc8724-c777-4fbe-aa17-4885c929c793"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "flag",
|
||
|
|
"value": "STRINGS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "687ff085-7b47-4015-9495-848c6a42fac4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "267",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4cf4830e-927a-4f25-84fd-b2a3e8b6848e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.7860462097603",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "263058db-7534-4d7e-9930-60a72684ac7f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "74dc7ac35de14986cfaac5f2658227bb",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "88ec9e3a-9205-44e6-9616-77e81b26fc88"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "ec359cc06f8285f868630847da04050335335f99",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "24b6f1d3-e076-471c-b90f-65cc5ce36d0e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "145e72f8cadd280b176943b95b409e907062136de801895277626b28696dd3a3",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "4b71b1ed-dbf6-42d3-a4ca-9acc6d027a38"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "3299c04742755481fcafab87f2eeca3b85297a4d71ddf0f3f4bd29b37e18954d8248b98d9b59c781ccd58496a582c63fb98d852dcf918e4022ff9902a98e44fc",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "7185eb54-5b51-4529-bd60-d7b85070e831"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "6:c2KsZRTB2RHf5xpqQGBo3aVJ2timE6YZRl:AsvTBKHf5qQGBoqVJ2tiLvl",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "97ba715d-8531-4bc9-a93b-ea43c629e118"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--3cc45be1-3a29-4489-a74a-e3ac6595c32f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:57:54.000Z",
|
||
|
|
"modified": "2019-02-20T09:57:54.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".debug_loc",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "cab54d6a-a1a8-40b0-a684-986b4643a1e4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ba9981cf-5081-476a-9e9e-fe1ab03669d5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "110",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d53684a6-8cea-4110-a64c-153e0b7f2771"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "2.2479367211772",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "90e1bc16-6abb-466e-9df4-56c0b6a76d78"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "c2e4faa0f2e7dbb09198677c388f1019",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "10162283-5e4a-4016-8b93-3f583beae19e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "ae4c96c5d8c6ef1785984321dd99e8d72119e6b1",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "0b95df4d-81ac-4a64-89db-81567c2f5509"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "317e06f071e0e2f1bc79da11f58bcb6cd6fa1764375ff5729b045454850aaf7e",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "814b6083-78eb-4dba-81a9-805f38039ba8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "16a3dc9d23eecbd88c47d999e193676d3780e1ca6867160686f609ccda7b02fcae044ac0d893770dcffe05ebd3f17f1a2fa4b01585d569fbb8a27343cf70e235",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "608e9ffa-e3e0-4748-b451-3719b42a2547"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:wzlrlS/lLRyll/Mhnl/ozll/l3lFytll:F/Pu+hn6Jllm",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "670fc84a-aef1-48ac-b84d-1264de967818"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--86fa725a-e9cd-4388-9582-e6dfca955dc9",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2021-02-18T08:34:43.000Z",
|
||
|
|
"modified": "2021-02-18T08:34:43.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".debug_ranges",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3d1a3b68-ca4e-433c-bd08-7f17743d9864"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "PROGBITS",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5b2ef096-6a07-43ae-b88c-b0412376715b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "24",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "71f4ef05-1507-4fa1-a506-4ac1a6197e09"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "0.98335575498169",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "798836fd-a3a6-497c-b47d-4f300213682e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "b1e1a289aec1d3e98850094c4a421bda",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "05d92429-aed4-481c-9eaa-6f91530b8e92"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "c2ddcc7b693792afd222bfbff523c936da4e3325",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "1a917b2b-ace0-4094-956a-bdf996d46ca0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "978e04525d1f1b53516748c6c0d3918d30a2de45e9b15bb49aff737cae044937",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "bd38c401-4838-49ab-8e98-4207da4ec483"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "88f095699295d45ba283b479d2c1f592cc0c12f539e8b6d66436b194c74392e45282854f1d26516898139f67d6f9816124b5e36b2c85dd26affa694480b0f794",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "d1eddab8-b547-4a3b-ad8e-1cce1d7772ef"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "3:tdt:",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "e66e7738-94ec-43da-9b21-98fb54b0d4ce"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--307d5d46-5ba4-47af-89a5-baa05c4a9ef0",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:57:55.000Z",
|
||
|
|
"modified": "2019-02-20T09:57:55.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".shstrtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3ec7ea7b-114e-437f-9739-477ca5595bea"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "STRTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7e4ca9cf-2afc-49ba-b68e-c4ef7744206f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "220",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a14e0b79-8f27-41c5-8aea-ff7960c5ae32"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.1928239393367",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4ff949cc-4622-47fc-9f75-2719ee2e45e4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "7d8271ce89242d27d4b223389d6b4868",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "54a82bb9-f971-450f-ba6c-dff99926d36c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "1d97635ed8a2ecf8231a4673b08f799d3a089701",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "9c830e8d-4ee8-449b-8c25-146e849c0299"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "a1d3736a83998135c55f9058ad8f11776d47cfd3da289731b5950b1aed814a77",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "8273b3bb-a52d-45a8-be4c-b276896337db"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "f002aa5b6494b8a781bbf752dee78c007c79ef23d6890e25ddea0e65747102f8e81761eca881742f51a07518418f095271fccd652b85cb79727a5eb27949bdb0",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "a8414277-aa3f-4881-bc95-e6b18f06beba"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "6:EXwWEgMF84MFTnfniLTptN9WztHKwVh48zFc+:IE/H8ivptN9mxhY8hc+",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "ea1a6d76-1346-4468-9230-07635faf0038"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--a57e5e78-b889-4b58-b687-ccf0c7fffcfa",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:57:55.000Z",
|
||
|
|
"modified": "2019-02-20T09:57:55.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".symtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7a0cc8d2-4da1-4668-b74a-777cff9dad72"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "SYMTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4d0806bf-3b99-48d6-9f4c-48e855ea65b4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "11664",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6b0cc395-c211-4a20-a76a-4cd50b97a760"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "3.8422976439828",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4a8daca9-dee5-441b-ba87-dd0e1d67fa60"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "07f620ecfd8b766727debf20d4fee114",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "099c20b0-1e80-4751-9d3c-53c2c8fa346c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "2b85a2e2df728fa6f8557c680dfca5c336abf163",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "fbd19079-59e9-4cfa-b053-c0f7890dd687"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "09d561264b93a4cbf920d08da3c67925b1b6ff2dce4c0832adf0b04e048df2b0",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c436a624-3fac-4ff0-a0d5-d3f517cf2940"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "216b5cf56f93d4a214bd7b4a39aa0fa149b60cf54b55858306fe4406173e0881b3408a6de4574fac6691974bf4cf0a06bfc1112cc74d7248460af1c3a476e2b0",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "f7d6f28a-379d-4dbe-a6a1-90416b6b45b9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "192:tcexoPy8CyV1mDWUqUJIlj7dOzgYIfGMK/S/+UL:zV8Cg1mFqUJEVtYIfGMKKW0",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "023d1d10-b439-42ec-9569-7a584751c1e6"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--f4ddf335-7cbb-4c16-9ccf-449c0398225e",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:57:56.000Z",
|
||
|
|
"modified": "2019-02-20T09:57:56.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf-section\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "name",
|
||
|
|
"value": ".strtab",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "efe7f1e1-3068-45bc-a335-cef1f98493d6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "STRTAB",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "cd2d12d0-bcca-41d4-854f-85f0d79ad882"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "size-in-bytes",
|
||
|
|
"object_relation": "size-in-bytes",
|
||
|
|
"value": "8880",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "324a90b9-3001-4564-9335-9d3f8352d847"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "float",
|
||
|
|
"object_relation": "entropy",
|
||
|
|
"value": "4.6088190848301",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a4f37855-6eaa-454c-84e4-828b1326f704"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "md5",
|
||
|
|
"object_relation": "md5",
|
||
|
|
"value": "04be42f32c035cc402ff6c52f94f53d4",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "fc31db96-20d3-4ff6-8522-a1d5a3c6f9ed"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha1",
|
||
|
|
"object_relation": "sha1",
|
||
|
|
"value": "e03b2d9b3ff4990b4b07be7ddbc2b346e142d461",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "cc52a14b-f16b-43bc-be3d-c855c0da8e18"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha256",
|
||
|
|
"object_relation": "sha256",
|
||
|
|
"value": "d961da9c5c1b16b8a045521c090a586a7bcfd861b3c21b775ba9b28cb1c1d3d7",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "297e6fe2-2884-44b5-9de9-12f1c5cc3a9d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "sha512",
|
||
|
|
"object_relation": "sha512",
|
||
|
|
"value": "11bd534fafa8e7f603df08b5472d7d6e0d6598a8fc611afed7e47f29a89b357b92fe2c4e684babb11c4222ec8bcbc6d3de53286b1735ce3e69f97d9e2ec69720",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "c208b539-419f-4068-afc0-c1bbff9a5c6f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ssdeep",
|
||
|
|
"object_relation": "ssdeep",
|
||
|
|
"value": "192:s3dc7I0fXMSX07DIDY7xwmX8cx5s4vsMFfASNCexCtSglf4oe//umhDXqLNaIfJ:Adc7I0MSEDIs7OmX8cx5HvtFYSUect3r",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"to_ids": true,
|
||
|
|
"uuid": "db8d0f9f-c6b3-496e-90aa-18d5e36216d7"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf-section"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--a9353096-af17-4e62-b066-40c4b6b32588",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T09:57:59.000Z",
|
||
|
|
"modified": "2019-02-20T09:57:59.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"elf\"",
|
||
|
|
"misp:meta-category=\"file\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "EXECUTABLE",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "bc887de3-e952-4d06-8ab0-481192f3bdf7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "entrypoint-address",
|
||
|
|
"value": "65956",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3526060c-375a-441a-a35c-85d9d079a8bc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "arch",
|
||
|
|
"value": "SPARC",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "8195a4ad-00a0-4e0e-90ca-c37ba7a40c08"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "os_abi",
|
||
|
|
"value": "SYSTEMV",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6035bad3-dfaa-46cf-ba73-fc5fb0a8b806"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "counter",
|
||
|
|
"object_relation": "number-sections",
|
||
|
|
"value": "24",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7c0e808b-c7cc-4ec8-8697-c4c3b86bf09f"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "file",
|
||
|
|
"x_misp_name": "elf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--dd31ea85-5cbb-453f-85b0-296d5ca4daad",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T21:26:09.000Z",
|
||
|
|
"modified": "2019-02-22T21:26:09.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'b46eff3bd43bef86f56ca1b93f82c21b' AND file:hashes.SHA1 = 'f51dd81bdb16b87cd3bf335c1bf918e0f40b216a' AND file:hashes.SHA256 = '3b72288b292a5b18d870277a116713118e23b103fe58b8b1ad93f0296513b509' AND file:hashes.SHA512 = 'ced15c07893d3eea189fede6b6ab446154f2f8695b1844ad900df8825bf454236ac2c5dac2e08cacb3c6fa65b7d36260d077b46b867386fa5a372af2777b747b' AND file:hashes.SSDEEP = '1536:s4A3+Setwt99N95at8tBwJD8vu3mn3FFYSPui/m3cS:hwT9NPat8OD73m3FFYSWi/KcS' AND file:name = 'sh' AND file:size = '100380' AND file:x_misp_entropy = '5.9292166759459' AND file:x_misp_mimetype = 'ELF 32-bit MSB executable, SPARC, version 1 (SYSV)']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-22T21:26:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--e3af71ca-c00f-4243-886e-3c4d279bd335",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T10:13:17.000Z",
|
||
|
|
"modified": "2019-02-20T10:13:17.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2019-02-20T03:14:14",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "73a79019-8f5c-4c94-8674-027e456ec84b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/7eefa483e23c0ae2e67ce3c3a399527b3244c6d23af4401842bab88276b26840/analysis/1550632454/",
|
||
|
|
"category": "External analysis",
|
||
|
|
"uuid": "c77bca68-9805-46e6-a4f1-e996db0e48b9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "18/57",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e4136dab-c9a5-4093-8eb3-41109acd1180"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--a2ea1f52-91be-4888-86e0-af75ed6a01b9",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T10:13:17.000Z",
|
||
|
|
"modified": "2019-02-20T10:13:17.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2019-02-20T10:09:28",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "08149525-72ed-4ada-8bef-7f831d6498e7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/25eb40f52fbf71f729b4b7422e181e22ef19e38a461ce450446d47fa765cb153/analysis/1550657368/",
|
||
|
|
"category": "External analysis",
|
||
|
|
"uuid": "f189bbf0-dbd5-4e4a-8f7b-01f083c07a1b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "13/52",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "b5cf61b9-a3ac-4f64-aa46-7dd659be47f0"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--01bb1781-57df-43f0-ae31-30611e59f11a",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T10:13:17.000Z",
|
||
|
|
"modified": "2019-02-20T10:13:17.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2019-02-20T09:36:20",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f68b07d0-2691-41a7-b404-4a118737f7fc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/3b72288b292a5b18d870277a116713118e23b103fe58b8b1ad93f0296513b509/analysis/1550655380/",
|
||
|
|
"category": "External analysis",
|
||
|
|
"uuid": "3d9cd137-75d2-429c-8956-010d535856e3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "15/55",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "40d8a139-85f1-4a0a-84bb-9d6b844426e9"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--a43da60c-51a0-4616-a935-b8ccfecf6559",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T10:13:17.000Z",
|
||
|
|
"modified": "2019-02-20T10:13:17.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2019-02-20T01:10:44",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3c61dc7c-4c89-4adf-822f-afeab5437341"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/9bfa55698985096343655c5c2bf7c33f6ec8460c636922437d5109480c60fc8f/analysis/1550625044/",
|
||
|
|
"category": "External analysis",
|
||
|
|
"uuid": "d028cdd5-550a-4d69-82d9-ffac31af4e48"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "14/51",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c436dddc-f1f5-444e-a6d2-a321c07b6145"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--d25ea6d9-0e80-49d5-98e9-489b46660622",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-20T10:13:17.000Z",
|
||
|
|
"modified": "2019-02-20T10:13:17.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2019-02-20T03:14:27",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0160c74a-2d45-49d4-b0f1-58d2dd65b25e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/85a118a21531fdfdc62ffd2f39376fa67644d8cd4041a288b770def0a4f5f5d7/analysis/1550632467/",
|
||
|
|
"category": "External analysis",
|
||
|
|
"uuid": "9e989e5c-6b0e-4be8-9d10-a70f8aa087e4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "16/52",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "03e9b807-2ce8-4155-8b80-5c6fafa0557f"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6e6e82-94e8-421b-9bfd-4be0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-21T09:25:22.000Z",
|
||
|
|
"modified": "2019-02-21T09:25:22.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'a51cbff34677e8be7bec232eb66db564' AND file:hashes.SHA1 = '5c7f873320ab3b6fab74ed402b953e58c0f99502' AND file:hashes.SHA256 = '7eed6eecf1b5b167ee266b04ff3b146231fe47531a3f7ad122651db37a860257' AND file:name = 'apache2' AND file:size = '95104' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIACtLVU56iMjHeZ4AAIBzAQAgABwAYTUxY2JmZjM0Njc3ZThiZTdiZWMyMzJlYjY2ZGI1NjRVVAkAA4JublyCbm5cdXgLAAEEIQAAAAQhAAAAnJIhLpazqvZ2C0U+AetVpplcQTL70Df9HrAmE0CSpY2Fk6pHlCrmVmlg5yCRuQVHe5PjVGCEmmAbu1Go40zpeJIDim/7hD5qaPX3l2GueoHQXTO4YVbutuDvzMlnO4eDnayBZVaKqpdZgEgsmWEKsFrRuBUxqUqgv8uwbYMUNJ6nJS1I7VRZp3XcGi44S5UJO0w3UqZx8nFdvf1QGPXcS4BGYS66O+P4I5A3HzJM11dblQrEqUZUWGU2MPXa/qGd7c9JK3+xNyOEbch6iiOpMsAFhkjLYzfi1IfsMP6TQibRw62PtaSSV4odTzgGbKIQev22PXIbfHI/XxUoEdGM6hWWr9b92VMil1sPO5pfLy157nVuFUaFYcZpESDiayB21Y2+B8KlrC5LjJPh3kMa8QQG3jr3Arqdud8NwWOJL2WHSVfI0uzpVo+3XqaDKjbiNSwY7WQOBjHEQklD3sUsybWFly3iPM+ybWTpowd80u8HBRRxyQietgFGcaOxbUMBlRf5evr0MrwEGVLaA4UYaD9tuPk7GpYNuz7z97U+U00xr0FIiD6NtfimpBSaiwasBTSC18ENAqe4DP0ADcMFY91WQuCfxkrzcu8BuR0z4bS4Ojy94guOag10aAXUmaKx16QR1v8pfqeJ3l/E1hyMEvUuBp1Dfca7d0kA2MSGgRpOjrDC4oes0jqlNlxMK6kGJp4ygQ2v7Qi2EZFiTabdE9YK2sG6s/T103cvbH4F9u+F7qbU+9eaqy1SxJv6Vdm5kjCKo0KHZRfmAj0NyOAe0HTRMCBkPxZlb3n1ITvDwQ98G24Q6udSWmx5soc2+sg3wtgQWZJPGoxKxjSDDfK4uToNl9vl3xErkMlU3FFrW4us1PPugqQUWWahP0aeu6yaUANr3XWen+A/od2NGT/GCnM2bEFlU9YnNLqA9mdhLvndZ0xARx3AlyR52ttCg2+KAWZmBBR+eC5ywdwC87SwpGA9PMv4De1KLnR5A+CmgZQuOa1LMkqEUUns5eYojP+Ap9QP9en8IiYYVCNd+2ciWy0HbWwiop5JbXfxtfp1cT3jj5qb/X3WqRMMtGhJvrYPYy9ZK9zHwKMwgsaJ6lbM46t+6Hon6zeKCPppGsfoNLE0nK0StzI0ILu7eFoJPVkmNNwNKGZusaBphZdaJ5XlI/77cOoj3V2rXATFLLdPNiW7CKtZUw49BADKYlN8s/gnGEVaqX7my+qzVNwDdRnSqDS5RIwwUEmbduhrQlaonHkr/xdIrYRsWKM9SSs8ul9e/noCHAV2IOG7+aW7poLhdV0DsQEPpmn13DGyy6LxLikEOHaxYK31alH+Nt7LDUkmH1wgSDsDhJ7LTaWyYMZaiFnVy2js7D5vLBeUwu76CrK02OwKkM97CHvho1Ygl3dFDZchz6QNCyKyVfHF3XeXmvPX5SuXE+VUHdvh+FkvJSf6ytNAzaNyjlxvFVN29G8mffyHGWpli+mBh4gI7hJJVX5Ql5Uq0TIDw4287DC9RtiRubuzEidP0MmwOp9Bi9oY1WY7rb7DS+prm+vki4t5Xy0rHEomTBqo81wvWWQZilNW7QFmuTMLWhtULmwJ6wciIu/y8Ay4SfX48RDpAJMqdiI4ZgFr4kvALwpBp46LMvT4tJBxG+BlTxT27HT1q4xWBzYMC3evN2gaQWV4ix8OJLTLOMqwTLO9cBmWS+HwqXQ32p01GA3tE5w9Ex7SdJhpAe0znO9FY3aEAnr2Ejlj52arLu1GXvzpcs+bVWT9CArrBYlKrmzBMlMD7sRwcBU3CwqRpvdk6+6YA5M4A45+WNxKdMgmUnIPlnvJQGnh0wSZoQ26PTGKIuXSPjEEE64cJoYObdKZkALqNmuOtxxV+tG6IXHwjo2V9QXklGVB370Y/gGeBwc8KnKNrh9Ok/5BaCPydnZyYVJumnEGRcJ8CujGIy9jayWMm7OmEgdoUtgPi4DTq54oUm1M301+Vff4hgYqGBpaHsvBsR6SFGh/szMiRk5X80Q5c8LHxEoU4WNSp6SPCO9ZzPewkvJo7eAmZCShrQxD27bKPz16HIK6BQtMNGIkmOnQKaw4e5LhFV3e7rLKQR+xRjbJGPHvuLGqbVfcBqQoV4dM8Ebt7k5XcUbhQPMuwZoO1wQdJwGK3iEVNGOYyRCnCk4HBOLxUcJgUjhda/l+o4NtVvbn/lHmx7XIQGJy+7GxqJqoBILM0MEL1TJ7juQwPEbdu/So4NyZCsad8a871GLu0KHERo4xvxrN76z50qahm9E/Xt6GSoalpU/afxgdFegzS30D5kRQK+fxXkBVsPPCe5QDggKg1d5klZdADtdfwtl0l0R3lG9oCRwH7hBR1dnV3bK1wwN8NA9UxWHs05my524yrzCp3208xrVaEUz3PfngbBM8XPEGqEJrSVcsI/sJ9WM9mWPiAxSa99bLbCot0I+4OUIPWCk8clt+uvkshtDfQAYMXBZae1OGzbfQsg2P1cQJTEF2GCIY7bGJdr+8PSppvVmspRe1N6GcfHeno9s7AaBunQcgZSHFx0Q2fwtVm3K1eFKwepl06i0WZoQFL9o6rzU73bpeCrPshnuEAwPqJ5+VxUTkwv1FWwHPvBllwcK9gQDnxwkd7gmnzrhDLmiv/eHb+lTV63mjFaSuBP5+p2tCKKtBN1XwxVwmrWUcdIq6esJE+oMHgPk4FJjD8p7A/3xjZJ4cFx5d6rO87FXMHyGZoTOb6bQmFTfGoBjFsGyeJDrz2NkrHTwNYtsPcFRkizSqB5qe5TwwMid5dgJEM/RXBNN7hBXdtqYTDbFlU7V8jMwKUURse0zm6jzm6tNQ00jDD+pbrOzWhqbVl+19ZDIrgPivGZKb4+9fGMfCu9G/O9OIk7Xn0N/eExGMhgRl6zAhazf7vO20UrxkdMOYaB71mkwkFLuYHKAvAP7FWQbhESZmPXDvjlBVRnl/WZRTXQoLYoC4uVyo7FDKrhZ0ZdoBP6YzDRGi5Sl72YFrjPWpoLGWogZ9zl8AsRAKt6T2y2AtsxU8N3DzfDHFPJ+c+JFPyankiIra5akDFnUWAHJoIF+Gf7x3GIfvdUfkNuuDnSA+ikZSO/kAgpu1jiL2oNMFCZgNNxa4uvlyGsRDKN7sPtDGWXs0erh2PllI2ZYIdyyazwuH5HXdursHoOuQQb3UVjAbOPsfG66TUlfL5abNSMfz4zRDjzqN4hczuafsinNirLPBPJMIX56L+L/k85ogpTlqmyMOYMGB42U6TYLvBSo2nyWrqFHGYAwv9PF3WCz+vRu17klVQU74zHct5wweMywXxUZ7apeAUmthnlhoNFV6Vp+Y7XMfv1DfNINnISa7R1d/LUdqsKSXckA07nwNrXomRBgZFZI6P69DrFcdhfHD6Deypz+Qdc9sN6VWCVllBQ/+/B5rDhQFdbk6oVTHvPPwb7uVGvKQiYV7lk3VlT/pu7b622B7x86Y0QV4cvy9YBxykTuSvppszIKjMiOAgb6wGnR+EZXis1eNuXRBuFdM3XJD/fxvMuFlc13qFhExyTGEuB7hiiBAFQ8W/xi2dEuGV86C7IIGT9eekMgX0l6Z884GdMrXxDZKeo5SYZjwlsMqYQY7+hGw2eyGnycBn7Clmg42RbPhRqqE2u3NGvNQENFt
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-21T09:25:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6e7107-c568-4761-94a1-407c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-21T09:36:07.000Z",
|
||
|
|
"modified": "2019-02-21T09:36:07.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'a51cbff34677e8be7bec232eb66db564' AND file:hashes.SHA1 = '5c7f873320ab3b6fab74ed402b953e58c0f99502' AND file:hashes.SHA256 = '7eed6eecf1b5b167ee266b04ff3b146231fe47531a3f7ad122651db37a860257' AND file:name = 'apache2' AND file:size = '95104' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIAIRMVU56iMjHeZ4AAIBzAQAgABwAYTUxY2JmZjM0Njc3ZThiZTdiZWMyMzJlYjY2ZGI1NjRVVAkAAwdxblwHcW5cdXgLAAEEIQAAAAQhAAAAOynS1eeVPuTfZohdsrFmVmcg7v2D02aU1KPmyboeJQV4jPF3HbxTUYSje9XGXVeLcnGQyZVtGcb9Y3BkApudtB6Usf1vItA15OluC+y2zWLuHcNnXAoQOH6ewMzlph9fg14xwBQ9H2ZLNGWqJ9RRSJ4UtkIrQ7Txeg26L5COVKP9XuVHBpG9Y8Q6HzPBdB1E7eNN4J/x3pBMwrbnJr6d7RUcrrC9WnLfCmPY0kuS3HiKZy5gVcDTtBixNKrrisDYu/3cVUptB3TgFpBC8UdnvZZe08JgcKzEs4fziE6xMCadwZItDsfInKXt2LF0t9XLoHVao59nO3eVhEfOY+SwCRYeKU5y7/dQVazDhN4qv1K92SdNWROMsy2TjxeZTZUa2xK1HtokSL+09f3LS5GeWSngNqS4ofoqOFcEKFYRFThqhOeKB1tIStthPpcxm+7YnmV3MeTlexZzge3HkTTbAclOpQsUuadWaUC4WrR9aSPiOPkEWEhRSpC67vf+2H1dJy44zKSbjVFwWgxoE0+QNNvK5IGR1k3ZrA5zFTeEOUybxJ3gdXrosA2Ve2SJhfbSGv16RsXcG1hc3Fn+koBxSOroL/BFlcnJ5AOD9ZYbgkmc804lokIKoZTDmk/2hlNiPJ3sdDoq5iWfSP+qcMOu+mhtxW/60r3/ShfJdowLCQWlpAPpX7L8kRSuRLa+W4Dh69cQKmeC/I9QhsXm0OQYGeS3NNaiUEaLeTolZUbLXyjN+Br7fYLzVXUJSgCyhsKW57BChFoRu0kHEOHjI1UvuqaR6dBxrYZKlSSUXhBtVLbNLoDR7X3U0/iOrPyo9tBZy1ME7ljvFx0QhilKfMPxqT46GHOdMdsUJwHg88NvCwYeQkmFOBYMUoEELkUdGJSx1gczNvXHEVxow6SWXSc/QuUEaBWDGKfhM1Gk0qVsrpnAraxwssBdFFf2CBa9kG4kLwoRzbPMe3Xcf/OeJbe9ohLgRy/ccYsx54H/233TVNN6s9t2tdhLv03IHCea9M8icYZSoXdOT1zhfGYUdRbCaHNpb7tlLa/WJ362A1JoGC9zj6WqIyzLD/RLc5ub4yCHRh+ycpv0PEiKrEvK+QyW4LwIJOVlO3xcQ7cxCHC+lB+jO+bJeSIuka8uXtv5TGMOmjSRwG94RWJzEA/9qhs9BUz6/jJq0Wsn1wlvKfkS5zhL5EKWCwTKzny78k7tkUXRTZzFvTfrNuX85xIj74O/mBBy8/bv7qYsHSNz4YXZ4z/X0fPnFNhG3EJvzCofDfwHX2u7+BUOKIe1AP6Wp4q9Yow9KMinVMYvzWXaZqO9uW1Iu50MhD8iBH2b2LIyN8rMF0B8d5eEoLUyAz25KFIdCh5Mpan+3PxlmhtY7fZh2JBSsnKISFVnyrkBcjqmlQCjJ5WMcQQ//KGzA1bZZQ8FkQGqmVpLHaW5oabO4wo2MUohpUvofojgXivwK83rMZzeE6d0eMCYWzrE7nwnrR8dVgFNDFggY7oZZlh3ggDIsVNZu5VIpxU3J/J3KY4Ifx+okb3V9WA+k2b0/yDhPj9i1RvSBA5QU4e4eO+3NIndom813YwcPx95A9yVI5qxLz/5JmYB4y6jTb62lx4Ojo87jDs5n4UWXx9liCM2o6U9e0k6Ja5WWfXgqPhOSxqlxWFRl54sq2XpvCzCfJY9XgoAMwLEz7ROo5zRwhP2oe66lRxUgH9Zs9i57ruRfAwwEphy/ZI7FfSEmleJa0up6SgNPkorxGNpm0dTg/FhppLI01qZjahT/miK/5q457jjEmQnr2Svfz2qE/Shg594BjNq0xaXJn8pyMbZr9wUpX6twFJyw47ZfwIwp/rs+vHrKyJ/MgqdNVxIMoGj7hA1scqGeFMK24+AIvZVcB98O++kY/NOU4M1Z4afGypjhII/wC9cob3bxPYDt7O0pjC7xhHgIFj4v17+mn3azR3TsmN9VTGly1rjkKOKdhOgmlJGftXv8q94dLW0G92k+br82lyDDDHUHJPRIbEX93AH55UarW1io3ccgZXJ9k5Z0EFC7EWqBv+vHl4CetxUX8hnQeipHB/EB2mLum13DPOvPz7mfl6FCcNh2i9u2ocndwArO72pSeZWElXdEbl+tbtvG2LOGUKz6+EPSS96mvEHt+j5xlV18Gf1gg9HXLrjwx75V3dj1N1+GK1a0naj1rQPa7AyMb1kOPCKAubl6nynndPp6i8Bhj1H71C+Tg22LKOXacah9z+yy2C5tg8xioEfKBS94eJSxM9JQW+tKWxFyUUVH7OY0tQXpQ9bMrDAizk3/pgG41b1Tk8y+2aZKNFEOlkg/sIgmfW93v+bTI8EKpJvX1SYU9DQybbgGYCfKjyrXhhiMoJSs/Qed91Rey4u1mxU4XIUnyuqppVYH+AiKWlZADIxCv0qcsQ2lqM0PZ4jjV8koVctLAZIrczvgaF7iL0UOFwg7cJFRtLIsbE4us7JAQ4wiaWBYGNZJkv3SH+SOND//lJg4pxwieAfpwtoa0Z+7h8Jff64ko3anncK4+h6Sn44IJryLK064/YraxbBAnujNIdGG2tLFWO8t6aV8KAyQkTF35lUk339K97+bdm1CIs14fyxLGbeP9U2QCEcBeLo0n/9Ym//CSexU0uTDhyr3vmneVincs+UMSESxBfDNO8fLM9mIuCC8tI9RpXUT20UiV17u54++scWG5yqSPf7RzUyaL/NwSHoQiIzhA+TdG/dVIRiaOWoRqjZA/nCwzIQN2j/Kt7m42BEuEuP7ZRpyqZ5MiGOT4fiBsBrlexsXZU/ZnGj7PQ8QwZ/GGX+GrXF7iqVmw8EzkEBagkLhYFlMH2Tm4hyKPy0oa3LuKJ+HNC0VAcOicgls/HREpI69AmARicHWiaKZsli0VKsUbKKe9vq7ewXJV/AvrrLksH1SaCmyCCCMQKFmoVaKg/hCKK8HOJjAUxjZ9j+IXGwvPSqNeoblSbKp8liqMl+KMz0QG2ZQDUqHlLm0uolOfrZ0V4mZeg0dxm+zz8bxjMIeqcaqsTr5japUApaUlDWX6Ub1C2qluPhYsmcrmffTyPOrw1s32Pj6zGdrvLLot3DSMITaqq2pXSoVj8pWFdu2sBLiV7gq31fU3gMOFHibQ2m6VIbMZz5tRq1dA0H1GnBQ8croX4USjM7CowfXLrwgreZSZTyqANicFACgFoaZ681iJdsGCk1kWFi8IlsfB1IMo7Rsg/oEuVeUtRnODcKBPAKZXj9QycdOukXimj+KW2kO5DwVJ52vaTaBYhlbG4yPdK90d3fHIz+DGKwRLgLiL/1n8Du3ZSjIgqgi/cuI5KLHsoAprQMp7cEQmhiMOMbGeEPZlxU4VARlKGnSh4sHmiRb+lg9wTeSC8Z7YurQJxSiY+J6fSyomz05/d5BV0HAEWJ0siCCEjNyXaFQ+34anSrUZzRdEG4+034h8i7IYisB34VNpL4GO/4N2GFOx1gF470sx5N8j6TMfg8E+mHaYSUn9XvQg0r3Avx22EXulBTVntLppuZc1++sFlNsxNusbVVz1KY7Hdrs6RoXWj0iZS7SY2NEiBYMzCrgBvJN8K5/MpuVeIcdKQ2HA12axhncSrWzJTqoNcsSvAESqYPCeaN8zKRy1XNlfK86mDsM/0RMm45uq22
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-21T09:36:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6e738d-9e4c-41f9-ab6d-4e63950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-21T09:46:53.000Z",
|
||
|
|
"modified": "2019-02-21T09:46:53.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '22f88dd2fab9ca0915e09aeb6784da08' AND file:hashes.SHA1 = '709c7b60e3ebb921592be87015b153b482ff68a7' AND file:hashes.SHA256 = '623a6f3f3192fe3b6a0e2d731a20b4e8eb5041fa4af3baaa68fde1720d296e5e' AND file:name = 'ftp' AND file:size = '77914' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIANtNVU4V2WuWc5AAAFowAQAgABwAMjJmODhkZDJmYWI5Y2EwOTE1ZTA5YWViNjc4NGRhMDhVVAkAA41zblyNc25cdXgLAAEEIQAAAAQhAAAADNbYFhedEkJtl9BIRJMbWVWk1Rkpebo3PkzdGTuTlJ3azZ0rjlUp+nJi/qNw1IHNsYJ9cOD+LkKweo1gBSlzRAXhwfW8a/N2E9U081WBSyF1kup/Ho0EiykR4QyifE0HFGLnMSA3OoH6WW1F550NQ6KgaewJaDwAI1FO6GYNyDOYuwOa4BQS44K4pv9lF3F550TiNBOLJXF+t9m4d+1UnFt2kYKWS8lIIrEjkjGhnySLKivA0scQRI90icmQI3TYGltaczwa/cGs/SIF5YRORrQE0cu6Bu/fnhFJtCEKfGvGuf2CajXeMkXIIGMsVw8wqhgJfCodqADxJvzND9RySVf/oOFzYXsaILMtq1OcZlFYZF3fEyE7v20eQrNWiaEuY5L9IbwWpoB933tTCV4DQpvCOizvEzZHY6Y+qD9NT9NZAhHlLW7lwhkhPBgMSsoT2BxnQmF7qeVLulTKMk5DeWpKBXlqnAR2J30FYQtIBIzdbzvho8i1X4pAruNjULBFaqfazk71M1a/b/3OKCkRjGwZyNzuHRZm2oUVy4ZLV5h+TbyJh1n93F6Z8shfo7dpbb+gnJpi9RZNfhuyyfq6zx24n5AAWnKTWARFlEmLIgdIbwXuYISspbu35N7Kh6dYmSoR0JNUMiP88bK5UxPsK8+iBdIx45GK/MEM8BsC1ANz0fNGrRWVLOMzl3E5w9o4Yumq5yYWmQaFv26USW/BGESVs2zMOlMTkP7fWEHwtupK3IKFWXEIpEVEOnMNLd/8/G8lCV0Jdz4NClTmkm0tcfXmZLwhClP89p6Fh8b4a+WNcnMYmMaxn/KecsuE826OqD7paC05TlpLoPcOV0Thk55bXW6zm1uyluJGHUP3Q7Jpdo6+EphteVLedwFlG8mVGuBuCaabVTv9wA7XlKZnWJrGTOCFZBO0coOdWs8k+HN+rG2SHsxoSdrfnonxzaJoYZdRl5z0ZEG77nChKWRJFz0yqYo/43L5h18Kx+Qa7ETIW9+31LgmfEvSsybQ3AtdRKpTzk1Mz4NGJsUm3feQ6pH41Cq+AulYgJrcfVk5hr7g1Pd6udsOHAuSoGAfAPoKxDLLIOZXPz5ZJpHcWbvGYykSKRogc0Q1JoFXh7NemPUDM7VxbFQHj8r6JDrRxEoNs1nsjmwllBxXy8Pa3FcS3Nib20ey6WdzW7implGTyGQa34xriQaTCKb9OB5uouTrQGFFPrnTLP845BxfayVM9UqjylqEunv4LUjurplSd2W8IaA+M0Yxet/QPMIqkMEjwuKeiFWQ2HO1+R0ZZeRqXo9bUS3HRljGi/j6kX1Fo5g9e/VUhHReN0jLiEla+zw9Hh2shaJgcF5BHZdpW1tTx93XC0FKl9skKP0BrF4CFWAYjtyh6YaC69iqXoRwe8XBjvtLpXXkHEBUHAxQiBZ4n0HWNgfUezxl1knOSaCZHePrnikRAoYv06O6PobHbXDKX7ql0QU2HAoh5D5ac4g129o9SVd2WvS9n5XTAJBT/LM/rDCUiVMZUOJ8mcokL+xXfGuyiFh7fPXppurLl1WeHCSGr2wXkuKB2TEeL5XGxoDuNfVLXhoZvAqc9+iOhCF6WhrATNjUlMcZSDdun3WYaltLfeSISP0nYVTHLa3hTFOPxaIeeztquJD4EDuL2ro32N/kyPS3u4B4jZoGl+TQ8ahXMwO2hQ0dfzS0/6jo2LyAMJErj2swWd+jUc1zzGsEDbKDsniLUuk8zGyVCjtoKp0QzB6r8sFBws6KHR54lvYfijRf7ZZMdkKcujMb27pUNg73fX/WzCKnmAmlrODnXvvliQFAzdCq88VD4m3lPC9BadAY6kr0TyhYGkq+Gh09rfOrUtHqt1AIclMmWAbPfVPCSyrThPpS8BlVPO3JJ20GLE7Gci2QBVVBPK/SYHbCuIWDz6ddJSsVhjXbgLQZhCBHVEfCAg7bkB2Om3NuQ1bW5QmeCD0/R4BGCMBy0l4ITH9fHG4lAjsvaJfEc2XmUAQ9YZ+vQHY4sL10yOn03YxqoaMqjGjKxqzojuBUT/hWJcJs2w6YOSip+CQp2VNmNMEfoSeL7iICdJaOAxEi7EJwzyEdGeIlM9EIn5rs0F2Ke8ZdFNTZOrhUSIUUik//KRinlpFEqPlgn03mJLRKjU8NswVouOnmN4y7k8JqonoUM35oshhqnEO4HiWDFPjk0dVBBdjn3QhVXzR1NKuu6Svl68yyUFWY3WAlzs85HczanSUVGueHf7T8f9JCcEeCkGRG3G1pFLT4QY31m/l3G1BGOw09qHEj7hkdLaYIHrHLqpCKcPP6SjjP3EFRPTyq8DLFhARBi4x+hxykzKefcfoFB7sgozsYjOOuDNhn/sL2QQrt+w9ImsjoRNmwct8qX7KkC7erb3M/Bu+uHu8QW3RqjkSfe1BtmmBMwh03eupcGiDTKFdC/HuucjFmobiSJpd1O2vP424YsD542JDA0hJaer4wSRqHxqvUrNiguBxXimjHYNmns5ntffrAssf7r2k/tFzkURxG0LZe2/zLSysSrA6JQZL6ZD3xk7XwfE9qpKeVk66+E8O8Hup9SGmwLCTGq2uqTX4i9DwBN/rlFrTzU9eXJ2YJ889k9N3RJqvNzUs/rIW9K7wq9SMIFzve6fdKtOJwxfUb6ugJ22meHpJMC34qQfqrJzCGrqWwHlQlDa7WqCfye8fmBYKW1F89HAGCc3ZcbX/SlPyv0PKTyC341ARKH+8XcPP2NqBs0iMPwgba5D4w/X1Hc6H2RRoiWNDtfWApHpxTdGFWD+0OGrst1h+3kvNv/mDnW7zpbcmQtgsTBnzoZWN2vMzVeJf2mmrRYDjhxirbCjyjtXy1Mbfuwc1ejvFfAFkQ6vBv7sdil4whTT9hS0dATKt3xCBjYwzBWV3wck7WAu1xGGTBnemTG/I3vpOZKT+xcTX+ZoC45Qu85+NYx3+uBe374MtZr6uuIlp8/zSqFYlrNBvdAJkdNYBHAywbwX/6671LzFYMKMcMiW+dm7a3tsl+UfUivcPO+wPGNC9Z/91ZpriTeyjfauXupOI+r/HUVvmBVVKt/Twmz4Rt06+7WqUbnhAf39fgC0REzX9/hYypTeGyEOuubxPOo+gcfQycR/GcPBC7hUMzpbYy7qXdStNWgUsgurtU1XZ9oh8Rcf/lQkuT4utXFY5+gzITFIjVPdpUg/5RVHaV3xNzAUOkRMz4kKBMSt5pz+yomZAyxJ+4JH7ZYHEwpJzqkqeTbjkQIFtbBpaQtEI4PF9mr/bHyERwuoNOW1ZeL5WB3N/RCTroig5k69cFWjLmFkaQFBenStI47TyvrGN5yraEU1F07SCjbbl6AbafMmuQWIlDyJQ2N+wIWxUb1U/s6VJYFMP8BV26KJikmrOYTtBVW2ZCazG4Y9cNrohv8cN4/BdyTTDuGILJpwq0MQOjpmXv7ueRXPnGH+rHzVTtGUlP5kxw4amXBbhsctS1ARvbGs77WOe1T1vjf78A0EemqFSgTNJ7Xq1uqTajoVTbC1g9x9sM0dY3iRnzMDW2Mzx9F7/r1K/Xd50N7RBIfyEDB7SUo0htHc4zxQQN+MwRv+njYmD5SoTyZ+ZxEtM2Tf5iu80YyNCiCaw6q/DFgYi2M6wpP1hd2ukyV2qpdmQz9S7+
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-21T09:46:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6e738e-acec-4ded-8db4-4c2e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-21T09:46:54.000Z",
|
||
|
|
"modified": "2019-02-21T09:46:54.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'fa97ea879ca0153486c537b6aaf772e3' AND file:hashes.SHA1 = '0896f82f6078a51fcf2e3d8aad5c5ec304ef4b99' AND file:hashes.SHA256 = '475035fda5081f1a2e7e7974f93532849b8631e458dc43e0049b661a593a03c5' AND file:name = 'ftp1.sh' AND file:size = '2249' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIANtNVU4UY/RCTwEAAMkIAAAgABwAZmE5N2VhODc5Y2EwMTUzNDg2YzUzN2I2YWFmNzcyZTNVVAkAA45zblyOc25cdXgLAAEEIQAAAAQhAAAAQTnP1v0fs7NgCrOXR8ceVs5eYRHpTrL6UipzxHoX9S6GsQHBelSm0olDQU/DypWvDhKV2M8UAISGBPluBiyCBAqbxCCQNByPvECSNdoDFwRIHfOJXCjing879LchknU+VPLNstvzeO2Ww+rsYRRnLMnJgWcdvxHBe1pluvNGY0q1fqDURf4Q+yayHajA8Ka/FLI12z2KpRDAw9hBI0VwDd9/uqKtGkgakqEiRLnu/5BNerSbJ3WnwJ1R8D848ZKuHpKVxmRJzUjsUzXsT7vZ1rY8nBgJgeqd5ZWWUtgiwhzwMVymFgTK7JzqOemPRssZy2SA9tZomRN/pVzMLvUMIgYMUzb+vclK7YxGiUOTSGExaOlZ4nPAzDSia9cwcv5IdIkIaSQZ6bmhc7CCK3OcWyujOxHywors3uwK+inItz1875nVfZH1fm+k5tO0nrRQSwcIFGP0Qk8BAADJCAAAUEsDBAoACQAAANtNVU7IPlQhEwAAAAcAAAAtABwAZmE5N2VhODc5Y2EwMTUzNDg2YzUzN2I2YWFmNzcyZTMuZmlsZW5hbWUudHh0VVQJAAOOc25cjnNuXHV4CwABBCEAAAAEIQAAAAyv5bTe28bqT8OCsrDf8SWR7R9QSwcIyD5UIRMAAAAHAAAAUEsBAh4DFAAJAAgA201VThRj9EJPAQAAyQgAACAAGAAAAAAAAQAAAKSBAAAAAGZhOTdlYTg3OWNhMDE1MzQ4NmM1MzdiNmFhZjc3MmUzVVQFAAOOc25cdXgLAAEEIQAAAAQhAAAAUEsBAh4DCgAJAAAA201VTsg+VCETAAAABwAAAC0AGAAAAAAAAQAAAKSBuQEAAGZhOTdlYTg3OWNhMDE1MzQ4NmM1MzdiNmFhZjc3MmUzLmZpbGVuYW1lLnR4dFVUBQADjnNuXHV4CwABBCEAAAAEIQAAAFBLBQYAAAAAAgACANkAAABDAgAAAAA=' AND file:content_ref.x_misp_filename = 'ftp1.sh' AND file:content_ref.hashes.MD5 = 'fa97ea879ca0153486c537b6aaf772e3' AND file:content_ref.mime_type = 'application/zip' AND file:content_ref.encryption_algorithm = 'mime-type-indicated' AND file:content_ref.decryption_key = 'infected')]",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-21T09:46:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6e738f-57fc-48bd-bd19-4c78950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-21T09:46:55.000Z",
|
||
|
|
"modified": "2019-02-21T09:46:55.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'cdd228f451fc4415d1d80a58bcae7e28' AND file:hashes.SHA1 = 'e975b3691ac96227163f3dde59183d2b7effaf3a' AND file:hashes.SHA256 = 'e1c050a5425f935557f947028ccddc0af7674b144baf959b5221ba8fa4e04f38' AND file:name = 'kittyphones' AND file:size = '116894' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIANxNVU4LUH7QN8oAAJ7IAQAgABwAY2RkMjI4ZjQ1MWZjNDQxNWQxZDgwYTU4YmNhZTdlMjhVVAkAA49zblyPc25cdXgLAAEEIQAAAAQhAAAAURdDyGuu22Be+adk+U61dRxpZWGJJYIyA/+J6UkUFtEpHIoBxTdKOtvWfdULZm6Jkg1SvOdkZD7gGV2r2WomEcgHILFoBnHCw5Uylq1lPPbuKulJJP+FhPSo/bEW0mv5onkUwvOv40gBfpHalK/u1LZraKVpAsQD4Yt+9Obz44jnW49ocITJxh/Fvp/OubgzQenK89x8FsufwDrtGXX7keTAA/6q5UugXlJtlHrludvxTNHAqdHAWIGp5PB6PQUwEbl0EMJSTwKAc+he7CpuyXpE9G/FbchcbFEXottoL8VzU1hpzkh6voJLl8kLAOAKdb8rXlDQS0B8BmyCF7J4udlERxfHkFJNsrXR4yseC8LRsTdHHZ4mz/FEeWAsRBvxixdWcuELSzTCaaeOgDdImkmHcoVP78iAFq0Qwz/JtOr1G7omSXXq5g8n8/Y0G+hgzS0wfYtKTkhnh5bzazK8owKIoV9aAL9/6VXV/YoyDRgU+mq8JtBPHmWbph0YJ2mPD7X1bIiySondZ4Ngovn+dYLM3/Hu+oNp/O7X1H4kVT+3x70eGkLCgJ5SgyakH9fe0G81CvWtHBKbPge6VM91jQpssY8GqlDFXJggndhU8t9/x7ph1tl5TLshmbsjsZJ8jWs0Fp6B5spAXE3t5y9kaFf1m+ncU9rMoLRRbfZXEC2ALpMQh3kwjrhM1nppaEJNM6KFog+/IrilTY5SPhrzJLssEt4DrSdu1Y6qaNdi4LNSxB34bdQQP3ppswElCuZKCAkIuIZLPeA0EWJdGxiW/mMuUTKXEBFr3OSgP83gQ3P52t6U72elfXe5HZAj1P3MFsudB+UZyaBn4qIl2CnXb2q53WN1A/lx2l+ttZJr4dvW7BSW6DAJdwoJNsJFTgiuocBuLH8mfnnKRAEUuhtz1WjNdpyTTgHLFL07lKDHQS4KchxUGbrrbUYnJ2XnDb0aV3YN5N+ZNX7wccXwQhkt49p7rRApNRHHaAXxVjHMI6Haln1Uhi9dvkcdQLkTB4Vg+XOrJ3/F25ow6imchaCM3zQLKJqth+jqlxHi7IrP7DkbZ5c4C7KmOaxdpcCDmW9Mjup2fXG5C5ozYMeJQ9O0IGrf/h+8y8EVG5z12VCxgs95UtfC3bQEnpJm+ceAM4u4fpkjrgIolWU8XRk5nbRCeIlRgJcIb5gctUkq4CTNGwvuRs0rvMnKqui8fyWQHzD6UOIk7btclu7GpPWj2wK7V0VrLxQ9v4uzz7OZcbATY37FlwRS0rXK7MUZvICiJ1nyo2oFU/+yr9eiOQUm/IWTX4ZGNlM9/KEumiGGpLT0Q2nEMu4RdlDNlnzyoaN13CDYOYEorR2ZE0XuSLSRkq6SGhdYD9PNmyTB6kdF6nQDxxC++7zv/i+ezwqJBBtJMGw4Y+Vx7tOnW5qanUl4Hvgnp++GtXpSIw8zjAY0NtcpUgyPL53kmX9HButuw2WHou8qy0UKO6+ZBVwPjjtLNAjCQSiNpmNS7wDlUO5nRb1I4YUXh8cQer414UKTpj2yALAZ8ZNYpV4nRrGHmceeM7Xye78xFF/Uu8RncmAoZyIqt93p0IA49qIu0fyAFQqxHVVoEQbmLVXVrIRGkSJHHaXB3WeO7aWPfWfnVNc99iSGTdZK24asb1rcjZDN6VslBHey69cEm41BWqkdjOZeuOiBSnrx9BleV0nKN0duEetIU22w5A3GnEO6XbZMAIKlM0qqhZj/IvHjIdXlI4nl46W8cDqzKzmnWkooRBfAOuFvp10BMPZkdRF47MZ1S//9mtEUYXKjxuGa0rgte7BYZEHZdlsFYX1b2aMDgm4dJyf6tvyXMic141XWTBKdkXk5TJtNT+k9EjrZP2qsOBf1i+3irXNShFhxa4vsrsfzA6rjgGqK9i0b5Vj19Err6VWyENU1/9ipKEOppJRTEHUoqEQFpMgt0RRU/4+H5SqOHnXSg8f9UYwDKcMRc4ZmQFM2QiGFD1I4KlnvkhOSi6iZyl5QvFizs/QqiHNbXiqeSYWCK0uzyh+G31WXJ07LgaC0Ypp85DDQbEbg1+qs/AmDNpTR0wPlWgC5+2YohLD15Zd1drZZL/aSvAIZ5hHJQij9A1noNERsFFY7JgekHG72Zj9resMfssv5wkfwa9SV+OBSeALHk3CF7d+oIRI2A4vzv2uraew2e0XG/7vTsN48SuFuPZDWtd258jDvgVOc6Xj7KAz/89b603WFUYMMLh83hgJfvz68m6kXFt6nwDa5TGNYMQ1s/nNdOSDXPbs6ymv5GDwzK9i2Ljqrku56fVvCH5EDKuPNSk3WeiYfeUFKIV1VovgD20Lk6TnPcrNzxEKN+rC5qoORT6yE1R3YbGEbVcs4+utDT3e2M3ALB2CIY8cAIc2l6VDtVdtjbveI4YR7F4SvycjZvGGI0/2uyZvcMf7nPk3FIZm5PvTcbJE6bP5/LKg8a+/aR0zETn57RM3JwF1uqbYycikmKRYa4fVBJuAyH1ZSIVTmQjY0r/LEiBu0zeEUeYsgy8pATyPzNpYCD8cOKFxews5gOMalQrHp32lMH53OhWxsUljJqC9Pnc8ABRNNDMUZYLsmNUikDovOlFHthKizPmvKsafu6CzH9efblJxPD04VjzRxyfmB+hisT1orhyNpd0VWanyjE0Hs+xewuuzV+/3e4/NonMs7ZZjMXK89gzguPebHRgYKJCCK0aeCkE/Si1ruJXWz8ACvmhmYaG5Orrf9zECGoFZ07WjlvJvIHPu1sC8fCX9jIZFsfHZNdVRrsntB77hsqMx/D9lEQlh7r1dFbIsQG4T8rXK25LyMIf34DT9Qn5BfqzLkavtymqqY0DKGC+trNVPFDRYXMwqHrdKmxspTV7TFMI6D+pgTSwd8+1MfPvcjuUcIl1eAgBlVLR8W4xOno+Emp/WCpKvWobx+/mODg/HdLR8dqMWnkA2AYLeJzDU+m/tWfdBEU9VDz2tOLeS5Jt5YFGk0oz6TKJO1rX6LsdoUZEftguCGvaBxGmlvELstgkBfxehJgTPwsR/D64IrAJCdhvJy+5gq0g0GH4Gbgi2qQUp6MOMLGIhk/o7U2qyiwCrvesQIsImz3cf/ag5tph7GIXPo6wq5IkLTh5jTOe8V/1zztPF40j9A0y1Op985EnaGtl1jeQV56dcB0/MGfzVN531BeE/OiyT8s4mKlhKVqqbckVgoIRp0I4QneS0ItXWk4r7WWyssGN0RvYjwtzoRr8zGJNzu98+PO9GMNOLqDM1UZ/3wUNA5N/SmEgxkY4DC2CF5UTFh3nbAVu8m3wRDl1BszMpV1a9YUu3+ZRr7dKTs2QxQ64wFnKWYD0zsotMUohxVgF+iRL52qiWVFLdG1KecsGxQHSXVfCK5tzaEyFWKS6JlB9ElEfLiC0SfnDuWY8M5KrcwmmxeMV4hRgP5Ne3wtuxGGdHpytLHqBPaJNMf023vhoNGNG0DQGmgLnudu6JPLm4WZL5XAnpmYor6REDQ+8vCQsxKV1Ftz1Yvo83yRx+S1j0HAV6NkraK6JTH1O+HWkhehkrdRRBKpDyo92B8wLgNq0hRrrRoE3ZYLEEHiQKkfGDeu5u3nnVwhzfVhv/MHquAgRN6i9XpCjHI07tp5E8d04BmWCseAn80e5v
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-21T09:46:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6e738f-c234-4da3-a0da-44d4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-21T09:46:55.000Z",
|
||
|
|
"modified": "2019-02-21T09:46:55.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '956d447745fafe12952363cfd1a6aecf' AND file:hashes.SHA1 = '57447545237c0c4e214bd16795c1ad3dc587128a' AND file:hashes.SHA256 = '8a0abbf321c2368b162c15cd322e465a02e696d2b0fbcf2f748cb49e98d3543c' AND file:name = 'pftp' AND file:size = '95137' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIANxNVU4niATIxJcAAKFzAQAgABwAOTU2ZDQ0Nzc0NWZhZmUxMjk1MjM2M2NmZDFhNmFlY2ZVVAkAA49zblyPc25cdXgLAAEEIQAAAAQhAAAAEmKjsQYqpqnySiR1TCFl4of+rX179rp+/mzl9Ks3hYW9SYeaf9uzrmwpqkfbJs0fk+Nl9YheoBDNyJpiY9uSKxQmcRwZEi0AW2pNMmZ6hOxanUYvQpLqNkypgFgJhQdVlInjnQOpToyCLfPBlS+WL+If5xfwn5x/mG2lhZsJC5pHOOi89JdvgpCFjEgiNlCB8a809/f+rHdPnE7Uaa9VI72cZXQPXHOpHOY/oACrZye2sHmba1HPFGKhOSfhIaYQryZqmY1dcL4bA/T5w0EhTnQfJ0ylCLcjg+Z+FrgDk0fkqhyN7Du0/P3WSOBA2EYLxWQWkSSP8xkUQ6E3V2TU/WJG9skXCS6NA4rWq9x8HqQv8GvFTivqTTQLUu9TCdqOIYN9OiEkx2WJoArdBg6z62Lnwt/4r+FzE5FmnVsEfpSM9mIPKBjIMoeWovUAqW6UhxZRH2ASeOzb4+PWYAVqkHhw1fIrI+K/VH3HrQaTtYj0hUyZgOopR/lqqNnpE/rlyk+z+ULnH6LSa8J3RelyAHrkZej8vr3M+yW545dLgJqdP4McFFopN980NJ6V7aSUYVs29sgMEcK24H/LKr3G+BpIS48YXtboKXHUST4Jkz1wqaHfZvcO7mGmUBkzWDMZKR8/fgFID0463Nc73QUR8yJDpUfadBlL8Tn5e+7mskhpD62w8DkjYpI7Ugxqve9uNj5fCso846qFLh/6i1M58ZacLl52A2bPVdNiJeD3c8xmIRvOeozKL0C4IccmxdHwILbbwswA4e3yXH7ZlZMyWwSFBeTtQOb+fXviwa11FqCYNFoH11JJuSGR0oel8pCRXDMF+vhQO/mKwVT5yjdednUVYN6JWugg7NWScCQZG66dpDL/ToHL67VRcCPhQJkcTNqZOhPYEHF6uZEWgVZ1GYwC/kRG+lxSYFLwKyIS6hUADDKm+JlOAbgBpo/j51TIJBWRBBKBo39cHgL8+cYAsYpjWU4xG15NFvY8T9ppt80BjqNltu2W3r9fQVu8FpLKY7uBhrOTOc6CzPdOIhektGPR+VH73JlRlYkLFGkVodNnI0vvvJz47mDrspLyGFr+sgDtjWTzvqXff9+6dYAjaiOjl113QQS0K689huJaRzTkGm6xk463MhV5+1bK9qidYDv2zwfBHDoG4OJmwlj5OBMbH/j/dZ62AWDrAfEOKXAMxOJpVCpddtyYAgz42JmGDuJWlhlF+nwvc4NUft7fIPBTrlnyahNPAMxkeaLoWN12HrCHkPBfW0V58/bKdJgva6B60/kYVR9YtemJXN4i2VUyULUIDvca1+oh12VJ+dxlPTDG/cNULdhXgAjYLyGGjX+cCxm7stFKI05UEcSzMX2aL5XcMV5iedGU4q9eKjQbV9ZHfx4cnSm5M2SosIyAw//p0qo8U9GNTIcXEWuFdkAX2QIXmt7clpKJAIs7Mz6572OZxCNEAA0CGPll9cLc8xCQT+z/BWqLSabKabwPAf/Z8uFL5Swgj+OgHz9amqAzJyLGXn4qWcGTWvEoeRYo3DI5uUh7xdEeSR8JSi7xKWBxpm1IOWfkjHoviqw5XSvivM2RDSfxHVMedVQlVv6HtECkh2ppjSd9XsAGsSQicf0LNfrYvPT2qr9hjbiPbZZqBt2PRxoRBQ4XHJBGTyG3CmLd01wS9dB+C15jBq+WrwgCzjMzvDZHiwXZ1PpmDWGMiKK4wPhmh5dkNDfmEviaCtisUcz2A04mEa1yufpaTt+GBUOg8WRWX0meNOoeuCFzrfxt5t+2pr5GKlLuqmqtO9RrjNj0J9YWtcd+2e5rdQy/vXYUuHXZCqJwqaRydr7VPc6glPQa6KDoLI7dGHvmosniQgcdZ7mN+jkjpOYLsyKQSgFuiK4I2GDUQF16G7TwMvT5o/Kw2qsKg32YoYeUH9aZ25N+JYSwQBKQxPs4Zu7Dxxl1DyQUb9jYE5r9mzbZwFXWD1KIUnZo8U0DbkFPHBPrYm9gQH8zVqWU93W6aPSN4YPUeuXy6wfJyAA32rIFtYCQO9n7zqSjY6xZkWn3XnvNXcyfDmat9Xv4jasSwMI/GkoSOGqMDNl00W0YaKiovwD/1BcTnLz0u4b7vTY9yht8SG9n4GpymSMa/bgMEOWKgW5L1wdr99vh+01jiC/EIlhbqJmc9KKLsh5yKUpYjcT7t04U/q01WXG/xYPUp5oL7Raq3wBNIbs6kx36IC7M4TYhOKJLPktyylIzLoWv593IB7CIlakoi0jsqGYYu4pJM4X62+PGGCIFO2an4of7nbcAct/kVp8RHTLTQV9+Su2JtLs6VqiYp5RjWyHTYXy14xXeGlRP1J9RblIFYy4DMq5oi/nwpHFDSQkskpWI223vSHDLT3KWK2tIYbkUcCCLedJU3hge9YdXpKvqavR9ozMdnvOfv/YrM+3rAUXifw3LzCLKCTHupaMtQOCZUp31SpO7fwcizVmmvdhLi7VVTKPZV33ZLSSlBX0kYOWttQ8/4OA+SDHXbJLyvb1OAdgnjH2HzG/lbyLUIZGkbWwOIqFcsLzD9gFQNimVKylnmPaCYxHU9hJ9rLfEF9LIntFbv74hfltf6MTK+W2WpZusPbPOaiw6IwDuPlh/IsLYIM7Ls+xMaRtDbiBsMzQpuQa0/pcAqyD+eI/TcYzEiREIe6PGuAcLB5TSPhcbnHqOrMC3gUipW8ayfit0luWmOZIooQH/47HCliBtp9sVTf9M+IUZKIQ8yZw4GoHd6GgNM3sNhJaAuf2vWkxQl5PUGVWyYegs/pMuPIv09BjGHHpmati3l+sSXZMsT0l7aDqSn8vW+ZKIVTYbW4HDxK36Nw9cjcg27nitNG5hPFVXAqwYBK7a3sxgRavDYTwbYypsGLfFyLumURa1dLSzs11CNKYr+UIHqtuNZoFOXvb4Iz6beCSsKoTntheNQePz0eeJCFE1MoMLhi8D8Ac6F4cT04EK5kxhepUC/29EuNjnfdECGj6GbLrr9UWFmAFa+wC5xwJP+l1v/jdl6es9/Jv6eyoWznYGsfb37kmj15nbfeA8laRmH8eSMb3Jw858CMwRblsDfVqDkJH03aD7PhluUsgAy/+2sqanEsgyIMCvLA0I1Cm5ZGKxeGTm3rvjDQAX2t4fiyIkVlGQHMtTErJyVKZqbBMlRVNud5/E4EP6UtKqHi9kFnHnvWNfoaZTQpSP4gDMaMaIv8VFrU/Fj0mYpFjc5b9ljdqjsv5+wIAcm1DDQiJt66nB5lSyaOvSEhBdOtWfoOf/sG7itdsyxHhco938v6vQwLHUaf46iuxukrIvgfyOo2aVdlH1wmELnhxWjf4SU5cMVUe5rbei56JKO+qobkjbeuLU8iga+Cl8J8ZncfmMZRPYCNw/18TAFkd7YJ4bF8EE4T9g+rCzbHk9nSkM+aAWOENjtEyYdSWpJ0IbhyAC9AtjKQaPhwi30thTvBnFftULOORzyzY5kuEpp4SzS1psRtWn44KpXcwlGZEwugJfbE/ROd29y+oG4UixAPbooTUWfVmR1GdYHv5qTZJ/8udA6AGN8ZClHxGQlWKof3pNQKvUQd1EACob0XjtsqjrcW13mBENUdcIYZxUOVrthOsisfDPGjWaJ3IRct6AiTTO4cgXJFBgBINEY+Kv6m2UZ3k
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-21T09:46:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6e7390-482c-409a-89f7-43c9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-21T09:46:56.000Z",
|
||
|
|
"modified": "2019-02-21T09:46:56.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '74f275d2c6620d8fd2f5819ae9341158' AND file:hashes.SHA1 = '8547ea228be2bd2563d87742fb25ab5be5126b9c' AND file:hashes.SHA256 = '05394ab6eebdc4ceef62efebb2a4e760f3339ac27af22b490057b92b56eeaf5d' AND file:name = 'pl0xi686' AND file:size = '77914' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIANxNVU6y5YN7wZEAAFowAQAgABwANzRmMjc1ZDJjNjYyMGQ4ZmQyZjU4MTlhZTkzNDExNThVVAkAA5BzblyQc25cdXgLAAEEIQAAAAQhAAAAMjhNL1ioYdEZin3nYz6ZRUbK5++dYZedbr75w1xsTbL0A9tizbnUx7Ext2vlXLKG6IYKHK4tH1FFzVr29VZ7owfzo7Starmp5m6X0Mf29zGmIeY6hj/mDZejNo0oPZ06jZNGo83gD4V/6TKtC0WOHo/NUsx9ObBQr/8T78j8XpBN1ytUgm8bhp4KtV4Mrxe27ysM7ZQE+ozE+iHhZsqbmZfA9zTI9EnzFcFGHEnE1MG9i2Lo65nsPDRNB/k62StHLza5ruOPK0hefO8PObZARaI1eF4gBt0RdzG5/qBywJTIw+/G0DwOJrBH0tfXtm73mbmj0MCcGMX7D+Sww9ECva16UJ7972upQe8ZquX6KwYNrSWYaFIayZJzVGyKnALJ7qZsa7Hdl2H0OIjeHi5FyMzY3AOA4usp0EfGpPInyLoSmdcOluH+UFit5Sh9mpxMXdgkulZTEttSWv6EOggRK1fj/y3H5HhF2t2RDpmx1eyadLP+U9z79SgJsjdiQCmGlPUelUfMfv0lh/IakymHtI2LaRWOiVhc+vtbTlJeJWVe02PNYnSOqcOcE4y2HR4BZW17HZriHQjcDZfDxC4tbZsQ2ztDfLgRRg1U7JEypCm9ted96X4KzqbQQChtZ5eEUJJzUvao0jV8RjhaBrd2dFWpDYRdIGbpwtBn+roCY20Wfnn+ZkSkL0rW6saF5sIRWr9bSc6tyO2XQdHTMHbVF+8wwirsfZWWelJxIgzFwAGBfNEJatWKQ72TpGaBl4REh3JaCW0tTH11oXkmpDs5QWX0wLnzogDU2/JxvqIkjShYhhM4ZawstCACbbk0Z7lG0prPoJVqhjHvdeaB6rO4QAJItGyLOJI6RVvBE0nYGaHm8tRNdQ+6BKKjA4NjHluKMCvUVnwu1GaMa0B1hFvAE1/lZyXC9x2enXPgnDxOiZ0VEpUz7VY37795RUzM3JSty1+f1nGIqEX4AerNeODdd6S8QxhAHMfR90GOhLJ+GKTqm64EF0Fq/LeOBWZ08neZL8NF4W2c/scD74P5LM5deUG613096tGN00rFhxm54p10JeWhN9Z6WcXmZWZiGr7scxGwDuW30vS0nSxvlyrOaDtRSD4c7yslE3pQL6cki2bVTYSm9HNUtGDj4AVqYssIksv6CcAXmUSAeq3ffJTaQdJMSukmg1Y+/u/9Yym+RG9I9w25YsT9dic/y0akULmg2P4buVEGoDwAG17PozbZsU5Qrnet0EJGsWmARMVVRvK7XKggcdWfNiyBPKm2O0t+nY4q1x1XFsBnSMvEVAWUCzrqh/i/6uIPGtySe+uGZY/oKH+xB0oRI6IpFDHhPhbS43pjrM7htAKXbe0WubEaBsZhrpS6SKO9F0nyMd0iSvBvMWIGY3bd0rn+V7Ti9Qw32QxetxibJNWwCG68Vs/c0XCmNtGQqRBrxO0GJ/G5G+9IoS7gsrP5z+rlD4HKI3Poy/EHm1nlzN7bDikRHPlPfEYfcsjGgbfm4GexsYJNroPxPPFyPcXsn43y7ADxFjMf0HDkVAqtlk56rQ5p9z59Rq0xne3JtIKBPPw01y/Hsv9SXmojHUzkwuz9d78Kz8JetY7yEJx4crd6yHRWjaPtsdtp9a4mm5iFz2Su3H4Rl+nR5i05cB2WDPuP9kLbZU1BJZASnecq2mp0oA0DcOvfC3S9SbzZ8mHGKbGQETj6gRKTaKFo7BjATYq9/aBEv9FARnDyXJS4H/EnfzxYLNTgY+7xRU4VpJ1gtJYJWuZtPIfq6fK5f7Q0AjN8bSUNPSsZleHRmWCfr0iolt8EDuZaKY/cdbDZlTUzsK+ylE243Q54kvIE9R7rzVUPWQwtNTMfIfDlTE9aURu9rwKG/wk8k0FlazQBXQQ1sRFLI6PzVtiOJHZ7Y/6Zcyx3DZWI4Iye849RtisQ/W0lclBf0QasK0aQ4RQNs9N77qjYvjRr6aKemEyd0SmExB+u71+g/aYAxb2aEwru5+b1w5QNh/1wjCDYaFo7+PuqLx/jmwCl7h/yChYhbPlUUVQEeu1l1njE6vF0mH1x4D1yTGz5o+PEu2Qg2xEz1D701RyYQLnCFYHAEIjrcSHwNSnfar3v56OqXU56V9ewgVCknGCX22dszOLUkcwKgO6RBuh7MoFhrnYtAm4qxL26Gi00dWYrvpsfX54wU02heuAs9LuYDUFZDIf4ham6hawsliglmuE6c+ekW5h5zkZrz3p+zdJGHKzWTYRdSEo93ojf0BewwST/ZcKPhBYb4Ij/6h3AQq41XrF97yR/mnrcYx59xiRb7w/1sEU98B+Ws7zJKKZd9u0t3gVZh5dUwbDo/yy4NGgVzpTobs8EVx37FXFxzPiMCu5pCUCSE67zF0Sz061m77803qc0glG6HrDv3w7gVMULR78n0SQMp5TBViE2Kv9KPPpoS6+QJAJM6Omdntex+TRN2+KmTRTwCUQOII18e2fOsnUL1FOiUIC8UP6+YEj0sg8am9VF7KPlcBDQX6DJehWse5cTg5yHjAuiBFdNkHoQoCrcV7qU1dJ8nqM4DUIKy2JW/CgH2PdhkGpXEYXhEHOEMhSIncHbal9ze0iHCzetuyJvyxRlfaWGfvl5RCKh82uyDbyjG6Iz2RordnD1QIdwZvXp5YUu9hX9naql5/IaAj2ZdV6pdJhR6v8OfsO2mGqYJl9FpmPIXBl9TReEwkKMqj2w2Dd9iy2bsxpicsQPFOX/KmBHSLpzdpqFDDMVgOro4kzwyhfydnWweavGwXkAg91J4dhor5TJoip+NikXDCom2xZl/N0zLJPidtoBw1q2z6nKsH/R0y0eLcis0P6Ytj98XXkA9cIrhRqZPyw5N++kn4J58lyV8xwKpID1+S8fqmEU10gHg9SEt8ibZXFNt6qlvOHBq0jvK0Hr/ZFd9oMn3fj95MXK6yYdfcAugg6bimHU2vJ/dVU+igSbH2dufUwzXUnS38b9rrqfvXbUg5vFU0n+WVV++ema/vA9qi6nkQ5DXZ6+6Gir7HqWvT2H/MeY8KPk9H6CNkwxBTcN5kYfpwMpHQmi5GfR8hBUciyNos0iykKfjWGIQYgqgW6nQXrpFLMQ8oZ8liVOpnObBkIKUGdMqFx80+b890rBIUMIhygp6w3pshLvKKaQK0ApzS7sCcUHOkr6tgYL2a3z3LO1KZRZAwymlPta/ipHA625oVkYUNEyPxq10ykSz4RcZmpYNzaiFDOCqBAmt1fEMTndPDId9gpX9Be4qXxUauXurPFSLtxH8N4a07mGgIlhVtch9T7yqFoiyY1M7S+JXv6/vyUp7jTygnEHQJVfpJzSyfHPdl7vZmyLtCtTFupnfReg3Jqa481ugsn24lBH6+KtSJKGV/B8aB5AvBabcsBjIJ30UOksCYjoNt4RTKlS6aSaVH1pAp9GlNzAg0DgcoB2gT/qnMvBH8rmeMgIJ8F8MyLRPkmkRUceUbp8qNzOHrt39tqroj+ypyQe0DRzGPumIuZfYyE1Lx8dVIx8foh5sgsHQZCMFcLYyJX7gbkZjXK6MDgG6J0R9gns4eI+PgN/+KdoyxY8qeSr5rAPv3wX/4miXcoS8tdKpfKlsGH2sPduH2W7I36Lx0P1EZ7HdUmnvUMWVJmsW0LwVZm1Ij/gttg
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-21T09:46:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6e7391-4144-4296-8305-41be950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-21T09:46:57.000Z",
|
||
|
|
"modified": "2019-02-21T09:46:57.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '87c8c0e95c33ee51f83a6aee659d9df2' AND file:hashes.SHA1 = '4fc8179d56acb490e841ee884b0fe27be22ebce3' AND file:hashes.SHA256 = 'b97e9993702e0e7c214b72c5869a8d9e4fd59cec7fb42c9873e548f52a6a072e' AND file:name = 'pl0xmips' AND file:size = '119796' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIAN1NVU4S8RP1RKgAAPTTAQAgABwAODdjOGMwZTk1YzMzZWU1MWY4M2E2YWVlNjU5ZDlkZjJVVAkAA5FzblyRc25cdXgLAAEEIQAAAAQhAAAANJlwKHEJaQ1Cm7+v6J5Y64Ki/2U4m8ImE8YYaiL2n1XSXssuk87hLrQWK1kjme5V1J0LEtqD4TsHCPi6i/0QuTBCblClxaRBIail/OwbTF1JxKLkP4NoDFWenycH0Ynh+D8yOs/s+G9W9kwEodf3EeVgqzz5V+EUnb5qlHqfwRJVz+Oj/Pc3M4+EwaZzx6islc9J2NhVBoOHOZOk8+uLXLPhixxcp/PXVcAqrdc/7nJ8YNMabrWK3YmYftL+rUpWdSApiNzZWmzy6R/rdmw3xpn2k9m09vzQZG6Y8CZ8jr14D6wp5DWuIWCtt3bdHjd5718ATwgOsJ/IDbQY0+fyKD3JimhL40O9OD8Rtd3yO2N0X9J+dksCypGb5jokQpOKgs0ljjhQHYLzb+9w1d0JYz4NVq9iyXtcPutorRbULfP4WoWulV+Qgo3MPiR2WTvmFdNDRqic34mxh3NyTp1V52kYHI7sgtUHDbrtDY9HTtJ+KRSENwZkvNRrC2QDVRkmwD+1h4zPmb0Msoj91UuHSFNxKjbeIkYW6o2QA04TILFhdLzXMHU/D/tQfVdR9eeothuf8/ollRiV7qx0O4ymSV3knyB2/cwWdggILrmWwT4kiVX75ux7kCDoZ2t6IsbM2h/GaPisirq6rvR8sJJhTaCJIiA0k6hQrizxD4evxSRQn90Lu0rRFCJZoaiHHXMfNDqHFkrIuUiPOzoppgWRpiIWbe/+cmeq4V6nyYC8QNaqo86Mab57rACno4LMWFmCPl0KiCky79IL0QXYhB/afzaC/pc6ffwfWWMejJ5mj7QB6oJxhTG3b5iSMcpZRKl3JDXCEbm6dxgVznY1cfVe6sHit5w0JWfikCBgsHvEBi9QQmJPZ6VwgyQrZ+ksAdekYslIpKJr42jd9iSzESiXhnxgulL35IoE1jnRVztbO3urChIgVyEuNMw9DwGehjA9zAbb2pGWtTvI/aK3MiS0QkvmvuV87cati3y1UKohCySENylqUK3UIZu6LifciyiNTRqZen5eyde2uPWnmrg6YJPxzMw4DV1rxv9Y/FFSx5BYNwDEwavOkm/Px+5R40tC0bRiqOf3/kxITEVcdpotta+pG8FPT6GMtg3dLpjvc9cLBUlMSwe6CFGT3kR2+PBMWp3zi3JisIjsR8kgsfE6jTaPg5kcgJutwbGqCb9aH90bHSMkPuxVBum42CipE9HV9itFV9njlnYkhu8zFgyeNStnyo2EKfNjsmAoje2ToG8hmOilJqvTxjYuWyMOP+w6RG+XfUIg61UthJXehfdasdmW9vK8Ljd/U0jf40z1smwiw8EEfhxom2OkivSEe5wDf7HlbUvpENuq1hsEX5Ucv5W9miQChQP06Xa7NpdfdK/avKzeUyWHxc88kLBa/N6nGvGC5xWJlCPTAT2TItmZIa42parhcPoQK8P7s3nofd/90tZNy95PeVSLAu04Re+sToIUC+VGQIHbisLqZ/91OUTLacvCeK1QoAyjJetlXM6N9QAGNdxhUfw80+v6jiPyzkoYj0xUdg7MZeuHkN+axfk9m0dzb/howg3Pa1TD7xPgO6Gz7RfHeuWl5bdeZLn6mnbhLuABKJHnZaEyXQtTrXA3qYsh7UVbq/BeBwaGvPl2dLn1uly6ipA8gCBPi+Rry4kNNp2L3GXff0opATY2dqQP/BJzDFwccZsGUm1QdW5te6mHRGCvXHIxq3rgo2YdOxljm+0pA4vwe9PdcOi55GkBq46iMIrfOsln+5zzKKNG5TK7luWGiWzADZT3cdapfFw0GWobTlRWNhfyWpP6xe7tim+S66l++l2nG4TzqUAY8ykN33U5fS7Ro9TKKIR2XhEbd8emkvoJ0scNLbtaCb/OXkkhgepPlT4I3IT5C9gdRYR6KOzKg+1PdEukBswPK4xrr1xEdYc/wdtrkzCDabyrL51saeg2qeCfNmrHiBqc1sc4DfIGGDJwfvkuAX8XvRG6zkD4135pjvLSnFDaiA5f7o9Q/3HhGvpZ69OtiKXBzw8DpXM0ahSPeQhKyHCheN+SpGaQ0+XRQLAylkMMb2pkwxgfMtf9DHWj2TF2tWs89bGCarMJ7sUin24/WRqfxOmTH3CO8kQf4sILLx3a1kCOxWddwtrUfIxVo4meTo6cTLnttflI7YscUxg+HI/e6eGXtxN72tjmxdubazENOT78LaXDcobj8gJf+lrA1nbo1hRvWjE1woQZoZ0dzkNZouurGskhZRQzbMntjS8WupdPxGIUnE6JuKLnbFfS7cs42n+FsufwnTI/R/PZh/U8n5gXAYmaSLr8locCx02KU6gjL7BTSCi/CbPFUsGE4HoE6h6ewfl7gkK2R9/aV5SAVCdY1y/4HFDy2diz+Z8/HDGCYVE05EWRSGHAYTO5VfnNIoelZ2J+AYZRkIflzv5TgovQMPcMYqDShPqJ6MO7MJ2Cn0Sf9orBjcIkdrtgrz0mE2Z9O/1nP0B7OB4T88qlj3CB9DVbziafUr6VM2ubtagS5vOQ+eN9n59DXeJpt/hLB8LgfvMIApkxq+yomAxG9BiHgB9VR46o9r0284JYv8drL1HPSyYIwVGOANmHQIVPXpeIL1PsQWqPvE09zX1d8tuoTM7bERGx+LgMd8p1FBxJ9mD+fTDAQeO/fDNSMo8gXOvOt/hkQQ8Q4EhqJnz5/E5dvSBhCJ+PY7dvLU6TkI4MpJPRG+BO9+3iTND4LUmQ+cCM4qWpvurxlleXXU3UqYxwGKwCUZTXyxjICkrxIo2DvDV3GSp7e08l7R+R2Sw3LK1Nlany+HMhojrNa+WmOo4nb8a0FdnCXwFxWMFLa3bTetumhlY0/ypwh3IMQm0cbM3aywMge40On3wlhnu+JB5Ko/N+D+oDp71yxXzau9cFb+XzTHE3J5cJTg+/nOXPhw4ARvOAmAYX77eOSyjEiKVMwaRfjNcT6b+QTBpX76W0VXkC/gXJT9THTGGwKVP2B/8qDjDndNyNWN6MTcC76CcYc1Ai/HdVDkOWBDa2ZMhh08XsZItfaYBpEOquOnsMscfQY4K2RPVUS95/VNr5IDwx3KFwEBh4DASAANLnD9IwVcfU59uFZpV7XKWayQ86vuSdH5GArHIqOQNmp34RnOyZ3UU5qcprpZif3kb2CmnjOSe+kvzVTV+bK2RGAbYUdOIwtaM9kWLCC7DNk/tsvbQ1wlB9N48zIrplNLgpgKviOuFIypo+dBIdJa9kke26QQ4ei/CgwEMp0l1pb1fVCnT+mM8wp+UeOXOpg95+WOW8CcZDF/9u4RVu8Q+1UQLIzl6+8qM6MDLKRMx7MiBTK54sSExe+A97pLtGhgJAMEcvUmrVqWQbRDO4VX/FLHx8pC1aBcY91op0G337tEQjXqWE3mh8O76Kn6ggAKCwYn5d1uKwthOd52NslqC6dLnF0e5BNptbaEEFgJtftk7z6I9qJa4Xjoi4rPnmx2oL1CHKOepZ4qNcRFTdvHa56Ixxgar+KbpQmE8B5Z3IxdDfUge+sktuIWOs3fWm4g0YmNylT6uFiF2Qs6YHScrm5l+uOisH2vALhYDao2o+eHSckzxXQb0aN0OJAyql9IP7JERp7O4rjxGnmgow5HG5fSa8Z/tOlLarS3RFqC/SJBE+2a
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-21T09:46:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6e7391-2b34-4fcc-808f-4796950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-21T09:46:57.000Z",
|
||
|
|
"modified": "2019-02-21T09:46:57.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd5abe44a8151ca764bccea7bf82ebb47' AND file:hashes.SHA1 = '7dc2a20e6ae81fcc09d96e9fb58f4ed4ec06d9d0' AND file:hashes.SHA256 = '7698bc8a71875a8937488facf779d023834f92f6ecf1e926fce7e5857f8b1306' AND file:name = 'pl0xmipsel' AND file:size = '119796' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIAN1NVU7wNBJkY6cAAPTTAQAgABwAZDVhYmU0NGE4MTUxY2E3NjRiY2NlYTdiZjgyZWJiNDdVVAkAA5FzblyRc25cdXgLAAEEIQAAAAQhAAAAcuqkMHlY9Sz1e8XSvFVjz3bvyVKthC09oLhbSb0G02hn36Pl7Qay6itrwd/6WKLalZgen88hIjUYYEjSGLXl02cqjaIl2Vx9y1motNnVU1M1Qyil20b7f5xPK5r9R6sgclTXuy29s/oIgCltHhsgGo54/QMFZRupTRKb1/8vKx6CdR1ZCjHp0fHxSsR7CUQRFT+cKZXspg45KoV+0QvqWQtofKNCoqnmuXq+ZYCKmN3BcunjmDAxreOQI/ThLLWH/lLh9quiBLbb8RKPoTyJnbjCG3tOFZg9lhnAjZYF3Oft22mA6DeFFPtjdMwWGoS0qfScj+mhBdJhqGrshK69lqKzF0XCmULeENJ9c6yCKYHyWuEOa7+iDQCMEW4I/Ml/h3lGZe6LJ7p1UcVpvGFWG7Rtra/A/jvoxcDNeQPUIik//AMqIalHxBFyfyLpENWrfLgvYvkq/bmQPck7XrwiAI/amnjTvna4Z1j/9xLjU+JtSI5HGzi9sKwi3gwiSngbWBI7VHfnIcoosZwX4+D290YktrSvBWSln0KJYTLIApOEg0MXQI3jqMh72WZKkSXZinK42tAXbcsrLma6yj8t1oabTOpYOrcDuq1hExLHJB7ZrH50orGaQ0jHan4ByEt5xYAYkqgD1dFv98w6767ypBx0ejI1HxOeVJgbwhUF9LVz5yADONaOW/lmsZGpNL3NGXqTvqDBpxcL+IwR7uZrrxNoZVKhcvbb0iCtVyVM+w/InB8Exi2LyewP0a0WnBDepag0eCvL4o/BSOUWoO9u+d8pdJeqXsq5QTQDhXMUAjshJm9rFp3MyrjuM0s0mKA2Xv1LdaODlNZywlTKzJC2RsHKWUqQ/9yfQIoIVncfDd8d3k4GuGrQ4mNn3o8QKgqV3sOJU5+ufHaChvMlIy1whVe22s03xYCkGhAYqFRzuJ0teL5124WHJe2v4QrNSeKMEo/lCjVSQIjooamRoKbZLF6Q0aG3glpZCdW5SGych0H89RhGsOHi6eAbQ5F7V6BAki/uYz6XQQBbLpVaAPsSsKNS2W76e4O42iAJQaVQIge97I1sUq0Y4dtThOuIUntI7rYeI/6Mrt62zOh5WC3JKmep+ST6ECgLlVhU6R+UOZgpUurD6PWVFKv88mecsCEXs2ij3AKL1u9mCWUOWcn6MUt6zuKHM/S9jSbQsL9fbDXF9yhCU8jGM2Z6VrGIttmC9W37PTYjV7+9iRQ7kLLj1ZGceM6DzEXrs15oT+ti0ncntv8lJvweISypNYLIxP6iUaY/SiSesMAR6cUkUs/+5u+zBhp1a/2eqlquGHK4vkwdIcoyJS6B97Bcsh4xYCRDjsdDMdXlKaUKoIEAyX+hFfx9s0Y0+bzD5xpY10UY8g5lSSgDarWs8MWd3sok8rojUDyZlpNEoEIotuA82oZNuWAEgV6+dWktmhlFi+tJgzmj4B1/UnD89CUmVGMyi436L6Hn9TG8gq9Q+iddXQ/I3wCFlTQHTz2WDBz63ydaYjVY73UpWqvHXgAz2aY/hf3CtlYuck2raf4GQ/pQqxRYztfIlMdjaT2u8zFw/StiPaktrUO1M0BSD0AmQ9Mgonw4kxajAJSz0t1aLpwJqZPmsl7SbpRaGBO7FRy+YkUNR+Y62UR82jbd0i2CUc/g/TxbWRYpoPPChOYhVUIBwFh665htES+O9MSHyEIpZuVGXTdww37xDB90ZM4r3V1HgbwADeDzYoYqK0g9baTqb2nHtvXHKZiSXDHcu6Y9d43a7P42PKimL0nBhU8NqEGcgM/YPL82vQsmA64oJcMi6KXlLpggo56U6VX4JdouDHUc/RsCN+tcnzPtBB8mfr9g25EC7kd3s18TIpG6LVBwX4pRSreIIwa4CePyXHqRQL0c8KXL/8ysYi5HXPS6BN8rrADkyTHAeBN2gE0RaqcGNLMJrd2GdldVTF9ycBWiTMrhFfq8Ui3dt1+RpcEDVWhlp5Yyf0dQyvaf21M9xIY++BdpVGCdaKO0DP7of4KXfSOslxvmi6b7Fq1olz4fU+rSFFSsM33XpNE0WSv5EPJhr38f9ZlZwvANuqeaDIwbribrQZ4pH9uD/B4NoVRJq+hwA+H/lJJL/2eyGK5XeBGMjyztur83b/y5G/580yA2Vkbh2O01LDVjLi0Rzo9thdHaTostyAPTMVdZUcbx6OzoCe9hKmwGB1juMPyz2/Np0gQRPP+7AR4TzlZFvuCTwIdd/t/ZpK1BetkNA6+aRvC2djaXFkb3kJdWX+rf+amYQJ6/O2T5FLqX9g3GJyLU2kzuuXZ7GGCMwX0pSafjNqwOlmLaHjM5UNYGuXANRVhSX6Lw5yMSn7aVE5PCoDHgjrejbKuFa7pHsoz02SIcxPxkipyIh6D6EmvwN9TLrcCX7mvJWsA1Ync3wHq7Vz1PEiiMNvqRNKqAVi0uwor2kPbdYOzLnTQ2i9z1SJMwZwGtX1Gn4i/lFySnJS69QUs7qWhEqkNsg4vApyI2xD6airA7yDouknbwzv6foD/S3Sy19i6n9Bmm8jMK5VSHG5AiVR0KebeG1ULvHZQwwuRJz2sAw3koZzc4b2SOkpX+/PIKJ+wrpu2061gFKwydOX3skNaVLQHGXArMgcvqelxLvLIYlnc9gFTbEZYFSlFdCxP+exF56XknsjWuYD+QhEiuZuvYMlfLPi0fWTFaIBQ2uk2vpBXwQupwrGQu2VefJHWbuMzDYszAw0FxI28Y4d7zKI0hKjnN2Dd4rU8Z46JE6EKWIV7iZRZmHjaMm92YckKb8/qDYsczN1QkSci9WN6TifERTLnoT2qmR5JWHemktCFysJvhGgQeTK4Fb+dhIfYze84iP165xQsMAfpFKnnheGY0t9UzNW4fBap2uxIiHkIc9e0RdYbFfBvvtfcKYma7qV8RRUzOkA6uNmFsH8SbnhyXU9u+wPppPsP5QRBOuNF+ifXxlEvPHV1sXsSf2fG5sIg9Pce1kDbBf5Tf2wF0njoQkqv8Wi2FwV8/mRLcHIHGPV+u4sCH0wo075Itni6QWsXJIucIGYDkKcY8fo1Q/1YKHWw16tBeu1ZX+r1J0yaRx8Vf2wD8HviCl78v6QBcljoxpEri1shbXsBHLGm9dovZvLbBApk85lQNyLN99PFksB+rgGDLC+WjTL0b4/wHTM6fKLdMJYnjY4FTSWVV7XYnvkH6f40PISnZ/DOpUnj5SOKGlYmwHq1HQj8ii/Cdy/iLb7pxvIh5cECgmQ8IFC490jZctBEDyygbozYlstAnguA2EdhhhVlXzxyF1MreJ4GyTHDSeTLFfjaDRMJV51+QDbb07ERbKoprA0Kz3O93zuyrht3xi38E4fk4lC8h9v7q6KZFOHqcV9Few8BweEC2u2HJxqc6NijsQnVke0ONHNEgRvXg9PSThmEdEEWIWPBJ32bugs+cuaFEfuQqe2uZVjK869eSkwtljysKJ1HTjGyx6DmM7CYHRn45f9cSo+i09zGrf5JgGdDiVN7L0H+TIz7YyWYsQrhBdZ2fMTQCxMbAulJy4XaZTWn68Amv/C7QQ2uXmLtH05cz7pXiKf+4z28u0GU0ei9rrzmrocyEMTMueNZ5QaaMZXg6WLurWdxBdRWlc+cuS2KCR6vT9oAAuJG/
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-21T09:46:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6e7392-0974-4001-b08b-4ff9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-21T09:46:58.000Z",
|
||
|
|
"modified": "2019-02-21T09:46:58.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '041fea93b5466565851dfd8ffe08fc49' AND file:hashes.SHA1 = '2dd0609e289ad8c172ff2534010a8b9b56a54bd4' AND file:hashes.SHA256 = 'ceaace7eb68ce0faab1ce80a019d603c3f11bfc8e1384cfcbde13da4a08467e9' AND file:name = 'pl0xppc' AND file:size = '90310' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIAN1NVU6Xz/FGdZgAAMZgAQAgABwAMDQxZmVhOTNiNTQ2NjU2NTg1MWRmZDhmZmUwOGZjNDlVVAkAA5JzblySc25cdXgLAAEEIQAAAAQhAAAA2YIHwY+cSo9WPqORAouBUvixSOkBk9XlcR20jWfColT7F4nfr3AOu3Bs9XKEyXgQYH6nZ7K2uCyPwpUYRrV13LZ6PEvW79sOxj9iKG5zU87cbKMkVE+zxAPzXi+5vqFwGZ9Gwa8U3RFt4nsXLEGv+y5mcIby1KsNOiEYvyPaXswoay8lhTXc9TJIAZNrBtHz0VN84zmaFBIt9T0dgBG8qDdRGS8IbtAMShtBngrBjTlskSikPkiAAGQWXqrM94vi2iYjtkpRlWtUIdAVc+uSflX+p9ZhCm1PmnzoAQ5VCzbNIa4KXU7tTJC6UoGp0f/XkYYwdKpt//6RmlW8ST1CUEOAe+8hT5BvAtTm+KAQTXlORZPPf/DXEjLy+ppYd4PDgO/xxcwigCsKnNUzXaeUgfejO8PmBJJrADBearbuNJpBPYfxclHWUMn+Btwn5ZfYDX8h4tPTaLm2c/8ro2tmNjO3AzV12d0kB7ahJt6Z/AzgDEKGUavufF6zK5BHE8Gn3HxBRyAF1QoXPzGoI2weRn+HSawtXyb/+I9dzeteY7gWXe0X45AFn/GX0eXkJBGvzVOqxCWhOLCnwQqj4HrfGSHW/p8NXVWFqPXIxa8N+pAFJjh2gxoWK0ZFPQFGiQI0VC/vAXCFJKocFIkTi8qrIAs67DYu5zhsfJ2r1xQDTncLrwxBryOUXz/CEfhX/GYSDvU1wQWSEpIbLhxrbEnf5IBvRmf8/ViF1Ax6/e7iEuP6ZssEBYCKjZ25A/T0lBI8xbsqprCc7R6rHeHcbNe1mWsb1sAMn3srR0gQhgouFfQYv9L/jZQ7COr9XOZWKRwVNEXW1nC1fhjDa8VZyNo8JURBVXbOIgALFVzQbS+I8ngfO56VzQL8OEd63GqAIAtKxD1FQJlZvyQRiV3HvWYTcy8Js3OhKYPpJY8Ik2Yj0OiXlEne3LeVAXNmkopEf0yuhqsenkOS5S+CSpIB0k1i1eX0JTMk+9luVlHl7TpWHhiHn8B/rLZYXkKf9cf+gIgrh8vqxGPggNjpSqWUXozefx0Z4kEYqYiabrAPHNhGVrOAkEjTsBnRRiUQSIVr7fb9hCAJ8UV5ifr93pobkKkxfKNum+zW0IiE6HkQVIUuBbW71qhf6zJvtg+WW/YtXDvw1HqWs2WF22zUSn1qbNyuxRacHDYVpb5y7pPR0W/CZuTSDiPuLfL+YvsYKVfdssD2+fMKAc1df+Br3gAyE3kCnDocL0IYwD62DihTOD1E817kM14Rinqbj+FZXtcP0ALGLecjTnMp16FneFjrYo/x+0l7SBzMzQyqvU6bHQZJRS1k1N4MmO99gkAXgTHD9MCPUJaQZNZ7vrGlVpx/o6zo2FmbCXzdGXquqzSYbrrGhpJ+q8JG3RrkdAa/pRRlxjgMrblzjoRq4OF24k4QsWHcKL7D9F9jfwF6LYl6312R9SE9gogE+yWbcY3/0+pLD4VDgWhJH3StUq6ixyH+Vj1dKKbv5ore9VPQ0nKVM/kH5mzvDeEXCCuR4jXQPi+tLwONZRQJlQpN7QIg5J7Vbj34AUggm0xCYI8lv2MFiRBr9O+PKnszSKAMcRJq4hAxQbOI8xYR0JsxwjkZSTqCeWv46heqTnlGCSdZeygrJrtktaSfulDDwQY76Kiq2QNU4BIqbVrNIA/a/h0xsa1s8/I8cUMamOGKvLoYm1f9MBWGe4aVPEdP6JypwkdcGneiAFqH8IkIPIwADAO7c2W5Tuten9KgphfFoHKYZ4T3ubq9tikMhEUHfpcox2LFjBZ7RUlQLNuDoRLztrjgnJ7MOOvry08+FNTPiQdNtlKQ/5Q4UhyKAy3NxOaG45f8T9lCT3knNmZuL+xH3gd5fF4u6+rY5t62SHv6zF4/92L9DtF/zNbVWEm5tBEXZXE6FAw3Hh2e2kigTNM77Xh6+FUphZ6U30cuebN/wDfdySgXZuxN4xrfdrkFawwrRLLKETK7s9TMQGpFbNFifN59EAPi2LhfScXqgli0CHLGl2Dk3OBmZQhdDlPdlDxgXPOXJH5gUBRbNVKPz6WdmMLojJ4puIZ1ERXPLIXRMdmKC5lJK21wWft3YAlwQNcpBvWycyzLrCbcOm+nONyKLYLg2paoMtdsbKTa1u360423UsGYcAMHaY9Rjs202/Sj3y4qgAa0citDq7ESfTY4MDU883FjGseKherUKjeCHUkniuU+K09DFd6Fqh+U5LXkD0kWSDw4MiGoCrYoB10WNr0sd2KSg46QWXvECBDh7ZeRSnQy9fofg75bX0Rd4vnYTnpnbpMpXkd7s3g22nc9pVofT97csE9x1atX1Ar9plojrz3vD+HqpNwsIYMC6H7S2yrn3tepRTD8jsSLzjTjM4eyNmui9bxUU2Ee0G2wZKJ8wIUG1C2Nf02K2XbdHwyqSaJ/8IJnctFPBSMcJ7qzoRN4FzKPW9f4bPe2oXJZZDodfSevkOD05/cukWbZfQA0dm4esUPH51mkzDypwkISbEkOfxGTmN08rCn0VO1cPrd87ZCyh2hNTUtT0TFLJdTosMt8Vv5sFGOM9VR0X9QwZzR71UnLb6YVfYmQmGQ1IxHdJOhBtMmo1C6AJ9h1mPLDvsP4CwMcv2YvU7WZ8nOnKfCTmcAUdUiV43xlwhU4iTAbCBvtWFmFYrQQUyNfTUezndD1j2/ley1hl8i/206ofd8mIam6TOLJPr18qk+tcXXyaR/4LmBasD/fx2RaoGbrqxpfpyqMemQOJeb1tVDzIn6nNGfDK6/HpomoXG064sY1pN5c0OR0jlu7iV5JefpTzsj/0OljCA6zGhEOpzVzaQ/bGqOHKCHevrAYA8/9PX8WToOCPl+6p/kgcCnggGqKPMlAMugS4zGzGxpTJa5rQ6qkQwrg9bVlcU8C/ErN8CdI5NZnc/jUQDTcaLbwowOrRL8esGmRK6hwE/aBMSQkI+mfZU9mFXQ3xp/YsK4rlQOMrX+MdyvyihwU/K3pO/RejZIYz2H4Q4AIKmu9QoJojSt+bpc5PQUnIINgQJbXTgq9AXM/DDQMEHHvNntP/bPvlbTVgOHDFbUAb4zxO+jHHY/yIerFAT5JI6V63Abjngri0uAShbobkU7dYCziIcGyrlMU03T8oXk/zoRog+dsrz+V23Hk6UxCIUi41zd57RbEDqeAcLMxun9k573ScfoUDToL7qaK4EEmZPi8Wg9U8K/BOMX7aidy8JYfZROANWzNDC2hBqExJ8el+plWp0To8NXCGLuFXnk+CPVHhNFfxbEss1HkL1PtBUaFGCkDVTk0BoaOTj/qQg6M6hwS6IP3uRNvW8rzIFfDwpZkjA3FfodczgYgl4D1bFwUq4QRTfy2Arak29PZ6CToBj304uXbqAWn7a3x/zUMVKs4dL7rpZ/l+jzovBc8SQk8ss8loNqFEnsbVNcDVwpn7xUpTjCe1XGcbZv/vQitGsTrm9PX/9gFAYeaKDOfcbQZiSKx+6PF3ROMU5u7EQZuglNfpaCnwaqMpduqGVg/XBkTxvzrlnf4EiXOQfnAlKY3fvoBsx5wJZiO90nsBrIz/XfAkKsjnKXY1JDMUXxQBxQ6T61ObroS6rv1AJxNQfmKpAqu1FIPVOTPxOvS56iE4NBe57OuAlQNuJsxWFFQGnTH
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-21T09:46:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6e7393-bc88-49b7-9f9f-4f99950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-21T09:46:59.000Z",
|
||
|
|
"modified": "2019-02-21T09:46:59.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'b2eaa4776b9c625c012d85319cbdc2fb' AND file:hashes.SHA1 = '4bd652c7ec439021e6ba559eb5b96a671aa71386' AND file:hashes.SHA256 = 'e3e7ef4f1b56b1a6a208df5f993989b2df33ec3c9e27a5bcd8add0bb40b63fe3' AND file:name = 'pl0xsh4' AND file:size = '82065' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIAOBNVU5CQcqA7aIAAJFAAQAgABwAYjJlYWE0Nzc2YjljNjI1YzAxMmQ4NTMxOWNiZGMyZmJVVAkAA5NzblyTc25cdXgLAAEEIQAAAAQhAAAAogG7K+usQ5B3i4wSolbaaC0J6hcHJiYgieoyIBaaqE3SjNBlFh1916TMhx53cDsqZ8m89F//jLNVWsqhW3a9ItRxO0B0iVBYXTj8TbAxIjQBEusMvA4dWetnqzVTMU+iau5l+8yGVtgbBkGnRq3B95fkes89B7aKqxmUe9gJ2MxBLkWrjcI/XyUa/wrQrqZlspSO5plIwGDYaKSqUppTGKTmbs/ARBTsD2dLcgo9493IQso9tZ19LlyfS+nIsy68Bia+f0R3CtUOv01vzwdkscTfHlL0TEJW0D78Rd83rXZ17zRZfg+A1VZvjTMiPhstwwWkB5s2vU8D1oSwpH0cU/t8cxV+WsMJBkbNmdmotHuoDEOcyMAv2731If8UEf58ZX9ml2lSVsEEoVkwin19ug3CPm/vzbKv0Wim91h/OdFKr8Gjw1E627e5gqQOCeezWhKIWU3Dbblpt4s/cvPa9Aelt1m5ez2CikB2QWxFeHV+7pTxfZLzbBCv6qDzRyiX8yHkmDXSBZQ4WJq6+z1IeYE9mX//eTexu5s2NU6/l4e19PtzFGv1AcjeuVROGdce1vwThzv3akR40Syd7+yNEB8hiMZTo+E3FTL+BM/5P7sEXpv2bYB2pBzGiOxW5xurfw7H9I/H07GEFNw6bfNn2IaveHd0By20sahJ6P6xWOCgP/PRSd/tMyLaXWRlr5pysjSie5YjRVhKOYTKGcYEU1ES+eIerZQCVQGaC2hG65rGC+5Rae5c2kxEXeGDYfd+o3z7Rsrr4vWmZWChmizZdauR22h0O93dgqEKwGzamx91KB79zyjU3HXcO6qhTieT7N5ZnsJpheLYbh+JXVQ7kwC7gaSrs9RZ5g5lVaC1YFE+zkdbapqbK32W2voCOmniTHDc8v/zNUGtuSAKHSQVsTXRDyeuPli45A3WQYGm0Q+lbqhCaFfNXoM8sXQs2HssDiIHXdzFUqB8iq49MPoetslX8vEP7Wt0GtKagEj6zzip3veA7GlBKQro5lidwvqT0gh43r6DDIli6sr/tMwMIyzM0Qc6dCz5MrBykgoplWzxKR1Ik4+qddUtiM3rIfyCcsy2gKQwQ7SNYnyJrHhUXu+qdc8Go+q03EsvZ9HN01FIOkP/N/tEAZCNrnRxAzPmHrWPuAww4ncs+8n+lo/20lQ5oJOcNqy7OOcUtTXqr8G1/SKVRa1jTNR+W82XdGgaSAoLbN7uuLHJjkHUO+KNxVjwcPzNEUl5Z6ZC2/qmeANHsOJmfU4Q8flm9q0o9po/oEBYsUadMRJvkwrdimX2wJa9yD3L/GTI21KD/VZmW4ezMZyIbNkS/i1kqjkbZRxuZOdPzSR1QMl5ZnOAFJfbiv7S7XiJrh828WBXpi4gUAnnmy590owEJFNbktnTKnq5nxS5LFc+uiprnv5cf8CU5nnfwWDtALDYmlx4yRBScw5WxMFFuoh2NTg5t6gCN6VijczDdob1m6pPwrG4mYjepBkAs6u2P5IUGIBdZR7HlDy1ZLWlFcKZiikEdZclvwFKffcmC8j7caCn9EqsCuXx3zklWpPNIjeZSl6fJ1i0z0c/2KDmSncL0xciDelkPYA7gzWX42cGYC2ye4kp6qmSmg7sd9lv2U/4mupd2s3L/GOKPSUmiNoBhCJT4wW1Hn5l/UP/Wll6gJC3r3fJlZ+ehhx8WJOwdrh1nJPaitwhd0my15yQShSjcC6yR8xqYyDNJociFHOtW8j3DyOnPAsEtwRqmH2lLUh5rZ0cL9I7PtGnAw/GMm/En+BqA2pW/lSGkDUWnRbLHvydogcKDSdp12mt02x+LVvvgkn30A3o1x2Ku9W6+IHoEEpFxHtEFmDXvNifAYpEIBavVINVZ7n6LvVcR6Rl5HyVgoBEjnkf5V+SYc31Jlltx3a9fIaEMEc8Dgk7goqLn8BFdHmO1uhoHdj9tpXBQ7e8B5xsqgD0eWSPaUTPe2uEhe94Id8CGvnCUrx1Y+NckYox4ZbwMAnC55S8NPreBKeMxi86r/UtFPOWThZy1BKtqMFhjX8kLEyfCmsoeqCE433JewbUAQQ/gNSb6qRJBjaw4783g7d4cQo6V3IBzzGebLEVlLm/2HHrQWHeMAYfMdmzo2R6C7/ef0Lo2Sb3LhpxlmdO9fCcUna/zvO4gyvnfpUI8MjXrhnDhFhUoe2uhUo9RhaNflGUHbZWOsz6ETfdBzetKupAevX/NROXmr5T48G0qXhwLiOApUD8DORFAcSZYqPJTqymhIwByRLl691cY6AMfolzFfew6WUvMy7ImX4X6QNqqyZNEx/KUTkwnKSbMxFqk4/AWCy2H562KBxzxxGAzjJbjGV3YLZpQc4JL85Pmv98zYLj/wpqONmpmXEKxF0DjPZ3EXXUHbUZV7rRTlJKVpXhQhCZgRdl++bXZ9K0U4r002EFSnqoLyGzFTNSsbjmOfL473WPxb/995tTuCC4FMpuDaIAMx6sY4G+q7CpVnDn+98vw5UJ2iPGeAu6G0oqXLX2j5n33VbeTxE1lghEh0K63X9s2RJorPqI8T4LanxvZi6avqVAmlLj+jk0SMV50vfI9GvH+qvoFqB3SCfQM+AxvdC3KzclmumkPeSSBDaNhpbCm+RJnrzXd8s4+63sMzm7o37zlxJvm7Fr9kwiw1FWkofzNFQSOEsUEdseNETCIHniQiOwXaHJ7GLVwl5ztNqW25R3DMN6kVD/85itHHYXubF50AWolzK1PHunBGQ1BDIpg8SCP5/shPBygDKePZnYU3iEq1WplnGpvuzcF9qOrl4lfMUHLlaIT6BquKETLTmqEa+94gH8z5TbGZSMYSFfz92+QmKX9meWiob8R30SDw9wB7s3ONyJ+P+rQYY3wNFd0dR9JHpSfXraxC1ZxnXnO/z1nyVdvfE6KNrb6roe0V9sFbCYtxoscPUdV446Gjg7mAC7Eou8SwupwMeln+oyycFglIYbQyfmjmQz+gLD8bfLBvqW3c0aEMZg036y+631a+zsTtnTQm5PVPTCCn1JSXXaF1b5GyrsWPc7VYaXgBfb/MuuWKiWX6/7LUyhrGlniVe3fBytmwOS8JQ3AyW9x8rdrrrJtEjOza6mPh5qAJJ3hOi2OWLJqnNrlh/Figt3ozMGL1lFQsTxFyslW8JFLlxtPTpr8qUwTvKctWXcbhFYnP+dm83Q/0jwAthuXtoiaeEOa2P7wvw4S4BMuIn3Q2S7/4olLbRHaNYbboexL8t9OQCbInnSPBX766Tiu5sNplGEcqe8LLothZcaY193mz5XQ5Rz37NKaY0yLy8AQQTb+MLLq8PBlBLi4n0RXWeGBess/UhjYSeMltl9axJatza9Z+Hji3vRGGTTQMWPvJX7mx9/HV6D73egzSydUT1RhpqsG4ySD6hgKlwi7QTPIkxhAKt3h/jeZISR4RsJV2uxLUkbP/4PCisG2yW1yTSDrOH7GWCxOWN5EoexOmQMgxcHZsoRPR3wvku7kJZZVaybBDLJ2TO6u3mIqBzY0iBvb1XuxZL3EojG/8/P0xPAjguDY5MXjcLjzgNB5kmMiS+L5W3/ou5kSoqjOlDr2479tk+heEhgfbkZHdDCo82vS9ml7yta3oyw1D7vogpEJkVVAIUs8abTYOV7gGNCj3wd/xMp
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-21T09:46:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6e7394-dd0c-49b2-9a62-44f3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-21T09:47:00.000Z",
|
||
|
|
"modified": "2019-02-21T09:47:00.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '386558fcea852864070f1c329c501bef' AND file:hashes.SHA1 = '190700ca3942b310ae483f46edf8e4e7e3b741a9' AND file:hashes.SHA256 = 'f8bb5631336876a708796184833c78a8feee167ac4d65da0625c28ab9f32cc00' AND file:name = 'pl0xsparc' AND file:size = '100380' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIAOBNVU40PlpZgaEAAByIAQAgABwAMzg2NTU4ZmNlYTg1Mjg2NDA3MGYxYzMyOWM1MDFiZWZVVAkAA5RzblyUc25cdXgLAAEEIQAAAAQhAAAAWFhGQ7ja/Uo4VmCrmsCrSJ3J7KjZbrMUIPE6HXjB1VGHEpPge/PE6y6Z1qYrPKUAmlbWEghZkXVaul6QuViLHMhgW8Minkps8vT8sar6jrmdq08CdAxqtKwW01kW7S11HKR9CM84xB+WbcHKZoeEAIPFG0328MUjyHp7N6mXSdrVNt7bYjB5GpK0lS5JV4ozdk3ioBvU0fZ6VWo9pLRYmPC4YnnpwnMXVGLCoM/0msHd66JemNBPwYLvgnsEJg4pEe2WvISaYSxc9Ea34PR9/WC/uI8SBDJoLk3jKmCk0H23VduhtIgrIn4YLzenELF3qw0p8vMzmAoHfIMqAZDUXjLMkkZP+AKFfgISUV2QECp950yF1yeAZDVFWOzR7Q69Jg7r8hBlaB4d1CwjEJ0Ysp0N7i1LJ1xbXwEtbKjH5yEQI6/oYGhlL5OXTTpbVFnAby8NU2SC/U7ZLKlAyp4v6oEX8JccDb6N++JCtNpw99IETFCe1N1o3gPNnV94c7hooBe5rl9gv1A0gZY/ecPFqQmHTAMOxqVoX3WwodXhhZ1b9RQGa7raadrsLTnIdfceMg+GnkQFMjweLgivpIBXIDfwMVV0MlJg4SDromG/TU+HVy1VfV4aP2IdV70WLGqO7tvmtVj84SXjOgtjm8sFtbJYdB0hmvjXJYMg4x7625XkrjJRiLK4bWZRupUSgNlmiVTJiBFTj1uf/Z/eilCpzIGp4MmRM41O59K7ep/eBxGInD+C2BC/UaOngvAPe6S3AMYkwY5dw1Fsyrg3hu3ujiL9i/8+wQUhrFoRqKdIpJln+qjO5nhHZ1uynbQmZQK674TzqjsIFBXEoHVpr0InuMZ634NSAlCPR1CmselhihxKLE4E8KTvwztbjUhLlBrJ5xIMpD19kQiqImZQwpwDOWgYQJ2gNfGiWm99oIlrISrpnx5M8dNU4l7ildU5wYLkXYnKLwsQe9rRpY5fizH30mHPT1l9O8s0r1d8PyYW1UEBEpr9e9v8Y9KNcFh/J2T/In/xyOaEAWWuN4v5+LhA7PEviXm0QJFH8DDcn7UEdgGTBZwRSBAN4ej70g4e5ZUXUWPwOz6c3uNVhu/mQxSBMPj/FM5Cp5de/E+/9svAQ3BvBC6hipdWrFZ0ciTErW6LemKbku1OxSX0RJcKn2oyQhDn4wlBFwM+PhEKlaztiwaA84f7qELxBaWyfoTa1hCEKaSkSuaXOPukaRma6yRIJRIGVWPaluWXfQJXxVCXzEoNMpSD37usGvqLN8vvzGQZ0D12m3KHja7zJ5Uql3+FvJ8WeaZGZzmpieHOw1Wmz9z1UOwj7SjqB7vlgBrOnuazoQK5LTh+3MdiXur5Nc9GiKVfoyrU4TEb3zClXvX1nxbh1cy0m8T7yif/7xf/JqgSx+hpl+GdXlgClSUah2KJ9/bryf0QXElWMblk/a7aKKUynbZpTLQmJNRSQ4vQVpvq050KoEPm3B5XdM4Hyhzc4wjEmHzkG4KZXvggfTHg6oS8tj89k17/2BzBSHvQk7Is9eBkKhHD5lTTwGEk/Nw/y4u2hk+9tIoaiFmPcnDwq6kaSOVtmZ46ACdIn/5fDCCZ+3QJRbUawEUgcd4OHp7/Ys5lRBL9P3yjJOSyotAz/b6Fh4s9GRT1Py6DP8CKwTdw80LkM7vBtbG+IMY2GWBukdJvmo8SmW21XQIboTpDSqs614WdU2sx/5adKK5zbiSNeVgQk+CxLvUaZEUxubRvzQI9YzXtoUkHC/gtTk0sXUE5cilBiiAff+vnGZxrQgcVju/DQUkfNW1VzKD8LH/llL954w9QOwzXABXCRnhpa72BrISAZx8njz8GdTobTTMKOpfvoXT3mxgsYDK8y0Q++TBrnel7OSHo0MyTKCN6mdnvYRS5Ym6cc+vskhITnTnb97piC/pX21zELshcligFAOW1GtAcC1Ogh+q8IDRUwDiqfb6g4TBQNK1R+Szh3l9aJqr8BoufSq0LzURAFa8N/8BGsuK2h4H5o+yX77lQ+mb2LE/OMTSJCBSQwCGeLV9WDVRG9qs9hY2pz+Rm66eRCIt7tDIfRLL0nUgMoAtW/ZfXPZHt4kBNjkPK+JWkrfeHDsglOGRzZMUt0lOmOn69MAziumnS5BAh0ax8xu246jLABP2zuzeirTNRTP06Xy493/wFQlc8ZkCPkNHtk8Qj6Fs3OdehRyoaxW6HmdQ/VXA6cFCJmqyC8b92iOKg2MCNOjdksorGCR1afKhJH2IpnJ2Yoi4be+J79TCn6E/ZCY7v5p8d04BdGqliCq4itj9Fi/zslXpYp5Yx9dAEj18FRnqtbtm+labcCObukKdaoUS9z3AgPAAibGvkexnplVuyWxwsOwdEwYujBppYOywk2qV93HhP7AkNKqVJsvRiLLLyrG6ikeNPQfqgnb1g/KXyoFW6fr0LWoPzXOnfVKRvtbDfCDDAGF1f2mlln9ifHLfjJ3elUBVl1n+8/2iT5KqA3ajyP+j5ib1e/psagta1krpHTJaEf3/tRGvBLPDN0DZ66kaMmkueRqz2xauIUJa7TonLH4a9tEvLYRi5Rwn1/Kgi+LKpXlOgPyNJTVV0EGAf8LuPZPH8ZyFVhhDDf7rsXRSZHpikHT1u5cgf02FfR3RG+AVTzoLlfZ6ndRGHjgjqPLdDOQdKleAmwnVv61osZ9KBsFLAs9rm8VI1gzgVLzgvIS9TX2QQ5UuJhzQPVgjavjvcCni3TqQcu+PL2aDk3xYFZdpdvywcEk0XtehXGa/n2HWqaH5C727+/kR8gOOg6Gu8+FpMhZ7VHUiZhjHrqNRuSdvQ7QDvbgvY5WSQIPC+V4a1peRCH945w7Og2F2XPCYbUCGdOPit57lY+gVyd2cGG2IYUb1D74z5fqXMFe+Ud9epffBZ3HOJg7tHNiaklxop38fXKOQldTfa2QhOJHy/LcVN/Xxh0o7NkcmBv23T7U+Jmkeh01dbkhnx55C9zU2+E9gNamKqIzz4mX4j4VlNv4E2tDk/ohOdEPqTgDI+QW/zBWYHXXZKgVDrXZuHQ+qaF7gmpP620LchN9kEQcND2mFdibEFeY9/rVjdGVrsqjSd/P5ImsDgI+tKO8jdDaefQFWR75QRU1CLTW+L3Ha11ObgaRICmY6stLeAm6xdl3ZjY/t/z3OjrIgyl+ltmzKt9rMpJJmNMSR/jccfnlgxzWrHImLluD/OvWqWXf/agfuW0QgkobrAc19LKT+9wdvHhtIcBUTXnhHxatK5/WE/ryLBHk0SE6flf2DrXnC0b1WtIibWGHZ13gJh25halQ6xsiA/iREOnpF4+gZ28pBNB2EOAHaCnMPP0yrcGDarC6kXo7ImPK3bpFBrjibLUICNFMF+o427tdMCqs3HkUqcgB//DCZJmThB951EW31z+/nnvpIJHbyVHqqIeMFhGmc5GoNTeiqXzxVTcXQXrdGBhclsZ1pm6KsBEF6uHBUI+jDna1+vxoqDlBQXJ9NDJDQyJmd7XwLAp+gOedfU59uPYkZxBUku40m/his92Up0W+1IeTDeSME1Az8iQuKJFb8o6zjdSxQjw9ZOxMfD9x2N16TRjlOH7qpKJ8PkiXsf1CzOcTizuUb4QKN0uhULpVGXDvzsP0GGr3SDb1eSU
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-21T09:47:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6e7395-aed8-4781-aad2-42d7950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-21T09:47:01.000Z",
|
||
|
|
"modified": "2019-02-21T09:47:01.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd51940b1cede6ecda2b73ee91d7aa68e' AND file:hashes.SHA1 = '694e9658f66e7a490bdfd98e19c7e627b83a23bd' AND file:hashes.SHA256 = '8b5f33b88b4abea7848d5dbb097b545385b6bca9faff0610c78dec45d7577a6f' AND file:name = 'pl0xx64' AND file:size = '90997' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIAOFNVU6HQGHugJ4AAHVjAQAgABwAZDUxOTQwYjFjZWRlNmVjZGEyYjczZWU5MWQ3YWE2OGVVVAkAA5VzblyVc25cdXgLAAEEIQAAAAQhAAAAJ5jdr4MPCoEToeQdyuAF7Qa55BiJ+NWibKqyO9/q7NIc1opctkSOU0EM+80Yx6cbwwwL2UbUVqFckWhDSLGggy6XomIeD59BnX0/KjfGFkPUTUtylYFSWxXBRhip365AtWDTv91k4OWaKhuQ82qrLbSYONYQZTpDTd65Ga4SxkIjEnY4QVW3nReZQPVOSLuoTnA/2kiVlqRDZ1zNGVJxvntvqrEQT1MROCPyWkiIoNm20UrXMyZ+4+aQFbauY/23iI2JANjhmBN8C/wXgF62MBoPyz0X8UplHGd4sYmficvFqam/Fq4tD8F/iXFojX30Nc1m3AE6BkXhElrHRjrOpA+diyVk1TP3O5Rt6neYZdVW+cHDlRX876+cdvEVwBClcDDndeWqSnjnMFjbWOf2+nIS87ZNK+k7KLa41noMmE6EjwEXocIclxfbARruABT7+M8pvVMgsk+1YDBqNhjDjlam0Z14yAlhrDowci7GVT+A1jqFjUfXiqV7nZDKdeE8u46vqqOI4oRoMxNS5wiOm5aMNuwX7EThlMsY1OQu/FVs5SXVqGvH5jyn+yuJvdrGj/aZhLuaOcGotFkQFKbt3lyXuNLQgeqkrq4cL7h+zNOh0jahSYsCQ81ZnsD7k5zi8IXneTOqewtLTuezO4ZkcdogbPGIc2asFPTQFSAKSaP/5hX0zWGuegik0PujsDYZPKAmTuOtHOc8AIfp8ddlqKPbapWWBbMfXzJOazaHFcvnQl7x0rwxlsjrXRFjzvixXIbwz3XIja/yzJ/axVsb6zw/Qc3Cefqc3jue8Yz+NqFsJnoCIiPKHEamrFl+YsD+W9L/Vg+Yt8wle1/bgc6hDugfKc2Zf3p1H4HBJqdYVG5JDRENYZt3PgtZB45TjrG1RqEROdryMUsC7EM8i3j87NbvU13mgE51k/NkFJ8LWEqNFBKfylc4AZq7p02DS5TGHhpMoyHRdV7ahKHdqc0ngo0/OckYpa7y/fdbNizCs7iw7lHf6Y/hJYbaxFx7pl/wmuqc4u0uCzcsrI5IwWlhIOoBvmMm83Yr3nMQrEqv0E1XQ7ov6GhSRqyCOP5UScCnbWg/4NIooX1bJdSFkMy5DqfPXqkNlqV2H/sspi+SIbae+U/4kJgvelvszleznHjdOtL3UmSdnMacjk0RUM0qgsFZ4e/dHi1J0wG2cmDU0cNupMrQkXR9CYtChOX5fiD37/AV7tfnmv+cmRFMcC3We0HtSmHEPVvTQVgyUjyPLIJ5pFhicqD1pGxwI7eF8umV92co+RRtHvtBJczv4z5dhQA4sH393TdadVIAV3xTzSauv95t4iFUKPMSHH0tLSw2eHMHHcpopfJ1/aDbxlicrsfK39C/WNpIwZJZG4nbFLex0CcmcDxqYoqdO6wm8rxd3K4oynPSHR6yJ3TY1ItTPUjKDrhPy7mjr4VSy+v4QQzI8qVyOSfIkM3NEP/UZ4tuHvad9q4lEH9h2nLAY5HJqtOzn89IgdOhzerPJTLs9wXS63tQ6C3tLpCt8dKxj3ZSnvEE2ZXHdvvaxLdUJtuDegrs7Fdmf109ZzM0eEUPbBVYM6GAnTImfjIo0dM6YJW+rRSsY5XT2hD3g6ZmjK25i4tHaota6qeg/15qvSsKk5PlH6MJpVfCOSAelQ4yZwKjvfMcu7TTXnjgBk4T+IOqyG8obWlblYFNQ5pjbrM58JaI6hLs/1MmjnKxDmTkcEZOdOoQO/m1kITD7M+cGBXvwoYUpQv5yhfz3j7TCAl+TdqyuqablDIc6cfPxbiSgLELuDBdiKT7E/nClDrhCMHcRU4BraFycMrBkz35SsQyp2V3NQqT3AYhYQDnQCdmq9hUbvR/+RsUf+xpTo5pU+NckXuMon60xvgzoaduNP7RnycmfG7EburpceD2iXOH9/Zsz9MXRT+WNTVCLKCpLJkYpikf0UDnRXWpjeExn8wT3hCilxiAfLEdvkf8ijyw4uu0u/hIg3NqBKgk1J73UP3Gt1N/2+9s3qOm4gXET5FcwlWUBB4/oaI604z1AJ+EHpNLpbDtvAgk53RkHQour1mpckfIQlmlboBhJ41ieZU5ETr3OyNakljQaBi2UCRiqB521v6hNhJN0CPR+qaSpABu33gEpHgxTNPhc3wx3p7V2QmN5O7vPjcyPDZ1XLQkrJe92tu65Q162M7QtxQww1vdHkwk09nho29GDuhmBJPMmEqRik7DkNT3z4uQA3Eb9vRkulMPlysvcAiimi+DH+OAbMams4EhQNv2BiG94iYix0CPL+qK0WqeU0xjBhsM8w11MA4m2nqBqHRMzAnH17pYi6+oKLiasDFC6e+zgo+BqE4ef3SylM7IgRHjojAsKzRRMwaD1ZFepoSoL6J7+Yf3OkGKYQ7pWISQsG/uH6bOvcfQbg0kRisAbSqPLAA0MQRHajm9D7C7pP0W2NxXR0o18cN2hZWev5OyDI6O+OVAPP70ELBmuhGoQCvzbEzlgjfTXCfXd4Q2IWaO4mz4solucqq90BEE0lPyjQRI0xnSxGOZDX+90qo9EXiriWJJTiF2cScSYfVFs9zC89K6zGSOvlgwUQJ3IUoy1TkMhmN4YPNSN2W6ryDZytbq2PbcNBd/LYwiWNxEEJ6jGkeSd/S/NhCRc7z9RoxsQLyDdvArkkDOuDqPKqGnXzv4mlgGajwAM6HZP6po6x8g0c8gEH48lz2G/+BHQnyPqxZrWjpxtt9Y1byb9ljmjJnWmzHBLSP7qVeRbDfz7CbvchpX/GMNIcrao95KmOK54AeeuCN4I40aPlfYGtLP4PBoN1VmAsY10J66Su5XbzyxvwZWpUs8/cwcPVhOMQrHNTb3HRoa4cE6tKk2Pwhf3VlDaAeHKfmuNkYV3HT2nCjIhTn3WjLdtW01CJ0I4G3XjfTTLIRf26ySEAw9qU5m3gbkM2swk4nRNp8pnb5C3LN53R4TmAB8Ac2eGyHpq0BDsnh7HzfrCIm0fE1ktI3Ubmx4pnvmW/U+S2ZGLEHL42abGfWEotjITqWyXatohHGQc6XkYQH6GM2cfTuREAb7e4UW2kfQMwxolF5XWnLLDwDQ7K94RVDMCIqZ6bai3y8ke9tKaev0T9Jtle2Bg7s+SPwwPQk4v/NdHzJ7Qfhy3Jhrd8g2QqA4yll+8zdiKUX9WdLfgpAI1s9teME6zahSpYLCg9CopHY5JLG/dSh0yZb7lAb853ICH8sjRLob0CV2tIBxcWvnb8Hdtrj4wVdqVbJMm/PA+S44B7oB+G92a/TgrV98lgGyZLmlRQGkYRsXsAPeAJuGw4YvUlrm/LOtrUvbN+k/Ho8yJ281XQoTi0dfhDSQTDTfu/e5ImZKcsAyygD403IVCuWnwoisINgCQL6XD/QyCtKVy3Sm8woN8c6YfdshvNZgF3qQaVCAjw0oMmJxTJluAMkinhKNxd+qjRQYIbROuCl/5ppLzLlfiUmENGcYNg5esgT6LfC6KpCZEkL+XYlSuOg9JwSq017LZUprP927OY0fg5IRJDeMweIoz/52QR1+yc7yd+n6K+P5v0fEBRYeaC/7g14WWcApS+fe7dcHLesnSXMbjN5q0ohlzOGg0jb2T3oBz9bRQg6m6U9AwfOJWnJHOnhJLbYNCNy/zrtlEg8oVkGe
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-21T09:47:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6fbdde-e650-4d41-89b0-4376950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T21:26:09.000Z",
|
||
|
|
"modified": "2019-02-22T21:26:09.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'a51cbff34677e8be7bec232eb66db564' AND file:hashes.SHA1 = '5c7f873320ab3b6fab74ed402b953e58c0f99502' AND file:hashes.SHA256 = '7eed6eecf1b5b167ee266b04ff3b146231fe47531a3f7ad122651db37a860257' AND file:name = 'apache2' AND file:size = '95104' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIAAdKVk56iMjHeZ4AAIBzAQAgABwAYTUxY2JmZjM0Njc3ZThiZTdiZWMyMzJlYjY2ZGI1NjRVVAkAA969b1zevW9cdXgLAAEEIQAAAAQhAAAANXTo7hEx35WkFHG/0XIxAFEChx0rwYUaF5hyli3z1yRu2n7pxR9AnhkSP7KCboLI7i0tJkQTu2i13ATnpbkExR2efIC7CHb1YdLs3Iv+AgDB5K2424GbCis/257a/TzrFq1rhEmjFqSLyGB7cF128mCAzsDw1livvoen7zJFWksFAhgGszenW6c3H3nLwO+ml/rNc7QkhSFtIys7Xc9n8BXvpORxnlVVjY6gqERvsg5mvMKSotGbY/CDJECxJZwmQQeXeA7zsD7V/HheWgpNYRTU3WS/+x60WIy3UTEVC53N2J2pvgsVb9WIj2uJsjFiNJ7vCjMf9Hj/Ovr3M1tAATWOyVDemaaBbV05IqhSMHRs28NALvoJqfhSU8MHqHMzmPFNgSfOKAniiwuG3lR0vijNRcUbQLHVNkaKWRGjQMy1z5aGcxb0/3QbpDMOEwfA8kWD6ZZ8/8EJpIaZ1qRRcyc4ZDZWHsRflYQwzuT/WSWmZZ3cEmoGE2soWk3XHSAZ5B2srgBhuJoLHvaUur0S+QBuy3kmAEtae0zidNn51B4TV5KEB5UGegeU9hauJBI+mJn7u1xmY8XqLQKTbQA4drS7DlYDcbYYFtnKth4BZRXlqfOk9mPJvZTEvXfu/l+a6wgBPZ9Qjst3ZOFn7YwYLtReO7ONJb8q+Gg6U8M8ZM7YacO08pI5420pJInE5BLpQYxVchdBy+vssjMV5aRarQ6ubtLs9P23egHn94WbH46cE7GBrhX9BZhdZLUS/Vbh+vBL4Sw5M5PYHCTeLEZnCMr3v7tuK7OJ7K3r/X8aU7qRJ82G8ozYVcHTixSjVr+DXlHHKNhcLFS2H8ToNi0F0HqIa8nHFL4yRHcB59Ij42O8+9uRpXdU6/S8SEwxpT7gJTVdaqZB54q6sPSGh2n8rnl9hHkMo5TXr02e3PcVna6J+qsniC+VQt1exdjITMI5fHD962R1f9b9i3YlGAFS2pBz+WMUspwZWqSZLkffXSUT7Pms9eYcyBUsyvkqmBSHy0jN0Pc4eSI7/1Y/ZDF9W3hpprj28a1aOqniTTyxhssIhnamKFe4Mu8sHYdEiQ6VCdKmS2XRn0J842HcKfTf/ivKzokDz9n1CZ7xNMx+6BjIO2RDCuEVjRWP+SprUVc8vmNrXjAV6MlsPH18C+X4AA5I+QQdMRoUeD8cPFeKNv5QJYueWTHClZ68uubSzM435TkwxXqj5G7vVvwcbfxakorIg3RYc76g+MuWflcSGHSw7YdIZqnv8wluimx+QjI1tWwHo2wHDvUY2bIv3Ry3Rp52iY/qIUnYftIpkotkvJd6y3O/l77SKaKQOaNc8AeRHiqRbjYpqrOwV6HQBVYJSJ0k7TOVh99Y3sarmP/T2RprdzKtaN0+pImiWdHbuTiOeJbqo8fvRqShwCg7Fo3ACqPV5NwsxXfEjd5Hly32MXsjmWPG+WpHiwfVEWQLmiIpU/V1wdneiFRCHWXi9LljyHyOlaUXiVkUC40lePeurcQAUHpprVQJWGKkVMNf9sNpVv632aeJib+gLL/25cFyXlVVC7g+1qsScv68edIQ4CE/w8FPSEF/y0jKIacz3Yr8wXgbZAps0a3MXSWXvuvjg50d+L13+rBAz/MyfQ13VveS/WAL4Lq0Sc63EVsIBKwv4BoNNK5koJvMeSfac+pOL6c7VJ2rSdb+X/dLsVR5Wx5GT6Qgma+6GEVbGR9DRguemUNqcUq1e8djkubfdUknu9jNVfzSUQwbS4uTZBiF+XCshmRJ3A9Taq/I1sbv6nP08LUbzzNpxc2BrJKpJ85S+HHM09DLgY8so2mXD4X73o40qTsAF+Ix/wWIFCq97ct5Ffa39nDCp5Uu6Kms+p6kGNZ4ZXwKH+i5/xVEPkP4wrNa3O9J89SmLKorZmSHN/NyQm4sYrSQ3DWd6TVnQtO0V+AkaAcS8VDfJRdB4KZFZbzx4DBF4+aVi0NVf9tOxciTpn1e0TgJxQq7pE2ukv2p9A4TsLqlbPH5u8CqhdNcoRCKH9H81oaejT2Y+NcwaYJnOvF3k7zDxOTTq61R6Zx5njy0z3xJ6NgD0VBfNjai9GdYZgnUAuBmZ8mIGFmKtDwnJYrCI63tyxxbjg/1sQ7NgID39VLAvcfkFcxj9kwc4Wj9+1NlcRIlWMvq3JKON13CVtqL4wgZE+0bbTmSo0WKiUMRNf2SPoVkG6PeuHen5TbCQ0BGG+bMUYXyRoS3vQ02NCHF3aLFvF0UrkkLSHJZwJx+uLFKDpuD54Idn8Z/4askFA70U8v0eVEK2DJoeqvqND0Qb7QEfXFJzPUGDtc5H9FD+k+IwImuyTs1YLvVNjWae4h8YPYWQUHeXU5gk78loArkoajGw7Bq8rGXvaRG98IOlK/Rq+WE0MNpGTgiTY5DVY0Jwm4gIwjQtmo9w30/3ns4w4ZtH+QTpWjsIF4tp2jRI6ucQyaRwISzMt5K+yIIQe1n5ub5Hods9GzRXfJmsg116WXERN5UAIjBFbHNXhVwi18KM4srDo7cMlCGzJijtfxKFLAr+TqQCyzmS9PnryyK5qtiaGOvevGeh8OXE6ipnd98/pv8R0i4u/3S2d0+uwcO/ZoxVazaLAEBoRyJ9wP8sV1t9TO1vxE4sLMMZ6diGiaKeFCwESz/hbqI4G1CfKhf5cWuzJ0iu9iXRdyZSYHBx983eA/0LqyZbEblXKhyGD6orKgPYqklGNe5HW7luTWruTHIlk9zO1zRDMH7yWgqvbi/sEYJpBeIbYhpYXEP5iLwIiTfHTCG2TXiujLaqjpSRKCrNGT8lwBnw4kVay9okXl3gW97MZcEEmT+GnCbAVREwfn4wyRx3Q7gMw3kauUKRHc0u6JVFT/ZcTNvuYOJT/J30FS2e2W/Tlk+Gti0x0v/Soj6JLEohuVxn5RGH1fH+B59V1MhuHmpZ504+cHcBUVi3C6GA9Zp8B44413Ss47HnxYKB9lsFNpdaj5pAtlrHhAa9ZXIixB6xL88D64RZFD+KkB45EUWi6HfpHqzEbNQgCiHuK6s/GEO8kvfW7iJzn3gnYeHwzNdu8mIVjNPFO1YtLpkUjeEBm5UHt9V0sZd2RnMMTRo6XpLHFr9IxKxp+CNJU7s2XZbT4+eqqZ1ADI/gtQGwY5t2xiAXkfAvQV+BwhEKZyLc1mogE85kUYBKGmfPAW6e/GiJKJSves4mep9Ld/rjRUffBFchwaUo8sKLLrytXFooCNNfRiYQSsk52jsVhbSXj0GNCqp5ZLEs3A8lYz+bwJ4PxKcLEh9YwceI9qOpzKl7BBSxXmWxBBhuP2zncZxYKhwZr2GDwCJM8XBSke6GOw4Pq/B8oEmWZKuMxJW2BhN7bNqXWpO90iLGa9qLK1P/kiFMV12N0Bi85rhfCkkXytCl97x7WA+3bDj4wR11tJHzfRIPLxxK/0qCKlMZ8PxJQtlcocj2sVirVV+omX72ocp0qF5t3FmgR+x2L5kYmVMAcQTOg+kvLXaqQpkQVzgrFCmtzXQyHCFyIl+VNmDRSn9ssDXbVcFK3QH+n5Nx+YVRnBoK3LXy9F9/0SfT85uO/KCIGv7RylBvz1gjS7IylLK+morZP2VcvmcB4b8QtpEeqKdo3TA8ZC9p0zjnZDQ4IWPfkIo40YN
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-22T21:26:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6fbddf-482c-423f-8d8e-4a05950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T21:26:09.000Z",
|
||
|
|
"modified": "2019-02-22T21:26:09.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd51940b1cede6ecda2b73ee91d7aa68e' AND file:hashes.SHA1 = '694e9658f66e7a490bdfd98e19c7e627b83a23bd' AND file:hashes.SHA256 = '8b5f33b88b4abea7848d5dbb097b545385b6bca9faff0610c78dec45d7577a6f' AND file:name = 'bash' AND file:size = '90997' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIAAhKVk6HQGHugJ4AAHVjAQAgABwAZDUxOTQwYjFjZWRlNmVjZGEyYjczZWU5MWQ3YWE2OGVVVAkAA9+9b1zfvW9cdXgLAAEEIQAAAAQhAAAAw/DszwiO22n205qMUnv/UQMLceCn6eHEvxKFKT7gB34jgfIz5GC6QgcCD318phD06GCFBJo2xKVrmazSCOQ+ScnDEMC0JkFYlGFx4HbS7xGTuSP9RDZkTNas0JRerE/ksurVkhAw5cJxywpRS1n5+hRziiT0OsphZP80Lk/2L80AEI+IBSoTBJS0yQCq29z301WNtNydROErV5xJ/kX4Tc+Nck/VetWlyy7Qk3dj2P/lXaDHhJnRIYqZTEvlW0y3h5PnxW1LFMgO3k5pHFu99IbuhvE3HMJLBHeHDhYShUh3G8Ic4bvLuT0EofJ2SKWq8ujyCstxXxjdiIWywhPx0AV+QEM8IAvpkNCVATLH3uUaI4lxgRI2fyXMHoz28vbNDc6KQ3WZd179v2rBwhYVS/jzCZydA21lbIgBzX5XosgtvbhnvtXNMccm8y1x5QcQpgBcLgbkoPDUMmAaIkmzM2xxF8ifm3Rebk1uWtmnSBRvOKYsKHcSaVIZZjKzKq3CCPeXSm7k972Et4m5Eqj7z8DVgTb9NbjaIcRVFTHEuEDjHtQAldShqJqZjcMuHCITh26JFGDmtfXlCLGuqYNamB43cP2hy3kM8fPhAqPpGvL3IabLoa4BnYRyZUBW4NTAW93zv79/Nat0mvWf+v6blK2NU4NORMjrU/GiZhGYvO7ooVZ+Fyp62Nzid7A4/wAErTEHsbcRaZsHMr1/4RX74e94Km2TvDFWkfU7S2TJ9jcYuaLa+E4omgwDReWm3RlIVKjkGrw4v2lP6uJ0rLQZd6QsxVrfylHjlT17L/A8HxeoFtx8BKMMaMbtcDsncr3Oh5C0SiJMb0zqLeIQsd4WOFRUQ84mPQRBRgUiw2i2gs1TIDCpZ+HD253aIRbXnjFyP4jRmsXFv9j/2l8Pz7uGEyrMa6bavp3c7hX9y+wUa++rYt2LH5mMWdfmGKOxsg6NjTa9TYuT16tJT/fdrJ74aSZRUXI9pOA4xrTtit4sDt4ZmJM72rw6kQU1T/b0973PnNNPL443zmxA0Vfpb4rVIRGE17aBsDcYIr6pQHcaR5J/hzI9KpEkSC4HpHQrdcdw8lXzQqIKZz6IQ7XMVr9kU5jGjHBe2H43oltw0tbjsJCHMez6/g/BTy+NZDXdm9RpRAP3m2pivnTLCtjdfrGZ9YEy195zw5BJUP/YFqgjdZBYqpMDyAi4a5/yAy9yhF1qo153DKBdDruHRDO+ye2tXUh2Bx5Az6Ei5HmdnYnny3VP+KzaEw0pSeqV3fsvLFEQ5oLS5TsNOr/cKl3Tqv9jvb0LVLmdrN4SWpelS4vO6yMsNmfY+n89s9ryiFdn6yXa2ab1WzIX7X7lDq+taTf+f2o5rrdDD41JoV9Z8jmyEWs12B3yayne3ebLIU+iwi58gXHcLZqEaoYc7CArN2liDNAxwVJEMevTptr4I/EaOWWVnthKyl2f+Rca6tLKk28j4YwK9jHNzHLIY8/XqP8Y0C07BH0xakG6z6rET/tIMJpKDQEgj9xWE+jVm/NRzRUCrXekjF9LQ/TnPx5gWus0AQVzVpNyWrnxe09DbTG2NIgCOkEU1D3i6Bjz9N5Z0ieuYewVsA7vMmtECsmbyzeKoHPTBckVsQ84Ej7MzkFmX4GDJ4kb2TCj35dEfo7rXdBHUDwaaIrds3QDNNn//TgVcjg4H5XTGvHF9bSn4UC8WxurfdUjk5WxiNH9Tqfg1k4xb641tGcT0gD/zkCeUfd4aG9+feMmgppZMbyXtdxXRytWUATHFScuCixKSoWJ248H3yrdpDour3kS1pED9MP7eY6rPl6JLutr//cv149rVEKb1NiSQzrVwa6mQr5bAOgVaSO5A5+vVjOEBWndDwGtHZJ5fdKTr+6wCTYrZZffPjD0auVhHeWVZ1oYtrTh3MS5mO1pYQssTNXylaffJXcPfyhzJRGgH3/bc/Xy/3Y0KwJde/xfb71Iu8JLeHbfSgH+daz41Nst9j5j5ewW7f+FHtP0MdE/3WfwoFvFBSGAnuAw+4HnLEBSMoyXBt6fr0alEJWt+bbG559sqQa4fLzYr2Sz3un55aToIEwRrFPS9Gvmlm8vbbOhnqBAaPTcV0V+qNJS2q9LULtQr6vITBpbrqcc4qCvvMNqWYLfPdkYJF5anzhwlAd4tKMtMbVG3fL/q71HNGgfJSLP7o+pUE1O3dwwDPn0o9dH0ufNHznXRCAc4Vv5E6Yxf04zLDP3wiv5rHzGNfhu32OZxLMu5SVWTETHphGE8jADUEapWINErGe5J7iw1gQsOP+Luq2V8Wdj6wHdRq38PeL6a8qzNXut+qiCkFyUz20eSHlyeDL2qU3Mq2WO/7AE7I6TMYUmUj66KC0y+uCnPuRfz1qh+XCc22HbwAuAEijEGny/6p2M4QCgab/BpTt9l5ezvAh9Cg3+hY6fPhPA7crccRfhQBIHr2cCvpgBBzbq8c3Zr0sazSrgNXy3QqJceb51saDxRon/XOLpYZOxjj+OBMQ+z6lE7HqfKPkO/6aEjiwLK+uDIhil7WwsOF3hAUpe0Nceh6h/FOD+89JXDOrIcLh/z3mJpfaNWwezDblIzvVoSgjjpFlkaJG16Y68j7oqbdRS+v4Klz2AnF9dhP6a+aiyUtR+wEzILo7sCJJdC3phqiikEEWqFWHzx6iuXmLQdQcsGAxMU0wXv3HprLhp6RlxaOupCtDchjLqdH0yqXHoFcD3fCoLE6ulWoa667PoPskfkbWjHzQp5RgnNGt1a+oR9Y2/Nrn8P1woS036mX17xWe6qcderwWa+ejrOI1WR4/sMgFc5lkk7CNUrhLfv9xtnMrSj8sa+5DBjXkxZSi8Ov7X/bzueigX68M4w6Sxb3V/T5qiC6Zsb3yZJ043j+so3xymqppTLOVeSuYR8uoZl42lVt15+ETN1evf6+sCk4sv1X/KPJap7KwDbX/vGHHBnsbtfYNcxtY/1oocP3+eVo/IIy3MPrbazegpdWtI+ab9y1CVT2GC+E/i9iIq/N8qXq8X7BbM5V1dLifQfuvfrBzxN+trqtozHwJKleMMlyjphK3+kTvTxXDy0FwLfCA3Gk4KbE+EHTh2Dwdwpj75s8tvtVWLxzU1z3nbHz6prndPufn8jEYa8BMh/+T3DGvXGsuijXTuO0g4jZqL68N6rxadfWoz6+x02MqGKmcXa3Mbb6piYdU06pyqwtjSS+2dsvtGxNtQpOMy4eCNOcx623KGFHuqKaGdp1HkfcABrgYoCiVo5yJs7N6LwpJhaVvipUQ6WY+U2NSw2M+jDC9jNAzMjXojmnTRXQx9d8WfboolKq5HlhZ2/m/SdfIzghR3zPxXDuYqtMo8p/Ap1yDrgWtewhjtU/+VGCt5O6okJJ6FUdZq8B42DB/2C+z0HCM7SNV2pWMe7/F1mgtSb/wT10xlYjhJPEeBFkPWSTSiy61h+koGA0yE0Dc5a0rs71bFQs+DhYzvZ+M/W7rEzmFbzO71Y5JLcCpdbzvmt4XJz5pQDmhA4H118cheZop+1ntffWMmWWpHIKm1lhwEdIJdQae436SSO1PlJ0rPl6wsxLYyWmo6FSsqU+daPPa0/t/KYp0pddHCqGRBxklbiAPUhx5cqG/dm6KvUedf5w8j8LVQTORGZo+iIQ8
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-22T21:26:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6fbde0-8268-4747-b0f1-49b4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T21:26:09.000Z",
|
||
|
|
"modified": "2019-02-22T21:26:09.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '041fea93b5466565851dfd8ffe08fc49' AND file:hashes.SHA1 = '2dd0609e289ad8c172ff2534010a8b9b56a54bd4' AND file:hashes.SHA256 = 'ceaace7eb68ce0faab1ce80a019d603c3f11bfc8e1384cfcbde13da4a08467e9' AND file:name = 'cron' AND file:size = '90310' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIAAhKVk6Xz/FGdZgAAMZgAQAgABwAMDQxZmVhOTNiNTQ2NjU2NTg1MWRmZDhmZmUwOGZjNDlVVAkAA+C9b1zgvW9cdXgLAAEEIQAAAAQhAAAA639V9JMaSYvAl4Oqmp6gK/YZ8tgliXU0kscKimeM2oxaVv9gr3pK2nqXH+Swey/xwAAJf/hLyezOuIOePJ389J+5TGBBxpe8i/VBStrmRmEwH5kkez2Y5sRIg27iOr6/K3ImiJMKqB86G19vJT+pT9MuXtyLCNWYsIWiz1TAWQDnm6VDYgG8lkTChpGm7DFgDinFc2QR0/ciVHwSxQWWfefj791avFOzenTOPGUO0HgJo8Cn/dsZ/iqQejRex71cShBZYSrkD+BuK0G1/v4SI38yloJBywZUS/r5AsASDXXHAaCb6hqN6CaPkLnJtCDXvWgjOw8ZnLx2TZcrH8629mwTvRLF1OgLG5UtTxpqwo+bsSzs5v48xUwPzWC3bj50xW/rZpA+BcKqNtUaoXgnKDuvTKB1DmNvEXYAJJ0K3RPm6F2jQv8xZuqri7Rx4DrKSQmNJePbF4aUTmos+6Bei7c2if2hqwYoFLXEfhK/HeJCNLi0fJA1f/Gjn/kBGNFgbv49sF2WkPQMtLdzBdlKzr5F5j+3Znp7NPztYLb6VoYOEyPcC+BXNpcPCa7qHqTDq6mwtddtLdg2pg+XtKcAqR5nDynZpaCTdbS7t6wuHj1id1JxI17U2cJb/7mF20Ku8gzUdiZTz3hPvBPhJkd7zCtFjoLi/LoLmSQ1akEAYSU2vSvScta8GMZjB7VgsXDPp8PLbAUBxoETK6G5PfsPQlsNwHUO6c6zWQCBNZEGiOLVaMMxW9gcqlzF+JVhWCp9sZkPvcZYtwyAXzeIl53zX4xDw105wov8GANB7unY8l0ftCr0IxxEnBckLlFubTTJMcrZ2Ztyn4ORsH9WsfGVGAMBhcu/ARQt3E9TU3Fl1rrZKsmP4N6W+BlsQUe/YtutmundRnPgl06q9rzDKrEp0deMoS65sIP4niC5WDwnJG4gkwBsFbvQRZ7ss7VZTXFfXXJNiy38MemvRAM7a8n8yN4GUeUGLIEP3WhMfIWKcgwJ0RhiGksJtbMKmLHw7PPq365Vqt+sshwRsOV73z2cpRlkCQiAkRv8kSesY7vaXfW5ERCAgsqYIvRSyZBy+RLp3xJfCKCgQtHPoZ9s1s6GHCYl4SKzcuMWZKn9+duN1oyn1y4iBvF+C/CzDyXZRl1M9YKWjYAzEBUJaLGZbUhLHr6xxhmHeENGKIIxRLypzkIujSBT3uHeOFsuioZJVHg/OJg0mB5vCUVmTBd47JMKR2itCu6Q8frrTIUBsui+xulIVmR9HRy/RM0yoxmkIVEUbhaxwkUE1EJM6bJRXKN2QcoT0iQJdMvlmijtKhK0/YM7U0mDNm9zlxqo7YlLhdx0wR0yzty6dPzpLKJDqvU8gmKVUYqmPjuImhlEdkymvJcJi8p195K+mHR0KIcl4wvTqJG1gQJ7qKZ340rblFIRGY5Bu0O7cV2/ZI2WRj8vJA61+SB93hRSsPcZGW5op9SA/oN1WBygWtiSc2v22avHsKBE6HUbJrSm3/f8CAcG71lZVx/bdYw8FSNubTf5EUreTG26yKDqEHYvWXVKOczPj4qBZvsmPct+qcEV/f2pzanTIn/GL/MNPF3O45O9ln8dK5670lU69k5loEXdHWvDdUuCeayOqc4F8e3Rz0xJx+XtW7a9gbsWDZ4QltZ8PwOkC5CVoAiJuuSAJN4rqi0H66dqhUtqinFOGIn/jVgfR/QPXc7My1XHCu/TrC2x8YJZC6aCaUahXX963qItUeIzBKmQozmluAmcqH4T+OQ76/HxRGT7h33aK7Iwxw6RYXuMG4z7yVUiZZkVJGxleV1UcDe7GRGOBxDj9Rc0qVJF0fManCjXraEyt7oZT4ZD6nO9jevUYrWQblJP2LyrGQFVyT8lFVbVXmWMrBOUazyUdfHPelCrqIKiky9L28OgEr1hmc6BSPyu+fSZC1gnWZUR+IeMdD0uDhZIvYsBz5Hou/ZImXsAiQ4vp2bpPYVlGUcs9oNzIMmeVCvnertPxefbD73IPs35usoi7gRDtPAJxnJDPr+gaw1orYM3WDOA3iQcfpju+mLrX6YkeieUhFdI65LzVIP/6toRPxtJHo0hfpIguwnK3sU5A5TGuazFtUN5mi8LWcBcNQGCNujalvjWwvhgCStCTQjCc3DNCfYzHt4YRutKJ2sUx+72/uMe1k1ybmZcP2r6TEHMUz4WXQU/glrxOfNMO63oalda1MnLqJPJCxVBR6UEglzKfGnoNpoLEP8AYRsA5bLx4nlt8Zm2ZwtOiQRSFWhV/o9FMaKpLKUI4mMvfMHT6N6CVmiXaV0Z8yoYUCHwM9pwEvkZu60YbBnxL/i/BrLAS0vtgbESE+iXB914Y9mVs1qlC9PtXpoBLDzOcvdqEjbpzts5R562xrQeHw43k4m5bZGFQw00zTGowcN6HkBoSh7HYtiSMhB6Z6Apwj5tjNf1itzW1iH9Pcgv7Bi5npMHY5lapIJbLv9B62Wkm2gNTTDinyRCCrLUm4F7BaFduQutLvYlBDDiO9t7Ihn3clPAEQ0opZ7Jd77vNDzxPz2ZgJJi/20NKD4RuKcUTJY7N5BMGtF9l2i4TXC9j9OHzusAyZEjm/0fKOOuY2jAddYI7jqO89vHxiOeK9wUP6/UejIZyZUiED4MMUkQFkc75nsw0tblfDMqwWQqsmfQIvKSLvnL4xpLJxgqa5WKD7qtNJ3u4a68lim9mmfkdQBg5qZDVG8+Uhr0zp9ExfR/AX+iwePNlTmfdgWuNyR4mOhXmyXM5d+TJDGu3sUigbxwhVVq4y+H68EfaSH9tsS5nCsLYXyZ46rAj/RJE/nkPXtWxRZ+kfU39fR6C6CO0jowVGhkPyAJ/cNuUVZlw0BGU4OuPXmb6dlGIGTSmBmtHDphexr4idhj9+fWsOh0cc5tOolUmrt+v4Fwam+c3LhNIlBJ+cY8+ElJnuQ9+lPYVZSZoSjI3NYarwcwN8oSD+Ng/Kpyi8kFQDdrySC9elx7x53e7mNJhaayj7NC+XKRpXyFm4agN7+wsg0wNDkSmA6R752K3CYglQyk8cNaRAzMH9/OOUNKwTAFCfCvzs9ZwrwdlS24IdN0JeYnAgZtsLPxe4IkKUDfJw+gG1z9hKh8gIwrbUFA5sy/8rGgU7v+wGk5hxJ9diWm9lUhRsM2NW0P6SBp9KVgKoeMWRJ5ZPLKdxOEjcmtDnZ2nrCJIfZNpdOpQfDRmLb1vKYvpZTRC9V9khG3D59wqHNJ+Nk1ccwFf7vDZnAD+6T71j+mwO0nrZxxBPoJNkpu0JkkMm3T/DovPHEPrR+ZBYlaF/GdWbffT2j3J6njChERqxEAVZW9qSVb/2183ZN8TPVeN06yFsekWqQoshmGgWeCTV51OIS3te0rFZQMKI1gwfoJYAv7havGuMbu09NhxhsdD1Lac6Tzg5/ScZLZmW9GZMJbJJkt8Y/eHXDacTB/Rnc7KbSA/V/6n75qycdtF6XNUcRHc5NE4WK1pf74/tchOU3P0eklOC4CA+y25e/5bLgSl9CjWtPhxKzB5/vBbWRTdNGY8HvXoytEEKJRGcOquhOGoHFK4PumaFYjI6MkD8cwti0WqOlXYqRVbik7mzsA7i2uUyJhg88Vx+oE8+C/WTl4QmJilLtkltSFcfSeEzzo/IefcPs
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-22T21:26:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6fbde1-de30-43f8-8bcc-424c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T21:26:09.000Z",
|
||
|
|
"modified": "2019-02-22T21:26:09.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '22f88dd2fab9ca0915e09aeb6784da08' AND file:hashes.SHA1 = '709c7b60e3ebb921592be87015b153b482ff68a7' AND file:hashes.SHA256 = '623a6f3f3192fe3b6a0e2d731a20b4e8eb5041fa4af3baaa68fde1720d296e5e' AND file:name = 'ftp' AND file:size = '77914' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIAAlKVk4V2WuWc5AAAFowAQAgABwAMjJmODhkZDJmYWI5Y2EwOTE1ZTA5YWViNjc4NGRhMDhVVAkAA+G9b1zhvW9cdXgLAAEEIQAAAAQhAAAAY9Hy27GwVj3rdKJbFRd6LKdK1Oj7Us99JNAYu9U+YgumWAcuACcjwMtRefH7xGN/eTEnYxY6wafDspW3R/Wg9IQBCMQ9/tkXqVmDjxrwYpJMGT2eUsN7sy6/2EsE4VZ92TE1ouzVoPkL/X7uSfrLS+s+N/cEbzZeOaayfMmdVUldeRbaO9k9UQVJxsdsAvVrIKxQ4UOUFWnPWXlMroBCKSZZoHigSajuizH6VaxMxcNMOZZ3uOmovpseM+JTAiw8HU2jLkNizrljC2KbjHrFTuFvdXsb3Vj+KSMMN5CTXoNKsruYEWyr/o9tjoCantHcG/1gmR8dxZA6Zc6UPNmUx+1G4vVqp7qb4G9jrxH6m+IejRNIxWfPINNLSa9TUHEAPW56lMCnCvN2lVbWwsAGqRORr0vjPU49aJjOaa5bL4kgR/H7U3s8AfLIw+l7qnXeNmZ8zAcV2gvfOZa5JSElv2LtYpHyc7STr9FYbQRfD+HuHkDaIpbD8nThoeacc107SdPS4dFKqJX88iLD3U9AEaHO/prituqol7dCKC8ZyJ/qTvDLADGtLYngCjaYFjyLcHGjIOVE6u+W7U0qrZveDtIb6uodAprhH6iq1pko08DxxV2i8WNO5OmIpvI/f57l7qYkTzi+VIGh+NqcvImIEZPoLQmiFApZ2jWWz0aMkxeUk+c1ZxvrurvM+yUX+pv/bPSzQB+pGpxrbwiQr/TPcZUuwshxOBjVxJjFhPAo6Aj3+64TA1UsFaRrNKecgI4hp+AzeOLXoKkZyBO1IN1mnnqJNLcEmSWiKo6wOC17jCh1JybgkZgZ2RfKb03RbNA3GmpAWtzWffGF0TXHYiva3dcthJh8hXtPxUdlrlmTueWP9mvGfIwxbC37qdOtU8Lq2mQqyRQ3q0QYG3U7LQrfedW4fCeWreq6pVGdx2NGv06EPFKWsXGeoOwLXW87WRZUlEC7xYvEMUf7BjmW3ijQSxcTIw3d9wDW2PK/gbuZrg0wuaOvDCImStjSQohIWWWwVrj3jn3DGOcBQchNj9YCUox+hf5YCW36bg0+8T/Cj/cNf5v/F0eyK4FIRZoiOy0bNNig4448UiDKpLyWgv32WB++s3rm7e46Y0Oef2IuUjlTIngXtk5qtnb3Aj7Lw6oCJV5WQfSm17zLTEJWDhext5fe91vCtvWFnz/kW3WV3EhIdFQ1B0zER+sdWuoCx5bZgRdwo8xAZIgo4V86yrJ1g3UshCIBSddoYXWwzFsWI7ypuL+6yfKe9NLBlVkmVzDbW9uPB30TqpGEBoifvTGh4cavwVtytuDUs3lR1oiG5Mbd60z5QqMbHUVUxbmGtYVrz9+8ul2xENB7M5D6gH4BhWWJeVUYfwohWNU4Qsfim8/WW9MM0+pWuW8q8HVlca+rNWdybhCSB0fPahBk6+tSSKHLLHbVB8n6fJHvpXoMMwsMhFUPSChyk6klpxGZ8TJFonu0Dd4Av1Xhaxpv+OE22q7nMGBHo+qDd6JSwoXdMoEXOJo1VAedAYQ1rPRdRy1fNgt9EE9aMFVmDPyOwpgFjfh0zno/gh32LksQZA0/GvktPbu1UowimcoJzF6eqqKQAyOB3NAsXeU3zMazdOCHgA8AmY2SoUj/0K4AcXnGTujeWooPul/gBIgrqXWfFki2aDSP0Ff3aViiVeBKUiZSY0omDYLfMgGNzOxqJ9yC25K7FGxhhyPoV9VegDKsBd+qPD+/AQsalnLetyz99dIIYZCSTD/myK9IUsxxxCOquHWH25qb+qSxJ5u8ok0CFJiHuqTr66VwYom92Q75kfXDA6125HrU7xXfICKbSw/GT5uno8Cvq2yMe6B4XMLqRxtz/rjVdzTv2+rJ3cdOMqURwXkjknVxQUkxWYbk07BRsYuA3PV6mylqqFPY/eyhZZvOw0DpKzvechz2NZcG2xVcutJarmh9OnTfTSx5UkFCFYd1WK7jfGf23wk8fMzZNQ8G3eCrkEhfNGe4wf4aVOiCQhv1Upyve3M3tN6OeZr1oipbjcGFy5P7tnlaz3NDEw5m+xT2bgWXGSFaomg+88HEA2oPeEN8kk2RWM1TLMwhZ1gzybZKH8if06fzq105v2OptuKOSCm/Gz+aF9JDeVVKlNQLdl7okUoRNbsB5CaS4sRUueAZ2LkVlI/vfHDKyQq5drJUa+RdzmosPMbbquX7QqMGS/uk0ctvX1MHbV2Z7cRcaceAzjY4dX/CruXv0rFh5r+JWGu8EAeN1sUwz/EnePyzfgHknnUF+2Nyl17ioNC9MJIZWw6ZKTORYfFCIAU6Zf1hHEDm7H/X56RP5F/ZxVNm6Ioc+X/bAvJjAgMnONGGqph+o70gjwfSexjJrym2mz6uZYh26TmtWoHhGBwXg+gvGPdTuEGkNEzegkCnu0Pbg/BrPAT/wynHi/Pd0aAZhnk2lIFjkn5McO/O8IR+Vbdaf/udbRCyZzg/g32/7NAcfD6DEv8z9J7/UVLnpWo+HNnfL7NAMyIoSj6CyPmdeup3dpsUEA1X5KAn1vWTOz0Co9C/QEiiYsxkFBFssHj5ViWYJXk/GyjAiOZ4Fc95+0S5Bcqef9EXZ2hqusO1AdJvAdHR8yfnDpTng20fmmhq2YuFpwVGosm3dcdTFsl2ZuJ1+6Wj4nlcu3AuoCuKrYQnPgjnz544e8KKwbby6BHgrJhSH1EjcWoFGjonoKBNmfBvCIoxgnf+y9hzMAqXYFxThvEqomaAhoXPCB8+BbUftWTUgp2MK9IAS94PC5zO4JtPTPT2Sjk1uiLMrKcwPZHtny6mDDuIf9XA1808ly+uDMj91cujXKMku2nuqh0XhlVgozvE3oNUnlTd1jBagsD5bpTyMUf6ZFgRtddvgJoWhEsmUThG4UXL1SkwxE/iYHGSKUDwM14yw73H3b5uGEtVl+wbP2wyiwrQQoPFqYCsXumLW5KGJO2tlziUnZiny975HGXDyEMklT326tjAN8ye25v2aZyLZQlvYiOsi/QHtWnDZg6twArg8Gpnhnuywur1z5Z7yycpvhm4CX6I2T9KjC4+q1KfmD8FttUwaMsUcSPVrTktcejzZhATY+1g7h4XFs+50EoI1qPWop9ERMCCBmm+WJ6eMI7o75Q4zKGSzH38zoP8khqmNBhAidr4K+W3zbWDbbvB7P1kUJCkCc3oJ5B3Ca39LiCj3OB17Ipnw6+UkciDwczmlus+npTUHSHkUbBcPbxOhaUi23Rr5yKMgcQr4dVSAx4DBFQhimFnjRkJRcFeP0NfTF9O3jlTACT6D/fndo/PtfL7N1SgsvDVNfbwAalkvWvuZKWOJsA5mYAcz1cvsdaR+TEc2r7x3OF9IzTVk/TgLoaHz01g/q2XQpvzkSQo/NvB3XAoRlTKbZ6hK62JoNGkvAC4a2TpNG2m0WUE5/vF7iIKSjVR275AEfnNojsU5RycLXUEVFhHz6hC9Y4WF1cb/0hEhb1o73QX1BI4OKz32/IbKupYxP49+pVOteA7/S90tOyOJhEuUtH4xIu4to/sYZJIzQCvFbd9ESyyb7IJzyuSyPN0Aqf6TxX89mioVKyDTTi8HUJe6vDY6GFafcFEx9HGN85ciIpicBK7ribfae99H8QoUirkRiquMIqX0FoB1EEp6vCU8i2cJkc1
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-22T21:26:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6fbde2-bee4-4d6e-a824-4594950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T09:16:18.000Z",
|
||
|
|
"modified": "2019-02-22T09:16:18.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '92c3a11ee7529861801cb0d7426f28b8' AND file:hashes.SHA1 = 'd2c914309b440b2d33bc834c19372ad8d1faf1b6' AND file:hashes.SHA256 = '5b70ff3a728f8981d2827efc1c1682ef288584ab67c279901c71e8f5e360a2e2' AND file:name = 'ftp1.sh' AND file:size = '2079' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIAAlKVk5ilz34OQEAAB8IAAAgABwAOTJjM2ExMWVlNzUyOTg2MTgwMWNiMGQ3NDI2ZjI4YjhVVAkAA+K9b1zivW9cdXgLAAEEIQAAAAQhAAAA5vT5gjMXTQu9n4tUNHjLB3i/1xgD/YXbHbtpUWeJdvdlKDgXJf6YnGCA/NeVrTIU0dQTiolZPKkcTY/RBC5ds6QYtq9ZYioSAMT/FEYDFaj7yAbbEJgINR88vONPgtTfw07UfXYOs6LzS2Za0Re04GkfUsTE+zPwOW/HniRA2ZutVpUjjwYCipX245wRM9phQtcFNKk7omvwLmAHV9a2F9JY/EAJSjjleYc97v43HRWTACzrFw18pEYVvwU+KxEchu/Z5MJW41v4MfrR6pi/xfikp8yw2K9K7jegqsVWQ4rs9F/a/aIxd/i2FzM0ecwUqs0uqej/OxIjF8Odi10NwtlcI2OME6LB9kxTlytoJtHr8II4zBrRLENnJsAAjicecVmGfVon3O4LpJwjgMaICamgGao/IjH4dVBLBwhilz34OQEAAB8IAABQSwMECgAJAAAACUpWTsg+VCETAAAABwAAAC0AHAA5MmMzYTExZWU3NTI5ODYxODAxY2IwZDc0MjZmMjhiOC5maWxlbmFtZS50eHRVVAkAA+K9b1zivW9cdXgLAAEEIQAAAAQhAAAAt3p99UF432BNqS82G2hQet9yQlBLBwjIPlQhEwAAAAcAAABQSwECHgMUAAkACAAJSlZOYpc9+DkBAAAfCAAAIAAYAAAAAAABAAAApIEAAAAAOTJjM2ExMWVlNzUyOTg2MTgwMWNiMGQ3NDI2ZjI4YjhVVAUAA+K9b1x1eAsAAQQhAAAABCEAAABQSwECHgMKAAkAAAAJSlZOyD5UIRMAAAAHAAAALQAYAAAAAAABAAAApIGjAQAAOTJjM2ExMWVlNzUyOTg2MTgwMWNiMGQ3NDI2ZjI4YjguZmlsZW5hbWUudHh0VVQFAAPivW9cdXgLAAEEIQAAAAQhAAAAUEsFBgAAAAACAAIA2QAAAC0CAAAAAA==' AND file:content_ref.x_misp_filename = 'ftp1.sh' AND file:content_ref.hashes.MD5 = '92c3a11ee7529861801cb0d7426f28b8' AND file:content_ref.mime_type = 'application/zip' AND file:content_ref.encryption_algorithm = 'mime-type-indicated' AND file:content_ref.decryption_key = 'infected')]",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-22T09:16:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6fbde3-d9a0-4009-8a03-41d2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T21:26:09.000Z",
|
||
|
|
"modified": "2019-02-22T21:26:09.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '87c8c0e95c33ee51f83a6aee659d9df2' AND file:hashes.SHA1 = '4fc8179d56acb490e841ee884b0fe27be22ebce3' AND file:hashes.SHA256 = 'b97e9993702e0e7c214b72c5869a8d9e4fd59cec7fb42c9873e548f52a6a072e' AND file:name = 'ntpd' AND file:size = '119796' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIAApKVk4S8RP1RKgAAPTTAQAgABwAODdjOGMwZTk1YzMzZWU1MWY4M2E2YWVlNjU5ZDlkZjJVVAkAA+O9b1zjvW9cdXgLAAEEIQAAAAQhAAAA7o62BPA0f4euVnwVjgyqp3oSPOT8V6ww7M+Vw1sdGvbSqki3k9exUKYg2Ez9fazrIbrBWDTGr/Gv58LCu9bv+PLBkTz0m88XXxPvPcLt06zddalXejT5TcenEQQtxsf2DJYTpeCFSm9CnlyFepsRYx36M58Vvw9AAEQ+ynhNkIKRigrA8OQeFAWc5cYuF2ngwzd9Sqbk3+yhmLutpfb+DktfAiyw20mKsVvHj3yi4MfZ9//izK0fG9G+9AtOEesxwlIUaZd54haoJO3NDr802JFbmBfAP4+afwuoyMRfBppLwhw2fu7zhRhqLeGGJb1NnCht7weCyD3dyt+5OHF9uPSpYUxlp7h1MHpgPBA43Q3rswcmMdNIW9BV6xtdmHlORORD95Y7MIkEHuj9kheHWN5eFmE/3NYJ4/iWpxgjR9Ifn0R2Gn4SlqpCmgGMdGneZK6KlOSKY65X1A3LwawwpbQjb/4EMVV9u1jaiRL8tGNY3X+HGicCdulH6PJTVRpqTEnkY9gfAhRBcKCVEW3TI328fQM6SzIHJQaNhQ7S1+u8AUdz3leJig06aZ1FE2d3S37oo26SAUvWSu6rSOyNfLMnGlC5TSG0nOtrlGSkIWyaMfb6FIoRhnHuHNS0A80yajC0g1RpNWKEHplu4kiyno+Mm4RsetWQwnVxLraRIw9twBJp6XCjCpICjDXAeXnnBtO4AiAJnMfdGrBf7jyxdeli4vif6y7Ool8YnwYqDGCxBGZETQNCsTdgV9Wt2rrLmJd1CL061iYJFaGwktXcRPxs6d+sDWcXu20X0IjpZiPeewDRdH7wkRcQXZAbotcfOVpWraB78X0YWDDhO/9/JofkVZe2lMxN+EBoo839nG6wvEj9Kq6bZD6rokFgTTMOMRJ8IWXK4ngMhS2eR8c70OzqXYhAx+iRd2DKhkGxJK6TOXzvBFrZi6sdjhiUqpWYLCOX5O00i9QtMIwdbRaFQQnulzPqSVv7AHIuzrUYLfQQsKLlGFrjEPi988nIqqj7bPyMeCt5N94ZGSdT//i1PbDId61MjgH/ajW+NxqIB13mJ+0mU2zUpPvovpHc0WcH7gktEFK7qX+sxOQUXlzo4Sxnx+G39jsvxtvzzCYhUNBBxjhrTnTUFEO3BieXcZ4njOKExbnxVJVS7v9g+X5bJgHP2k/Eu1Zuda0hRW7wrfLia7xq3q38f6PcvHBJ+OcmTQUC/ncoUcfyjcrRJ7xy2zqucuzZypAWCTYzQ21DEAGZOZGOwDwBujzZHBWglv2TGFTECCp3n7fR530PSnLj6w4A8FPF+e3h+h8PpGW7ZeVpMx8ajBbR1gzirp4iBKxz84YfgXzYeJZ1mo5GjpjAujCQrnf4u4iWqJZUVoXYW2p8oWVFl/NZ5xVwzlaVQJyNac4Lb4VswYcTj7rtzwqUvKpxlSwIrwn/FIPrDDBdKyt6kGiMBCMA2HHSlEYBc+8kFofmzn17uT7EypCWQjnYPEfM4XEOkJ478Ws7RIDk5brYxN1RVppOwn1JWarj7iTFuE573kIhiCChASHEmydXigjZkq2q2Cay3nXlC6U42cKGHJQDkNoU/LFOSIhfSIJYwxP5kg+aLjLpglXtc4sU7c6cKURkEvMjKMsrJGD99Y/CtfcLwZMX9vxzbm7AsuDyIJ+zDeIwzCSLkQNHiGOeCpJT6k1YY598PucDJSW7mS8dJhDIF753VjwSBiJjkAquSC41325kU7nnRCa8MfSTCz5r0yEZ1l0OSqYDioVq5eloaOX0d/svsgLOhia/rxrEgUo6gZ+ot3y3VCHsZFmedcmoQErPq8Pi7v+K3Q5jNbMIjLRbU6rPaXCPkN/ISldGxSP+TeESw/PaPXVqjD+dswxm5mL/Z4TRtLtDGoFYj506y/Cdq7EUPg1jFKU1ihsCXrXQ3kdT/XP/YKr4WPEmIPYdOjB7m/RAhR99qTbGAK6HR13PkxWWc6etgltoxpJ4Vbaic/WtNZCcg60w54gfI065HWBjR3bcFQil3dJY02Gu9RMKmYrEYM/KS3M9VF3cAegWm9pwKAXdc/ZEI+UrfFteQdWtFgdpeFgYgDAGwAfHCV+ieahk0Xgh8/eQ3+rYZUeseb2eCZpUkcIihPe3si/3p8nCXA4rJqX7BH0G/79bQInJU79TzGyMOiikpKikfg9zz9RhTOegZO1iIcmHtttlT5ZxI9gY0BY3p4In2xIhvuCiMgzPHWTZR5ckYFf6CFsI295m1CYy6+gBy6GQviJn3w/brhwxnYCLoneJlsUtrIf0Hh9pIotaB8n7zj4kcpNXQeLA7t+3IISMbPYR6ic5mPJPAMy7es7eXG2CUJS9iJxPNGzk5TqjxksKy8VuWCXBxw6R5XeM8rIR+H6Mcl9IaWF60kUqxCyVnvNi3lehHpkPjTuyiTCDEMjNSHiihq1Tzs3dh5qvAZEFfmBmsbxK8DWbgVLc23n+xUg21twi3bKkyDQxJDPx1HdJ9lg94r+wni7F4uOeUUZbVCny5jhzm/k+vZn9pm6derOabvD7ScNb4V9aMbBZwgJRTunqL/NpiZoiP8lqm/X2cdo9LRqf6bnyQVEpMvXBzjC0eed9IfY+3Kbo1bOgUx1PyTBQ0WbP1DjobMVMxefMwIN7BrDP00dYRbbMdOkE0n4Jsg49Tx/OrdnvR3slZer2ohMMuY4ezrQiNXTaHjejVueLJnP3PnWxGU9jubN1DofAp9lbLj7IfUGkTcHoNpGeeRfw0l4jtNDRl/Wi0pHlKpZ5luVI0cWGw1bvjWfPnsB+7YaLLq4RmBH8IA5jR9Z5vEHzFw1td1OLzcqXzUi9VrY9Yzi6rlxWPJRCawH+Isgfc1PQdxOIc1T0p/itEybeEsoEgLmtAb7088ybqEtzuRONJcC/nDQZmPPfzd+23O49XeEkrV00DK2jxpNbBNJDZx7Y9cgUgEDy69ONTOXrXrv4AkkYbESAqFOlPgjS5qV5WmkBd4YL6nbL04LTevIc739abk9+WUW1vGA4MVHyziOMv7kn8ZK/Az+9qci46ieg4E2pdqqkTf7TByRNnFAAf+xmme6LxZq2O8c7Z6qYOs/efhFI1QsgCPuFVEU0n0BEDYN2O1uVDnhJdmLjyWOxv3wwwFYRPnziNpcD3YofO88OU3zaYHSWPQ7KF66igdkxf7IhPDLDlFBp/DUOccYWFkqqg5XreRlefvWm1FFDFdveNzuSfrglmr1pqznV9hWSWuJdR/t+FesQK6lH30y1Ps2H6d/jFKdtkIFhVwyUsogaB9uNgL+KOwIbT3ega08+jgjnWlHOEluLyE9+TtfNIFBgwkx5U0hcoXfi6pdgIhzr9dUYffFkvjdaTZggroRLDvIJgVaj2KKoBB+GXdecUDh2C3GmkUx/qGC8rval3MWCPBUYPh3CMWgCM+7sS7T7v3Dngoux6JbHA/ChE5MGoN6FTopDr/1Jq2IQ7BVOv4ku+kT6SekXgkvroBX99la9nctVH/7mLxA/7F4G5fzsq6Z2eF4IOrRcuNCGiccPb+JE70Jmha2stdvrabW3gGnNt53ZCIp77Pyz0R5VFnFJULZmt75DrR8vmZG/wfdkG8pV90QEf7CxYRAjhPDZRkNVL3KoixyfngnzkvZS9lBpt4KHSN8DhB
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-22T21:26:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6fbde4-300c-464a-a542-4548950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T21:26:09.000Z",
|
||
|
|
"modified": "2019-02-22T21:26:09.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'b2eaa4776b9c625c012d85319cbdc2fb' AND file:hashes.SHA1 = '4bd652c7ec439021e6ba559eb5b96a671aa71386' AND file:hashes.SHA256 = 'e3e7ef4f1b56b1a6a208df5f993989b2df33ec3c9e27a5bcd8add0bb40b63fe3' AND file:name = 'openssh' AND file:size = '82065' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIAApKVk5CQcqA7aIAAJFAAQAgABwAYjJlYWE0Nzc2YjljNjI1YzAxMmQ4NTMxOWNiZGMyZmJVVAkAA+S9b1zkvW9cdXgLAAEEIQAAAAQhAAAA5mDjF1K0uwee/CxChAo/cx+pIIFvZZkagFoeErZt5FUnTW2axXZh09pxYesUBLHnuzk1YajVANtz2qh0VEJa/IYbA5lmG0XrDDIprWyPh3BU8xt96RruQ8xjp5CLu1cTIYAyx6RIFu18S3kEnijhUyls82lnTM8hVAZrplRrNPAvBPlaujoYxKRCWPh7kIloVohD6jZ7Frg9570YxIRM0K+/ZTtKh8Co/kBXNtK0PC3WjQAgqVlYyRdcHDTzWJdf5eY6QuK0/WGrh2e0oTxy1G9WtV49fUsqGy7bmrKUBKGqCFYwJ2U1ANi1q70/vQGJtZIzPmpWi/YsOzS6fk+FdqQ3a18gCK1EVz9za2uvIlUNykIuYLXNCN4LfB8v8Z4rw1hvIrRZrI3mg/TYvZoQBVublxLe5tEiLhUnvDNKJAUjbqxTpBLvRcpkzoI0rCD1LZtwrYPY1RZWmufrgPeZxyAa5g8DDvjp8ozHBYgk07Mz2H6r/L9rFZbYKRHBVPBDhU9noH8dwsIQB7ouj4vvo/0Bxlj+qN5WE8NLxjeheWspHDgu51YVl85vVpNHBJJqelolL1uBJcI/3f6heUnIiNTXDObIn5ZNFWeDH0+CojKHgVuUD+aRSpC3kGLL4avU/Onx6ARPcwn1gVXHwU+epMSWzpzyL6YxyL7MWekD/CqT0mnIfTHDP25jl/kWVYiTbNmivLGSbas12EN2gBCY23MqoEXxYz439n1lyGUPPOxDo9rX5tcgLUUKKs8RWtWIwhH/VLk5UXTtPxZYfwXyYn5kB+/iezJG3XUBcxKP7xCeTGGkxYmfq3PrVTjMSzmrwGr1dMydYtnxpoMy9vE3kcZISGsMwCqq+dHGHs16G985AV1bG64gY7Zt5LGsuh3lSXI7aHcAKrlfZJYX3lFNFMOLmYQSOwlhthOfgB57l9rzL0DHRMRXs4buSVHJFoQWP0XYpNQNuND3KdtE1vMQpzkPEjnhD9bj+zQ5HlVwzoxT5LGU3P2023XA4CIoDUPLDZ5kmAaQgWznqnGfKnjksq1CHM3myRic+t/h0IX806KzFiDByzZuUSdzArJ32G9qOAaqFvjCSuxe+R3yW7mbINBs9p+Q+UyOqB7ZwRIAZZgrZ9B0iq3Lh+B0t6I+1Kkp3RYfR2+UJ4Gt/mJJva70jrQ+QFwNCa0av2VvydGiiZrTzfMX8XzQ5silFvZeiiUgqWbpQGeHZ9IvWqaXEGZJ9Ns5CmTSodIyk3BthiuJLVfKFknuDbaDhJahldlP0HlReD5+aBU8QMCxaMDrQTkiDQIe8SZPLuE9SUKolJ2D2OqWVDSTZ041bsIYfVR711N3CXe2xuKbsIjkb+JfIkUAYu1Hzer2QmUgMMGyQfQCKkUE3xuuyO03SGO8ckjWnkEhjbmi0yO5WV06px/I97DU42yZY2x5k1JUIYjaGg6fjZspTAosedE49kM6w1PqFedZwQjxHe/G7eeCWLv/JuhxTE7E00hvxp1JBxZFnXO5xUl7CpMCdyI+Jj/CJjAa6rRtpXicGwK32Ttggjdntk0BfYvq+4Lgb052GdCsUJnE0oJyCusuuYScUNfKC9s+qpKJ7/OHoL8+dA/6rCLm/pz8EsqmfhmFLNj6D7Tjua2bCj9oraHtT0MruzFFqytWrHvH9vlv1z1Lxmk4myVbdV91bxXzHXDd+K+EM9sIfH476095re32UitXf7wuLPoCHsx90p+oS2f6s+F0g/tPcLEgTgq3GWeknmfe0CsYM2hNbbca44IEE7VOtqyFqE0iZtxxJ4K+pLF4cf0aHDN6Qn/kYkVjfcUyN1CvsfHX3lL8tVbQLIjSi76DeNlNLTlgJtgEa5L3jc6tf75PjEv81mpVKH8ah4jTMvhtGQc7q5a4h7k1EUTs0ti6lO0T5RvCBHVLFr5egnXO0MzUyRsJ1DTt7KZOfoJdk2bEQ//YsaS+4nOZgcivOfIBsh4qoraA7kATAwsBRHoAA4EYGjgiXGTApx7Ld1IvhXL5pLWRLfAj9sEYlrt0rzXl3lLbanw3vH1ecVQ3uoZ+9zi8sSSWCFlDgmjdFflpnFBLARYVG33Y5QSSwgiwY4soemL8CP9L+br/YFGWnCKKZrq6f3tMDiWEKqTfvrla/MrMySaAXP5Zw/9hf3EVdtc1/GyxwpgLJfNejMT2TDDmg5omjvNhwR2mN7d5uSs2BKqnXNYOUrN2t9AmXadLNPM7SOZBOI+QNL4YHhxmgSZzkz742o6J8zwzFLmKvzQZ/IDdT2VK/KK8K6c1o5ojcRsf61pzPPKGIeZteGPls5yDoqgET0kvfKzKD5gsJorAlmCJTl5uyFou+hn7FrJy1PGYf9zel+LNrTB/j3Z8BCWkqPcoeN9qry8bGYAaomLJNw+YMxRuC8W0Fhg56YT0cPOkGKYgvhxx8s5Xa1lTTL5NcZuJiNzwcWda4j55skZ9QbLWtVAASp/+zZ/EulaaPnOQHUWQ1Pt6uYc4bAnHzJ+xwSnI4V8n5RVrbyOb74xfdaOJSEexgNsTA2yRB0HWQX00E9QC5EYOOdN5ArHe3Fs+AvsWhrmZ1/ETVwRP/87TdU5j0/Vx+QIVo+0UB27pBfQRROnhbpv/ehBmcrO5WU1ZELers43HOTMSriHeQd/rKfJ+VBEreKOwwym+mDT/IEIwthXcx7FMlTv+8G14EVnnjXIMngQ7ezEwuJf3PJ2zm2Ul3MwcFSWSxajz6a5YOVaLsOAPVpVKdZRYjXmsVyKpRzRpUVEjKrqcZmH5ucmCXNqekj9WzrRHWHv+n627EAo3rpRQCPKpOjk6uPVZuovNJ8Ab+7vnZDvsRNOzFw53wLRsnOxzZG7gVxkp1FGfK9JdJE8Pmlz508QRH6qsV6AA0AuG5ZKQ7txW17aeDhV8+aQiSQ/PXABvEcGfvLSTA3sbeJOfggX2+TS7vMzBhh8TG7+JzYGBdbAFS+RqumCDciNFwwrboFTjzReI4h9Z1oGYiGfG67b5QGN9dTCq21rSi/qLzzBgc775rejTYlPGeRz2RAZKCBdk5JvwVNy6++m83c9S+chNQ3iS/0HUupYCOjZ9R3Q3Sh7IQbhVXMB5kNafNN3OhygOyvGQ8b6a0wDXJZyEgQeUNTEJX5Cjj5hrjLvYsNEn/dJyOcSyqvb5mTqtC43bU+mLguIy28CvV2T+qWUNoG89TIXikIQkAMIEyfGm2JBkaaKPYhWxCLYSs1+k/FlCR6r334rgeEUz1n+k31bJCAxVvinyUb05GD1jiQZJtDi//Q7/VAxPscA2XJyLNZPVGhRYjvXoa+3ETYabm4OPt/tQjoGsq5Ngl6QqbU6+IWp4CSmoovYfbg1BORtX6SZ7K9PMmIWhkgW+C/Ueib9YyVhb//AZoume3nJOjgWpHOfjDFeZC46NQJ+B2OTgdP0aN6EVkx3nTD8molzFUunRYq6G3dPy40C7l4pQZhYSyWlkkIhbFSms9jlbSK6WwxyeMdyTeyJXl8zgE7r8XLVZ2le3JDD37WcFyvBDeQqB37hf2TtaRKkmRA/XGe/szEOau/1wCVFrsUEJZFRQ2Qp69Degwok6AZU2Upqg9KmxmjiQGLkcilNgp0TAGfVHlMEHvdd0D3gK6YitBxOzGlxEF2/BT24WZsIs
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-22T21:26:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6fbde5-e8bc-450c-ac02-4a4c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T21:26:09.000Z",
|
||
|
|
"modified": "2019-02-22T21:26:09.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '956d447745fafe12952363cfd1a6aecf' AND file:hashes.SHA1 = '57447545237c0c4e214bd16795c1ad3dc587128a' AND file:hashes.SHA256 = '8a0abbf321c2368b162c15cd322e465a02e696d2b0fbcf2f748cb49e98d3543c' AND file:name = 'pftp' AND file:size = '95137' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIAAtKVk4niATIxJcAAKFzAQAgABwAOTU2ZDQ0Nzc0NWZhZmUxMjk1MjM2M2NmZDFhNmFlY2ZVVAkAA+W9b1zlvW9cdXgLAAEEIQAAAAQhAAAATwd29gn7hZ9+knXfoJ1EnfkNy9SqTV1BNnZjbKc1fNK8N4XHZ3SfWp8pE5fdSs4j3/PRb04eIEYTfEsnP3/zIsiR5pVBgXmdhlreaXscHX7gOLcILLA63220z78DEbkCKQcDyc0WMGuxkMUqLKywMhn9vCNEphHyvTVpsNkMHdaDJcNDWrLqnN70ljZ0EglnjC4sscQIfbBkc6POc4WH7yzM5zO66Ax3Eqi9MUgG/S+OlOqjYg4zRLuKIGRRh76uccQjzeduNXVEA/kHu8sOhGy/1q98Csr5n1zPXIIvSuMj2EPopOeYCIWKsBr/7Q4grbc3u+W8bNBPM/SlcmNvhiGjOe+iYD3vhoHJF5ba80pEUAUBvoc8efYBMV1JBblfpBb3I9b+Urxf7jEUQRRW3Kc3Ds3bt5py9YG1Gus48HjFd2xsslz8Om3D37k8aqEMbTNgztSvjuAan/vorUCAolCYDr4XY3IWckEypUzDrvtB2b2fyfeLv/vzf6xWnbQo/vtp54Ae/dckPb59W7rOTo3zNJwoKnwf9LFt/tWOX5AEQtHa4mDoJKf31xX+OppZOjBp2DrKbyrWcYTVZIfpGCZFGVRUUMWhbWM9awsxJ8JUmPyhI67RymSymhTXEhjYuE3gX9T0KMM3byCwloXAv7mhXkhk4Jdxftntu+/T4bjVbWN2H2C1vT+fT090pjGdtXUy0qnas50eYucaDCgdjwxwgMJ19hb6mfbEPQROsTflDsXiFaSZ41Uv3iWYc4WJleEdjYmSlV7A3k7umvIir5/Zz/QHdWAX58DbSvHuGYxlSazTJtXuveeN/g0HZ/4gv977vxRFpmbEZ+Q6NHcees3xi81D+PzDQFit+mFrcaCy2/k1NPSbSxPx2tdQDh8tqKp3VF54ITTlGgXfjyU0LTJ+ouBCJxYvKgWkQ81peinQMfKwYWmN9QzLn5XFvXGrxZ1Do3IL4ZQV1MgRdnbf0wRfn9fHZ2MB5gIm+HmRSaH98FDnDDjMzaWrUKuZ4A/K6kCYri8m0EtWB/CEiDqIq3R7kAqv7wrOMCz0EzdIkUEngD0axDiI/PBvgQb0HQ6AI0GqqMoaovIezi4vpCwlkpK8KYySec8ZYpZDYiq1sPZk2wThschuaX+A912ofR/dLIoigoIWC1/9PmNhthvpR+V+6NOfGt6hXHREdn9ytBl7OyUzt9yZzPvo2RY44IdItvX9mfhol0UEFg/QZGwcwDFEi9aiHccwLXoEEPmT5M85+hmR1LgOWGdXujVyX32hDp5KeqaimwsAmB7LWAWZadde0dNT5/KYAcYafwv6Q9B+7LRdUrsqC1kMIW7kJkp9JG9LTpLkrKkwzl0RVaVCZraY55HJwW2idnLtnhxy/Kd+MhYfxZMCnSrqYbhNEUnILB0VfQPtpBn8ACL0jiC/a+Ehny96BixjhQW15y6h70DzUygdbLUSRdxoJo1dDun4Hp8YXYwY1cRdYbc7+SAH2r8XFVekHyuxfPDWIjybvJkxwKyDBQWlP0D8Jxq48zpLbUIDyeTr1Q0THc90LvYEdaW8PdqbN7G00fPwykFZ4HY2EXwHs/fg1+iQwDk7EMJmtAuANfZhJgzW6NniJGqpdbdO0GUndLGn4nqT8DfIA4G+XIq4ua0wISFfF4+NRNTEyPsBZqhiwyGwlAwoPdE1vphovztKUiEMdzk0KurjQmuvDq2O3+0UXHU3r+/vJlTGbp9y0XiL8mfpUtd32ll7vVbB6QRdFbyiHofFQMSUVmSXNGHWtzfc3+fFsahk9VgoGtebLa25eqnz3LDxXsCZYbRFXeboU+c/tOqn4l0J/sLAwziL9tN2c17wi78WomQ1QAR4sN2Sbakg45/BOaSphjDVBJqsEx6mlzkP4o0OCR/Dv3TGUmovVUDVlA5+CGV6fYTiJcqzlgfbQKObZwsA5MgXXJ/qAJD7FBly47nQCfLDo5gLDEFMkYGUYnwFlZFZcyyCxN6C5HYmIN9UFxKh3l89YpdbghEAP3B8N6OD5+KMXMiCRyMnABwWSfbI5cTTOTCo91xBhAHI6jxjF/K85kLvBfAtYitgO2C2qJBX/ROO2hkAQm6j6ePIZVIAHL/uFmWSjSULKqYHAQPazyM0Dg7MyuGSaMkZzgR4dCvwA+2tyyZLZxawLRr2MsWUrYAhLRTTFRizV2jWVdAq+T5TqdG2/u+N/gcNHMPhYZ/DkfJhc80aDxr88YUVArv5ZDImuNK5a1O1GzIngHMjToCe9SN630CIcgPDjKBQpSMk6xi35LDk/bUBjhpnh8EGizF7goiqIKRo4HBRuIml2EFFe5t9Torr7aJbg4fcQmRL7eNCi52qFhGqwdrBv6BWLyxbs7ZenQTm9RsngNdz+pcC1p1xbnIdyynn11xj8UXs3upAmkoUWegv9HalqHmVyExqafM23/ESXazHtUFBqX/BGKvPr7b3IH0979ineKKNnSy5eO3Y75PH205Cuo2W9oMG6Y5VJxFvUdliL5siN8Bcc1lsYuNrSEX+toXEbaEyXfiS99hRWCzr4v9C90aBiFbXnuPRSfHUJq3z5008Kwh42nBivtYsn/yas67gjV8XK6tM0BrhiPyHePDziz2xkECyOEAgvSAbQCyP1Cp7T+h7Q4JhcnhIHvneHB7U7RiI4luDpkWU8I8V3+EFVCUpGRKoEw6vX6cVxj4Dk42NXPN4omI7VfdCOA4CzEzjaXn48Qyy39AYtEbi8OQVHZW3SCGJGMcKE0X/GT+ia+o6DNHMj/ckR+D2L+dihiF8zmiRzRlBe0NkevSGycgxF7rT8KwRetSxppT77S43PIIhecM6EOkgOM1eO1RUmmvjhapw8YbEmQiAQY/KIJEc/o/wKoP2Wiwl6NpwslWr4qR6o5MytUIMrKdIil5m4Ej/eyPo2xwZ1jI6yQsdl8EL/Mg4RjHXlr1pftgJNSveS+z/ItYCA5DsYP7OBrq0rjvGy5xiMO6PN9cZPnVfnyUae5n66gdSWomvXiSNNF8Yc3IQPr/VrQ1tpv0LMKK4t7iXFofseSwowDP9qbMgo7wMXep52x3L17iuFK2MSseBXoxPh8zqpM+KEJLiSMQARZcWi5tscWyl7W31imsO+86TwiDv/86WqMyL3LgenC1TwJKFB+ya5s55mJH6J6FhoqdaoPABpUYYNYUFueu9QlkICfa0WaY44gft1tMVUeDlSWRqBRuxLH8T/8CVftQkKBjLZlk5OQY3apCJ9WYwFA6ehneaoG9fsLdatjxrbiae2tgM/NwSQnvcJl5bWpq5H6rFK1373Ubsqpud6NzWDCBOofz/KIoS44dZ4GfhOkxyiVrTN0GsPIe6wm7EsxrNuLJxZNhurHBo5tBB7N5zpGM7qhLuhXjKb5SBw0SoMlRMpmX/EOWtbW7HOC3QhyCEW7Sstr0E5aDdEbjZ3TW1AG1CyAsNA0Z0Z7ZJAlmFKp7FLt8Fyiw+JKH/qThl2wrvUUD9y4gPY+PBHCbAz7dnhgvRgDrdQb4I27Ika/FPsZ4xPSLzMX+Y1Llm3VVmWFkPW6cpc+nmrs9E3EOs8bBNrd06pQwkWqGeY69UOtAgVi+1ej0ztMIRyiaZsMz9NJhzrnTv0AXpDpkB7cOFOqc/T05mL9ThcfAccVVuQ/4
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-22T21:26:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6fbde5-dc84-4660-af29-4a3a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T21:26:10.000Z",
|
||
|
|
"modified": "2019-02-22T21:26:10.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '386558fcea852864070f1c329c501bef' AND file:hashes.SHA1 = '190700ca3942b310ae483f46edf8e4e7e3b741a9' AND file:hashes.SHA256 = 'f8bb5631336876a708796184833c78a8feee167ac4d65da0625c28ab9f32cc00' AND file:name = 'sh' AND file:size = '100380' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIAAtKVk40PlpZgaEAAByIAQAgABwAMzg2NTU4ZmNlYTg1Mjg2NDA3MGYxYzMyOWM1MDFiZWZVVAkAA+W9b1zlvW9cdXgLAAEEIQAAAAQhAAAA3EJiOGoNjdMXquIQBHRfZrtSujwHgg/mYOY6H8rLpP3Dumh0HmSowDxar0km6pMKa7gC4Y+V0OJ6eu+sMXW1hbQU9XV6Ls1fx1rtwFD86QzzdaEBRSo1b3hrdzCRZ4wreg2kFZKiRjzvGLmK5uKXc47m7pIlelfk2w7W0tWmvqQdLJDIToApNfBjcDlwO7snd5YO48IUf6ABxlWY42949NKxwOCfCL/w6Co91sNiMZXB8NZjzeUBjIpzAkw0YbH5ZQ0u81gF5KDPCA4+r8SuNF3G3qa5QNE3Hriyb4QGlCfPWX8uo4Wca68mcQGEmOqPSenSg9Zn48ziaL40BzJNJci/bKc9TKM1em9fmPpKzXhD6ynbNCfRmkAD8zHs+0i0nEKBGi+VoCRHt5epzBmVyUx7d+DYqndkV4ObVR46xLCEuKZB5FQoBGuUOpOKUplpYRWIKypPNoLVoYCKVfKTIjN4CBSzXXVsD8NA5lUxILNORyaO4kxWo27DqNqcJluIePNwecJ0educJfzwm5fQuVEw53gpVdjz+4D+GmEf5vPmmJQWAtDGXrSVy98MN7CKxrbZ8UIpz0CtZcAdC4TnliO9ZyyTYBw+eZDEf1R2CKQnGxEm1c+rrvdnxtZIzXvaP2cbGHTizuAWGAidzngf1h/7BaJ7px0ujxnSGo59lg6/N1j4KWHNi09sGGhdgwYCLcsfhqpg1DPadjKfg7fgFVMD+lgF5XBb1pZTUaYnaabT8DeMe/Y1NwMmeIlF1nNRLysWHH0v2Cb3FiLVtZaHEfFnuO60o7yozRZraN7rlPe1zT8E+yjPT73uzKAv5yUtw9Fa0j+f4I4oSOFpiyd1IO/OGjcRSO78Hlb0PqkKlTomZyDgDhLsvzB0a7Ca7SiS42zx20DQdsWyoxWHjkI/c+aWMXHk8EnCoT6e9ekX0i5OyDwGU3xEXtV8O78tpR0xa/WZBT6doMu5qV37+6GAowpgzoeHzvf7pEsQUDEDCcAYpnGN08Twr1dKJTjkK7+kDXg5Ul5x9h1KIqpZ6VkYbYwJCn570hcDn8l+EFWGcP9BRf+kmfR9GCgbUMzJ++PosMyVSZtSCNmCzw3SvSWonshz3GP+5KFd4F1eYLKrN+Zirbz5430zibJDYGCswtOTjZin5OHzomg3KcXYd8xiU1rm2I3nZtUSGyqX9qVrximlmsj4M/jT8a7W+x2cY6bbLbRecQ/QiDWE4otgx37qX9zaWiKYoYhtRCb0p851E2KE6Bgs5J9LAgVhqUplATo+VWX7dPyK8QApjfkPLJgCyX0PVn/Y4AFDQw1TOpSi6sWtxXmVcxjBzheLM5CD1FJ/K35BXOgw4KQlqyWJzPO1q/4nYAj8dQPtz/rx9asxTYqvc4AuXTSOo2s4GPye86qfEHJSeK87f0jPGNZ60G0hlAQxVqRkpxdPhpeT3+wnSS2g8twXQAsq1yW5Ei/WG/qRdNhDr1FjW78Aq2Usq7nOI7ETrcgko35637Yg8bYgAIqpj27wfg0+7R7aKTxO4hnVQTFOh9OAyA0hWykSdBg1fe23gMpVDzAuShpT9RvBXtOEVS+JI1Doh7JKDS+k6j2JhU8JXbHcNN5g9KWSIggDcUguivoM2GVxYIWJ7VIxfXEFS8vRmyXRZUVW+JyCo4CWinCiAZSSe+SV1DfymgJyZz/CFn7n6uARDV4td40PC/IFTKfkBugN6ndL8vfNDMFaX3627d/Cv67aHHb9nv6WELrwOxHsUkcZELynbm08uUrwcwJOR9KM/1FVryWigs/oDkS6+z5Pw+8lm/pLTzbZmBzBdrL6DEAjoBBzpKMv0IbfH6DK36aJiXzOs3AU2WJpCiOU9SgtcmCjkpdebhF8W4b0SEWkEmkqn1fhvmjg+T9lwwkKce42K/XoAqp59w5vEOZpwQRY32J2y4Vad2EA3akzCU587m+jB4fHukCQLIOMO4sPd1/HKSXjYTcevIvn5ZHlkfiX7JYoSoXuXs6n/q6WtU8Cbz/WAO/HmpA7Jvh23Z/Va6wbBOIZaIR88Ry6l5q3fd339lqA7sk8Jl4OHu75cY1GLFLqY0TbakLlhjAtnJN/lEK6zB3CXBKEBs68ukt/hgbIRRxKkelMw3dY2EGcxlB4T1ATvcOqLtEH2a+O3G0UAyqbXOYWvPgRoiE4VvSF9O6sOWIXRjsStRajRylccoqc7ZVGRaGemCzjnqtxdznqxT8zg1LubgY+CaJf2d8b6/yFTKOtAlUm85qxOvaVNBJ4dZfnpjw5IJ7XOjYXubJDXXNS6SBSyraaa9rPopu47HuvGotHyhH/QIo9zKjmXbyNAc/BVfGGiygZHKpmc8/InzQiFOzzxvu7+MFtv7UN+f5rQSJcm7Ahaz36MZERtM4oO/wEKOlfkck+5/UTXZ8lrjXfvfnosWVjmJ+2FRcKnKNHhb6V4A46WH6QXvt2MT6T2FvNMmKHEKDDftpl/U/cGzB68L5U2ZCWnh+ts3p8j87wB7oxtH+arUscpPt9nOry7r3kTb4/GINWItOQaqXrLKcUOCPEk/EhGBBT8l2Zt/63uEe4Jh/32rmgQg0wJnsq83GLjVtmIKehjN0DewuPq69pfHue/JUgmmgQ5l2CCF5Om9Mbq0Z5yzprzsjOsqidDnqIzHvtqzvF5H1r6U24eXZS7Y/AZ+d+0VchPXgbKZXFFNkzWvrR8QWxOEO1WEMDIY6RLCpT6CL/wnwCAr4QCkZ7xLChe6NsEp8dU3qO/eOU4KqWhpM+/lPNR8NR8Xbe0MBJIx/jT4Y1jOmSHwc4u1K1iUoRr3whH6BFvGX/yzSe/LJzbYLcwssacoHdFcWnbTc0YlfM2pmOI8zk1NitMi4z3oIYtha/mZMI+FZf7U1yUnSh/8XTwh4NkqgNRxONYpLcXMF/7zJ5uHfeeADfEw4FChQIJD9ooNnT88Es5MsNy4ZTcMm0cI4+2rE/BEvJerEfMbfJ1Z4whQHiiQO++7BDmpHPRhOdKQnJjBnJnM6/dz5npr9scGAWgEuKSATPpbQR2pwteoJdGcnxEFNOMANxKEjF8HZ6KysI1jpXUUTGdtBU/2x5fsdmVvqmcJEtsRzQ/YaSnbB6mpwGvu5SFgNbqP6Q7iytIL37oNtfr1vEtsvXaxDEph7sNcqOz95TOXiDBFtnQI/LH992a6yWuoow8+hbjnyfvEth4GKWSaHVLpYIb4mx7CSED1RgswptxVEe3aGVs9MTtbnDL+93g6llPNSFIIVUmc4cvT05IwENPrJ8EegqWzn6YdhBGV93fo4XtCUuS1AQS10OAyO7U2mNoSRajwL0F3zQ3VoCy6OMoOe6t4glEbRz6zGlOs19C9JCKKCvXnJa9PUSQeMkqR57/hXMy1KZtswCOhwkRs+BF3nN5XsfLcmtoFfPw/C0tf36Cqj7QxKcLKVaHhoanRs4SKp4IGJR5YJ8G/Bi6Yg/wXzw7YMPJfZw8XMNCVJxKxjWb2Eo0QLbbjt6fYYcUwcorM2SBL5kQQOQEW4epFtR8vfK76sjc30Y0x5+dzsx4bnUiQLqZcwoA0WojQf7c5jB57nnKiK9qVFve494QIdlpncGUbdOWwn0wjpHneee3LKdBp8weOcVbzng3C2TkFzM0d5C6HrZi+4AQth337Bu
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-22T21:26:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6fbde6-3cd4-46aa-bbbd-4a8f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T21:26:10.000Z",
|
||
|
|
"modified": "2019-02-22T21:26:10.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd5abe44a8151ca764bccea7bf82ebb47' AND file:hashes.SHA1 = '7dc2a20e6ae81fcc09d96e9fb58f4ed4ec06d9d0' AND file:hashes.SHA256 = '7698bc8a71875a8937488facf779d023834f92f6ecf1e926fce7e5857f8b1306' AND file:name = 'sshd' AND file:size = '119796' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIAAtKVk7wNBJkY6cAAPTTAQAgABwAZDVhYmU0NGE4MTUxY2E3NjRiY2NlYTdiZjgyZWJiNDdVVAkAA+a9b1zmvW9cdXgLAAEEIQAAAAQhAAAAAG584RyoH0rBcvNzYj1iIwdJMG78v46b9lw3mOitvKvXkzd+MwZcT2mkuLTngGzAhMKLcY8IHiB6X/NgZFJrunda59Io3mHPgIEvRfCdx+wzhHQb9j87Mmjh+Jn/+rJ1YbIcYpHdXKGPaDNTt7n3Da3UZnrB8YZVZsWy/XPHgm01vnhje/vO+/27KqJrhlPZetObVv0xxtKiIQ3fAkSQcJZeoiuocx1bECXXTbndyqze0JERu11gb8I7hMCGdEge96uJpru3GfnnJAgsfH8cWDUBRQhhTElUv8Z/YjF2a6sSjBMxXROBIBOtECDSNArzrks2Z/kCVrgtR3SNEFwM9PAXIRY8bIbPpKEBgUcHi392TSKz1wRAAPcQGmm4jyayJdh6D6TU7lo9BJdvVLbCTRBSsWVg/srwv4Byn26Syta+MvxBrQPvb+gtwCdjSiR7Ux8mpuBbLJOIdYDCD+O/ECCPSUKW4KFlZ5jbWudVbsyl36KemvCYxIxCeV9W2Xq3XzbHVzF2qlRrltVgQjM1mz5/Hs/hrFmHzcBqwJsjROnfkwpG/BgTa0M4l7nMP8HLDqE48UkrGE8Ld60QEozTmGNZD/LCxsLniIOc0UAhWQ9r3jHAOz5RRJlhWQ32JTClwpuVHrloLQ2EWCjdsA0kPUD+cwCEIna5lR2+foan1HBa8g4HCYwYWMrb3PQ+o1m5DUC7BmC1Ao5kxv77YNGK7zhXo9V8UG75PK+h5z/W5WJ5/zqN4OCmjp2+ayqaEQR6rYTSEcYTUsXYB5v8fsVL0atoPJ68qQjOuRcxbekeQrA6ckcRKpPIzxaaT9lOiLdPECx+FwhIg9KU789pvWCCnQxj6VBV9I9F6bcT+xOPH9G7427vB43m0JdmUAmOWrs7B6SO1HCMyISqul+ffTNbJ9bTGdgLwnQ7qDn87fT1C/7Zt/85vCZAoRXzK2/r9Wk4rlT74uSZTrUYBX9ozWkQ2xY0fhsOlRFW1IAEhJIyHtPnA6yliZPIjHSsu8XYFm7u59vHd+xwQacverpycsL9CvzOh0AXMYCkNTcZhtS9wYiR/CIYJW7mdRAE5KHE9p+UKUmyN9LCaTDkUWANDDicKLSbmUWqihTN3uqpVRsjkFb9CZQozNJDtMnHFxsfWo4I0PYv7/zCPsQYi5XjePjbqBTkT14blPYoIqIwEhJX8O9h/riR6QL5bpmC9yHyyFWUELhlDOms+A1kM3dnBiWm2p5kvYefMmX+vbFuZyOMPXH5r/edmMWAofpiSV/ucXkXU1zaHi8VbbjUvf4+jiTT6jxRqdS1lWtlta8VcPDpgJr/VG9d4RVV9XfLQBz/JtDbYCWSAHkIPTgfyI8Rx86ld1jLsb+L+nvwTYRJFvDHOBfvS4LPpk4Csj2yV7IU0Qbqmp6q57qdwQe3TIhbVdad6abFtfIQAJf3N61zKt3jwEgbNdCqdVrvXfxpvJAkZa879VAKC7/eqBA56WcJeGH7JZsAsQsmMqJn+ALQtu1fLtdrL/zp22JxOIz1Xcfw3lqHA8hD7B9p1/7Sy9JKU7675vXBKRjt2YAAsl71hGkSsW1xyquzS/OxVax61scT4jsIe7lrRyAlOipl7S0mUSnqs8VYuApqlHy+ryJNl6JhIfPL4V0AYC3k6mh06W/pNnjHRByM/5/JHuMZ6ag0bQtO3EEaRxmUCQvcEiZhQlg1Mqn0+dGYgQ7LAoN84ATutlgFyhFyld1yZ0EA0VlgZJHNqyOqwRwumYlgQ/Vl6qJ0IlXfcZF+Sgoy4ZBj+tymHZBs8IQ8fAaw7ieotq41eDBhRH/LhIC/1yrLLX6QvRD7POZcLx840OUMqBcS++/3Yut39WQm53Bdy4CgQ9t1P9UNsgiGSDu3pwKWQZopVNqKhvFAOMyYhPESucBJmeGwuEJnxv/CoDerZ8BTD8frL22vjX3cUilhUfldiBGms3n6Occ/yrLSlBn2pi9np9Urc+drb3PLicRnOfeQqd97nOAqTqaVcM7nD21x6GfJKIxYZX8/dHu7rppMBtoBSs5oHMo3/kc0Ura+1CI+xj1ZsPMLZ5dzosf9i9lOBmfNqAbcacGTO6or7gXNUzphqYxaUWm+dLIbFVCnpJlUjTaRv/bml1OJmejvlAnYgl5bVxf4rsHYmLXNuOXgXHk9IqYj2ZO5grBaI5fN5C8CLi/jFCN6BEVE+oWFrocUOUsLvZekwIY+ORnWbGUqzpx5oji/i1fX2ujOgKjXKamGAD602p0kqX1da3p6fUFzYM5cCe8MHT87kFIKO5F6i2gcmG7SAD12ZEwI3Y4VMaA6PvsZJN9W/e1aGf0oorG2sLcLn6slzhP3DN8lfSbk5PA8dXs2f1eky4FdNMvKNqrBWw3z6z+ATHM6mKGmuCzcHwLZE+YmOfoL+eXyv9WliI1QsU5JoYM4mIY/yq4r+MSzROzo5QmIN5ixxhTuesQ9/OXGqClK5ueIowlbzhYFNWi4WgbcvHrYlYxutv+EuUFXhyEFb7OnZkzcpsH2pgVDLXD8LE1Oka+Tq6iucKB8DvrjfwR9Rr1rcdTbfN8YDDSZ/dZJX6RFUNSJpEcUb1rNB2702RPPK1N+ye1/ldgALBovLgT5dSbBuYk3hhfk0w26zO3xgKbWx0zWXpKknwzWVzD2crr/RikDsCjneFv5SSdCBahOJxgBG9EZUtsxDkU7YRBFXawUYn7xcGQt7ZTBYiSRI/WjbVENTrz91eonXqXp+2BZNjhb66stey0gWMPS3u8ByrjgWjD6+MZmZha7oKvu74vbT8JDQ2aR+lGLLJC1kDTdGK9NZOW/V5CUjxnKebXjbG3fbLk3TDdpmpFvJhcKsiKf3To4HBteRCXFKuljxsHHsbY9osGy7t/sDDLIhEDJvS9FLj4OzXkocsYvu/xuwV7bdnjpI+uAgrgr9uf9wrpBEChFiZC/24MxOlZXRnS2tG+t1PidpQY6HoQI4cMrKuUFEe0oINxWSIVvIEbTvozV3IFz4am0ORNVVFXQQqfgg4Z/chI5aB2tl9qFf2x4Ty+7AsU2Pdl23NxHmoY5kTrV/offNaCNlO5nxOh8JGdWXAUXePor2HDjAgRrLNtUznW6fGAYVYSaktz1MM9qMlBmmBsYapYXJCqxRVaeh2ug43NCWGIAjt/syOuQD2/taDrV7rbCS9VPhF22ii91d29OByxbjANyVHAv3OqtcVT0ubtbtE0Bli7GDGLVrJDCzTswADec+rH4nhgsI8kRq8JGP37FL4EA11TlF+vGKHRKYbwC7DK8r0OddI/pBPKu2pgO+ntXAFcl3VnWlheHyxb4D//qCXj7qq6kvBIE4keV17ZMVms5fSBiBY7HwcVHQSzrX0TJNQHnLUaQeHueu/C3kab/eP43B4VN+Xhr2CexyGdOBixeDSKjZsz0NXZ0qauVMjqL+ifKjHXjvvOEOphf8KBV4qlf2b80gJ9Na4YWSM7ePPVn8i6It/N2T+WdFCdTanRvUaFGD9SYkYZW5cPwMMJWCLQuYn8wqXIeiZQF45liX3NPCK42VnTYfaJjcgvn+Wbd9VJHnMiFnV2Gem0sWJkLthJSTtm8z+EA0fguGvGjgpZha+mfu4Ne8uanCCkZSwfgHSnLdoNsPnnO+cmmNN5VnZRs12
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-22T21:26:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6fbde7-a888-4f78-ab3b-43a7950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T21:26:10.000Z",
|
||
|
|
"modified": "2019-02-22T21:26:10.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'cdd228f451fc4415d1d80a58bcae7e28' AND file:hashes.SHA1 = 'e975b3691ac96227163f3dde59183d2b7effaf3a' AND file:hashes.SHA256 = 'e1c050a5425f935557f947028ccddc0af7674b144baf959b5221ba8fa4e04f38' AND file:name = 'tftp' AND file:size = '116894' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIAAxKVk4LUH7QN8oAAJ7IAQAgABwAY2RkMjI4ZjQ1MWZjNDQxNWQxZDgwYTU4YmNhZTdlMjhVVAkAA+e9b1znvW9cdXgLAAEEIQAAAAQhAAAAesLvWkpmHtoBF4IWFHPg31wfoKyQ+nxHOib3GflnCUD/HUnwsECMhGpyCaP6f6EE1QGavulL0CD4LZzdw5ZT+W/fPJF+4I+RmXePZkH0+Qxc6jruFkIMfyx1Dl/xVblkgARWAQMFN0OZG7iiCTPQxMKKJyPXdoginGZzFOpVJGlW+46CAB0uUrNJL/qDZcj4Ys+LVs4888moqUSSupjQc/Qr0uzqv4NPE3kXUEFgu1R/8sgSnjQNvK+KxRACSFfK2w/MF1LOcArQiTesy8TZ6tZZ1x9lGTuvtUgNmDbHKvUsGLuafekU9XKKvAb1aHPATF0Mc9h4X2Z74vvV2fZ+6Jo+IF24yT8laZToeZ/kMR91/ZvT2poyjAI36rMfpreUVJE9maf1X+glH7UUQbxLkNhM3tQMDVjguPAz4dqjHGxvveLfR1YKMMtXoR/2LjVEjgeFl10PUQVoPTs8vmTscJaU50uA/eHmfY6gs6f3Evqmq6+SIG9wzhb0/UvV9gR9Q3vrlu8e07NhnvQJ28lQ9H4fyJcxcUbRgff5Y/+wk8RHtWj/yiYVA3axJzQLxtFQWOuZE8QmvU339sd4m7y2LZJF/vvA5qMCb8x+Ef3ERGNIIbeQD1TG1ZGLWrxOIX0ITgEfzTRwcY4rIRhx2pV7xq7a5KxNj64mbzLso1eU1HLn0HppgTJgpdMr0VhvPhceLtvBzINAoBjMypvmBipkMluB6/6x9MhH66NwUjI7MN2daovAfVamg2oTGeagOsn31cKKfWIddnS7NubaU4aDZ/opxekRNPdSqZQ+UyNF1LxmCXCejbSUVXdT9fFTfnHXGWt+n5CG68XGVIFylVk579kjoV08c2NZuAWnY3SODxtXHmaKwLDZv2VAgBa9AAs9AyWkMwoWudAyGua/ua0tYk7S+T1NXj+MouLBkGEv68x7Fe/HmglwQW0BYvf8+nhXfo4LSsRyF1gW39Kg5U3Vr43asDfpuHcSe0i3HZBd5Ju9WAVQCxRPxSixlymTEORgqQWDthyycF/uO+/r+FqWTPvXoKbDkNS+EFELzeftQhTm+hMoiVagzs69lw9N6QNNTpTdNfxvhMGqVr31BeQn5bM602ZjXaKyVfzJQuW9rOJEPd9Pei5xcsm+eUj/ta5a3amYX0gAkJl4QkDLA8ujxvoXNPhZ+l7jjW1/bAGDSnSMlcGyECpiPn0zl9AiV03388nwQvc5UmLLcN6yOPCKruXnvVIJ2/F1eLFz5YVkgRdslJF6DyQDK0C1jNkq+n4y2GfT/QU9hsKoefHdQQBYnGPIRIk5mv3PK3Kd1Lld1nUupyypxtOprs0RU+fqhGanjNwyQLeQHZIXSCZ6L6pya13odwN2Jn17NKM06FnP3Mm3CamKF8p9boWe1C9hLkQRqyEPzn2dnsvqzqGdZQADQ8EbJGNbPC7rSTCA24QfhgJU+eEp70mOeswxQzH+ZkOOH4YSp8EOki33WiJ8Y5ifGqQ6XI2/tTcrhGF8kiDpO3BicDQlCt/j3I0JbYGI+NQgdEhfaV9e20jc8BzaRMI/iEfNeXb1AV8cvWpfarx9T6R8Hq4uLoWz0pOgbDKuXT3j7Ba1PJu3tWfxG4jPmZoSJUaNTt6Ebb6upe1puZIZgaIwhy/WEF3+mDbj9O4xttbNxD4V5MbDMwgyc1BsuBHuCFihz8/GAmyJT/KQOjw3CInXTbY5kdiDt5DTLrMhnr/c01KzyMKVI35D6Iew4C48hmvB2AxmAKdmTmH2uewjSDbEFKLpmSt3AAXrRGwLKXfEtgdokfae7WJ4ePTxNeXgAngc1+ky3QGqcMPFjI/31siIto8wgUaHJ83hQaaT4PxbM9cHbVRgWaFGliuqWqDrnN2r6GaQ1Fm1JPZ4LHkzoGncASRpicS2mLnj4y/ot/RdDxfZ7Js+E+qfQWT5Jn+IAoNQu1TPsadE+9k/hOaBL7aFf0qgTd74SOT4y0QmW7fK1r+n+4lpBHAcduH+WyoAmWWIdJAG4oek7W9hHbrcrzK8+XJ77UFdOQINzO1KYgD1p2+xRp3VeoWJScrOQGLo5qwoKKlW+INt9QLtLzbCZDf3yAPqOPiXeCRHV953B5PU05Ggc+hboBfCaEj4/92l2MTRJtxG1ReDVpWlOSsPeuqxx3Wp+g6Ijdgp/WMgl/DLScpCmSvAaRxsMc/PlMlUGb0VTdNHzEgB3D8L+swwyAQK1PZqjvckC5RCarXo93v8eNjkjdzmjzU06JgORNiT/pXhme47iKsASdUttdgx4aiQBjiae97jmZ7P/UkOEb3u0ehgAwMB4irQ8OCB8IXQXP3fFGAltYGIm09uQxxqaW6IwzqoV9gl2+LC+TSs3uYFR9ZyqhNLv3qtHTY9dX/AsnPi437s8KUqF6vyUZ6NdBjm4MFQI4cWzs7uRTNhgVv5vb2vhlhobTbdiWtlUj1f1OaKcx+G/sZhFK1NA3cVF424Xc2C/juQ2t0CgGdRvJQu3HktXkQ4dMSHveAEhe8dMaP5qQxKvNCQY/hp8W34n0s3ZWBrAKLnYcuAWVp84tIg4M+HxRC+XFi06uzrUwLSWnujziNQor0geAx0sO/MdQ98U7vMXRL3vElWqK6rMaRU8KZk4i7Z4SwNY2WWncMaETwjTdGQ1VTL+Sa98gtbm/GMdhGOKtA3EKngo5SFfMSBrUm/75UJkfOU0vfQsrKSL7KtJZ5y4dv0PmDqpq7kPy+n48yNNPKcZemQhJ2l8KmR148hao7nd21sAMjJ254eOBb8n/tis5PMtaf6MNNnoTdKZ3o9RcVAxXLUyIi5fwngye+jRlg5bm4w+bxsPRmE92E0W98jv3lQrNzqlefCSXxJKitbmfToW8SpMkrEhh6tpcqVNUE5Y2zRRKScFSIgpzM2wshP9pkU/Tk5TCCNIxTDlvqxAOeOC8IOnPkVx0UXdWZQc4/spDbtDI0Cd8Shd85n6ena06IRytQnJU/2q4lV3tUQT89++RchD9EQIxTGb9YRVIieBEFE6JANBDMXN6jHsHw2zxfhyYJPTDAKYsVJQKjYLhhmhK2BeCHE69Z+YiUrtGe1nSVhaammwOFlfNU8ULqLomOezP91rcIwBUb96qMMAihgvNZDzpiPpJJ0tr1kHrMIluomb/Fv968b9ndY9ORIAiZtpzXqBxmL0HnN3mopsm1k6E0cedNDid5ZqKQNVQXCJx713VZPC42vE9AqAaNJyuu/giCpP0vyRD12d5KuZzn0c7W/da08d8mnSLEcs+dEQXFAruccF0c5/hgPYnhg9KV6+AHLA/5qU7vAVJ0qpp1Rw2jmxIDgwn726CdjsYmptydQVW3/1foun3Y3CGb5SXzcBUsp6MO4dHNk669IHlnf3be6f9WdmBLVJebpVIAdjf6HkagcRscPJTT9reI1U2JCJTDMTvd07gJJNR/XPRH5R4uusCnmu151rnDVUTyC8qYwRNg88qx/UI/lDffqqXysRbyHMtD4+yPgOphGgELxGkWP0pyqz/5syNp3CJ9QvPtIFsYZIE0RS1L32B5ep8UYq9s9xpCE5YDTzl1XOujVqWou0WlmwyBwRhDYPENQXftgMVFzdS2aek2CrgqPQKdIwjldgXxv/8vEXmbQRJOkQFwOQ1s0Zp1N2oNkfi
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-22T21:26:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c6fbde8-f124-4ab0-9316-4235950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T21:26:10.000Z",
|
||
|
|
"modified": "2019-02-22T21:26:10.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '74f275d2c6620d8fd2f5819ae9341158' AND file:hashes.SHA1 = '8547ea228be2bd2563d87742fb25ab5be5126b9c' AND file:hashes.SHA256 = '05394ab6eebdc4ceef62efebb2a4e760f3339ac27af22b490057b92b56eeaf5d' AND file:name = 'wget' AND file:size = '77914' AND (file:content_ref.payload_bin = 'UEsDBBQACQAIAAxKVk6y5YN7wZEAAFowAQAgABwANzRmMjc1ZDJjNjYyMGQ4ZmQyZjU4MTlhZTkzNDExNThVVAkAA+i9b1zovW9cdXgLAAEEIQAAAAQhAAAAlncCFs2qP8Z3IusvUeCUofsfsKLMMU32rTEeQfy54VAiCYf/Wh1StQtnvlQIuRSDSWELUl5DacW4UjVhuk3JEbzjgfTM+U969Evn40+I/ESZEql7/LP6GXycMdNBiV5La1Lnez9GN2CbxjUfc71/0fS9LzEFuI/62Bw7OKvkYG77gzSMD9J+XN3yt+gYADCFxQn/Un5VXENRGCHhzzYWCqRVeHl4QcaBDvdGpIh4IwahopTq0W2OeqYxfNBYyKXiWIBqn9MOYVpvOXkNh4h62WO2EWkbMJ83DLHpV7P851AD/fNFEmobdZyV3COown78fG/S+Vz5CJfDj90sC2/7wNoP7xe5cNRDpnLYVD1/UVd/Q8/n4P738lo77UmyG2uNvCl6I4bVup2XeP3EN+jmPhN6WPXQGIebRSgy8ApyHskzRmV395cml9cEf0FmqptK69MQVpdJiqJVcc0IUSRt28WUhv1NhO35vPsMQl5aqTbIxGBB+OtI9oO6zjT7KUGZ14jERSAYPu86QFGIJQMXlIn5aZ1voNnwjcd9/OmP2zMfgG+mlvay+A5ePkQ9JWwzPAj1B+PsH01bUsHtFoxyw1vubJN/hzxRMNmuy0aVwav3Aa2hIwAbzpXt6o2sYCJRlT3B7M/bmkiGR3rY3DUvpfhM7vaIfQoEg5Fytgk+eLz32MCZrF8nqE8NbUGmayx3REELvaXfAW7/3MHJVQ9op7bfCbDtsk32UdcxlCMKWzOiFt/ZeAgufD6zDxioAVoNVOTCE0Mr0Uq3DL/z42c3CE+QVejcbNDL6ffrpJV3cNQiuAmsQraIHsW49yikYy+a8rsO1W5UBmrFqNxQdoJmpovKM/6W7YMtg4H756FNESKuiCwqY+jS+wm7vohxxRfI3ucfCuy9zU2QDRzQV3/aybag6hrMsFCOlrlVrUw7C1iDwmZhHdIyj0ewptCA/Wb+xBCiHFFmehT2SUbY5OXfGyR1Ehft75kyrpmXJ9+ogf49Lpc1sNA1+fPL7V4ft3RgKgXa3W2jd2JOKG2gFRuS2qtIi9yDEnZV0Lxn3TGFLbedTq7n2fI7wLM3r3YIquT1tr+Xvkl+9cirUXFarXpfE+VAYtpj/xSoPpp6zQ7fSNHU0a1Ac5MXhUftb+28h3Z6IoaYODkEEpk4SJZ1vNBPIHiP5PQpuFY6PjuV9ks6du7rHrpOzYGDhk6F2Jv5CQKyFqFjhAsdZ6Xgiq4Oe6LQKIlrtZi9bV+T/F/XwQjPpn0Tqg9BQbUoahTgomTeAosS6BNtdh0RAm2uITa19X4Zx1aTuDumy8Jq1FYtM7QdH6R21l6rYUYznCffOoTcyJNH/4YyV5DA2kTlea7B+mKEbiu2oxobM0hRNIFMcF++cx2QWemEMCZnSZa8sL18uO9CwXKYqOWPIxDC6OhvwRotN/kenXnSRboUZcbYssoi3WBTmW/A1OCaNt6nmkqegiRKCvSfx8XxKkjU34BCN/3g//2F73sx/UC8i4ui5vdbBFVILxgASeJolB1BkrA4vRKJJAumitqEIH5j0uS4zlimS/dDDeQzGMEOwEsZN2uyatWMk9Ga8XvrilNa4BClw88TYsN4m174MMSkVodLA7UkzCatrWd1MKfL5BApRxJr/wx06uZ5b7rPD44N9edcCWQH+TeGEiCSzfyYUzJbQTGHeQgDnc1TCLMtGHuNrmLMZd4DiHA+ETEj1XJTGjOXHPUlxK4M8SHsLwwRMf23rDpQkTz1Wwn2By0A7uGFX4Fjp+5iBjHswxR5OxChEQEIZl+j2CU6FC8RxQwyxd1Z6xcv7hnP/dwLBMmEHGSqn04B3flz2PPV9UZUr+BJ1umEKDlQIYBQKYQ3DiZWjvAG9sEfxL1NeG/7PJVjpaWsxo4tav2FufnVI+lzodRrufQlLKieLz50IYrBfIpx4BoX+bbdRMYZAwQaRXnjSFO1+YoVOYd8s1R0FrSgvqHl5FwI5vlGBqraBzx6PB1F7bkArScBT2aPK3iHDUgOM254BMc7eoqWALi+53zek2ATf1EE41fuIr5kQmJzwUuEmEK1bXDiXh/lGhUcGU6HT2Gw5XPkGO86Y68oEW9kdWH1H9M5iEMPftBGrSCLIsGyN7KWJElTVDPlqXy6axNourAw25gznBGB2nf/n3lQk/4/8LmLova6PSTUydfNQfrNi3b6BqhG+NFfZ6fh4o+VSkYZEdCC27F2ez9s4+n+ZN1CAsjR3KHaWBjTV6qwvHBxX0KbW7CCJbeE3kUdF6k7knfGw61bkRB4M72IzriOkh6NsduTOp7SDfnte8hNGLpJR0283iCYEHndmoXblEBm8IbNuOJ/hpsZXE40GBYNSeFaSOlIeU56GeZcu4yz9c358zzWDt3L1xs2IJd34MBXm9pUZtysM/qYtEd5EBHgjJTNJ7ZtjMpV+S7evvSZvzL/r0knwNChA2zJ4fhj/91WpfTHLm7Do4IQ9Vxs6+P1Pa5mggoyewNeMexxK64vN5zMKSj7LoNfbyGVJeydoyZsju5ZgNvXGhaHufpmdKiJTtGl7RU53oKrNBihASJ4LFolCu1SHf8mmjsJ96C4BkHfvGX4xS/v/y/gWun//35MrG5QSihPXi8RNcTJhjEsMiKRwfQbj/8v+vu+iWgcZ43q78nBExMwgXkJpCq2XR4CYXDvlwniFKZbiWy4yDjuT6PRd73QMiAilhF9N6Nc/c409KYyjtwboS9syulSQ2Mt1U6fqKdAGXZDhYi4SIEkRIeNd2ty6HbO4N6T1hL4qDxyPOCBUk2F1iMxnFKNeKA3zfmOw9aYvuJtfp5xHaY4kKrCl1F4/CHhdu63iMDUZD+MJ+zt0675Kh9N4P+A+obNZrLtjzbuPwms7vSjgyt5ZzPDFENTSESUoOEYP9u6SwLnshmjoyhZuiNir+BjiLFdKv3VICRzxkAdrD0kuzazzR8lNiN9kYigtoqLua4N2DQFBTpkLy8wMAWF+LlvTnOH/15SRza5iKKvFovUPuFLpxHS9yBOWc0S5Fk1EDBGv2m3JZC6Q/yHQQx6d0BoEcXARpePP8dfHFyBKvKnnNZqKT3L074j6dTE843EMVUFx228NTOAZs55w6wk3rUfTIZTedDdsSILmTlkHht2U1H1COCR+1QfwbcRL+KKHc5umrzTPFGQeGl6md+oUpSzwpKacidHd41/+VbHDML33C3kMC5MTILzicNHNkwAQAlQaohwWn6740cb00kW6JvlTz89oayPDNYtiuFIsHRnUCTUC275at/oWU1LDFV/atYGYtp0/vznc/G4xONIYihogBwyvYtx/p1dGQCEjxf8SrCxjj1xv4zuCPTMeKO1iz6pHLFI+/znj+z6Jg6s1mSbHKizbIVosBYoTZxqn8l4MM4ZLkVXD8WVVv/mlKiX2uJuOb9ps1cxAXEdQTpHESCe9usTflrdefZuexewMpLwLBOkKSjgnaYpjRSVvV9c3qisZEDBpoOJNRqB66AfYY1hMNzCuvbVZp0Q/EiCKtan6779qaTwiwfJaQb80jdiJWCgOidixb6VAc1pbukrtci9QC6WG/8lKfAweVMd2dRTdnVlyxzlwcSCAg6kTiBiRIDhw37fln6KK0D/FXNyNx20M7aoE0MdHEOCMrV8KQRstJd
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-02-22T21:26:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--d782cd47-8d2f-44cc-b5ff-5179f2f1f2ba",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T21:26:10.000Z",
|
||
|
|
"modified": "2019-02-22T21:26:10.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2019-02-20T09:36:20",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d5534ef9-4955-43d8-a763-c873ff3e0ceb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/3b72288b292a5b18d870277a116713118e23b103fe58b8b1ad93f0296513b509/analysis/1550655380/",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "13f5738f-6efb-4623-9b00-ce66326a62f8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "15/55",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "3b3ee2cf-71c6-4a12-87ca-d5d8a800be34"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--a6780ee2-559e-4d53-b571-df123fa7ade4",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T21:26:10.000Z",
|
||
|
|
"modified": "2019-02-22T21:26:10.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2019-02-21T15:16:34",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0e52517c-13d6-436a-a296-fa6e7b6f38e3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/f8bb5631336876a708796184833c78a8feee167ac4d65da0625c28ab9f32cc00/analysis/1550762194/",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "e85c98c9-07e7-461b-8ef9-becfe1226b51"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "16/50",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "5eb6276a-c276-471d-8e7b-04a9120567f1"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--1c0c430d-30df-41e1-9e1a-1e291bf92014",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T21:26:10.000Z",
|
||
|
|
"modified": "2019-02-22T21:26:10.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2019-02-22T06:12:43",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "50eb5e8a-92b8-44b0-85dd-f4d8919ad63a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/05394ab6eebdc4ceef62efebb2a4e760f3339ac27af22b490057b92b56eeaf5d/analysis/1550815963/",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "ae2e4b31-58fe-4ca3-b8fb-2e54657cde57"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "18/53",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "57aa71fc-56b9-411f-be79-084cdd5cb3ce"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--ca5fadde-6d66-4478-9f89-15aee8ae3781",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T21:26:10.000Z",
|
||
|
|
"modified": "2019-02-22T21:26:10.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2019-02-22T06:12:55",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a8e4179f-0c5f-429f-a33c-59b04c090dc0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/ceaace7eb68ce0faab1ce80a019d603c3f11bfc8e1384cfcbde13da4a08467e9/analysis/1550815975/",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "e28cb24c-131a-4b0e-93c5-3ff69241126c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "19/51",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "7b368696-ef51-419f-98fa-20bb71174612"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--bdd37f7f-ce08-4bf8-a7b6-378947ac1f32",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T21:26:10.000Z",
|
||
|
|
"modified": "2019-02-22T21:26:10.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2019-02-20T03:14:14",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "5fe6212b-aa7e-411b-b220-cd020cd8923e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/7eefa483e23c0ae2e67ce3c3a399527b3244c6d23af4401842bab88276b26840/analysis/1550632454/",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "8d679758-5593-4237-b30d-86e8cb3fefb9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "18/57",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "2c79d764-0dab-49aa-b961-184c9f35a00d"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--684aaa66-2785-44f6-93f2-08fe5ef56710",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T21:26:10.000Z",
|
||
|
|
"modified": "2019-02-22T21:26:10.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2019-02-22T06:11:56",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "fde4d03e-ab60-4701-adbe-0c7c5ce8d34d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/7698bc8a71875a8937488facf779d023834f92f6ecf1e926fce7e5857f8b1306/analysis/1550815916/",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "4168dd19-db47-409d-968f-60c12939aa57"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "21/52",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "c54742dc-e63d-40d2-b21a-b51c2500dde4"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--8560e314-a454-4bcd-a2d6-3f2f948f85f0",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T21:26:11.000Z",
|
||
|
|
"modified": "2019-02-22T21:26:11.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2019-02-22T06:12:29",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "88cb4d72-5e56-4852-b843-8684a428b6d9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/8b5f33b88b4abea7848d5dbb097b545385b6bca9faff0610c78dec45d7577a6f/analysis/1550815949/",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "5559c79d-d521-4def-85d6-bc704ad2c7f4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "20/54",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "e1feefab-8a8a-4283-b401-29e3488438fd"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--2e5a1e33-ce78-48cf-bbf5-67cde8b81971",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T21:26:11.000Z",
|
||
|
|
"modified": "2019-02-22T21:26:11.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2019-02-22T06:11:41",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4ee08472-e3a3-471f-aebb-4c219bde1338"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/b97e9993702e0e7c214b72c5869a8d9e4fd59cec7fb42c9873e548f52a6a072e/analysis/1550815901/",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "c031f0ca-2b19-4a69-9704-53d4111598cb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "22/51",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "8b4747ae-af90-4d34-8002-258f2c2b1c82"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--e1c9702f-771a-4bc6-9dda-605e62b64bd4",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T21:26:11.000Z",
|
||
|
|
"modified": "2019-02-22T21:26:11.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2019-02-20T01:10:44",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "80990bae-045e-4f88-b687-0c62c2db7527"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/9bfa55698985096343655c5c2bf7c33f6ec8460c636922437d5109480c60fc8f/analysis/1550625044/",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "a9aa9132-aab4-4d42-b3ac-a1253838159f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "14/51",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "65044a39-47cd-4035-a975-0a7b78cf740c"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--c445863d-249f-4f4f-8a2b-f334a57cd879",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T21:26:11.000Z",
|
||
|
|
"modified": "2019-02-22T21:26:11.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2019-02-22T06:11:14",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "950e511e-4b8a-468e-a5f0-9ab28bff00e6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/7eed6eecf1b5b167ee266b04ff3b146231fe47531a3f7ad122651db37a860257/analysis/1550815874/",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "d0f3bb84-caf4-4db2-8ea6-cd9bbdbd7aa7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "21/52",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "f71cd1ed-febd-497f-bc4c-9fd39f43a58f"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--46a3f6a3-d2fd-4d95-91f2-63c200bcc518",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T21:26:11.000Z",
|
||
|
|
"modified": "2019-02-22T21:26:11.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2019-02-21T08:56:49",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "baa4255d-7968-42dc-9358-ec738df49e80"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/623a6f3f3192fe3b6a0e2d731a20b4e8eb5041fa4af3baaa68fde1720d296e5e/analysis/1550739409/",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "2f8bb771-220f-48a2-997b-f09f6310fd3f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "16/53",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "be099aed-c239-4c8d-acca-e27154b50088"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--90a03b89-315c-4f76-baf5-270b8f50dcba",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T21:26:11.000Z",
|
||
|
|
"modified": "2019-02-22T21:26:11.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2019-02-21T15:15:28",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9167fbaf-cee8-41ee-a479-7a2d197b3568"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/e1c050a5425f935557f947028ccddc0af7674b144baf959b5221ba8fa4e04f38/analysis/1550762128/",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "fd9c42ed-27e9-4e77-9ad8-e811deb3d7d8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "19/52",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "10271050-d088-4cd9-8072-78d7d9ceb357"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--e56872f0-2860-4b90-b6d6-e90e54a7062f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T21:26:11.000Z",
|
||
|
|
"modified": "2019-02-22T21:26:11.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2019-02-20T03:14:27",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "0eab675f-98fb-4a0a-91f7-370b3ecb0f71"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/85a118a21531fdfdc62ffd2f39376fa67644d8cd4041a288b770def0a4f5f5d7/analysis/1550632467/",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "0055f6a7-b033-4367-819e-bef60f951738"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "16/52",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "8cbb1f8b-7fee-465b-b27d-169713c14104"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--404871eb-92bf-4226-aef3-e35dd843f916",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T21:26:11.000Z",
|
||
|
|
"modified": "2019-02-22T21:26:11.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2019-02-21T08:50:44",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a7d8f99c-3d46-4e45-858f-25a7ae4e4d54"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/8a0abbf321c2368b162c15cd322e465a02e696d2b0fbcf2f748cb49e98d3543c/analysis/1550739044/",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "42a21570-8cff-4605-bcdf-ea2c1725e1e4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "15/56",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "d3029ff7-ff63-4c5f-9c21-45c71b427f52"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--db87582d-4bc5-44e8-bb5c-692c0a1675b3",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T21:26:11.000Z",
|
||
|
|
"modified": "2019-02-22T21:26:11.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2019-02-20T10:09:28",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c20162a3-383f-44f0-8bdb-0a2bb3466c42"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/25eb40f52fbf71f729b4b7422e181e22ef19e38a461ce450446d47fa765cb153/analysis/1550657368/",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "847ef514-c7c4-4e18-906e-6d9e890ce255"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "13/52",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "9fc15743-0ebd-49f2-b767-d95d27f24585"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--65a677a3-16ab-4e76-aed3-ecba7abc12f2",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2019-02-22T21:26:11.000Z",
|
||
|
|
"modified": "2019-02-22T21:26:11.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2019-02-21T09:00:12",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d8818d9c-1cfd-4f52-bd6e-51e9e6dee01d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/e3e7ef4f1b56b1a6a208df5f993989b2df33ec3c9e27a5bcd8add0bb40b63fe3/analysis/1550739612/",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "98e18b0a-52f3-4cdb-8f6f-10bb0989be27"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "16/51",
|
||
|
|
"category": "Payload delivery",
|
||
|
|
"uuid": "c30f13c3-9e96-491b-9d3b-865068609f38"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--87ac1cfa-413f-485a-a968-1c8b3c19bfee",
|
||
|
|
"created": "2021-05-26T14:00:58.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:58.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--23275e05-c202-460e-aadf-819c417fb326",
|
||
|
|
"target_ref": "x-misp-object--ab5f0c85-5623-424c-bc03-d79841700d74"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--486450c8-d407-4a0c-8801-5366144e9567",
|
||
|
|
"created": "2021-05-26T14:00:58.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:58.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--23275e05-c202-460e-aadf-819c417fb326",
|
||
|
|
"target_ref": "x-misp-object--4f5d6000-e3f0-4282-944c-8ab3f686c973"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--995581e3-b771-40f2-91fc-0a8205cdb0df",
|
||
|
|
"created": "2021-05-26T14:00:58.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:58.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--23275e05-c202-460e-aadf-819c417fb326",
|
||
|
|
"target_ref": "x-misp-object--dc897614-58b7-418c-a6d6-fee0515c8e7a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--a0e01e47-6eb3-43fc-8bba-e7f9393c5804",
|
||
|
|
"created": "2021-05-26T14:00:58.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:58.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--23275e05-c202-460e-aadf-819c417fb326",
|
||
|
|
"target_ref": "x-misp-object--7f64ad39-cff6-472b-a6e1-7bf50d613d3c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--f971e341-fa71-493b-89e7-c23bd331dcd8",
|
||
|
|
"created": "2021-05-26T14:00:58.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:58.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--23275e05-c202-460e-aadf-819c417fb326",
|
||
|
|
"target_ref": "x-misp-object--5d3c8572-b1e9-4af6-9067-34d2c9359651"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--707902a1-5723-45ae-87aa-3c3cc9544a3b",
|
||
|
|
"created": "2021-05-26T14:00:58.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:58.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--23275e05-c202-460e-aadf-819c417fb326",
|
||
|
|
"target_ref": "x-misp-object--1c18e4e0-8fb3-4d11-ba91-63c60ca95981"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--8895514b-8083-4406-8de9-69823a4fcb2e",
|
||
|
|
"created": "2021-05-26T14:00:58.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:58.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--23275e05-c202-460e-aadf-819c417fb326",
|
||
|
|
"target_ref": "x-misp-object--2198b5e0-4891-493a-8a0c-19452f7d5702"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--1431935b-73e5-40ee-a37a-e44ee3b530ae",
|
||
|
|
"created": "2021-05-26T14:00:58.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:58.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--23275e05-c202-460e-aadf-819c417fb326",
|
||
|
|
"target_ref": "x-misp-object--4f3aeec4-3cbb-42ff-8caf-9b50e6e172b0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--896dde70-9273-4174-8ce9-2c934b691ed8",
|
||
|
|
"created": "2021-05-26T14:00:59.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:59.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--23275e05-c202-460e-aadf-819c417fb326",
|
||
|
|
"target_ref": "x-misp-object--9d4b06b3-e506-4b63-991f-fdde148494b0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--4cdc8fce-5c6d-425f-8518-a0b4fa80d7d2",
|
||
|
|
"created": "2021-05-26T14:00:59.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:59.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--23275e05-c202-460e-aadf-819c417fb326",
|
||
|
|
"target_ref": "x-misp-object--1d9b9f2f-295e-42bd-9793-e553832e940c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--0042cc85-e91d-4d30-b83d-b20d2477c67b",
|
||
|
|
"created": "2021-05-26T14:00:59.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:59.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--23275e05-c202-460e-aadf-819c417fb326",
|
||
|
|
"target_ref": "x-misp-object--7a8106f1-71ea-4f5c-8835-74ebe31688fd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--169e49ec-b063-4d9d-aa71-6fcfcb4550df",
|
||
|
|
"created": "2021-05-26T14:00:59.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:59.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--23275e05-c202-460e-aadf-819c417fb326",
|
||
|
|
"target_ref": "x-misp-object--1f6dfa85-e357-46fc-aab5-c7f886092666"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--bf9fc089-411a-47ef-b117-8e0905e984ff",
|
||
|
|
"created": "2021-05-26T14:00:59.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:59.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--23275e05-c202-460e-aadf-819c417fb326",
|
||
|
|
"target_ref": "x-misp-object--9bd89f5b-da48-4fbf-bcf6-722baca2ea3d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--6c704288-a1a3-478f-8558-9e9abb0d4b0f",
|
||
|
|
"created": "2021-05-26T14:00:59.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:59.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--23275e05-c202-460e-aadf-819c417fb326",
|
||
|
|
"target_ref": "x-misp-object--1bf32510-81a1-4ade-bccc-d0044cb5267f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--394bf2c8-cd41-463c-a90b-83037561be1b",
|
||
|
|
"created": "2021-05-26T14:00:59.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:59.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--23275e05-c202-460e-aadf-819c417fb326",
|
||
|
|
"target_ref": "x-misp-object--c873cad9-ab04-4a26-a0ee-fba9a8a4b27c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--acd2415e-ec73-4a25-afd9-53bef636b47a",
|
||
|
|
"created": "2021-05-26T14:00:59.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:59.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--23275e05-c202-460e-aadf-819c417fb326",
|
||
|
|
"target_ref": "x-misp-object--0070abd5-c842-4a8e-8b48-54138e4136b1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--cbacc7c0-6c13-481a-9adc-db18364f1620",
|
||
|
|
"created": "2021-05-26T14:00:59.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:59.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--23275e05-c202-460e-aadf-819c417fb326",
|
||
|
|
"target_ref": "x-misp-object--321a716e-311b-4023-a02a-1980cc3b3d02"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--703711a7-13ae-4fbe-aa67-e2a791e6feca",
|
||
|
|
"created": "2021-05-26T14:00:59.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:59.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--23275e05-c202-460e-aadf-819c417fb326",
|
||
|
|
"target_ref": "x-misp-object--de794f38-760a-4c03-8514-98ddceeeddc5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--dbc6380f-6c05-499a-97df-5694d2c5ea45",
|
||
|
|
"created": "2021-05-26T14:00:59.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:59.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--23275e05-c202-460e-aadf-819c417fb326",
|
||
|
|
"target_ref": "x-misp-object--320625e6-bc23-4868-967f-ac3a684997fc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--156d2f49-9cb9-4ea7-8f7d-f61ad2df0a58",
|
||
|
|
"created": "2021-05-26T14:00:59.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:59.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--23275e05-c202-460e-aadf-819c417fb326",
|
||
|
|
"target_ref": "x-misp-object--504ec11b-59f4-488c-bd75-ca4d85c57f37"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--01ff68fe-38d8-4f49-9d88-27fadab7a12b",
|
||
|
|
"created": "2021-05-26T14:00:59.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:59.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "indicator--3f183dde-981b-468a-b9ed-5c4c3e16b42a",
|
||
|
|
"target_ref": "x-misp-object--23275e05-c202-460e-aadf-819c417fb326"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--35dbf801-88c6-4344-b9b3-f0d67418e756",
|
||
|
|
"created": "2021-05-26T14:00:59.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:59.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--6ff6a916-e131-436f-95b6-6266d38a16fc",
|
||
|
|
"target_ref": "x-misp-object--0efddb66-b6bf-4244-8fee-2cba6be0f5a1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--b879133c-8bdd-4427-9095-481ddd1ed751",
|
||
|
|
"created": "2021-05-26T14:00:59.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:59.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--6ff6a916-e131-436f-95b6-6266d38a16fc",
|
||
|
|
"target_ref": "x-misp-object--ae12d82c-b919-4527-b625-8c178fd4f30a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--c914887f-e8db-4384-8260-cceb48ba8817",
|
||
|
|
"created": "2021-05-26T14:00:59.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:59.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--6ff6a916-e131-436f-95b6-6266d38a16fc",
|
||
|
|
"target_ref": "x-misp-object--91933b10-68ce-4a57-aed6-5f379af1b5e4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--f32a7fbe-1447-4e0a-bde5-02725fe40adb",
|
||
|
|
"created": "2021-05-26T14:00:59.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:59.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--6ff6a916-e131-436f-95b6-6266d38a16fc",
|
||
|
|
"target_ref": "x-misp-object--b4c0cfbc-93ed-4be0-b4fe-b644085f4463"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--697bbe14-c4bd-4906-bdd6-9d10419c3ff0",
|
||
|
|
"created": "2021-05-26T14:00:59.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:59.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--6ff6a916-e131-436f-95b6-6266d38a16fc",
|
||
|
|
"target_ref": "x-misp-object--38ec7e98-19ab-4d57-bb9f-7986d2c6a038"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--7e40c52d-c306-4fe8-b284-2f4bee2fb1db",
|
||
|
|
"created": "2021-05-26T14:00:59.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:59.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--6ff6a916-e131-436f-95b6-6266d38a16fc",
|
||
|
|
"target_ref": "x-misp-object--a4a5a544-d184-49c3-9682-0b8c96d98c69"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--83e74d0b-ab53-439d-ac34-9f6a6682cfa0",
|
||
|
|
"created": "2021-05-26T14:00:59.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:59.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--6ff6a916-e131-436f-95b6-6266d38a16fc",
|
||
|
|
"target_ref": "x-misp-object--632a229e-d0b5-4524-a97d-8816e5792f43"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--3a588e0f-c0b0-490a-a09f-fee0ab63c09b",
|
||
|
|
"created": "2021-05-26T14:00:59.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:59.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--6ff6a916-e131-436f-95b6-6266d38a16fc",
|
||
|
|
"target_ref": "x-misp-object--e90c448e-ba4c-40cf-8546-cee2c43613c8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--94206def-9239-457f-886d-c8dc8e74de7c",
|
||
|
|
"created": "2021-05-26T14:00:59.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:59.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--6ff6a916-e131-436f-95b6-6266d38a16fc",
|
||
|
|
"target_ref": "x-misp-object--c8acbc26-1989-4f19-abde-85f8ca74b0fb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--486554f5-2109-4e12-a252-46f2ca423f1d",
|
||
|
|
"created": "2021-05-26T14:00:59.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:59.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--6ff6a916-e131-436f-95b6-6266d38a16fc",
|
||
|
|
"target_ref": "x-misp-object--cb41f2a5-6432-4a61-a25a-b54abef32bc8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--5c8eaf0c-0cf9-4124-aa4d-59a39a062607",
|
||
|
|
"created": "2021-05-26T14:00:59.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:59.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--6ff6a916-e131-436f-95b6-6266d38a16fc",
|
||
|
|
"target_ref": "x-misp-object--51c1d7f7-0362-43a7-8a81-cf5d558e36e3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--aa16a024-835d-43af-baf8-189f9e9372d7",
|
||
|
|
"created": "2021-05-26T14:00:59.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:59.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--6ff6a916-e131-436f-95b6-6266d38a16fc",
|
||
|
|
"target_ref": "x-misp-object--39c43ea1-e61e-411a-b531-553326d63b56"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--756e450e-1776-4ae5-83d3-33d10e035680",
|
||
|
|
"created": "2021-05-26T14:00:59.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:59.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--6ff6a916-e131-436f-95b6-6266d38a16fc",
|
||
|
|
"target_ref": "x-misp-object--1fb60859-3d2f-488b-a56f-1cb8ea504f54"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--7e76a296-fb35-4fc4-935b-fcd680b18ddc",
|
||
|
|
"created": "2021-05-26T14:00:59.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:59.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--6ff6a916-e131-436f-95b6-6266d38a16fc",
|
||
|
|
"target_ref": "x-misp-object--9dbf82e2-a659-4f65-a1cb-1a4c1917a005"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--91466298-fa3c-437c-8569-34454afe3886",
|
||
|
|
"created": "2021-05-26T14:00:59.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:59.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--6ff6a916-e131-436f-95b6-6266d38a16fc",
|
||
|
|
"target_ref": "x-misp-object--4dbada84-b2ff-42b0-9263-5f43ec5ce1a9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--ee01e902-7594-4681-852e-a8d0c9c905ba",
|
||
|
|
"created": "2021-05-26T14:00:59.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:59.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--6ff6a916-e131-436f-95b6-6266d38a16fc",
|
||
|
|
"target_ref": "x-misp-object--1608b5e5-da24-49e8-b0c4-8609562bce1e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--fc78b96d-d946-483f-9943-23cc8f670905",
|
||
|
|
"created": "2021-05-26T14:00:59.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:59.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--6ff6a916-e131-436f-95b6-6266d38a16fc",
|
||
|
|
"target_ref": "x-misp-object--67da960b-1262-4850-8386-de665b4e1399"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--495a3e80-e1a9-4a22-81bd-e0e2701db80a",
|
||
|
|
"created": "2021-05-26T14:00:59.000Z",
|
||
|
|
"modified": "2021-05-26T14:00:59.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--6ff6a916-e131-436f-95b6-6266d38a16fc",
|
||
|
|
"target_ref": "x-misp-object--af6f3841-8a1d-4348-8e26-9b0f175c048b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--23e8fb9f-9dfb-4a60-b03d-bfe531644860",
|
||
|
|
"created": "2021-05-26T14:01:00.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:00.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--6ff6a916-e131-436f-95b6-6266d38a16fc",
|
||
|
|
"target_ref": "x-misp-object--ce498a1e-28d1-499e-afdf-799d6da13d3d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--24069fce-65cf-4fa5-b622-99cbc85a420b",
|
||
|
|
"created": "2021-05-26T14:01:00.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:00.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--6ff6a916-e131-436f-95b6-6266d38a16fc",
|
||
|
|
"target_ref": "x-misp-object--4d9a9254-0873-49bd-9cfb-62a1f0848a58"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--01004c6e-e28e-418c-b101-a4f150b38a77",
|
||
|
|
"created": "2021-05-26T14:01:00.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:00.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--6ff6a916-e131-436f-95b6-6266d38a16fc",
|
||
|
|
"target_ref": "x-misp-object--2cee848c-2326-4854-9d96-93a7fa2cf988"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--b272d464-2ab5-4546-92b2-694aa1263d1d",
|
||
|
|
"created": "2021-05-26T14:01:00.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:00.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--6ff6a916-e131-436f-95b6-6266d38a16fc",
|
||
|
|
"target_ref": "x-misp-object--d8d201a0-3149-42b2-9513-34b447c1c13f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--74555e11-a30d-4f31-8db4-324707733774",
|
||
|
|
"created": "2021-05-26T14:01:00.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:00.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--6ff6a916-e131-436f-95b6-6266d38a16fc",
|
||
|
|
"target_ref": "x-misp-object--1926ac04-ef31-4e89-911a-345958a68ede"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--fe480d95-665f-4b55-91d3-1e96864941f6",
|
||
|
|
"created": "2021-05-26T14:01:00.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:00.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--6ff6a916-e131-436f-95b6-6266d38a16fc",
|
||
|
|
"target_ref": "x-misp-object--e10eaa5e-938a-466b-8710-99628dd0f5fe"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--5219e1e6-875f-41d4-859e-414cb30e6922",
|
||
|
|
"created": "2021-05-26T14:01:00.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:00.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "indicator--82185331-b6b4-4731-9a54-341245df56f4",
|
||
|
|
"target_ref": "x-misp-object--6ff6a916-e131-436f-95b6-6266d38a16fc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--91024cdb-21c2-4521-b89e-1374e0c9e46b",
|
||
|
|
"created": "2021-05-26T14:01:00.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:00.000Z",
|
||
|
|
"relationship_type": "analysed-with",
|
||
|
|
"source_ref": "indicator--82185331-b6b4-4731-9a54-341245df56f4",
|
||
|
|
"target_ref": "x-misp-object--a43da60c-51a0-4616-a935-b8ccfecf6559"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--fdcf720f-e144-4177-ac77-c748b12eb059",
|
||
|
|
"created": "2021-05-26T14:01:00.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:00.000Z",
|
||
|
|
"relationship_type": "analysed-with",
|
||
|
|
"source_ref": "indicator--82185331-b6b4-4731-9a54-341245df56f4",
|
||
|
|
"target_ref": "x-misp-object--e1c9702f-771a-4bc6-9dda-605e62b64bd4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--6b0c7ca6-afe2-45dd-9f7f-e9c1c7e69b14",
|
||
|
|
"created": "2021-05-26T14:01:00.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:00.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--519d047d-55a5-45d8-ae55-1f511b364c39",
|
||
|
|
"target_ref": "x-misp-object--470171f6-6891-4934-a348-9e23bb444d58"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--8928112c-74af-4604-9fb5-d749bfa42803",
|
||
|
|
"created": "2021-05-26T14:01:00.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:00.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--519d047d-55a5-45d8-ae55-1f511b364c39",
|
||
|
|
"target_ref": "x-misp-object--ea29e220-832b-4092-a670-d3959c5e6f05"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--1e01af9e-3224-4de8-be59-d431f8852a1a",
|
||
|
|
"created": "2021-05-26T14:01:00.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:00.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--519d047d-55a5-45d8-ae55-1f511b364c39",
|
||
|
|
"target_ref": "x-misp-object--8e75def0-9d85-46a9-b3a0-766442a23aff"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--383467aa-6df3-44da-8d4d-d6a336bb2d10",
|
||
|
|
"created": "2021-05-26T14:01:00.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:00.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--519d047d-55a5-45d8-ae55-1f511b364c39",
|
||
|
|
"target_ref": "x-misp-object--6283cbe6-5c69-44d0-92a5-f9947fb7f579"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--cc7b6c8d-276d-43e6-a1d6-cdf1fd6cd4f8",
|
||
|
|
"created": "2021-05-26T14:01:00.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:00.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--519d047d-55a5-45d8-ae55-1f511b364c39",
|
||
|
|
"target_ref": "x-misp-object--857bd85d-cf7a-4c31-835a-d33b78de4309"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--5c6d5fca-9ebb-4df5-bd08-401765dca40b",
|
||
|
|
"created": "2021-05-26T14:01:00.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:00.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--519d047d-55a5-45d8-ae55-1f511b364c39",
|
||
|
|
"target_ref": "x-misp-object--10cbb692-f777-4e40-b3a3-1530d159680f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--12abc147-3038-4bb9-aa0d-0527c7582b7b",
|
||
|
|
"created": "2021-05-26T14:01:00.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:00.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--519d047d-55a5-45d8-ae55-1f511b364c39",
|
||
|
|
"target_ref": "x-misp-object--f5bb7808-71a9-480b-8be3-5a131cc7b14d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--8f14e56b-649b-4e2c-8857-2db81b5776e0",
|
||
|
|
"created": "2021-05-26T14:01:00.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:00.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--519d047d-55a5-45d8-ae55-1f511b364c39",
|
||
|
|
"target_ref": "x-misp-object--54d38ffe-220a-487d-9d9f-4c9601bcfc26"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--7b613e9c-8239-4468-9102-96eea9125102",
|
||
|
|
"created": "2021-05-26T14:01:00.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:00.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--519d047d-55a5-45d8-ae55-1f511b364c39",
|
||
|
|
"target_ref": "x-misp-object--2b50e37a-113f-40b7-83db-8d7cecd7445e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--e394f6cc-cab1-4018-a5a7-169e43bc0cb0",
|
||
|
|
"created": "2021-05-26T14:01:00.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:00.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--519d047d-55a5-45d8-ae55-1f511b364c39",
|
||
|
|
"target_ref": "x-misp-object--686654a9-8744-4acd-8c99-882671eb86a5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--4df301fa-2f0f-4d15-8e78-08fb8387fcb9",
|
||
|
|
"created": "2021-05-26T14:01:00.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:00.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--519d047d-55a5-45d8-ae55-1f511b364c39",
|
||
|
|
"target_ref": "x-misp-object--ffa1f4b4-6c33-41bb-a9c6-8497c56cc1c1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--f26b790d-3778-42b9-a185-ca256fac0f86",
|
||
|
|
"created": "2021-05-26T14:01:00.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:00.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--519d047d-55a5-45d8-ae55-1f511b364c39",
|
||
|
|
"target_ref": "x-misp-object--076dfd16-0873-42f0-b06f-fbbcaae6b7c8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--c520483e-1967-4b3a-87af-bb979fda6ad3",
|
||
|
|
"created": "2021-05-26T14:01:00.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:00.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--519d047d-55a5-45d8-ae55-1f511b364c39",
|
||
|
|
"target_ref": "x-misp-object--af66b768-1c00-49f7-a4ff-803d8ab37233"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--6267311a-97cf-4903-b4ab-5ac104115d5e",
|
||
|
|
"created": "2021-05-26T14:01:00.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:00.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--519d047d-55a5-45d8-ae55-1f511b364c39",
|
||
|
|
"target_ref": "x-misp-object--dd6bb24d-60aa-4447-a2c3-53e4719c1a6d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--e4047c99-ad48-4f46-99e8-a31e79e8942f",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--519d047d-55a5-45d8-ae55-1f511b364c39",
|
||
|
|
"target_ref": "x-misp-object--d17533f6-f053-4ad0-8ac3-e4640059a3f2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--64324339-40bc-4f83-a4f7-7a60b5d67cd1",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--519d047d-55a5-45d8-ae55-1f511b364c39",
|
||
|
|
"target_ref": "x-misp-object--925757a0-52b8-4622-a57b-ec05a890b587"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--ad00c751-28a7-41ad-be7b-4d473dc26954",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "indicator--ee88ac4b-ae90-4c72-9d23-ea171d52a814",
|
||
|
|
"target_ref": "x-misp-object--519d047d-55a5-45d8-ae55-1f511b364c39"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--54e8e0bf-5867-4ffb-98eb-0a093b22cf44",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "analysed-with",
|
||
|
|
"source_ref": "indicator--ee88ac4b-ae90-4c72-9d23-ea171d52a814",
|
||
|
|
"target_ref": "x-misp-object--d25ea6d9-0e80-49d5-98e9-489b46660622"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--ddbfcec5-867c-4d49-9d28-bff5e4fe5520",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "analysed-with",
|
||
|
|
"source_ref": "indicator--ee88ac4b-ae90-4c72-9d23-ea171d52a814",
|
||
|
|
"target_ref": "x-misp-object--e56872f0-2860-4b90-b6d6-e90e54a7062f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--49184f05-62ec-4348-9a4b-9c3a12dc586a",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
||
|
|
"target_ref": "x-misp-object--e826781f-d8c9-432f-9e69-4d36839e3633"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--3f6ffd46-6089-4b83-aa58-f1724ad9fdcd",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
||
|
|
"target_ref": "x-misp-object--3986c66c-514e-404b-9e28-7ab45578994e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--414cb189-2eef-400a-936f-41c90172e2f4",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
||
|
|
"target_ref": "x-misp-object--bd803983-4b03-49b8-ac03-9d349ce2c233"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--7ea27add-9a9c-47bc-a447-548b1fa7bac4",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
||
|
|
"target_ref": "x-misp-object--c0d75914-c1de-4526-a7ff-48062734a6bc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--cea425b0-4c7c-4fb2-b72f-b237724411df",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
||
|
|
"target_ref": "x-misp-object--56631f91-e310-44a3-9ffc-5f87beca5393"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--6899bcd4-d5b0-445c-b741-a9ecf3b15d5e",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
||
|
|
"target_ref": "x-misp-object--fec33774-1305-4cf9-a062-9695c3c0b2f8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--d7a24555-7416-466b-a547-354e6711864f",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
||
|
|
"target_ref": "x-misp-object--8a8f8c42-4139-4fbd-8e47-95c67bf44b7e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--b3a95435-61e6-4de0-9d09-f5fca57ff751",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
||
|
|
"target_ref": "x-misp-object--06eddc48-a6c1-4ee3-b93f-59153e8d07e8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--19aa83cd-51d1-491c-94d0-d4933f51caec",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
||
|
|
"target_ref": "x-misp-object--65ea31ac-3e42-4d1d-b488-ee8a30e3ddba"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--345c5b74-880f-46ac-930b-294644b365a7",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
||
|
|
"target_ref": "x-misp-object--c02bb6f8-3bd6-4cab-af0f-d4175ce1757b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--c4b2b311-fb29-4dd2-a2c1-6d838b0ee0b3",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
||
|
|
"target_ref": "x-misp-object--8e061ff5-a705-494a-8cec-a45f3aa7b0b4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--bbe5eb56-0ed8-4d62-8000-ee0519bca478",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
||
|
|
"target_ref": "x-misp-object--a30e6ecd-679f-41c5-9535-9bba600cefd1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--e45ac432-8873-450a-bb0b-58bc41aa901f",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
||
|
|
"target_ref": "x-misp-object--4fe89ca0-8d15-4412-9c39-907e06000097"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--aea348c7-4987-4276-807c-027d0ca0df2a",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
||
|
|
"target_ref": "x-misp-object--14ba151f-dbf3-4567-86d9-a7ef3a3a92a1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--28d6b686-9a5f-481b-9041-b08536dc736d",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
||
|
|
"target_ref": "x-misp-object--ab60dc7f-1824-4330-ae97-d4fd35d8b19d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--08cc1af4-29e8-4057-a709-2c072482e452",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--2f4cf82c-26e8-44c4-a37d-54467ea9b83c",
|
||
|
|
"target_ref": "x-misp-object--8c00983d-18f4-43af-924c-52e733a3ba2b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--b8fed001-cef2-4f6d-bea9-c0e6511fc935",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "indicator--9fa78408-d5e6-4e34-9133-e6b63f8ccb00",
|
||
|
|
"target_ref": "x-misp-object--2f4cf82c-26e8-44c4-a37d-54467ea9b83c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--f7ed9ac6-ed92-4f8a-b15a-f07857c30bfd",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "analysed-with",
|
||
|
|
"source_ref": "indicator--9fa78408-d5e6-4e34-9133-e6b63f8ccb00",
|
||
|
|
"target_ref": "x-misp-object--e3af71ca-c00f-4243-886e-3c4d279bd335"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--ccbd1757-69b9-465a-9099-d4f26562a32c",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "analysed-with",
|
||
|
|
"source_ref": "indicator--9fa78408-d5e6-4e34-9133-e6b63f8ccb00",
|
||
|
|
"target_ref": "x-misp-object--bdd37f7f-ce08-4bf8-a7b6-378947ac1f32"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--b642d1c8-13bc-4130-bd96-8a90a486561a",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--2510904a-8b31-4775-b820-c2118673d768",
|
||
|
|
"target_ref": "x-misp-object--1d2a78b2-cca6-497e-8d34-e4aaf48058ab"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--bd898bbb-c447-48ec-a3db-ff9558b376e1",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--2510904a-8b31-4775-b820-c2118673d768",
|
||
|
|
"target_ref": "x-misp-object--3736e5f2-fbf4-4c27-9a64-1329ce50e0ff"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--cc638376-a93e-453a-8630-a7ec82fd3951",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--2510904a-8b31-4775-b820-c2118673d768",
|
||
|
|
"target_ref": "x-misp-object--053151e3-420b-4c23-a820-a05687c79638"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--516134fa-6903-4524-8c4d-038ab792c4d5",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--2510904a-8b31-4775-b820-c2118673d768",
|
||
|
|
"target_ref": "x-misp-object--42057437-daf0-47d5-8ef9-1265ca9c3bf8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--d1d918d0-28af-486f-8eb4-3fab6de35f0d",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--2510904a-8b31-4775-b820-c2118673d768",
|
||
|
|
"target_ref": "x-misp-object--55e74daf-857f-4346-9f69-051c3955ecf3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--b6574e82-0f7a-4231-9fda-92f882d539fd",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--2510904a-8b31-4775-b820-c2118673d768",
|
||
|
|
"target_ref": "x-misp-object--db355308-9731-45bc-bf64-a51def874d82"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--e1769741-0bc1-4183-bd36-ed3c54292e6c",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--2510904a-8b31-4775-b820-c2118673d768",
|
||
|
|
"target_ref": "x-misp-object--51a41008-1ed4-4a5a-b4aa-d61c285491d5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--1e9f7364-5d74-47ad-9122-a61db07710d6",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--2510904a-8b31-4775-b820-c2118673d768",
|
||
|
|
"target_ref": "x-misp-object--b2e6ff07-699a-4a1f-aca7-3a21fc9300ef"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--3a22154b-4c12-4d08-8d90-7c60353be86b",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--2510904a-8b31-4775-b820-c2118673d768",
|
||
|
|
"target_ref": "x-misp-object--7ebf77db-51f9-4ccb-8d44-0900b626feb1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--982079a7-cb10-44c7-ba75-b7196ae4d9ea",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--2510904a-8b31-4775-b820-c2118673d768",
|
||
|
|
"target_ref": "x-misp-object--31451acb-ef2b-4981-a413-52be999c4c77"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--7ccb522a-b8ac-416a-9709-bcb1c9b92c90",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--2510904a-8b31-4775-b820-c2118673d768",
|
||
|
|
"target_ref": "x-misp-object--843e2684-e148-4805-8002-5680f152c755"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--72851d34-41d6-49ea-adb5-e41f7b60c7d8",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--2510904a-8b31-4775-b820-c2118673d768",
|
||
|
|
"target_ref": "x-misp-object--32380cda-a18c-42b5-9842-d32ed0ac8899"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--bdf6d090-1d33-434c-b2a0-49b888401cee",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--2510904a-8b31-4775-b820-c2118673d768",
|
||
|
|
"target_ref": "x-misp-object--b79752d2-5f10-435d-aad3-88d65099277c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--d9abc2ff-c947-4de0-aa9c-2a3f322bf0cd",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--2510904a-8b31-4775-b820-c2118673d768",
|
||
|
|
"target_ref": "x-misp-object--75289f6c-02f1-4bc1-bdcb-c2f34d6f534a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--755d15b1-3143-4839-ad5f-0ce26f351613",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--2510904a-8b31-4775-b820-c2118673d768",
|
||
|
|
"target_ref": "x-misp-object--6483f9f2-8ef6-455a-adb4-ee92998a2d8d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--efeb18fd-6d2d-48e6-a1c7-d1dc0259bd77",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "indicator--6a28fa02-9b7a-4619-ac64-780383067644",
|
||
|
|
"target_ref": "x-misp-object--2510904a-8b31-4775-b820-c2118673d768"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--3ed913ca-1db8-4108-b398-1f4c80af69d8",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
||
|
|
"target_ref": "x-misp-object--12e6d593-a557-4c6f-afde-5691fa98d03c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--ec085fc9-04d7-44b8-abcc-ce588dca56fa",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
||
|
|
"target_ref": "x-misp-object--626c678f-ed94-41f2-8bdb-5c22a0416ce8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--ae6274dc-3b97-4827-be17-cabb545b8a8d",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
||
|
|
"target_ref": "x-misp-object--68122fa4-5fef-452f-b5c7-65856255d959"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--c82d1bc3-5673-4887-b88a-bc24dd371aca",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
||
|
|
"target_ref": "x-misp-object--98dcda44-bc1c-49d1-be0b-0b84a84cf09d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--537a3a72-09b2-49e9-8954-91744cb1959f",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
||
|
|
"target_ref": "x-misp-object--8e4b1b09-47c6-497f-9e3f-f3944b9072dc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--30e522ed-3d05-4e65-874b-4cce7fe92b93",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
||
|
|
"target_ref": "x-misp-object--c5228190-32c1-414a-9cf4-679d7b6c5278"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--5a1746e7-bc04-4fb1-894d-863cc3e72a50",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
||
|
|
"target_ref": "x-misp-object--708f5d2f-37cb-490b-8273-aa0d60d45e30"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--17027316-8b98-4264-8f1b-9c462e934861",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
||
|
|
"target_ref": "x-misp-object--17269a28-42b6-4d6f-94e8-f1c16976b19b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--6bc08255-eae6-42b3-bb59-93476ca8aed6",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
||
|
|
"target_ref": "x-misp-object--c28ef437-adb6-40bd-a96b-c3decc193b3e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--fbccdc45-b298-4b94-9851-35030738b55d",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
||
|
|
"target_ref": "x-misp-object--11a4d35a-907d-4351-abcd-dfcd4c4d0aa8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--b4359a75-bd3b-4363-8a0c-c1f43054acb4",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
||
|
|
"target_ref": "x-misp-object--c3c71253-50ac-4d14-9d85-8f08cba16df3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--4bf1d73a-b33c-4d5a-bf7e-b711ee64ce47",
|
||
|
|
"created": "2021-05-26T14:01:01.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:01.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
||
|
|
"target_ref": "x-misp-object--db63748e-1bda-4748-bdd0-64159e4eb3a6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--21d9b65a-eb0d-40f7-b8e2-cbfcde9b5965",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
||
|
|
"target_ref": "x-misp-object--3ee50d25-47b5-4e5a-bfe1-e6376f8e7e83"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--22675c5d-3ee9-4bde-91df-76a75972047c",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
||
|
|
"target_ref": "x-misp-object--a9c5f0eb-2b88-4b62-b69a-6de7f6682586"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--d8d95f9b-ada0-4816-b4ef-5646dd13e210",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
||
|
|
"target_ref": "x-misp-object--96b539e3-df21-4c39-b770-a222dbb1e1a4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--bbce4acc-21d6-4d67-bb44-b49343c87213",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
||
|
|
"target_ref": "x-misp-object--551ba26a-581a-4c53-b192-ec14f254250f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--5b1c98fd-59b1-43ac-9ca3-ef6a1d0782fc",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
||
|
|
"target_ref": "x-misp-object--e9c37e32-2ab7-4409-ae3d-23b6911f98a5"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--f6480439-3d39-4dde-a8c4-5604e405b49f",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
||
|
|
"target_ref": "x-misp-object--491db90d-b576-4739-bfdc-15c82825d4c2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--0a561843-0b27-4941-aa7d-275bb2fa8927",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
||
|
|
"target_ref": "x-misp-object--0432ec5c-2735-4638-aba6-74383c250015"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--4d667216-52e1-4d40-b90f-762cc7ca33a4",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
||
|
|
"target_ref": "x-misp-object--eea5d69c-5686-4b44-adc9-6d4f0a46c4ea"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--68f26f3f-7077-4354-8945-a36ed2ae91dc",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--109dd5a3-5ee7-4a76-aeb3-717ca8a92635",
|
||
|
|
"target_ref": "x-misp-object--85b5e80a-bbea-48d8-b54f-72e758c59ffd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--5bebe745-1352-400f-899e-a8c92033e50d",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "indicator--0b58e05e-34ee-4211-9c13-db3d9083b852",
|
||
|
|
"target_ref": "x-misp-object--109dd5a3-5ee7-4a76-aeb3-717ca8a92635"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--1e9ffabf-65a0-4ed4-bbe4-f0433d230edf",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
||
|
|
"target_ref": "x-misp-object--461050ca-2a51-4f11-99ad-ec7a63b03ff1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--af731da3-241e-4cc2-a8ca-9e8174003540",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
||
|
|
"target_ref": "x-misp-object--df522c29-c65b-48fb-afb0-d3a4932b1bdb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--c8b22ca6-18b6-4b98-a00b-dfdbd7e51085",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
||
|
|
"target_ref": "x-misp-object--45c8b70f-1502-42c0-bc02-f1d0ebc460d6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--6e6402f6-ccb1-4411-819a-093162c48362",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
||
|
|
"target_ref": "x-misp-object--33b1ae23-3cf2-45bb-88b3-3af9b3643cb9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--bc30cebf-70a1-446d-8fa0-f37f34c07ea1",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
||
|
|
"target_ref": "x-misp-object--6675bbb5-046a-4034-adfd-d70db36993e1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--809a819f-a975-4ee8-bde3-6468d82e1718",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
||
|
|
"target_ref": "x-misp-object--b4262ef0-03fc-4efa-a3b2-8a44fc89a4de"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--3c139f26-ebc5-4672-a351-57fd59f50c82",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
||
|
|
"target_ref": "x-misp-object--05b17a24-12c5-4980-a8fd-d8d54f8d2a5b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--4d1a5af0-5bf1-4beb-8858-8bd278b18b18",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
||
|
|
"target_ref": "x-misp-object--14689a10-2a7f-48b4-948f-824efe79131a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--d703e537-20fd-47c7-bacc-3a674518d113",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
||
|
|
"target_ref": "x-misp-object--652eae67-7686-4363-8583-b31aaed4af30"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--2248be1a-a931-49fc-9b73-2fd3dd07299a",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
||
|
|
"target_ref": "x-misp-object--60a5f09c-c861-4eca-9448-5e7bd592ecbe"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--d107d364-fa8b-4e39-bbe3-62ba6857967d",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
||
|
|
"target_ref": "x-misp-object--5d8e7117-335f-491c-8980-53cc0c20d4bd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--723bb4d9-1904-4be7-afd6-84a9c53c1ae2",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
||
|
|
"target_ref": "x-misp-object--11bec101-ea69-448a-ae53-247c2f25a01f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--de05a408-0f53-4c8b-9009-f6abbc22cb09",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
||
|
|
"target_ref": "x-misp-object--8d079804-d695-4435-819b-3f1a65812d66"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--768251f7-4e40-4078-9578-4cd0dc8c502f",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
||
|
|
"target_ref": "x-misp-object--c2730fc7-ccd3-4ce5-8fba-da72a3db38c7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--72f3dfc4-0073-48d9-9716-64d2deb52815",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
||
|
|
"target_ref": "x-misp-object--f75edb72-2a39-4aac-934d-4980703c3a9d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--3c22de5d-f78e-455f-9245-5b5a8ef3b1df",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
||
|
|
"target_ref": "x-misp-object--bb14a9d1-e11d-4590-83d1-0165d6c59aa7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--be0a523d-defa-4aa8-8eec-355510e40b1c",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
||
|
|
"target_ref": "x-misp-object--4a1d8145-fb08-41ef-80d4-50120ea92a11"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--705e4368-9024-4830-9936-66d395850100",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
||
|
|
"target_ref": "x-misp-object--609bb5bf-21ce-4df3-ac3c-7c2a3a16fe6b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--d2db9580-9a66-44c2-b3ef-cb913b3cb02d",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
||
|
|
"target_ref": "x-misp-object--96e3297f-ce4f-4c24-a681-26b10337c17f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--11859613-d48b-4f00-ae78-1002025a4771",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
||
|
|
"target_ref": "x-misp-object--f7f0af2d-7551-405c-ac2b-f1f347b83d0d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--2c6a8b76-0846-4ebf-bd06-900384c43167",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--80d8e828-308f-4ad5-84a4-f8a7d8438d82",
|
||
|
|
"target_ref": "x-misp-object--7dbd1012-551a-4944-9652-28e708774042"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--530467aa-cc2c-411e-9b57-17b2f0ee0396",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "indicator--ec4f8e6e-5a17-4c5a-adce-434e99f66868",
|
||
|
|
"target_ref": "x-misp-object--80d8e828-308f-4ad5-84a4-f8a7d8438d82"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--77e92bef-a17d-4dd5-889d-2dbaf1b162fb",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
||
|
|
"target_ref": "x-misp-object--56573e90-319c-4ca3-ac05-7a9ac20743dd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--8d0dbcdb-32a0-45e9-804c-efbe05a67eeb",
|
||
|
|
"created": "2021-05-26T14:01:02.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:02.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
||
|
|
"target_ref": "x-misp-object--e896240e-1257-4cec-bb1f-90ca909285c4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--6fcd86b3-fc78-44f8-9ed6-0b15e0f0bf99",
|
||
|
|
"created": "2021-05-26T14:01:03.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:03.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
||
|
|
"target_ref": "x-misp-object--3e5eaa70-dd1e-45c8-ad6f-35ad3b7449ce"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--6a3ca17c-42bc-4399-9aef-776a615b8c7e",
|
||
|
|
"created": "2021-05-26T14:01:03.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:03.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
||
|
|
"target_ref": "x-misp-object--1d17b468-ce54-48b9-a8a0-99af923ffe3c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--cb89b7b1-aae7-417e-94b9-999c6db7da2e",
|
||
|
|
"created": "2021-05-26T14:01:03.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:03.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
||
|
|
"target_ref": "x-misp-object--622d5d53-20d6-4c02-ab1c-ed562b45155e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--7e72b942-f5ff-4824-b634-768cfa074264",
|
||
|
|
"created": "2021-05-26T14:01:03.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:03.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
||
|
|
"target_ref": "x-misp-object--c3b033c9-8301-4eb9-a7c9-042bf5a2947a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--f4efa4ff-ee60-4f23-8b8d-17729c814d5f",
|
||
|
|
"created": "2021-05-26T14:01:03.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:03.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
||
|
|
"target_ref": "x-misp-object--2595727b-8ac2-42c0-a335-601eb9968f76"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--0e022ffc-ea9c-43be-abdb-2d8c0d330f44",
|
||
|
|
"created": "2021-05-26T14:01:03.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:03.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
||
|
|
"target_ref": "x-misp-object--c805be7e-462a-4067-bdac-5a2da1a49d53"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--bd0a4865-d5ab-4629-aee4-ae5d4c76ab61",
|
||
|
|
"created": "2021-05-26T14:01:03.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:03.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
||
|
|
"target_ref": "x-misp-object--67665457-214f-4ca0-a9e2-1caa8f1a4c1e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--eeeb3535-b954-4da0-9e06-6955c0dd7200",
|
||
|
|
"created": "2021-05-26T14:01:03.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:03.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
||
|
|
"target_ref": "x-misp-object--4b8a75a1-68c0-498d-bec0-ac8af7b192d1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--4633c3d4-1f3a-4014-b97b-23956f1ff2e5",
|
||
|
|
"created": "2021-05-26T14:01:03.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:03.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
||
|
|
"target_ref": "x-misp-object--fdfae2ea-c125-4b8d-85fb-34052ca74b95"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--103b26c8-14e8-4c9d-be33-4863cb108c2e",
|
||
|
|
"created": "2021-05-26T14:01:03.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:03.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
||
|
|
"target_ref": "x-misp-object--c5ea61b2-3a24-44c1-b223-d7405de29f18"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--44f6e829-bf3c-4026-b0d0-60e309d64fe3",
|
||
|
|
"created": "2021-05-26T14:01:03.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:03.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
||
|
|
"target_ref": "x-misp-object--521c8b9c-76be-4a62-9dca-73e4c9b9c218"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--e9ae7b94-ca62-4a7c-a897-49387d68fca9",
|
||
|
|
"created": "2021-05-26T14:01:03.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:03.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
||
|
|
"target_ref": "x-misp-object--c2b4cf8b-9b6b-4149-940b-11d0d691318d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--5af98b0d-d863-42bc-9ecf-e95beb4b6773",
|
||
|
|
"created": "2021-05-26T14:01:03.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:03.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
||
|
|
"target_ref": "x-misp-object--d137929b-9eb3-4c34-b326-d9a7014b134e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--670f64ad-c804-48c5-badb-f8836231a9e7",
|
||
|
|
"created": "2021-05-26T14:01:03.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:03.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
||
|
|
"target_ref": "x-misp-object--3555c174-555f-4e29-9da8-5a6bb5018d8b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--74b29455-97ae-4e82-8fa2-d4b6031fada8",
|
||
|
|
"created": "2021-05-26T14:01:03.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:03.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab",
|
||
|
|
"target_ref": "x-misp-object--760f1ed0-af91-44f1-a78b-2860b083a1ad"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--6d954b60-b844-4bb6-b68d-cffb9247c68c",
|
||
|
|
"created": "2021-05-26T14:01:03.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:03.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "indicator--5dc63b80-216f-4ae2-9c4e-c0d92e1608f2",
|
||
|
|
"target_ref": "x-misp-object--7b518a7e-8c1f-4ea3-9aef-e7df5a99c4ab"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--d23928bb-61e2-4abb-a343-5f1a9c61c347",
|
||
|
|
"created": "2021-05-26T14:01:03.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:03.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
||
|
|
"target_ref": "x-misp-object--7bb5de32-42dc-492f-9f15-dcc7b301e494"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--e2a37f9a-450e-4e87-89fd-96f07a04f476",
|
||
|
|
"created": "2021-05-26T14:01:03.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:03.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
||
|
|
"target_ref": "x-misp-object--68eded72-59ce-4d08-bef1-668df62db58a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--66d6c044-8405-428e-8e71-ccb9c8ac380c",
|
||
|
|
"created": "2021-05-26T14:01:03.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:03.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
||
|
|
"target_ref": "x-misp-object--09c61fed-920a-412b-a271-ce02a84a1545"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--183415f3-8d63-4c99-9145-b2f293acf4ac",
|
||
|
|
"created": "2021-05-26T14:01:03.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:03.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
||
|
|
"target_ref": "x-misp-object--6f2f215b-e90a-407c-a890-9b4e7b6ddc25"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--dcff23ec-da92-4352-a6aa-3637cd5b99cd",
|
||
|
|
"created": "2021-05-26T14:01:03.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:03.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
||
|
|
"target_ref": "x-misp-object--ee43fd41-f5e9-445a-b64e-591bae9edac3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--983a613b-c00a-45ed-ad7e-c83672b79518",
|
||
|
|
"created": "2021-05-26T14:01:03.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:03.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
||
|
|
"target_ref": "x-misp-object--1a82c8d5-cc26-4b68-87a0-34c96ed9245d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--dbe11594-08ad-4ddc-b370-2a09fd37c780",
|
||
|
|
"created": "2021-05-26T14:01:03.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:03.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
||
|
|
"target_ref": "x-misp-object--289f1b4c-540f-4f29-8969-e9ebcd0e670b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--11e122d2-073a-413d-a1eb-a644973b0029",
|
||
|
|
"created": "2021-05-26T14:01:03.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:03.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
||
|
|
"target_ref": "x-misp-object--e30070e6-2fe3-4492-9dbc-8a6ba6399a0e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--b696542d-460b-4a56-8cfc-30f79f5cb66f",
|
||
|
|
"created": "2021-05-26T14:01:03.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:03.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
||
|
|
"target_ref": "x-misp-object--8aba5cf0-1929-436e-b447-dc91c761dea4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--1ba8a831-035b-4fe8-8419-868bbdc88248",
|
||
|
|
"created": "2021-05-26T14:01:03.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:03.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
||
|
|
"target_ref": "x-misp-object--14cb1917-5119-4963-a18f-dac5e7d2e59f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--3574f8e7-9828-4c37-99c0-d98e9dbac28a",
|
||
|
|
"created": "2021-05-26T14:01:03.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:03.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
||
|
|
"target_ref": "x-misp-object--daaf43a3-100c-4fe3-8e89-4adfd9057efe"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--fa83a026-fb5c-4087-b789-51aeb0aa9e32",
|
||
|
|
"created": "2021-05-26T14:01:03.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:03.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
||
|
|
"target_ref": "x-misp-object--e92fec30-1048-41d7-adad-639103eaa63c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--eb3988a4-783e-4fdd-82e9-a1eaa61596d8",
|
||
|
|
"created": "2021-05-26T14:01:03.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:03.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
||
|
|
"target_ref": "x-misp-object--020ca0aa-39e9-4f7b-982d-0ca840149593"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--bcff4da6-024c-4a1b-89d2-0db9ccae35f0",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
||
|
|
"target_ref": "x-misp-object--23e9bde3-6221-41de-943e-87d5c9c1d128"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--c6ff6a1b-51af-4fcd-b66a-b0051da684c9",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
||
|
|
"target_ref": "x-misp-object--614810d2-58b6-4b26-a507-2ed5e82abab6"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--45cffa85-0138-4774-847b-6abfffd443e2",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--64a52227-ffc9-4f53-bf15-05f15c0faf46",
|
||
|
|
"target_ref": "x-misp-object--0b73ecde-d78d-45cd-8c84-be00190cd1c1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--32444441-4abb-4bec-8192-2b6c46ac4019",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "indicator--bbe86c8c-5387-4624-b3db-0d287317db87",
|
||
|
|
"target_ref": "x-misp-object--64a52227-ffc9-4f53-bf15-05f15c0faf46"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--f3ccdd5d-7f3a-4039-9f03-fb864e364213",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
||
|
|
"target_ref": "x-misp-object--9551bb88-fa96-4aa6-b707-cfb4cd8623fd"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--acc90b4c-59e9-4dde-bb55-f982b59284d7",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
||
|
|
"target_ref": "x-misp-object--2fcb8fce-1cef-4ef9-9efd-7a0b98c6a106"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--fd395944-cdc6-499d-b0f6-f8f4ceb52323",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
||
|
|
"target_ref": "x-misp-object--1aa3230b-657e-4e2d-9e07-84564e79d11f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--cb95475d-5abf-4a05-95d8-4d433e617d93",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
||
|
|
"target_ref": "x-misp-object--d9cb1d67-bc67-4288-843e-fc58b2bcef1c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--0ff7a19a-8138-4991-8459-ada43d4f574d",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
||
|
|
"target_ref": "x-misp-object--1a3da186-1bbc-4a48-97b1-6440eca59723"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--e1dcd7ea-cb59-4b54-99fe-9667ab336fbe",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
||
|
|
"target_ref": "x-misp-object--c216228a-4acb-47a3-8d5e-3f4a1beea28f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--826c28e0-c46d-4163-85b2-4cf25836c628",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
||
|
|
"target_ref": "x-misp-object--733971a9-763b-4866-ae77-1700627e83cc"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--4c484acd-dabc-494d-b889-c8da4fc0c708",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
||
|
|
"target_ref": "x-misp-object--f9aae507-1a91-4b11-aafd-2a42fbbc55b3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--2d0e2ed8-8c24-4881-ac7f-09d856ebf5bb",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
||
|
|
"target_ref": "x-misp-object--a494e224-56b1-43cd-8678-60dff775e87c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--32da0281-133e-45b4-bd5a-7917dff1f8bd",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
||
|
|
"target_ref": "x-misp-object--4efcbd17-7421-4e61-a49d-ad3da379ac93"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--091ff929-3ddd-4cae-8526-f114af156107",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
||
|
|
"target_ref": "x-misp-object--9ab8c8f5-6fa8-4f4a-a71b-3835066ce15c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--264ee688-8179-4b99-93bc-c719a638d73a",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
||
|
|
"target_ref": "x-misp-object--4f972a14-ad50-49dc-a95b-26939a450cb2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--d381d67e-803e-4ca7-bac0-4003ca912686",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
||
|
|
"target_ref": "x-misp-object--dc0ed1b0-554c-41b1-98bb-de6a6bd8363c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--1abbd61b-0d8a-4671-9cc9-877d2f15df61",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
||
|
|
"target_ref": "x-misp-object--7d20a574-f708-4c7b-83a2-4b1e863e5034"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--44cbc1dc-4fa5-4148-a42c-86e691e8ca97",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a0b9d704-d79c-4b2b-b6f5-7034e190cb83",
|
||
|
|
"target_ref": "x-misp-object--29ee112d-4c89-43d2-8ba2-eaceb48e47ea"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--5eca2629-abe0-4124-95e4-10f7768c50cd",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "indicator--2778da7e-f6a6-4dfa-8675-3b0214ba6312",
|
||
|
|
"target_ref": "x-misp-object--a0b9d704-d79c-4b2b-b6f5-7034e190cb83"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--aa02617a-3cec-4865-b522-b36ac3cf0da7",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "analysed-with",
|
||
|
|
"source_ref": "indicator--2778da7e-f6a6-4dfa-8675-3b0214ba6312",
|
||
|
|
"target_ref": "x-misp-object--a2ea1f52-91be-4888-86e0-af75ed6a01b9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--4b5a986c-d5f1-42f4-b7f6-344f6036644a",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "analysed-with",
|
||
|
|
"source_ref": "indicator--2778da7e-f6a6-4dfa-8675-3b0214ba6312",
|
||
|
|
"target_ref": "x-misp-object--db87582d-4bc5-44e8-bb5c-692c0a1675b3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--152df8b2-5a37-4376-88f9-42cd9b3d3999",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
||
|
|
"target_ref": "x-misp-object--11a24eda-644d-4f56-b930-c983aac96f18"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--f89a215d-1704-4c56-a56b-047a4e0cda5c",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
||
|
|
"target_ref": "x-misp-object--bff723ef-9525-4a8d-bbcb-753601d37d1f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--5f4b4584-5f46-480a-96cb-64a468208fd5",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
||
|
|
"target_ref": "x-misp-object--a49c56e4-b1e1-4a90-afc5-94f7685081b4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--167767df-b2f4-4dff-86c6-368b1a0b78c8",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
||
|
|
"target_ref": "x-misp-object--b0776b62-9478-444b-9c3c-c2a23fb56166"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--8f969f24-fece-434b-bbcd-ff242142e195",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
||
|
|
"target_ref": "x-misp-object--ecbfe0e5-1dc5-4622-8b31-9936022825a8"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--07a30b59-0931-40d6-add9-554fe0016656",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
||
|
|
"target_ref": "x-misp-object--88733aec-0db4-4ead-919d-7dcfe9a62add"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--6c4cc1c5-7a3e-4142-8610-dce2e8e0d010",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
||
|
|
"target_ref": "x-misp-object--d0db047a-afca-43c5-bd64-7dffd0f35bb1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--953e3dfa-5f22-4010-906c-4f6c4fdb7524",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
||
|
|
"target_ref": "x-misp-object--69f51d30-c609-4518-9971-33891e74a22b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--2ac59e52-09d9-4b11-a9ee-bbd345ae9c7d",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
||
|
|
"target_ref": "x-misp-object--928e4d64-d370-4ab3-ad61-288a74833311"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--c536b331-53ba-43b3-b9fc-04b1cba8e766",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
||
|
|
"target_ref": "x-misp-object--0ff49c85-00fb-4092-99b7-c6e1b843f89f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--e078d76c-2dd7-45aa-bcc7-b8e33a9de40b",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
||
|
|
"target_ref": "x-misp-object--7343fd4a-fcd7-4dd8-959b-7e502301d511"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--67187b08-9473-4d8b-9e45-91ab634f8cfb",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
||
|
|
"target_ref": "x-misp-object--055a24f0-2875-45f3-a7ed-4a44945d23d2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--f7538637-a797-4c7e-a174-5bcb45bba1de",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
||
|
|
"target_ref": "x-misp-object--4788fcc5-b819-409f-a970-8e3fef7d57f1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--626224cc-8eed-4508-b19e-c902cfccee1f",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
||
|
|
"target_ref": "x-misp-object--e13cf509-faaa-4fa2-8905-57403bcd10b0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--76ace74a-617b-4f0e-ba72-e1badc12f2b4",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
||
|
|
"target_ref": "x-misp-object--fa037f31-83f9-48a6-a6b6-d705198c4000"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--5a9ac5c0-5f3a-47da-84a7-bbede05aeea5",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
||
|
|
"target_ref": "x-misp-object--c4856c35-6cb0-42bf-a9f3-d3ce5619e33c"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--4fe4fcf5-ca6b-4fbf-aa93-198c7ad451ac",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
||
|
|
"target_ref": "x-misp-object--ef892eee-4947-4c5c-b2dc-02c4e857d362"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--01d54be7-b26b-448f-8940-8f993c4f91a2",
|
||
|
|
"created": "2021-05-26T14:01:04.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:04.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
||
|
|
"target_ref": "x-misp-object--07ea2ef7-9551-4312-9f4d-c35eb8644384"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--60080cdf-7c77-4459-8763-0f91ef2b25fe",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
||
|
|
"target_ref": "x-misp-object--3655f618-c369-48cd-ac03-09c998b3d4df"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--a004ab06-4857-469f-9d85-c25247667c30",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--571c5fc2-fa75-4ecf-8936-0fb1042d27d4",
|
||
|
|
"target_ref": "x-misp-object--3028e64b-ce69-4bb7-9130-bf908c6d8a71"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--33506e18-4ff6-47d8-bac6-3cfd78f4b6e8",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "indicator--145938cf-4945-41a3-9bf2-5faacbf1f366",
|
||
|
|
"target_ref": "x-misp-object--571c5fc2-fa75-4ecf-8936-0fb1042d27d4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--49c9f32f-ba05-42ad-8595-c6fb8a45d7bd",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a9353096-af17-4e62-b066-40c4b6b32588",
|
||
|
|
"target_ref": "x-misp-object--e35ab664-d370-4925-a464-f43cc09ca4ad"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--2b844f27-d9a1-4d73-b1ae-b8805ebf4234",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a9353096-af17-4e62-b066-40c4b6b32588",
|
||
|
|
"target_ref": "x-misp-object--140ed95e-052e-402d-abe2-4216654b44e0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--eefe1ff2-cf77-447d-8ef4-c3dfbe0604e5",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a9353096-af17-4e62-b066-40c4b6b32588",
|
||
|
|
"target_ref": "x-misp-object--6cc47bbf-9bdd-4a5f-bf98-5cc516bbf0cb"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--ecdd67fb-a5a2-40da-a12c-f12aa4fd780c",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a9353096-af17-4e62-b066-40c4b6b32588",
|
||
|
|
"target_ref": "x-misp-object--69ed74d7-a7b4-4a25-8067-14b425cdfb18"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--bed21be0-a0a4-42cf-80ad-914b45bd587d",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a9353096-af17-4e62-b066-40c4b6b32588",
|
||
|
|
"target_ref": "x-misp-object--7bd7974f-8307-46b8-b3c4-e4eb88ccd02d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--a9030ed8-4b18-4336-a9d4-cbab5a5771b3",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a9353096-af17-4e62-b066-40c4b6b32588",
|
||
|
|
"target_ref": "x-misp-object--baa88f1e-d75e-4a25-83ad-70258c54cc5b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--4cba7e7b-5868-4753-afd5-34eb4d9699c4",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a9353096-af17-4e62-b066-40c4b6b32588",
|
||
|
|
"target_ref": "x-misp-object--77aa1ec5-ea18-40f8-823e-a7595a9fe702"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--3f074284-cef7-4001-94bd-056f39eb8f31",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a9353096-af17-4e62-b066-40c4b6b32588",
|
||
|
|
"target_ref": "x-misp-object--310046fc-01e4-41d2-86a5-f515ca712b2a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--99360380-b593-4752-8c79-1ec628795430",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a9353096-af17-4e62-b066-40c4b6b32588",
|
||
|
|
"target_ref": "x-misp-object--37c15adf-ea19-4531-8ab2-7adb7442b7e3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--b12ef13f-9da7-4e21-875d-d18073df0772",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a9353096-af17-4e62-b066-40c4b6b32588",
|
||
|
|
"target_ref": "x-misp-object--47a5cfb3-b3d8-4372-b682-a0192c36d11a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--5e6dbca9-0121-41c2-b6a7-64849972e9a9",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a9353096-af17-4e62-b066-40c4b6b32588",
|
||
|
|
"target_ref": "x-misp-object--5a72317a-eb57-4df5-affc-4f4db6de49de"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--b917e5ac-792b-48c0-8f81-c8e4a706a2ae",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a9353096-af17-4e62-b066-40c4b6b32588",
|
||
|
|
"target_ref": "x-misp-object--91040cf2-0fa6-47d0-9b25-3d469c7da8d1"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--cff2cad9-3a1d-4394-871a-1054461a1ebf",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a9353096-af17-4e62-b066-40c4b6b32588",
|
||
|
|
"target_ref": "x-misp-object--3fd5d40e-c67b-46b5-a180-910ff2014aa3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--c3232a2e-8c85-4d9e-a993-bfa0eb8709d4",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a9353096-af17-4e62-b066-40c4b6b32588",
|
||
|
|
"target_ref": "x-misp-object--1b8bf0c9-da8e-4ebc-8fcf-12f148cb8aa7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--d88b27d7-9e3c-48ff-b333-7e7fdbc81a5c",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a9353096-af17-4e62-b066-40c4b6b32588",
|
||
|
|
"target_ref": "x-misp-object--3bcb4d1a-66ee-48db-962f-a49a365cca79"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--8fed14ed-ec75-4f96-b7fc-4f33a26b2642",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a9353096-af17-4e62-b066-40c4b6b32588",
|
||
|
|
"target_ref": "x-misp-object--9c4329e8-ac6c-4b40-8b90-93c97d47ca19"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--3cf6fba9-2b32-455a-9db0-d8d4b8a325af",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a9353096-af17-4e62-b066-40c4b6b32588",
|
||
|
|
"target_ref": "x-misp-object--48c25567-9566-46ab-bd81-b76a29f55869"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--0e87d71c-2a03-406c-8c50-f7932c2887b6",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a9353096-af17-4e62-b066-40c4b6b32588",
|
||
|
|
"target_ref": "x-misp-object--5e67bb4a-3c5b-4fd9-bda9-52e99ec1a9ec"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--11a3f5fe-250f-4556-bbc0-0a111158225a",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a9353096-af17-4e62-b066-40c4b6b32588",
|
||
|
|
"target_ref": "x-misp-object--4c8a51c8-1527-4aee-a2f5-b1107db7deab"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--d105fa6d-b9b0-4c38-83d7-433170abb483",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a9353096-af17-4e62-b066-40c4b6b32588",
|
||
|
|
"target_ref": "x-misp-object--3cc45be1-3a29-4489-a74a-e3ac6595c32f"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--faede6e5-7c53-4e10-970d-4c65d54399cd",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a9353096-af17-4e62-b066-40c4b6b32588",
|
||
|
|
"target_ref": "x-misp-object--86fa725a-e9cd-4388-9582-e6dfca955dc9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--19b30927-c045-4152-a9e6-93428c520703",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a9353096-af17-4e62-b066-40c4b6b32588",
|
||
|
|
"target_ref": "x-misp-object--307d5d46-5ba4-47af-89a5-baa05c4a9ef0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--b4e125c5-a6bd-44b0-8b64-7f1850e0b3fd",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a9353096-af17-4e62-b066-40c4b6b32588",
|
||
|
|
"target_ref": "x-misp-object--a57e5e78-b889-4b58-b687-ccf0c7fffcfa"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--d50d81f9-1fd4-476e-aaf8-0e5739c38f5d",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "x-misp-object--a9353096-af17-4e62-b066-40c4b6b32588",
|
||
|
|
"target_ref": "x-misp-object--f4ddf335-7cbb-4c16-9ccf-449c0398225e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--53db6dea-cb5a-4b11-92f6-04434fef850a",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "included-in",
|
||
|
|
"source_ref": "indicator--dd31ea85-5cbb-453f-85b0-296d5ca4daad",
|
||
|
|
"target_ref": "x-misp-object--a9353096-af17-4e62-b066-40c4b6b32588"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--df9c80b7-6226-490f-9f03-e7eaac4466ef",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "analysed-with",
|
||
|
|
"source_ref": "indicator--dd31ea85-5cbb-453f-85b0-296d5ca4daad",
|
||
|
|
"target_ref": "x-misp-object--01bb1781-57df-43f0-ae31-30611e59f11a"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--e98ea4c6-8da7-42b4-9c11-54b8c432b49d",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "analysed-with",
|
||
|
|
"source_ref": "indicator--dd31ea85-5cbb-453f-85b0-296d5ca4daad",
|
||
|
|
"target_ref": "x-misp-object--d782cd47-8d2f-44cc-b5ff-5179f2f1f2ba"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--d19a658f-f152-483c-ab69-8f22676103af",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "analysed-with",
|
||
|
|
"source_ref": "indicator--5c6fbdde-e650-4d41-89b0-4376950d210f",
|
||
|
|
"target_ref": "x-misp-object--c445863d-249f-4f4f-8a2b-f334a57cd879"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--b80d4749-cd62-439d-b01e-6503cbc29adb",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "analysed-with",
|
||
|
|
"source_ref": "indicator--5c6fbddf-482c-423f-8d8e-4a05950d210f",
|
||
|
|
"target_ref": "x-misp-object--8560e314-a454-4bcd-a2d6-3f2f948f85f0"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--1bccc6bd-0c7f-40fe-a042-43448447d09c",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "analysed-with",
|
||
|
|
"source_ref": "indicator--5c6fbde0-8268-4747-b0f1-49b4950d210f",
|
||
|
|
"target_ref": "x-misp-object--ca5fadde-6d66-4478-9f89-15aee8ae3781"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--9d168969-0a13-4896-9f33-6ad2cbabbe75",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "analysed-with",
|
||
|
|
"source_ref": "indicator--5c6fbde1-de30-43f8-8bcc-424c950d210f",
|
||
|
|
"target_ref": "x-misp-object--46a3f6a3-d2fd-4d95-91f2-63c200bcc518"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--fed96d62-fed1-4f34-ab2c-a9413c7a8cd1",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "analysed-with",
|
||
|
|
"source_ref": "indicator--5c6fbde3-d9a0-4009-8a03-41d2950d210f",
|
||
|
|
"target_ref": "x-misp-object--2e5a1e33-ce78-48cf-bbf5-67cde8b81971"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--b90792a9-6897-40b2-8bb3-2e3829488c8b",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "analysed-with",
|
||
|
|
"source_ref": "indicator--5c6fbde4-300c-464a-a542-4548950d210f",
|
||
|
|
"target_ref": "x-misp-object--65a677a3-16ab-4e76-aed3-ecba7abc12f2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--78655f6d-8599-46d3-ba0e-11f683e5eea2",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "analysed-with",
|
||
|
|
"source_ref": "indicator--5c6fbde5-e8bc-450c-ac02-4a4c950d210f",
|
||
|
|
"target_ref": "x-misp-object--404871eb-92bf-4226-aef3-e35dd843f916"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--749a0063-73f4-4f7c-a903-9aaed7b94378",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "analysed-with",
|
||
|
|
"source_ref": "indicator--5c6fbde5-dc84-4660-af29-4a3a950d210f",
|
||
|
|
"target_ref": "x-misp-object--a6780ee2-559e-4d53-b571-df123fa7ade4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--75cbe419-3402-463d-8b66-a3e192686d7a",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "analysed-with",
|
||
|
|
"source_ref": "indicator--5c6fbde6-3cd4-46aa-bbbd-4a8f950d210f",
|
||
|
|
"target_ref": "x-misp-object--684aaa66-2785-44f6-93f2-08fe5ef56710"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--ae6e5891-0bb4-4ec8-988f-7c20ed924469",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "analysed-with",
|
||
|
|
"source_ref": "indicator--5c6fbde7-a888-4f78-ab3b-43a7950d210f",
|
||
|
|
"target_ref": "x-misp-object--90a03b89-315c-4f76-baf5-270b8f50dcba"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "relationship",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "relationship--6b3487fb-6ca7-45a8-b8cc-8abd8c2581eb",
|
||
|
|
"created": "2021-05-26T14:01:05.000Z",
|
||
|
|
"modified": "2021-05-26T14:01:05.000Z",
|
||
|
|
"relationship_type": "analysed-with",
|
||
|
|
"source_ref": "indicator--5c6fbde8-f124-4ab0-9316-4235950d210f",
|
||
|
|
"target_ref": "x-misp-object--1c0c430d-30df-41e1-9e1a-1e291bf92014"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|