2023-04-21 13:25:09 +00:00
|
|
|
{
|
2023-06-14 17:31:25 +00:00
|
|
|
"type": "bundle",
|
|
|
|
|
"id": "bundle--56313b33-93f0-426f-99ea-26bc950d210b",
|
|
|
|
|
"objects": [
|
|
|
|
|
{
|
|
|
|
|
"type": "identity",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:04:01.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:04:01.000Z",
|
|
|
|
|
"name": "CthulhuSPRL.be",
|
|
|
|
|
"identity_class": "organization"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "report",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "report--56313b33-93f0-426f-99ea-26bc950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:04:01.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:04:01.000Z",
|
|
|
|
|
"name": "OSINT Trojan.Win32.Banker.NWT by AlienVault and Telus",
|
|
|
|
|
"published": "2015-10-29T07:04:37Z",
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"observed-data--56313b48-d5d0-469b-bbc7-48fd950d210b",
|
|
|
|
|
"url--56313b48-d5d0-469b-bbc7-48fd950d210b",
|
|
|
|
|
"observed-data--56313b49-a9f8-47d5-9bac-4b6e950d210b",
|
|
|
|
|
"url--56313b49-a9f8-47d5-9bac-4b6e950d210b",
|
|
|
|
|
"indicator--56313b93-50cc-44f6-a324-4edb950d210b",
|
|
|
|
|
"indicator--56313b94-b2fc-4a9f-bc57-4978950d210b",
|
|
|
|
|
"indicator--56313b94-1010-444b-b3af-48a3950d210b",
|
|
|
|
|
"indicator--56313b95-797c-4d51-acdd-4a6d950d210b",
|
|
|
|
|
"indicator--56313b95-f73c-4d3b-914c-44a0950d210b",
|
|
|
|
|
"indicator--56313b96-430c-44bd-950d-48d4950d210b",
|
|
|
|
|
"indicator--56313b96-bc54-4472-83e5-42c9950d210b",
|
|
|
|
|
"indicator--56313b97-5d88-453d-8eb1-4b7f950d210b",
|
|
|
|
|
"indicator--56313b97-31a0-48a3-8626-49e9950d210b",
|
|
|
|
|
"indicator--56313b98-a5a4-450e-ae76-4b5d950d210b",
|
|
|
|
|
"indicator--56313b98-4d24-4cb5-984c-4ca6950d210b",
|
|
|
|
|
"indicator--56313b98-4240-4ffb-9a26-4391950d210b",
|
|
|
|
|
"indicator--56313b99-4da8-450b-8344-44f5950d210b",
|
|
|
|
|
"indicator--56313b99-fc88-4f31-b6ef-4907950d210b",
|
|
|
|
|
"indicator--56313b9a-e724-47e0-a31b-47db950d210b",
|
|
|
|
|
"indicator--56313b9a-215c-4282-a653-44c4950d210b",
|
|
|
|
|
"indicator--56313b9b-c914-4b06-ab0c-47dd950d210b",
|
|
|
|
|
"indicator--56313b9b-b88c-4518-9346-41b3950d210b",
|
|
|
|
|
"indicator--56313b9c-1d10-4535-b1ab-48a9950d210b",
|
|
|
|
|
"indicator--56313b9c-3b24-45f5-b563-4e31950d210b",
|
|
|
|
|
"indicator--56313b9c-5650-4deb-8092-444d950d210b",
|
|
|
|
|
"indicator--56313b9d-8818-499c-b4ad-4a2f950d210b",
|
|
|
|
|
"indicator--56313b9d-4210-4569-b576-4bfa950d210b",
|
|
|
|
|
"indicator--56313b9e-ff88-4acf-9d9a-4443950d210b",
|
|
|
|
|
"indicator--56313b9e-6c80-41fc-a20d-4618950d210b",
|
|
|
|
|
"indicator--56313b9e-4ba4-4579-b9ca-46f2950d210b",
|
|
|
|
|
"indicator--56313b9f-c884-4ef0-82a2-47c8950d210b",
|
|
|
|
|
"indicator--56313b9f-f7fc-47f0-a233-4979950d210b",
|
|
|
|
|
"indicator--56313ba0-b0dc-4fa6-a243-4e54950d210b",
|
|
|
|
|
"indicator--56313ba0-3b14-4cfe-b863-4a16950d210b",
|
|
|
|
|
"indicator--56313ba0-23ec-4293-85a3-4234950d210b",
|
|
|
|
|
"indicator--56313ba1-1e40-4ff2-b54c-45a4950d210b",
|
|
|
|
|
"indicator--56313ba1-70c8-4717-8419-4b88950d210b",
|
|
|
|
|
"indicator--56313ba2-baa8-47df-a73d-4240950d210b",
|
|
|
|
|
"indicator--56313ba2-049c-4616-a9e1-40a4950d210b",
|
|
|
|
|
"indicator--56313ba2-0bec-4a82-aadb-40ae950d210b",
|
|
|
|
|
"indicator--56313ba3-facc-4f97-a779-4b9e950d210b",
|
|
|
|
|
"indicator--56313ba3-e0e0-466c-a357-4a5a950d210b",
|
|
|
|
|
"indicator--56313ba4-347c-4b98-9441-44d2950d210b",
|
|
|
|
|
"indicator--56313ba4-84fc-4f44-84cd-44d2950d210b",
|
|
|
|
|
"indicator--56313ba4-1bd4-4053-89c3-4a64950d210b",
|
|
|
|
|
"indicator--56313ba5-5ea8-4150-aa1c-4974950d210b",
|
|
|
|
|
"indicator--56313ba5-f6fc-477c-af5d-4e2a950d210b",
|
|
|
|
|
"indicator--56313ba5-92d4-4150-9771-4bf7950d210b",
|
|
|
|
|
"indicator--5631c484-e604-4dfe-8533-4c77950d210b",
|
|
|
|
|
"indicator--5631c485-f724-4db9-8667-46af950d210b",
|
|
|
|
|
"observed-data--5631c485-79e8-4497-ac1a-4a9d950d210b",
|
|
|
|
|
"url--5631c485-79e8-4497-ac1a-4a9d950d210b",
|
|
|
|
|
"indicator--5631c486-fb74-47f6-b113-4211950d210b",
|
|
|
|
|
"indicator--5631c486-5dd4-4c73-aefb-4ced950d210b",
|
|
|
|
|
"observed-data--5631c486-4b4c-48b5-8d84-461d950d210b",
|
|
|
|
|
"url--5631c486-4b4c-48b5-8d84-461d950d210b",
|
|
|
|
|
"indicator--5631c487-3ae0-4bfc-802c-4c61950d210b",
|
|
|
|
|
"indicator--5631c487-d104-4b8c-bc13-429d950d210b",
|
|
|
|
|
"observed-data--5631c488-8fc0-4375-a13e-425d950d210b",
|
|
|
|
|
"url--5631c488-8fc0-4375-a13e-425d950d210b",
|
|
|
|
|
"indicator--5631c488-7f1c-4304-9c75-4295950d210b",
|
|
|
|
|
"indicator--5631c488-2950-4f8b-a978-483e950d210b",
|
|
|
|
|
"observed-data--5631c489-65b8-4920-83b9-475a950d210b",
|
|
|
|
|
"url--5631c489-65b8-4920-83b9-475a950d210b",
|
|
|
|
|
"indicator--5631c489-0dec-4e50-917c-4dd7950d210b",
|
|
|
|
|
"indicator--5631c48a-486c-42af-a70b-412f950d210b",
|
|
|
|
|
"observed-data--5631c48a-9ff0-404f-b016-4a8f950d210b",
|
|
|
|
|
"url--5631c48a-9ff0-404f-b016-4a8f950d210b",
|
|
|
|
|
"indicator--5631c48a-5db8-4cd4-9caf-4c9b950d210b",
|
|
|
|
|
"indicator--5631c48b-e208-4fe1-89fe-452d950d210b",
|
|
|
|
|
"observed-data--5631c48b-11e4-4ba7-b4cd-4183950d210b",
|
|
|
|
|
"url--5631c48b-11e4-4ba7-b4cd-4183950d210b",
|
|
|
|
|
"indicator--5631c48c-e518-4083-8960-4160950d210b",
|
|
|
|
|
"indicator--5631c48c-9d2c-4063-912e-47f7950d210b",
|
|
|
|
|
"observed-data--5631c48c-9554-4f3b-b56e-4f61950d210b",
|
|
|
|
|
"url--5631c48c-9554-4f3b-b56e-4f61950d210b",
|
|
|
|
|
"indicator--5631c48d-d948-4bdf-8f26-4e48950d210b",
|
|
|
|
|
"indicator--5631c48d-c38c-4a00-92d2-4962950d210b",
|
|
|
|
|
"observed-data--5631c48e-d4dc-4afd-be57-449f950d210b",
|
|
|
|
|
"url--5631c48e-d4dc-4afd-be57-449f950d210b",
|
|
|
|
|
"indicator--5631c48e-787c-457e-9df3-4ee8950d210b",
|
|
|
|
|
"indicator--5631c48e-8d84-42e9-a3a8-4952950d210b",
|
|
|
|
|
"observed-data--5631c48f-4344-43f2-8931-4988950d210b",
|
|
|
|
|
"url--5631c48f-4344-43f2-8931-4988950d210b",
|
|
|
|
|
"indicator--5631c48f-64f0-4fa3-8dbc-410e950d210b",
|
|
|
|
|
"indicator--5631c490-5c38-4c6b-a08c-4686950d210b",
|
|
|
|
|
"observed-data--5631c490-ae5c-40ff-a712-408b950d210b",
|
|
|
|
|
"url--5631c490-ae5c-40ff-a712-408b950d210b",
|
|
|
|
|
"indicator--5631c490-60d8-41b9-a2f5-45ca950d210b",
|
|
|
|
|
"indicator--5631c491-c778-410b-bc32-418e950d210b",
|
|
|
|
|
"observed-data--5631c491-bd9c-4ff4-9a1f-4dc8950d210b",
|
|
|
|
|
"url--5631c491-bd9c-4ff4-9a1f-4dc8950d210b",
|
|
|
|
|
"indicator--5631c492-e63c-4fc4-a6fe-481d950d210b",
|
|
|
|
|
"indicator--5631c492-d810-40c8-b7c4-442b950d210b",
|
|
|
|
|
"observed-data--5631c492-a3f4-4974-9d7f-4ea7950d210b",
|
|
|
|
|
"url--5631c492-a3f4-4974-9d7f-4ea7950d210b",
|
|
|
|
|
"indicator--5631c493-1dbc-42d4-ae64-4bed950d210b",
|
|
|
|
|
"indicator--5631c493-cfe8-4598-87ea-48fe950d210b",
|
|
|
|
|
"observed-data--5631c494-83b4-4a11-9865-428a950d210b",
|
|
|
|
|
"url--5631c494-83b4-4a11-9865-428a950d210b",
|
|
|
|
|
"indicator--5631c494-5ad4-44f6-be22-44ac950d210b",
|
|
|
|
|
"indicator--5631c494-3c20-473f-9285-4f5e950d210b",
|
|
|
|
|
"observed-data--5631c495-8a00-474f-9437-4fc6950d210b",
|
|
|
|
|
"url--5631c495-8a00-474f-9437-4fc6950d210b",
|
|
|
|
|
"indicator--5631c495-4934-42d6-8269-4a0a950d210b",
|
|
|
|
|
"indicator--5631c496-805c-4fd6-b1a1-4bc4950d210b",
|
|
|
|
|
"observed-data--5631c496-67cc-4e94-89c8-42a4950d210b",
|
|
|
|
|
"url--5631c496-67cc-4e94-89c8-42a4950d210b",
|
|
|
|
|
"indicator--5631c496-eb14-412b-8a3a-43fd950d210b",
|
|
|
|
|
"indicator--5631c497-c1d4-4ee8-b77c-45bd950d210b",
|
|
|
|
|
"observed-data--5631c497-6ec0-4716-9bf7-4d2b950d210b",
|
|
|
|
|
"url--5631c497-6ec0-4716-9bf7-4d2b950d210b",
|
|
|
|
|
"indicator--5631c498-0468-4c21-bf8a-4537950d210b",
|
|
|
|
|
"indicator--5631c498-94f0-471f-85f5-4183950d210b",
|
|
|
|
|
"observed-data--5631c498-0b14-48fe-a875-43f1950d210b",
|
|
|
|
|
"url--5631c498-0b14-48fe-a875-43f1950d210b",
|
|
|
|
|
"indicator--5631c499-5350-4d89-9b4c-428f950d210b",
|
|
|
|
|
"indicator--5631c499-5a90-4724-ab8e-4a97950d210b",
|
|
|
|
|
"observed-data--5631c49a-1ff0-48fb-9c80-4544950d210b",
|
|
|
|
|
"url--5631c49a-1ff0-48fb-9c80-4544950d210b",
|
|
|
|
|
"indicator--5631c49a-653c-4b92-a0d5-4d17950d210b",
|
|
|
|
|
"indicator--5631c49a-6740-44bf-8935-4f8e950d210b",
|
|
|
|
|
"observed-data--5631c49b-3444-4fb8-9a54-400e950d210b",
|
|
|
|
|
"url--5631c49b-3444-4fb8-9a54-400e950d210b",
|
|
|
|
|
"indicator--5631c49b-7b20-482f-8778-43f0950d210b",
|
|
|
|
|
"indicator--5631c49c-3238-416c-8bfb-4874950d210b",
|
|
|
|
|
"observed-data--5631c49c-7e5c-4057-89aa-4b83950d210b",
|
|
|
|
|
"url--5631c49c-7e5c-4057-89aa-4b83950d210b",
|
|
|
|
|
"indicator--5631c49c-f97c-41e4-a8c9-41ea950d210b",
|
|
|
|
|
"indicator--5631c49d-a59c-444e-b506-4749950d210b",
|
|
|
|
|
"observed-data--5631c49d-892c-456f-8cea-424e950d210b",
|
|
|
|
|
"url--5631c49d-892c-456f-8cea-424e950d210b",
|
|
|
|
|
"indicator--5631c49e-3a30-4cca-ba23-4fbf950d210b",
|
|
|
|
|
"indicator--5631c49e-5c00-4021-8ff2-410a950d210b",
|
|
|
|
|
"observed-data--5631c49e-0814-4ca2-9df8-49a6950d210b",
|
|
|
|
|
"url--5631c49e-0814-4ca2-9df8-49a6950d210b",
|
|
|
|
|
"indicator--5631c49f-cf3c-45f4-9143-4aba950d210b",
|
|
|
|
|
"indicator--5631c49f-b260-410a-8795-4e70950d210b",
|
|
|
|
|
"observed-data--5631c4a0-4ab0-485d-8ffa-47f8950d210b",
|
|
|
|
|
"url--5631c4a0-4ab0-485d-8ffa-47f8950d210b",
|
|
|
|
|
"indicator--5631c4a0-70fc-492d-934c-4e59950d210b",
|
|
|
|
|
"indicator--5631c4a0-6c24-47e1-971c-4710950d210b",
|
|
|
|
|
"observed-data--5631c4a1-ce48-4eb7-8cf5-4936950d210b",
|
|
|
|
|
"url--5631c4a1-ce48-4eb7-8cf5-4936950d210b",
|
|
|
|
|
"indicator--5631c4a1-2c0c-4afd-8d96-436b950d210b",
|
|
|
|
|
"indicator--5631c4a2-4140-4bcf-a0f5-4d30950d210b",
|
|
|
|
|
"observed-data--5631c4a2-a478-4e4f-b61e-4f6d950d210b",
|
|
|
|
|
"url--5631c4a2-a478-4e4f-b61e-4f6d950d210b",
|
|
|
|
|
"indicator--5631c4a2-9300-4867-9e73-4993950d210b",
|
|
|
|
|
"indicator--5631c4a3-10e4-41ae-bf6b-4e14950d210b",
|
|
|
|
|
"observed-data--5631c4a3-87bc-421d-96b6-451a950d210b",
|
|
|
|
|
"url--5631c4a3-87bc-421d-96b6-451a950d210b",
|
|
|
|
|
"indicator--5631c4a4-0e98-4791-b9fd-47f1950d210b",
|
|
|
|
|
"indicator--5631c4a4-2e20-4b44-bd64-43cc950d210b",
|
|
|
|
|
"observed-data--5631c4a4-1788-4fec-9fcd-4a93950d210b",
|
|
|
|
|
"url--5631c4a4-1788-4fec-9fcd-4a93950d210b",
|
|
|
|
|
"indicator--5631c4a5-48f0-46d9-a7fc-45d8950d210b",
|
|
|
|
|
"indicator--5631c4a5-81a0-450a-beaf-4970950d210b",
|
|
|
|
|
"observed-data--5631c4a5-ac90-4065-a814-407e950d210b",
|
|
|
|
|
"url--5631c4a5-ac90-4065-a814-407e950d210b",
|
|
|
|
|
"indicator--5631c4a6-09c4-4254-8922-482b950d210b",
|
|
|
|
|
"indicator--5631c4a6-22a4-4ef7-b77c-4c66950d210b",
|
|
|
|
|
"observed-data--5631c4a7-9040-47dc-8e60-447c950d210b",
|
|
|
|
|
"url--5631c4a7-9040-47dc-8e60-447c950d210b",
|
|
|
|
|
"indicator--5631c4a7-de4c-4ebb-87a3-4087950d210b",
|
|
|
|
|
"indicator--5631c4a7-8878-490a-8961-41b9950d210b",
|
|
|
|
|
"observed-data--5631c4a8-2c88-4aa2-8c3d-4eba950d210b",
|
|
|
|
|
"url--5631c4a8-2c88-4aa2-8c3d-4eba950d210b",
|
|
|
|
|
"indicator--5631c4a8-daec-4bb7-bc65-47ee950d210b",
|
|
|
|
|
"indicator--5631c4a9-0bf0-4d1b-b25b-4218950d210b",
|
|
|
|
|
"observed-data--5631c4a9-8580-42f4-a2f7-454c950d210b",
|
|
|
|
|
"url--5631c4a9-8580-42f4-a2f7-454c950d210b",
|
|
|
|
|
"indicator--5631c4a9-3848-468b-9fe0-47b2950d210b",
|
|
|
|
|
"indicator--5631c4aa-56cc-44e1-8bf3-4fda950d210b",
|
|
|
|
|
"observed-data--5631c4aa-d1e8-471c-a6d6-479f950d210b",
|
|
|
|
|
"url--5631c4aa-d1e8-471c-a6d6-479f950d210b",
|
|
|
|
|
"indicator--5631c4ab-8950-4c4e-a11f-4baf950d210b",
|
|
|
|
|
"indicator--5631c4ab-aab0-4fa0-b77a-4e45950d210b",
|
|
|
|
|
"observed-data--5631c4ab-1c78-4641-9fa0-4dc8950d210b",
|
|
|
|
|
"url--5631c4ab-1c78-4641-9fa0-4dc8950d210b",
|
|
|
|
|
"indicator--5631c4ac-543c-4d1b-9419-49f4950d210b",
|
|
|
|
|
"indicator--5631c4ac-756c-4619-9bca-46fa950d210b",
|
|
|
|
|
"observed-data--5631c4ad-7c18-4b4a-b3d0-4bfe950d210b",
|
|
|
|
|
"url--5631c4ad-7c18-4b4a-b3d0-4bfe950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"Threat-Report",
|
|
|
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
|
|
|
"type:OSINT"
|
|
|
|
|
],
|
|
|
|
|
"object_marking_refs": [
|
|
|
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56313b48-d5d0-469b-bbc7-48fd950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:16:56.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:16:56.000Z",
|
|
|
|
|
"first_observed": "2015-10-28T21:16:56Z",
|
|
|
|
|
"last_observed": "2015-10-28T21:16:56Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56313b48-d5d0-469b-bbc7-48fd950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56313b48-d5d0-469b-bbc7-48fd950d210b",
|
|
|
|
|
"value": "https://otx.alienvault.com/pulse/5626932167db8c47d3ce1b96/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--56313b49-a9f8-47d5-9bac-4b6e950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:16:57.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:16:57.000Z",
|
|
|
|
|
"first_observed": "2015-10-28T21:16:57Z",
|
|
|
|
|
"last_observed": "2015-10-28T21:16:57Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--56313b49-a9f8-47d5-9bac-4b6e950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--56313b49-a9f8-47d5-9bac-4b6e950d210b",
|
|
|
|
|
"value": "http://telussecuritylabs.com/threats/show/TSL20151008-01"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313b93-50cc-44f6-a324-4edb950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:11.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:11.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '4fcb03122dbc79b96abd304f0c8f61887672ad64b8fab4f4077387ef3ba455e6']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:11Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313b94-b2fc-4a9f-bc57-4978950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:12.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:12.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'f53b2ff9660027fc7692819ce80f8fa0b49766af44d2e5a5aa3fd3cf89b9b979']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:12Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313b94-1010-444b-b3af-48a3950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:12.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:12.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'a1b3ada62cb45f8ba3b175b7bbaadad7e76afcc4fa73df8cfd3ea4028484a689']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:12Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313b95-797c-4d51-acdd-4a6d950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:13.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:13.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '99de7d83d1b293d15f170cf9d7cd30c04c5d91393cdacb5fc34e1595c9301b26']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:13Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313b95-f73c-4d3b-914c-44a0950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:13.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:13.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '8b9a06d4505da9ac8f7707114518ee87117cc77ae31157196564323f780f0f4c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:13Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313b96-430c-44bd-950d-48d4950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:14.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:14.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'add1fff630b8f7f915938dcf70248bf0c93b6caa2dd275c4ac38c639cec996f7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313b96-bc54-4472-83e5-42c9950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:14.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:14.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '5b2dc39fbd2c6afe14232d562f59337da779eb855e0e707947349871769ecd90']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313b97-5d88-453d-8eb1-4b7f950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:15.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:15.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'a3ec8c9763eb8a5f87df7ba6977f7c8d3e3548b4afda6e9f1ed4eb316554add0']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:15Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313b97-31a0-48a3-8626-49e9950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:15.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:15.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '40a6a0beb1d1a21fa795fc1234c9d512c3bd40b432fec14080294433a87d4c7f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:15Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313b98-a5a4-450e-ae76-4b5d950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:16.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:16.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'cd8c9ccfa748cb9dba66425cbba2c331b124209bf758ce927e8423ee20f2f2b8']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:16Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313b98-4d24-4cb5-984c-4ca6950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:16.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:16.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '5bab39d4073a28084e359cedd563c2881948311e4f204b9252b81239f6798ecd']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:16Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313b98-4240-4ffb-9a26-4391950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:16.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:16.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '1be2ef22767d278fda7897bd6a1c7d21a082c50ec0ed35b1a1dff9bb5cf8bb6a']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:16Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313b99-4da8-450b-8344-44f5950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:17.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:17.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'fa1940d18e3e16ccf8d69021e46612c6ea3f020ee8a9c726641725571f17f9f5']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:17Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313b99-fc88-4f31-b6ef-4907950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:17.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:17.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '8b8e04ffd351486f02619a20d3211199747bf4468dfcbd4c18e02bb40ef55545']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:17Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313b9a-e724-47e0-a31b-47db950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:18.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:18.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'b1120c56e5a46f64dfc46bb7600cb929fef7dd84d9c21b09e18b35b425901513']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:18Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313b9a-215c-4282-a653-44c4950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:18.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:18.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '6bbb1b0af6762dde688253ff2aaf68f17bf22a5bb15e430ab9139396370a58d3']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:18Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313b9b-c914-4b06-ab0c-47dd950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:19.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:19.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '673947ee3454ffdf4f0d483d7c8b458da87aeacc6ce00fa63c7938d67f738d98']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:19Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313b9b-b88c-4518-9346-41b3950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:19.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:19.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '12bd9dd2c9df9a1ea9fa45dd8be7b39c289112e29c400da97870c60829a073fd']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:19Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313b9c-1d10-4535-b1ab-48a9950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:20.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:20.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '6c0e76aaddd132eb92bd72109a96a301c1b3a33f2844044f2578fde4c886a3f0']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:20Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313b9c-3b24-45f5-b563-4e31950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:20.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:20.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'dd2a0293e799a2bbba56f3163633004371b75aea7d1012dfae1bb5b32446493e']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:20Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313b9c-5650-4deb-8092-444d950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:20.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:20.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '27a1d7009c742f6cc38153f1adb927b7f239d13e31674b4b344cae21355187f6']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:20Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313b9d-8818-499c-b4ad-4a2f950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:21.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:21.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '7ebdde8c23e2ab109066dd444d5ec8a16a7dd943ce5009c48805c3f60f282464']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:21Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313b9d-4210-4569-b576-4bfa950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:21.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:21.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '19f10b57bba3fccf45c5ba6c2e8b914a069d580bebf286ec8644f0e1524dc606']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:21Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313b9e-ff88-4acf-9d9a-4443950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:22.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:22.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'a3e8496ac7475967a37544b52261353b5a2ee45da374b2c278eb722a00ae2709']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:22Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313b9e-6c80-41fc-a20d-4618950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:22.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:22.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '4eee63581357745a033c76a6d63f20befa214514a5f75f48418604fdc2bcf434']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:22Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313b9e-4ba4-4579-b9ca-46f2950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:22.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:22.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'cab87182ff5523199f1cca98d33b40b28bb302d3015d8366ba134e3e75ccfe0f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:22Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313b9f-c884-4ef0-82a2-47c8950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:23.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:23.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'faefe727291ab4658962a9669b720d685b94e515a541630e02177497e6bd9448']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:23Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313b9f-f7fc-47f0-a233-4979950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:23.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:23.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'marmitariakisabor.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:23Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"domain\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313ba0-b0dc-4fa6-a243-4e54950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:24.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:24.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://gfxcorp.engenharia.ws/p1/acesso.php']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:24Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313ba0-3b14-4cfe-b863-4a16950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:24.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:24.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://mttconstrutora.engenharia.ws/phps/aviso_grava.php']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:24Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313ba0-23ec-4293-85a3-4234950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:24.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:24.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://marmitariakisabor.com/oficial/acesso.php']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:24Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313ba1-1e40-4ff2-b54c-45a4950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:25.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://corpsone.agropecuaria.ws/j1/acesso.php']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313ba1-70c8-4717-8419-4b88950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:25.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:25.000Z",
|
|
|
|
|
"pattern": "[url:value = 'http://smartcell.webcindario.com/acesso.php']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"url\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313ba2-baa8-47df-a73d-4240950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:25.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:25.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'dc517239a94713665fd2f7a5c67d106f53b2ff6bad8af1d0c312733ef5960e3b']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:25Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313ba2-049c-4616-a9e1-40a4950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:26.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:26.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'corpsone.agropecuaria.ws']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:26Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313ba2-0bec-4a82-aadb-40ae950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:26.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:26.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'mttconstrutora.engenharia.ws']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:26Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313ba3-facc-4f97-a779-4b9e950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:27.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:27.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'smartcell.webcindario.com']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:27Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313ba3-e0e0-466c-a357-4a5a950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:27.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:27.000Z",
|
|
|
|
|
"pattern": "[domain-name:value = 'gfxcorp.engenharia.ws']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:27Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313ba4-347c-4b98-9441-44d2950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:28.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:28.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '9a1c70353047b29755a74df34c2a80a794cc592b295816c845e94de2c35dce1d']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:28Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313ba4-84fc-4f44-84cd-44d2950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:28.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:28.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '36dbedf68918b86519b2814e124491e0768e70fce0427c5b70e0cca9951889c3']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:28Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313ba4-1bd4-4053-89c3-4a64950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:28.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:28.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '59e0c339a2b481bddbc3ce36873f97aceea6df2382229b73e2a227e0980ebb28']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:28Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313ba5-5ea8-4150-aa1c-4974950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:29.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:29.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'f9eec69869f2f53d27a2e4e6887f03f879526bf9230ed69c050b2b5239da8461']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:29Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313ba5-f6fc-477c-af5d-4e2a950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:29.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:29.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'dc50e9ece45c1d8bf8bfd05c02a31a40503b1949bc51436056f522a642a3a040']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:29Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--56313ba5-92d4-4150-9771-4bf7950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-28T21:18:29.000Z",
|
|
|
|
|
"modified": "2015-10-28T21:18:29.000Z",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '862d6f1c7e3f051c19e30ba3f969c57ada1d9fc6d6e75d3960adba8224913691']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-28T21:18:29Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c484-e604-4dfe-8533-4c77950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:28.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:28.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 862d6f1c7e3f051c19e30ba3f969c57ada1d9fc6d6e75d3960adba8224913691",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'c647b27df2cb94403a103534a29aec6fb5facbf9']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:28Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c485-f724-4db9-8667-46af950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:29.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:29.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 862d6f1c7e3f051c19e30ba3f969c57ada1d9fc6d6e75d3960adba8224913691",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'bc87d4ad244974d9f33f3d78defb4906']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:29Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c485-79e8-4497-ac1a-4a9d950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:29.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:29.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:02:29Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:02:29Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c485-79e8-4497-ac1a-4a9d950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c485-79e8-4497-ac1a-4a9d950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/862d6f1c7e3f051c19e30ba3f969c57ada1d9fc6d6e75d3960adba8224913691/analysis/1434479851/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c486-fb74-47f6-b113-4211950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:30.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:30.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: dc50e9ece45c1d8bf8bfd05c02a31a40503b1949bc51436056f522a642a3a040",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'b144889d6ddcb9d747c751c75ab657b8a9969714']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:30Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c486-5dd4-4c73-aefb-4ced950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:30.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:30.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: dc50e9ece45c1d8bf8bfd05c02a31a40503b1949bc51436056f522a642a3a040",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '791e32d356c8dc7e87dbe1ac899f6d8b']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:30Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c486-4b4c-48b5-8d84-461d950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:30.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:30.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:02:30Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:02:30Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c486-4b4c-48b5-8d84-461d950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c486-4b4c-48b5-8d84-461d950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/dc50e9ece45c1d8bf8bfd05c02a31a40503b1949bc51436056f522a642a3a040/analysis/1430302551/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c487-3ae0-4bfc-802c-4c61950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:31.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:31.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: f9eec69869f2f53d27a2e4e6887f03f879526bf9230ed69c050b2b5239da8461",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '3298ee6c873589e15ce1b409ab8158ccbd4547ea']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c487-d104-4b8c-bc13-429d950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:31.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:31.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: f9eec69869f2f53d27a2e4e6887f03f879526bf9230ed69c050b2b5239da8461",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '2d522ca089c7b8fd6748583c5b95374a']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:31Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c488-8fc0-4375-a13e-425d950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:32.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:32.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:02:32Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:02:32Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c488-8fc0-4375-a13e-425d950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c488-8fc0-4375-a13e-425d950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/f9eec69869f2f53d27a2e4e6887f03f879526bf9230ed69c050b2b5239da8461/analysis/1429212822/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c488-7f1c-4304-9c75-4295950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:32.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:32.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 59e0c339a2b481bddbc3ce36873f97aceea6df2382229b73e2a227e0980ebb28",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '74af33dd90b943a9e1e69673a1de2eb206930d3d']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:32Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c488-2950-4f8b-a978-483e950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:32.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:32.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 59e0c339a2b481bddbc3ce36873f97aceea6df2382229b73e2a227e0980ebb28",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '86b3f7383996475eed006a5e64089de2']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:32Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c489-65b8-4920-83b9-475a950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:33.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:33.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:02:33Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:02:33Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c489-65b8-4920-83b9-475a950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c489-65b8-4920-83b9-475a950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/59e0c339a2b481bddbc3ce36873f97aceea6df2382229b73e2a227e0980ebb28/analysis/1443918377/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c489-0dec-4e50-917c-4dd7950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:33.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:33.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 36dbedf68918b86519b2814e124491e0768e70fce0427c5b70e0cca9951889c3",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '32a4c0c9800e4f499c6882260846c031cb1c52f1']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:33Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c48a-486c-42af-a70b-412f950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:34.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:34.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 36dbedf68918b86519b2814e124491e0768e70fce0427c5b70e0cca9951889c3",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'a99170fb344e8e160f0137f1d6adfef7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:34Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c48a-9ff0-404f-b016-4a8f950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:34.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:34.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:02:34Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:02:34Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c48a-9ff0-404f-b016-4a8f950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c48a-9ff0-404f-b016-4a8f950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/36dbedf68918b86519b2814e124491e0768e70fce0427c5b70e0cca9951889c3/analysis/1435118981/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c48a-5db8-4cd4-9caf-4c9b950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:34.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:34.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 9a1c70353047b29755a74df34c2a80a794cc592b295816c845e94de2c35dce1d",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'dfb9e0172d88113777cabe419776cddfbd653750']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:34Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c48b-e208-4fe1-89fe-452d950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:35.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:35.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 9a1c70353047b29755a74df34c2a80a794cc592b295816c845e94de2c35dce1d",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '316c2fccbdf453f9dfebcdc3871e0209']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:35Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c48b-11e4-4ba7-b4cd-4183950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:35.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:35.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:02:35Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:02:35Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c48b-11e4-4ba7-b4cd-4183950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c48b-11e4-4ba7-b4cd-4183950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/9a1c70353047b29755a74df34c2a80a794cc592b295816c845e94de2c35dce1d/analysis/1444392422/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c48c-e518-4083-8960-4160950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:36.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:36.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: dc517239a94713665fd2f7a5c67d106f53b2ff6bad8af1d0c312733ef5960e3b",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'eae3acada9724814d151b7d6519e5315da1d4c83']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:36Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c48c-9d2c-4063-912e-47f7950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:36.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:36.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: dc517239a94713665fd2f7a5c67d106f53b2ff6bad8af1d0c312733ef5960e3b",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'fc2f62cda15c86ac01d8951c7108a602']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:36Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c48c-9554-4f3b-b56e-4f61950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:36.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:36.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:02:36Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:02:36Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c48c-9554-4f3b-b56e-4f61950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c48c-9554-4f3b-b56e-4f61950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/dc517239a94713665fd2f7a5c67d106f53b2ff6bad8af1d0c312733ef5960e3b/analysis/1429803945/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c48d-d948-4bdf-8f26-4e48950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:37.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:37.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: faefe727291ab4658962a9669b720d685b94e515a541630e02177497e6bd9448",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '878d0a189cb96d6e369562d74f334f06d43495cf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:37Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c48d-c38c-4a00-92d2-4962950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:37.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:37.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: faefe727291ab4658962a9669b720d685b94e515a541630e02177497e6bd9448",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '6eca71162ad03aeb18d66df14db971b6']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:37Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c48e-d4dc-4afd-be57-449f950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:38.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:38.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:02:38Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:02:38Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c48e-d4dc-4afd-be57-449f950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c48e-d4dc-4afd-be57-449f950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/faefe727291ab4658962a9669b720d685b94e515a541630e02177497e6bd9448/analysis/1440807667/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c48e-787c-457e-9df3-4ee8950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:38.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:38.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: cab87182ff5523199f1cca98d33b40b28bb302d3015d8366ba134e3e75ccfe0f",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'e7a403933cc35146b046440ad485a72579405464']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c48e-8d84-42e9-a3a8-4952950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:38.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:38.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: cab87182ff5523199f1cca98d33b40b28bb302d3015d8366ba134e3e75ccfe0f",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'b43a1c725fee4616c8fd9008cc9ec709']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:38Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c48f-4344-43f2-8931-4988950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:39.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:39.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:02:39Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:02:39Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c48f-4344-43f2-8931-4988950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c48f-4344-43f2-8931-4988950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/cab87182ff5523199f1cca98d33b40b28bb302d3015d8366ba134e3e75ccfe0f/analysis/1423145691/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c48f-64f0-4fa3-8dbc-410e950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:39.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:39.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 4eee63581357745a033c76a6d63f20befa214514a5f75f48418604fdc2bcf434",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'd3e113a227dbc26912680efd8cfd0eee494d7a61']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:39Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c490-5c38-4c6b-a08c-4686950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:40.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:40.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 4eee63581357745a033c76a6d63f20befa214514a5f75f48418604fdc2bcf434",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'ce5647546d9d0000d9135e0af931916f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c490-ae5c-40ff-a712-408b950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:40.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:40.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:02:40Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:02:40Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c490-ae5c-40ff-a712-408b950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c490-ae5c-40ff-a712-408b950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/4eee63581357745a033c76a6d63f20befa214514a5f75f48418604fdc2bcf434/analysis/1428076142/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c490-60d8-41b9-a2f5-45ca950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:40.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:40.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: a3e8496ac7475967a37544b52261353b5a2ee45da374b2c278eb722a00ae2709",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'd946d54310ec5255a7716362c511c7d4c8be74fc']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:40Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c491-c778-410b-bc32-418e950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:41.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:41.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: a3e8496ac7475967a37544b52261353b5a2ee45da374b2c278eb722a00ae2709",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '6738f037685e09d0846cb912b8072e0f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:41Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c491-bd9c-4ff4-9a1f-4dc8950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:41.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:41.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:02:41Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:02:41Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c491-bd9c-4ff4-9a1f-4dc8950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c491-bd9c-4ff4-9a1f-4dc8950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/a3e8496ac7475967a37544b52261353b5a2ee45da374b2c278eb722a00ae2709/analysis/1432372455/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c492-e63c-4fc4-a6fe-481d950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:42.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:42.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 19f10b57bba3fccf45c5ba6c2e8b914a069d580bebf286ec8644f0e1524dc606",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '3a59b1c4271cf70d1698346b8f2ec68869ecb55e']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:42Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c492-d810-40c8-b7c4-442b950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:42.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:42.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 19f10b57bba3fccf45c5ba6c2e8b914a069d580bebf286ec8644f0e1524dc606",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '72c7945c1e8f76bc8768335ca9842ae8']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:42Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c492-a3f4-4974-9d7f-4ea7950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:42.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:42.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:02:42Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:02:42Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c492-a3f4-4974-9d7f-4ea7950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c492-a3f4-4974-9d7f-4ea7950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/19f10b57bba3fccf45c5ba6c2e8b914a069d580bebf286ec8644f0e1524dc606/analysis/1445774362/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c493-1dbc-42d4-ae64-4bed950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:43.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:43.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 7ebdde8c23e2ab109066dd444d5ec8a16a7dd943ce5009c48805c3f60f282464",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '518298c3d88154e53220c2df428e8028037f0af8']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:43Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c493-cfe8-4598-87ea-48fe950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:43.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:43.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 7ebdde8c23e2ab109066dd444d5ec8a16a7dd943ce5009c48805c3f60f282464",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '4714eebc8a4c603d0973444ea31a376c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:43Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c494-83b4-4a11-9865-428a950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:44.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:44.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:02:44Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:02:44Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c494-83b4-4a11-9865-428a950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c494-83b4-4a11-9865-428a950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/7ebdde8c23e2ab109066dd444d5ec8a16a7dd943ce5009c48805c3f60f282464/analysis/1444148206/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c494-5ad4-44f6-be22-44ac950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:44.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:44.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 27a1d7009c742f6cc38153f1adb927b7f239d13e31674b4b344cae21355187f6",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '0dff3c92934740edf6d5d6ef51583244aad1dbaf']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:44Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c494-3c20-473f-9285-4f5e950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:44.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:44.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 27a1d7009c742f6cc38153f1adb927b7f239d13e31674b4b344cae21355187f6",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '50c7900b46db9818335e46a0f85eb858']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:44Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c495-8a00-474f-9437-4fc6950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:45.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:45.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:02:45Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:02:45Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c495-8a00-474f-9437-4fc6950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c495-8a00-474f-9437-4fc6950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/27a1d7009c742f6cc38153f1adb927b7f239d13e31674b4b344cae21355187f6/analysis/1426917818/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c495-4934-42d6-8269-4a0a950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:45.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:45.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: dd2a0293e799a2bbba56f3163633004371b75aea7d1012dfae1bb5b32446493e",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '3dd9ff1df38478dfcd03cb1f256dbcf007d4fced']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:45Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c496-805c-4fd6-b1a1-4bc4950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:46.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:46.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: dd2a0293e799a2bbba56f3163633004371b75aea7d1012dfae1bb5b32446493e",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '2b6905c4f1d4d5af09c27c334d5632c7']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:46Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c496-67cc-4e94-89c8-42a4950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:46.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:46.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:02:46Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:02:46Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c496-67cc-4e94-89c8-42a4950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c496-67cc-4e94-89c8-42a4950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/dd2a0293e799a2bbba56f3163633004371b75aea7d1012dfae1bb5b32446493e/analysis/1431581596/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c496-eb14-412b-8a3a-43fd950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:46.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:46.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 6c0e76aaddd132eb92bd72109a96a301c1b3a33f2844044f2578fde4c886a3f0",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '8ef3b9194e8cb545f7d95c9b7c7703ee3418fa0b']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:46Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c497-c1d4-4ee8-b77c-45bd950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:47.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:47.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 6c0e76aaddd132eb92bd72109a96a301c1b3a33f2844044f2578fde4c886a3f0",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'bf50ec146ad5c192e5fc17d45695c817']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:47Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c497-6ec0-4716-9bf7-4d2b950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:47.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:47.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:02:47Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:02:47Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c497-6ec0-4716-9bf7-4d2b950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c497-6ec0-4716-9bf7-4d2b950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/6c0e76aaddd132eb92bd72109a96a301c1b3a33f2844044f2578fde4c886a3f0/analysis/1430236360/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c498-0468-4c21-bf8a-4537950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:48.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:48.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 12bd9dd2c9df9a1ea9fa45dd8be7b39c289112e29c400da97870c60829a073fd",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'bba6a26cd61ae27fb0712d70e246679784ebe8e1']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:48Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c498-94f0-471f-85f5-4183950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:48.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:48.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 12bd9dd2c9df9a1ea9fa45dd8be7b39c289112e29c400da97870c60829a073fd",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '78b0bcde022843908116ed56e0e99b6a']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:48Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c498-0b14-48fe-a875-43f1950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:48.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:48.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:02:48Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:02:48Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c498-0b14-48fe-a875-43f1950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c498-0b14-48fe-a875-43f1950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/12bd9dd2c9df9a1ea9fa45dd8be7b39c289112e29c400da97870c60829a073fd/analysis/1431853764/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c499-5350-4d89-9b4c-428f950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:49.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:49.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 673947ee3454ffdf4f0d483d7c8b458da87aeacc6ce00fa63c7938d67f738d98",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '937d59bc5504e4b1703c42ae62a2c5cbe19d2f05']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:49Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c499-5a90-4724-ab8e-4a97950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:49.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:49.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 673947ee3454ffdf4f0d483d7c8b458da87aeacc6ce00fa63c7938d67f738d98",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '311b42fc82aa6229afb5aef805364c03']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:49Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c49a-1ff0-48fb-9c80-4544950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:50.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:50.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:02:50Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:02:50Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c49a-1ff0-48fb-9c80-4544950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c49a-1ff0-48fb-9c80-4544950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/673947ee3454ffdf4f0d483d7c8b458da87aeacc6ce00fa63c7938d67f738d98/analysis/1427863462/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c49a-653c-4b92-a0d5-4d17950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:50.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:50.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 6bbb1b0af6762dde688253ff2aaf68f17bf22a5bb15e430ab9139396370a58d3",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'b88c28ba6911afd2dd9343b211f82e961dcd9a14']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:50Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c49a-6740-44bf-8935-4f8e950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:50.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:50.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 6bbb1b0af6762dde688253ff2aaf68f17bf22a5bb15e430ab9139396370a58d3",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'dd6bd132e94675d010e54a3e1bba6b34']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:50Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c49b-3444-4fb8-9a54-400e950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:51.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:51.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:02:51Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:02:51Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c49b-3444-4fb8-9a54-400e950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c49b-3444-4fb8-9a54-400e950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/6bbb1b0af6762dde688253ff2aaf68f17bf22a5bb15e430ab9139396370a58d3/analysis/1431355773/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c49b-7b20-482f-8778-43f0950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:51.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:51.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: b1120c56e5a46f64dfc46bb7600cb929fef7dd84d9c21b09e18b35b425901513",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'b1813f6e46772b3112d2118533c60ec51788db84']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:51Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c49c-3238-416c-8bfb-4874950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:52.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:52.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: b1120c56e5a46f64dfc46bb7600cb929fef7dd84d9c21b09e18b35b425901513",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'e8d43d381152295690dd55d271a342d4']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:52Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c49c-7e5c-4057-89aa-4b83950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:52.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:52.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:02:52Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:02:52Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c49c-7e5c-4057-89aa-4b83950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c49c-7e5c-4057-89aa-4b83950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/b1120c56e5a46f64dfc46bb7600cb929fef7dd84d9c21b09e18b35b425901513/analysis/1431399252/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c49c-f97c-41e4-a8c9-41ea950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:52.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:52.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 8b8e04ffd351486f02619a20d3211199747bf4468dfcbd4c18e02bb40ef55545",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '3aa5de142b2f2cb1186cd4ba2b3f25824870dc87']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:52Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c49d-a59c-444e-b506-4749950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:53.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:53.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 8b8e04ffd351486f02619a20d3211199747bf4468dfcbd4c18e02bb40ef55545",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '6c3223460911f3366b56a44341d7ee7f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:53Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c49d-892c-456f-8cea-424e950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:53.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:53.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:02:53Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:02:53Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c49d-892c-456f-8cea-424e950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c49d-892c-456f-8cea-424e950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/8b8e04ffd351486f02619a20d3211199747bf4468dfcbd4c18e02bb40ef55545/analysis/1438876485/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c49e-3a30-4cca-ba23-4fbf950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:54.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:54.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: fa1940d18e3e16ccf8d69021e46612c6ea3f020ee8a9c726641725571f17f9f5",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'dc453eba98548f5a66a3d0f351017be83559ce15']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:54Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c49e-5c00-4021-8ff2-410a950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:54.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:54.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: fa1940d18e3e16ccf8d69021e46612c6ea3f020ee8a9c726641725571f17f9f5",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '89d28adc1f4756cc526cda3002762b1c']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:54Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c49e-0814-4ca2-9df8-49a6950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:54.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:54.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:02:54Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:02:54Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c49e-0814-4ca2-9df8-49a6950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c49e-0814-4ca2-9df8-49a6950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/fa1940d18e3e16ccf8d69021e46612c6ea3f020ee8a9c726641725571f17f9f5/analysis/1428973783/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c49f-cf3c-45f4-9143-4aba950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:55.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:55.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 1be2ef22767d278fda7897bd6a1c7d21a082c50ec0ed35b1a1dff9bb5cf8bb6a",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'c82b973d73db863fac2ac49e22a40c23faf0accd']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:55Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c49f-b260-410a-8795-4e70950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:55.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:55.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 1be2ef22767d278fda7897bd6a1c7d21a082c50ec0ed35b1a1dff9bb5cf8bb6a",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'bad9c3bcf81c5a111b0d8c70d91b8703']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:55Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c4a0-4ab0-485d-8ffa-47f8950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:56.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:56.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:02:56Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:02:56Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c4a0-4ab0-485d-8ffa-47f8950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c4a0-4ab0-485d-8ffa-47f8950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/1be2ef22767d278fda7897bd6a1c7d21a082c50ec0ed35b1a1dff9bb5cf8bb6a/analysis/1428768397/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c4a0-70fc-492d-934c-4e59950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:56.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:56.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 5bab39d4073a28084e359cedd563c2881948311e4f204b9252b81239f6798ecd",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '55ca47526a639abed533f16c790cd78ad064ce01']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:56Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c4a0-6c24-47e1-971c-4710950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:56.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:56.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 5bab39d4073a28084e359cedd563c2881948311e4f204b9252b81239f6798ecd",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '6a9a031ffcd42f17e6f06708aa60eb23']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:56Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c4a1-ce48-4eb7-8cf5-4936950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:57.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:57.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:02:57Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:02:57Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c4a1-ce48-4eb7-8cf5-4936950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c4a1-ce48-4eb7-8cf5-4936950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/5bab39d4073a28084e359cedd563c2881948311e4f204b9252b81239f6798ecd/analysis/1429564646/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c4a1-2c0c-4afd-8d96-436b950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:57.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:57.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: cd8c9ccfa748cb9dba66425cbba2c331b124209bf758ce927e8423ee20f2f2b8",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'b6ce8fdff1444df32defdd9639b4da5a85f84da9']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:57Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c4a2-4140-4bcf-a0f5-4d30950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:58.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:58.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: cd8c9ccfa748cb9dba66425cbba2c331b124209bf758ce927e8423ee20f2f2b8",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '797e0181ad50f976ccd43f832e1e352e']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:58Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c4a2-a478-4e4f-b61e-4f6d950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:58.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:58.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:02:58Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:02:58Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c4a2-a478-4e4f-b61e-4f6d950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c4a2-a478-4e4f-b61e-4f6d950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/cd8c9ccfa748cb9dba66425cbba2c331b124209bf758ce927e8423ee20f2f2b8/analysis/1427989867/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c4a2-9300-4867-9e73-4993950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:58.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:58.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 40a6a0beb1d1a21fa795fc1234c9d512c3bd40b432fec14080294433a87d4c7f",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '90335e00d01a735c7324dd61d2d200a94faee449']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:58Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c4a3-10e4-41ae-bf6b-4e14950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:59.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:59.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 40a6a0beb1d1a21fa795fc1234c9d512c3bd40b432fec14080294433a87d4c7f",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '7373c34aeb9089bbe18874b441cc1d80']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:02:59Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c4a3-87bc-421d-96b6-451a950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:02:59.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:02:59.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:02:59Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:02:59Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c4a3-87bc-421d-96b6-451a950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c4a3-87bc-421d-96b6-451a950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/40a6a0beb1d1a21fa795fc1234c9d512c3bd40b432fec14080294433a87d4c7f/analysis/1429225706/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c4a4-0e98-4791-b9fd-47f1950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:03:00.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:03:00.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: a3ec8c9763eb8a5f87df7ba6977f7c8d3e3548b4afda6e9f1ed4eb316554add0",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '7d79a622cca8e9d81bcb50e4de6ce0a1ec8f6e6a']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:03:00Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c4a4-2e20-4b44-bd64-43cc950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:03:00.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:03:00.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: a3ec8c9763eb8a5f87df7ba6977f7c8d3e3548b4afda6e9f1ed4eb316554add0",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'da8b411288a6ca4c8af28d5eb05a286b']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:03:00Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c4a4-1788-4fec-9fcd-4a93950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:03:00.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:03:00.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:03:00Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:03:00Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c4a4-1788-4fec-9fcd-4a93950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c4a4-1788-4fec-9fcd-4a93950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/a3ec8c9763eb8a5f87df7ba6977f7c8d3e3548b4afda6e9f1ed4eb316554add0/analysis/1443735791/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c4a5-48f0-46d9-a7fc-45d8950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:03:01.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:03:01.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 5b2dc39fbd2c6afe14232d562f59337da779eb855e0e707947349871769ecd90",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '94c52a6e55855aaeb7c9c3fd78236bfccd326db8']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:03:01Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c4a5-81a0-450a-beaf-4970950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:03:01.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:03:01.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 5b2dc39fbd2c6afe14232d562f59337da779eb855e0e707947349871769ecd90",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'a2700e2226d1778e00eb2d482c8a4dd9']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:03:01Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c4a5-ac90-4065-a814-407e950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:03:01.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:03:01.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:03:01Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:03:01Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c4a5-ac90-4065-a814-407e950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c4a5-ac90-4065-a814-407e950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/5b2dc39fbd2c6afe14232d562f59337da779eb855e0e707947349871769ecd90/analysis/1428508288/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c4a6-09c4-4254-8922-482b950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:03:02.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:03:02.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: add1fff630b8f7f915938dcf70248bf0c93b6caa2dd275c4ac38c639cec996f7",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '22a2cbfe2613905edc9e4db71aaa0baa7b8841b1']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:03:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c4a6-22a4-4ef7-b77c-4c66950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:03:02.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:03:02.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: add1fff630b8f7f915938dcf70248bf0c93b6caa2dd275c4ac38c639cec996f7",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '788100634f7532b14215287f9dc07026']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:03:02Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c4a7-9040-47dc-8e60-447c950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:03:03.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:03:03.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:03:03Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:03:03Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c4a7-9040-47dc-8e60-447c950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c4a7-9040-47dc-8e60-447c950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/add1fff630b8f7f915938dcf70248bf0c93b6caa2dd275c4ac38c639cec996f7/analysis/1425169147/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c4a7-de4c-4ebb-87a3-4087950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:03:03.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:03:03.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 8b9a06d4505da9ac8f7707114518ee87117cc77ae31157196564323f780f0f4c",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'c9a652e23c5e8eb55c17d3d8659ed1652ea2025f']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:03:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c4a7-8878-490a-8961-41b9950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:03:03.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:03:03.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 8b9a06d4505da9ac8f7707114518ee87117cc77ae31157196564323f780f0f4c",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '0bb6054cbcb14362ff0ae1a6e67f27cc']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:03:03Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c4a8-2c88-4aa2-8c3d-4eba950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:03:04.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:03:04.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:03:04Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:03:04Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c4a8-2c88-4aa2-8c3d-4eba950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c4a8-2c88-4aa2-8c3d-4eba950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/8b9a06d4505da9ac8f7707114518ee87117cc77ae31157196564323f780f0f4c/analysis/1445376284/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c4a8-daec-4bb7-bc65-47ee950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:03:04.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:03:04.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 99de7d83d1b293d15f170cf9d7cd30c04c5d91393cdacb5fc34e1595c9301b26",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'ad4eaf7a0404120f292db7e2c0eaf1322c408d3a']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:03:04Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c4a9-0bf0-4d1b-b25b-4218950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:03:05.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:03:05.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 99de7d83d1b293d15f170cf9d7cd30c04c5d91393cdacb5fc34e1595c9301b26",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '5f423fdc2d2e15dee08d72d8cd25c774']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:03:05Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c4a9-8580-42f4-a2f7-454c950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:03:05.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:03:05.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:03:05Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:03:05Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c4a9-8580-42f4-a2f7-454c950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c4a9-8580-42f4-a2f7-454c950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/99de7d83d1b293d15f170cf9d7cd30c04c5d91393cdacb5fc34e1595c9301b26/analysis/1439480163/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c4a9-3848-468b-9fe0-47b2950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:03:05.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:03:05.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: a1b3ada62cb45f8ba3b175b7bbaadad7e76afcc4fa73df8cfd3ea4028484a689",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'fe8cd85227d275d908c1ffbae4ac7d35b2c3e5ec']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:03:05Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c4aa-56cc-44e1-8bf3-4fda950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:03:06.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:03:06.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: a1b3ada62cb45f8ba3b175b7bbaadad7e76afcc4fa73df8cfd3ea4028484a689",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '38aef00d10665331222ddf5c625fa846']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:03:06Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c4aa-d1e8-471c-a6d6-479f950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:03:06.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:03:06.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:03:06Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:03:06Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c4aa-d1e8-471c-a6d6-479f950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c4aa-d1e8-471c-a6d6-479f950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/a1b3ada62cb45f8ba3b175b7bbaadad7e76afcc4fa73df8cfd3ea4028484a689/analysis/1446034298/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c4ab-8950-4c4e-a11f-4baf950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:03:07.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:03:07.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: f53b2ff9660027fc7692819ce80f8fa0b49766af44d2e5a5aa3fd3cf89b9b979",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = '2e2bc2983c9736b6431ad328bb51d8294b7c1cf2']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:03:07Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c4ab-aab0-4fa0-b77a-4e45950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:03:07.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:03:07.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: f53b2ff9660027fc7692819ce80f8fa0b49766af44d2e5a5aa3fd3cf89b9b979",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'a574f8da772f52adca10ae0b218f1e61']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:03:07Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c4ab-1c78-4641-9fa0-4dc8950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:03:07.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:03:07.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:03:07Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:03:07Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c4ab-1c78-4641-9fa0-4dc8950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c4ab-1c78-4641-9fa0-4dc8950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/f53b2ff9660027fc7692819ce80f8fa0b49766af44d2e5a5aa3fd3cf89b9b979/analysis/1445069531/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c4ac-543c-4d1b-9419-49f4950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:03:08.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:03:08.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 4fcb03122dbc79b96abd304f0c8f61887672ad64b8fab4f4077387ef3ba455e6",
|
|
|
|
|
"pattern": "[file:hashes.SHA1 = 'd5da1d8c5325e7e5c62ba31b7ddd4c8888bda500']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:03:08Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha1\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5631c4ac-756c-4619-9bca-46fa950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:03:08.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:03:08.000Z",
|
|
|
|
|
"description": "- Xchecked via VT: 4fcb03122dbc79b96abd304f0c8f61887672ad64b8fab4f4077387ef3ba455e6",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'bd9b157f08236ede7718b9a06cbfea83']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2015-10-29T07:03:08Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"md5\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5631c4ad-7c18-4b4a-b3d0-4bfe950d210b",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
|
|
|
"created": "2015-10-29T07:03:09.000Z",
|
|
|
|
|
"modified": "2015-10-29T07:03:09.000Z",
|
|
|
|
|
"first_observed": "2015-10-29T07:03:09Z",
|
|
|
|
|
"last_observed": "2015-10-29T07:03:09Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5631c4ad-7c18-4b4a-b3d0-4bfe950d210b"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5631c4ad-7c18-4b4a-b3d0-4bfe950d210b",
|
|
|
|
|
"value": "https://www.virustotal.com/file/4fcb03122dbc79b96abd304f0c8f61887672ad64b8fab4f4077387ef3ba455e6/analysis/1430322405/"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "marking-definition",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
|
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
|
|
|
"definition_type": "tlp",
|
|
|
|
|
"name": "TLP:WHITE",
|
|
|
|
|
"definition": {
|
|
|
|
|
"tlp": "white"
|
|
|
|
|
}
|
|
|
|
|
}
|
2023-04-21 13:25:09 +00:00
|
|
|
]
|
|
|
|
|
}
|
