misp-circl-feed/feeds/circl/misp/56d61087-d19c-4552-9802-48fe02de0b81.json

{
    "type": "bundle",
    "id": "bundle--56d61087-d19c-4552-9802-48fe02de0b81",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-03-01T22:18:53.000Z",
            "modified": "2016-03-01T22:18:53.000Z",
            "name": "CthulhuSPRL.be",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--56d61087-d19c-4552-9802-48fe02de0b81",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-03-01T22:18:53.000Z",
            "modified": "2016-03-01T22:18:53.000Z",
            "name": "OSINT APT Bestia used in APT attacks on Polish Government",
            "published": "2016-03-01T22:19:11Z",
            "object_refs": [
                "observed-data--56d61119-760c-4b21-b93f-45e602de0b81",
                "url--56d61119-760c-4b21-b93f-45e602de0b81",
                "observed-data--56d61119-bb30-4d1c-b53e-45e602de0b81",
                "url--56d61119-bb30-4d1c-b53e-45e602de0b81",
                "observed-data--56d61154-cccc-449e-9a91-49a702de0b81",
                "url--56d61154-cccc-449e-9a91-49a702de0b81",
                "indicator--56d6154d-5ec0-4699-a570-484402de0b81"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "type:OSINT"
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--56d61119-760c-4b21-b93f-45e602de0b81",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-03-01T22:00:57.000Z",
            "modified": "2016-03-01T22:00:57.000Z",
            "first_observed": "2016-03-01T22:00:57Z",
            "last_observed": "2016-03-01T22:00:57Z",
            "number_observed": 1,
            "object_refs": [
                "url--56d61119-760c-4b21-b93f-45e602de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56d61119-760c-4b21-b93f-45e602de0b81",
            "value": "https://twitter.com/yararules/status/704613871294746625"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--56d61119-bb30-4d1c-b53e-45e602de0b81",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-03-01T22:00:57.000Z",
            "modified": "2016-03-01T22:00:57.000Z",
            "first_observed": "2016-03-01T22:00:57Z",
            "last_observed": "2016-03-01T22:00:57Z",
            "number_observed": 1,
            "object_refs": [
                "url--56d61119-bb30-4d1c-b53e-45e602de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56d61119-bb30-4d1c-b53e-45e602de0b81",
            "value": "https://zaufanatrzeciastrona.pl/post/ukierunkowany-atak-na-pracownikow-polskich-samorzadow/"
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--56d61154-cccc-449e-9a91-49a702de0b81",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-03-01T22:01:56.000Z",
            "modified": "2016-03-01T22:01:56.000Z",
            "first_observed": "2016-03-01T22:01:56Z",
            "last_observed": "2016-03-01T22:01:56Z",
            "number_observed": 1,
            "object_refs": [
                "url--56d61154-cccc-449e-9a91-49a702de0b81"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--56d61154-cccc-449e-9a91-49a702de0b81",
            "value": "https://github.com/Yara-Rules/rules/blob/master/malware/APT_Bestia.yar"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--56d6154d-5ec0-4699-a570-484402de0b81",
            "created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
            "created": "2016-03-01T22:18:53.000Z",
            "modified": "2016-03-01T22:18:53.000Z",
            "pattern": "[rule APT_bestia\r\n{\r\nmeta:\r\n    author = \"Adam Ziaja <adam@adamziaja.com> http://adamziaja.com\"\r\n    date = \"2014-03-19\"\r\n    description = \"Bestia.3.02.012.07 malware used in APT attacks on Polish government\"\r\n    references = \"http://zaufanatrzeciastrona.pl/post/ukierunkowany-atak-na-pracownikow-polskich-samorzadow/\" /* PL */\r\n    hash0 = \"9bb03bb5af40d1202378f95a6485fba8\"\r\n    hash1 = \"7d9a806e0da0b869b10870dd6c7692c5\"\r\n    maltype = \"apt\"\r\n    filetype = \"exe\"\r\nstrings:\r\n    /* generated with https://github.com/Xen0ph0n/YaraGenerator */\r\n    $string0 = \"u4(UeK\"\r\n    $string1 = \"nMiq/'p\"\r\n    $string2 = \"_9pJMf\"\r\n    $string3 = \"ICMP.DLL\"\r\n    $string4 = \"EG}QAp\"\r\n    $string5 = \"tsjWj:U\"\r\n    $string6 = \"FileVersion\" wide\r\n    $string7 = \"O2nQpp\"\r\n    $string8 = \"2}W8we\"\r\n    $string9 = \"ILqkC:l\"\r\n    $string10 = \"f1yzMk\"\r\n    $string11 = \"AutoIt v3 Script: 3, 3, 8, 1\" wide\r\n    $string12 = \"wj<1uH\"\r\n    $string13 = \"6fL-uD\"\r\n    $string14 = \"B9Iavo<\"\r\n    $string15 = \"rUS)sO\"\r\n    $string16 = \"FJH{_/f\"\r\n    $string17 = \"3e 03V\"\r\ncondition:\r\n    17 of them\r\n}]",
            "pattern_type": "yara",
            "pattern_version": "2.1",
            "valid_from": "2016-03-01T22:18:53Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Artifacts dropped"
                }
            ],
            "labels": [
                "misp:type=\"yara\"",
                "misp:category=\"Artifacts dropped\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}