2023-04-21 13:25:09 +00:00
{
2023-06-14 17:31:25 +00:00
"type" : "bundle" ,
"id" : "bundle--5bbe03c3-0ec0-4ee7-949b-4e3c950d210f" ,
"objects" : [
{
"type" : "identity" ,
"spec_version" : "2.1" ,
"id" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-28T08:58:51.000Z" ,
"modified" : "2018-10-28T08:58:51.000Z" ,
"name" : "CIRCL" ,
"identity_class" : "organization"
} ,
{
"type" : "report" ,
"spec_version" : "2.1" ,
"id" : "report--5bbe03c3-0ec0-4ee7-949b-4e3c950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-28T08:58:51.000Z" ,
"modified" : "2018-10-28T08:58:51.000Z" ,
"name" : "OSINT - MuddyWater expands operations" ,
"published" : "2018-10-28T09:03:22Z" ,
"object_refs" : [
"observed-data--5bbe03d3-9090-4212-b186-4139950d210f" ,
"url--5bbe03d3-9090-4212-b186-4139950d210f" ,
"x-misp-attribute--5bbe097d-c65c-4fc4-9a33-45c3950d210f" ,
"indicator--5bbe0e30-cfc4-432c-a427-4daa950d210f" ,
"indicator--5bbe0e31-77ac-47bb-828d-462a950d210f" ,
"indicator--5bbe0e35-5910-4145-bd71-4120950d210f" ,
"indicator--5bbe0e4b-4ffc-4a67-9092-41ad950d210f" ,
"indicator--5bbe0e5f-f118-40ee-a5a1-4eff950d210f" ,
"indicator--5bbe0e61-63d8-4c71-87ca-4d1d950d210f" ,
"indicator--5bbe0e63-7954-443a-b3b9-4e09950d210f" ,
"indicator--5bbe0e65-ed30-48a8-ad34-4e06950d210f" ,
"indicator--5bbe0e67-c5ec-4b9a-b1ae-4cfd950d210f" ,
"indicator--5bbe0e68-e554-4c61-b11e-4afc950d210f" ,
"indicator--5bbe0e6b-e194-421a-bef5-4484950d210f" ,
"indicator--5bbe0e70-baf8-4293-8e07-4744950d210f" ,
"indicator--5bbe0e75-c64c-4d6b-adda-404e950d210f" ,
"indicator--5bbe0e76-2ab4-491d-9f11-4471950d210f" ,
"indicator--5bbe0e78-ef4c-49c0-818b-4b9e950d210f" ,
"indicator--5bbe0e7a-aafc-4048-b48e-4e3a950d210f" ,
"indicator--5bbe0e7b-a5c4-4d06-a1a1-473b950d210f" ,
"indicator--5bbe0e7d-9788-4e8d-894e-462f950d210f" ,
"indicator--5bbe0e7e-eda0-42c4-a5e8-4b2d950d210f" ,
"indicator--5bbe0e81-3a68-4dc6-abc8-477c950d210f" ,
"indicator--5bbe0e87-48e0-4c21-816d-4374950d210f" ,
"indicator--5bbe0e88-5cc0-4596-b3ec-4d53950d210f" ,
"indicator--5bbe0e89-a904-44e3-a565-4a99950d210f" ,
"indicator--5bbe0e8a-72d0-4209-b1bb-4368950d210f" ,
"indicator--5bbe0e8c-b780-43ad-a2f6-4264950d210f" ,
"indicator--5bbe0e8f-4c14-4a29-9a46-4993950d210f" ,
"indicator--5bbe0e94-dec8-47f8-bf21-4e37950d210f" ,
"indicator--5bbe0e97-8814-4726-8c7f-4ffa950d210f" ,
"indicator--5bbe0e99-1f34-4d28-9b10-4f73950d210f" ,
"indicator--5bbe0e9a-b368-4341-84fd-4512950d210f" ,
"indicator--5bbe0e9b-32fc-483f-b112-4d1e950d210f" ,
"indicator--5bbe0ea1-0b50-4c89-bfd7-4557950d210f" ,
"indicator--5bbe0ea4-28c4-47f9-8800-491d950d210f" ,
"indicator--5bbe0ea9-ccb4-464e-af89-4bd7950d210f" ,
"indicator--5bbe0ead-7954-4f96-a028-4609950d210f" ,
"indicator--5bbe0eaf-dae8-47d8-9724-44fb950d210f" ,
"indicator--5bbe0eb1-f384-4426-832e-4a13950d210f" ,
"indicator--5bbe0eb6-77cc-4215-8b82-44b5950d210f" ,
"indicator--5bbe0eb7-dde0-44b3-a715-4f60950d210f" ,
"indicator--5bbe0eb7-4230-4f74-b8f5-4487950d210f" ,
"indicator--5bbe0eb8-c7c4-4f67-82c8-4443950d210f" ,
"indicator--5bbe0eb8-fc10-4a90-b12e-49c3950d210f" ,
"indicator--5bbe0eb9-aa60-4db6-908c-4ee2950d210f" ,
"indicator--5bbe0ebb-5d08-402d-8c6d-4fce950d210f" ,
"indicator--5bbe0ebe-b0a4-477b-9a65-4e41950d210f" ,
"indicator--5bbe0ebf-aa70-402d-88aa-4443950d210f" ,
"indicator--5bbe0ebf-a388-432d-a5c3-4130950d210f" ,
"indicator--5bbe0ec0-35a8-4d19-ad28-4394950d210f" ,
"indicator--5bbe0ec0-fdfc-410a-9626-4610950d210f" ,
"indicator--5bbe0ec1-ec40-4cf8-be41-4d6d950d210f" ,
"indicator--5bbe0ec1-3b70-49d7-b4e4-456d950d210f" ,
"indicator--5bbe0ec2-c4e4-45c1-8ca7-4c76950d210f" ,
"indicator--5bbe0ec2-04e8-4565-a44a-4a81950d210f" ,
"indicator--5bbe0ec2-2300-465f-8b36-476b950d210f" ,
"indicator--5bbe0ec3-44e8-46c7-9191-42d9950d210f" ,
"indicator--5bbe0ec3-d018-4ca0-91c1-401d950d210f" ,
"indicator--5bbe0ec4-2698-487e-af5d-4478950d210f" ,
"indicator--5bbe0ec4-14c0-4eab-9a01-4e6d950d210f" ,
"indicator--5bbe0ec7-3544-4e3f-9d4e-44ce950d210f" ,
"indicator--5bbe0ec7-2310-4abb-93ec-4849950d210f" ,
"indicator--5bbe0ec8-30f4-4746-a683-4ff2950d210f" ,
"indicator--5bbe0ecc-5798-4b31-811c-486f950d210f" ,
"indicator--5bbe0ecf-550c-4572-882a-4b4c950d210f" ,
"indicator--5bbef709-1198-44fb-b614-4783950d210f" ,
"indicator--5bbef70b-d0d0-4c6a-82f9-4b5e950d210f" ,
"indicator--5bbef70c-fb50-4fef-89ec-4e8e950d210f" ,
"indicator--5bbef70f-c224-473e-a5b5-4b40950d210f" ,
"indicator--5bbef710-8e94-4a38-b25f-4599950d210f" ,
"indicator--5bbef710-9934-43aa-aff6-40e8950d210f" ,
"indicator--5bbef711-0c90-406b-b169-4894950d210f" ,
"indicator--5bbef712-8894-4c7d-a835-4122950d210f" ,
"indicator--5bbef712-718c-42cd-ba5b-4b05950d210f" ,
"indicator--5bbef713-05c4-47d3-bb74-4efc950d210f" ,
"indicator--5bbef713-eec4-419d-9dff-4734950d210f" ,
"indicator--5bbef717-56c0-4ab1-901a-4ab8950d210f" ,
"indicator--5bbef717-d0ec-4611-8724-4025950d210f" ,
"indicator--5bbef718-37ac-4dbf-a117-4a40950d210f" ,
"indicator--5bbef718-b9c4-43c0-91b9-4bee950d210f" ,
"indicator--5bbef719-709c-413d-af51-4ee4950d210f" ,
"indicator--5bbef719-e438-4400-bfe2-4939950d210f" ,
"indicator--5bbef71a-ad08-458c-86e2-4d27950d210f" ,
"indicator--5bbef71d-d7a8-4c02-b480-43d0950d210f" ,
"indicator--5bbef71d-eda4-4f12-9f0c-43bd950d210f" ,
"indicator--5bbef71e-f328-4196-a141-4eb3950d210f" ,
"indicator--5bbef71e-e224-4ba9-aed2-4332950d210f" ,
"indicator--5bbef71f-44d4-4490-8ab7-4407950d210f" ,
"indicator--5bbef71f-1b78-4c0a-b435-4a39950d210f" ,
"observed-data--5bbef720-43a8-4b70-a29a-49e7950d210f" ,
"windows-registry-key--5bbef720-43a8-4b70-a29a-49e7950d210f" ,
"observed-data--5bbef721-0198-44d1-87f9-4a03950d210f" ,
"windows-registry-key--5bbef721-0198-44d1-87f9-4a03950d210f" ,
"observed-data--5bbef721-ef90-4859-937a-431a950d210f" ,
"windows-registry-key--5bbef721-ef90-4859-937a-431a950d210f" ,
"observed-data--5bbef722-161c-479c-a92a-41ee950d210f" ,
"windows-registry-key--5bbef722-161c-479c-a92a-41ee950d210f" ,
"observed-data--5bbef722-1038-4ec6-8301-493c950d210f" ,
"windows-registry-key--5bbef722-1038-4ec6-8301-493c950d210f" ,
"observed-data--5bbef723-6778-4a05-a3fc-45a7950d210f" ,
"windows-registry-key--5bbef723-6778-4a05-a3fc-45a7950d210f" ,
"observed-data--5bbef723-1a90-496f-a0a6-4759950d210f" ,
"windows-registry-key--5bbef723-1a90-496f-a0a6-4759950d210f" ,
"indicator--5bbefcc3-9170-475c-a872-485c950d210f" ,
"indicator--5bbefcc4-cd58-40bc-a143-4d49950d210f" ,
"indicator--5bbefcc4-691c-44a9-a0a5-486a950d210f" ,
"indicator--5bbefcc5-1f00-409d-925b-412b950d210f" ,
"indicator--5bbefcc5-02fc-47ae-84e3-43f9950d210f" ,
"indicator--5bbefcc6-dd74-4a21-abcc-406a950d210f" ,
"indicator--5bbefcc9-8280-4d95-a1e2-481f950d210f" ,
"indicator--5bbefccc-5cb0-488b-b32f-45a2950d210f" ,
"indicator--5bbefccd-2f04-4610-930d-49f8950d210f" ,
"indicator--5bbefcce-78d0-4e0a-9e6c-4951950d210f" ,
"indicator--5bbefcce-5468-4b10-b415-4b3b950d210f" ,
"observed-data--5bbefe30-1718-4cae-b3fa-4ae2950d210f" ,
"file--5bbefe30-1718-4cae-b3fa-4ae2950d210f" ,
"artifact--5bbefe30-1718-4cae-b3fa-4ae2950d210f" ,
"observed-data--5bbf0086-44fc-4fea-a218-463b950d210f" ,
"file--5bbf0086-44fc-4fea-a218-463b950d210f" ,
"artifact--5bbf0086-44fc-4fea-a218-463b950d210f" ,
"observed-data--5bbf00a0-e538-4d28-b3d4-4ac4950d210f" ,
"file--5bbf00a0-e538-4d28-b3d4-4ac4950d210f" ,
"artifact--5bbf00a0-e538-4d28-b3d4-4ac4950d210f" ,
"observed-data--5bbf03d5-77b0-4576-af75-4ee9950d210f" ,
"file--5bbf03d5-77b0-4576-af75-4ee9950d210f" ,
"artifact--5bbf03d5-77b0-4576-af75-4ee9950d210f" ,
"observed-data--5bbf0405-e380-406f-b611-4b32950d210f" ,
"file--5bbf0405-e380-406f-b611-4b32950d210f" ,
"artifact--5bbf0405-e380-406f-b611-4b32950d210f" ,
"observed-data--5bbf042c-4c84-4d1d-ae23-4a5c950d210f" ,
"file--5bbf042c-4c84-4d1d-ae23-4a5c950d210f" ,
"artifact--5bbf042c-4c84-4d1d-ae23-4a5c950d210f" ,
"observed-data--5bbf06ae-f9c4-4fb9-b068-4ed3950d210f" ,
"file--5bbf06ae-f9c4-4fb9-b068-4ed3950d210f" ,
"artifact--5bbf06ae-f9c4-4fb9-b068-4ed3950d210f" ,
"observed-data--5bbf07f7-701c-45d8-b786-4fd1950d210f" ,
"file--5bbf07f7-701c-45d8-b786-4fd1950d210f" ,
"artifact--5bbf07f7-701c-45d8-b786-4fd1950d210f" ,
"observed-data--5bbf0804-142c-4835-a6c2-4038950d210f" ,
"file--5bbf0804-142c-4835-a6c2-4038950d210f" ,
"artifact--5bbf0804-142c-4835-a6c2-4038950d210f" ,
"observed-data--5bbf0907-48b0-4ee0-be05-4df4950d210f" ,
"file--5bbf0907-48b0-4ee0-be05-4df4950d210f" ,
"artifact--5bbf0907-48b0-4ee0-be05-4df4950d210f" ,
"indicator--5bbf13d1-88bc-4b03-a881-4167950d210f" ,
"indicator--0dce5235-c55f-4bd3-8ac0-31177f487562" ,
"x-misp-object--56f07a86-19e1-477b-bec7-68f3b5f92d94" ,
"indicator--31a57645-1669-4e5b-a07c-55300bdff8bf" ,
"x-misp-object--2cb20ec0-1762-421e-9640-4acca2c0d48a" ,
"indicator--0ccd4d0b-e97f-4dac-9d63-38118a4ff31b" ,
"x-misp-object--297156af-d00a-49e5-b136-0d8b658dc016" ,
"indicator--6c5c645a-1154-4e6f-9a8c-e09bec28b813" ,
"x-misp-object--c19442e0-d547-48a0-9fb2-8309d78c74e6" ,
"indicator--fec87bee-a27f-453d-81b2-b573b2980dfc" ,
"x-misp-object--fa3879d1-a417-4bb5-82c1-0771fd8f690d" ,
"indicator--b870e457-a906-4413-ac38-e27ae839ae13" ,
"x-misp-object--460c2688-f882-4aa9-9a35-4707ce903ee9" ,
"indicator--3d147083-9b4f-4565-9cd2-0be561143f21" ,
"x-misp-object--5005a835-a840-49dc-bc1b-04269dd4ab59" ,
"indicator--33c319ea-ce85-4548-996d-fada6f872995" ,
"x-misp-object--e8307187-524b-454e-a7e5-35de3ae028b0" ,
"indicator--acd0e574-aa79-4dac-80d4-e804d961b256" ,
"x-misp-object--df591dc3-d453-43fc-977d-4bb8b0bc9cb1" ,
"indicator--e7d69dcc-6ff2-4f14-a8c3-97a099dc7001" ,
"x-misp-object--fafae45c-0a60-4442-a37f-22d9fb5b84a0" ,
"indicator--51cbcdd0-059c-4be4-bb1d-689701e0af1e" ,
"x-misp-object--e35d7710-6c17-4600-a491-78d9b2d974af" ,
"indicator--5f1c620f-9bb5-44a0-a49d-d4a20fcc5b56" ,
"x-misp-object--fd6b82ad-05eb-4cc7-b654-8259cb33f397" ,
"indicator--e37a5a13-697f-433b-b91f-b796b81c6843" ,
"x-misp-object--4931955c-02f5-437a-8673-39acb95429fe" ,
"indicator--0fb7a91b-5a1d-456b-a372-9bd1792e4d59" ,
"x-misp-object--53a0ab1d-952b-4206-a553-8b111df85bd3" ,
"indicator--53e618c4-8a5d-4156-a5c6-8ea1f5328d3a" ,
"x-misp-object--b68a949d-1041-4ec5-a1ee-50774483da01" ,
"indicator--9ab3586b-39d0-4150-8279-e143df7ad88b" ,
"x-misp-object--7102d5f3-62d3-4f2f-b6fe-63baeea4ffb6" ,
"indicator--2df61ab0-86b0-444f-841d-0c3cb4543ad4" ,
"x-misp-object--90c525e7-74e9-4a8c-ab7e-a609a3633442" ,
"indicator--b0c96e50-6743-4347-b27f-2d9828182184" ,
"x-misp-object--f3cd75ac-beeb-4a9f-a2d4-b78604188d99" ,
"indicator--4a57082d-1113-4c31-ac54-fcabcd334522" ,
"x-misp-object--21387002-20ff-4b1d-ad38-09d5a5dc2556" ,
"indicator--08d435b6-9c5c-47ef-827e-0c2e535a1264" ,
"x-misp-object--8d937a08-3ec8-4710-bc00-62adce8d1fd2" ,
"indicator--e31585a9-e153-4b53-b420-d6e0519e00c4" ,
"x-misp-object--96804372-de78-45de-bd01-063861671447" ,
"indicator--d2f7d021-4acb-4319-81f9-53370a45e832" ,
"x-misp-object--4d21d162-1fb4-4198-8949-2c296cd028cd" ,
"indicator--74246f0f-70de-4ad4-a1f4-361cac2bd78f" ,
"x-misp-object--4dffe3df-3904-40e0-bc19-f002f1b33eeb" ,
"indicator--88c615e1-7bbb-4b0a-bddc-7b85e2bb579e" ,
"x-misp-object--7c5e4ccd-80e2-47cd-8cb1-a56ef4e0b865" ,
"indicator--6c663bc9-cfc1-4ca0-a03c-0b4f60d6e7d4" ,
"x-misp-object--5bd663c3-7b0b-41f6-8a5e-cbc776ad81ea" ,
"indicator--109617d0-6a8e-4cc9-aae1-92e11425e4cd" ,
"x-misp-object--afaeb002-c625-489a-9cec-ce0191ed8d49" ,
"indicator--bd146a67-39d0-4e55-bd92-27ad3ed4b6b4" ,
"x-misp-object--db4f4e2d-3ac3-4dbc-9519-3a4204112ecc" ,
"indicator--4f7b9f67-83dc-46f9-af98-a4b1fc542771" ,
"x-misp-object--9094218a-0a32-4747-8f21-bf0f7bfed79d" ,
"indicator--3302d71e-7875-4c88-b2ba-41dad3c95145" ,
"x-misp-object--16f41dd9-5ec8-42fc-9def-e3b9f5868d5b" ,
"indicator--cc368270-d79e-4a9d-ba7d-064db8e3425a" ,
"x-misp-object--7ab71cfb-ea18-49f4-bfc5-cd3ee49738cd" ,
"indicator--344a7eaa-7132-4b02-82c1-e5584b3169c1" ,
"x-misp-object--46d0a508-b361-4427-a099-64e9f943116d" ,
"indicator--245a788b-a28c-4d13-9cfb-6a3f67f892f4" ,
"x-misp-object--c53779ab-34b1-4e06-80a2-f060d1dd2212" ,
"indicator--3ca55f8e-4d26-48b5-92fd-5ea47ba8b291" ,
"x-misp-object--fa93027d-b99b-4cc3-a32d-f0afdec46d12" ,
"indicator--969cd2bf-3874-4c07-a054-5eec49bf0079" ,
"x-misp-object--341e106f-4861-4bb6-9581-fbee0cb3632c" ,
"indicator--46b26e92-d82a-4fea-8c89-580becaa903a" ,
"x-misp-object--f4196559-f992-4516-bce9-7658600a7894" ,
"indicator--ba352a5d-16d7-4309-9282-c2e88311365b" ,
"x-misp-object--afbfb77f-dbbf-476b-bd72-4cc29f2d52eb" ,
"indicator--277fd140-36c3-4b42-a9f6-56ec81f87384" ,
"x-misp-object--cdf6b744-d24a-49f9-8ac4-2c2c72de5e56" ,
"indicator--2d1711bf-a2cb-4113-96c0-26c70f04bc38" ,
"x-misp-object--348d53ec-29f8-48bd-b32e-d4d632e8bf5d" ,
"indicator--efb4664d-3744-4557-a6b0-eadb0e46f982" ,
"x-misp-object--864c648b-dfb9-457c-84a7-a69a18909bfc" ,
"indicator--0a31c783-7db1-4ee2-9113-dd1393956968" ,
"x-misp-object--d49c4443-b917-485f-9988-346a4c174c36" ,
"indicator--5a1bf1ba-5c6b-4882-af35-f992c5545079" ,
"x-misp-object--7fbb889d-657e-40e0-9458-b7a422b9ccd2" ,
"indicator--58012976-30e2-4822-b6a7-fdbf701fc7b8" ,
"x-misp-object--cb449345-1d6a-466a-ba9b-b35a37462d75" ,
"indicator--dc0c9d2f-28dd-44fe-913a-db5481dfc8ba" ,
"x-misp-object--ee33f122-421f-4d64-82c7-8e6f75329c57" ,
"indicator--a4fe4a04-2083-4108-a050-f5920409d023" ,
"x-misp-object--43dd37f2-90c2-463f-9166-eb111de8e695" ,
"indicator--5ecac345-ba1e-4426-9400-0f42240de6f9" ,
"x-misp-object--3d957cef-2600-427d-8c91-ca9a3cc06dbb" ,
"indicator--b5662b78-6d3b-44cf-86db-a7ffd1324345" ,
"x-misp-object--e2436b65-f8eb-47f8-96fd-a957987bf24e" ,
"indicator--c18dbdfc-e3d4-419a-9d61-399cbd689f00" ,
"x-misp-object--f73e119f-231f-497c-8b71-1b3c9c2a475a"
] ,
"labels" : [
"Threat-Report" ,
"misp:tool=\"MISP-STIX-Converter\"" ,
"misp-galaxy:threat-actor=\"MuddyWater\"" ,
"misp-galaxy:mitre-enterprise-attack-intrusion-set=\"MuddyWater - G0069\"" ,
"enisa:nefarious-activity-abuse=\"spear-phishing-attacks\"" ,
"smart-airports-threats:malicious-actions=\"social-attacks-phishing-spearphishing\"" ,
"misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Spearphishing Attachment - T1193\"" ,
"misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Scripting - T1064\""
] ,
"object_marking_refs" : [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5bbe03d3-9090-4212-b186-4139950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T13:51:29.000Z" ,
"modified" : "2018-10-10T13:51:29.000Z" ,
"first_observed" : "2018-10-10T13:51:29Z" ,
"last_observed" : "2018-10-10T13:51:29Z" ,
"number_observed" : 1 ,
"object_refs" : [
"url--5bbe03d3-9090-4212-b186-4139950d210f"
] ,
"labels" : [
"misp:type=\"link\"" ,
"misp:category=\"External analysis\"" ,
"osint:source-type=\"blog-post\""
]
} ,
{
"type" : "url" ,
"spec_version" : "2.1" ,
"id" : "url--5bbe03d3-9090-4212-b186-4139950d210f" ,
"value" : "https://securelist.com/muddywater/88059/"
} ,
{
"type" : "x-misp-attribute" ,
"spec_version" : "2.1" ,
"id" : "x-misp-attribute--5bbe097d-c65c-4fc4-9a33-45c3950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:15:25.000Z" ,
"modified" : "2018-10-10T14:15:25.000Z" ,
"labels" : [
"misp:type=\"text\"" ,
"misp:category=\"External analysis\""
] ,
"x_misp_category" : "External analysis" ,
"x_misp_type" : "text" ,
"x_misp_value" : "MuddyWater is a relatively new APT that surfaced in 2017. It has focused mainly on governmental targets in Iraq and Saudi Arabia, according to past telemetry. However, the group behind MuddyWater has been known to target other countries in the Middle East, Europe and the US. We recently noticed a large amount of spear phishing documents that appear to be targeting government bodies, military entities, telcos and educational institutions in Jordan, Turkey, Azerbaijan and Pakistan, in addition to the continuous targeting of Iraq and Saudi Arabia, other victims were also detected in Mali, Austria, Russia, Iran and Bahrain.. These new documents have appeared throughout 2018 and escalated from May onwards. The attacks are still ongoing."
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0e30-cfc4-432c-a427-4daa950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:35:28.000Z" ,
"modified" : "2018-10-10T14:35:28.000Z" ,
"pattern" : "[file:hashes.MD5 = '08acd1149b09bf6455c553f512b51085']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:35:28Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0e31-77ac-47bb-828d-462a950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:35:29.000Z" ,
"modified" : "2018-10-10T14:35:29.000Z" ,
"pattern" : "[file:hashes.MD5 = 'a9ec30226c83ba6d7abb8d2011cdae14']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:35:29Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0e35-5910-4145-bd71-4120950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:35:33.000Z" ,
"modified" : "2018-10-10T14:35:33.000Z" ,
"pattern" : "[file:hashes.MD5 = 'e5683fb480353c0dec333a7573710748']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:35:33Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0e4b-4ffc-4a67-9092-41ad950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:35:55.000Z" ,
"modified" : "2018-10-10T14:35:55.000Z" ,
"pattern" : "[file:hashes.MD5 = '159238b473f80272fdcd0a8ddf336a91']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:35:55Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0e5f-f118-40ee-a5a1-4eff950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:36:15.000Z" ,
"modified" : "2018-10-10T14:36:15.000Z" ,
"pattern" : "[file:hashes.MD5 = '16ac1a2c1e1c3b49e1a3a48fb71cc74f']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:36:15Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0e61-63d8-4c71-87ca-4d1d950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:36:17.000Z" ,
"modified" : "2018-10-10T14:36:17.000Z" ,
"pattern" : "[file:hashes.MD5 = '1b086ab28e3d6f73c6605f9ae087ad4a']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:36:17Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0e63-7954-443a-b3b9-4e09950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:36:19.000Z" ,
"modified" : "2018-10-10T14:36:19.000Z" ,
"pattern" : "[file:hashes.MD5 = '23c82e8c028af5c64cbe37314732ec19']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:36:19Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0e65-ed30-48a8-ad34-4e06950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:36:21.000Z" ,
"modified" : "2018-10-10T14:36:21.000Z" ,
"pattern" : "[file:hashes.MD5 = '24e1bd221ba3813ed7b6056136237587']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:36:21Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0e67-c5ec-4b9a-b1ae-4cfd950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:36:23.000Z" ,
"modified" : "2018-10-10T14:36:23.000Z" ,
"pattern" : "[file:hashes.MD5 = '2e82e242cb0684b98a8f6f2c0e8a12f3']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:36:23Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0e68-e554-4c61-b11e-4afc950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:36:24.000Z" ,
"modified" : "2018-10-10T14:36:24.000Z" ,
"pattern" : "[file:hashes.MD5 = '37f7e6e5f073508e1ee552ebea5d200e']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:36:24Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0e6b-e194-421a-bef5-4484950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:36:27.000Z" ,
"modified" : "2018-10-10T14:36:27.000Z" ,
"pattern" : "[file:hashes.MD5 = '3bb14adb551663fd2328d59f653ba757']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:36:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0e70-baf8-4293-8e07-4744950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:36:32.000Z" ,
"modified" : "2018-10-10T14:36:32.000Z" ,
"pattern" : "[file:hashes.MD5 = '3c2a0d6d0ecf06f1be9ad411d06f7ba8']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:36:32Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0e75-c64c-4d6b-adda-404e950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:36:37.000Z" ,
"modified" : "2018-10-10T14:36:37.000Z" ,
"pattern" : "[file:hashes.MD5 = '4c5a5c236c9f4480b3d725f297673fad']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:36:37Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0e76-2ab4-491d-9f11-4471950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:36:38.000Z" ,
"modified" : "2018-10-10T14:36:38.000Z" ,
"pattern" : "[file:hashes.MD5 = '4f873578956d2790101443f24e4bd4d3']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:36:38Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0e78-ef4c-49c0-818b-4b9e950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:36:40.000Z" ,
"modified" : "2018-10-10T14:36:40.000Z" ,
"pattern" : "[file:hashes.MD5 = '5466c8a099d1d30096775b1f4357d3cf']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:36:40Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0e7a-aafc-4048-b48e-4e3a950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:36:42.000Z" ,
"modified" : "2018-10-10T14:36:42.000Z" ,
"pattern" : "[file:hashes.MD5 = '59502e209aedf80e170e653306ca1553']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:36:42Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0e7b-a5c4-4d06-a1a1-473b950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:36:43.000Z" ,
"modified" : "2018-10-10T14:36:43.000Z" ,
"pattern" : "[file:hashes.MD5 = '5a42a712e3b3cfa1db32d9e3d832f8f1']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:36:43Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0e7d-9788-4e8d-894e-462f950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:36:45.000Z" ,
"modified" : "2018-10-10T14:36:45.000Z" ,
"pattern" : "[file:hashes.MD5 = '5bd61a94e7698574eaf82ef277316463']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:36:45Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0e7e-eda0-42c4-a5e8-4b2d950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:36:46.000Z" ,
"modified" : "2018-10-10T14:36:46.000Z" ,
"pattern" : "[file:hashes.MD5 = '5de97ae178888f2dd222bb8a66060ac2']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:36:46Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0e81-3a68-4dc6-abc8-477c950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:36:49.000Z" ,
"modified" : "2018-10-10T14:36:49.000Z" ,
"pattern" : "[file:hashes.MD5 = '665947cf7037a6772687b69279753cdf']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:36:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0e87-48e0-4c21-816d-4374950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:36:55.000Z" ,
"modified" : "2018-10-10T14:36:55.000Z" ,
"pattern" : "[file:hashes.MD5 = '7a2ff07283ddc69d9f34cfa0d3c936d4']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:36:55Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0e88-5cc0-4596-b3ec-4d53950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:36:56.000Z" ,
"modified" : "2018-10-10T14:36:56.000Z" ,
"pattern" : "[file:hashes.MD5 = '7beb94f602e97785370fec2d059d54a5']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:36:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0e89-a904-44e3-a565-4a99950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:36:57.000Z" ,
"modified" : "2018-10-10T14:36:57.000Z" ,
"pattern" : "[file:hashes.MD5 = '801f34abbf90ac2b4fb4b6289830cd16']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:36:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0e8a-72d0-4209-b1bb-4368950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:36:58.000Z" ,
"modified" : "2018-10-10T14:36:58.000Z" ,
"pattern" : "[file:hashes.MD5 = '864d6321be50f29e7a7a4bfab746245a']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:36:58Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0e8c-b780-43ad-a2f6-4264950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:00.000Z" ,
"modified" : "2018-10-10T14:37:00.000Z" ,
"pattern" : "[file:hashes.MD5 = '8a36d91ca331f62642dbcafc2ea1b1ab']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:00Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0e8f-4c14-4a29-9a46-4993950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:03.000Z" ,
"modified" : "2018-10-10T14:37:03.000Z" ,
"pattern" : "[file:hashes.MD5 = '9486593e4fb5a4d440093d54a3519187']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:03Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0e94-dec8-47f8-bf21-4e37950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:08.000Z" ,
"modified" : "2018-10-10T14:37:08.000Z" ,
"pattern" : "[file:hashes.MD5 = '94edf251b5fe7cc19488b5f0c3c3e359']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:08Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0e97-8814-4726-8c7f-4ffa950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:11.000Z" ,
"modified" : "2018-10-10T14:37:11.000Z" ,
"pattern" : "[file:hashes.MD5 = '9c6648cedeb3f5d9f6d104e638bd0c3d']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:11Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0e99-1f34-4d28-9b10-4f73950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:13.000Z" ,
"modified" : "2018-10-10T14:37:13.000Z" ,
"pattern" : "[file:hashes.MD5 = '9f4044674100a8c28f9ed1b336c337ce']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:13Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0e9a-b368-4341-84fd-4512950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:14.000Z" ,
"modified" : "2018-10-10T14:37:14.000Z" ,
"pattern" : "[file:hashes.MD5 = 'aa1e8d0e1c4d4eb9984124df003ea7f2']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:14Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0e9b-32fc-483f-b112-4d1e950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:15.000Z" ,
"modified" : "2018-10-10T14:37:15.000Z" ,
"pattern" : "[file:hashes.MD5 = 'aa564e207926d06b8a59ba50ca2c543d']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:15Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0ea1-0b50-4c89-bfd7-4557950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:21.000Z" ,
"modified" : "2018-10-10T14:37:21.000Z" ,
"pattern" : "[file:hashes.MD5 = 'ab4f947f4649b9ec28d182b02778aa69']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:21Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0ea4-28c4-47f9-8800-491d950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:24.000Z" ,
"modified" : "2018-10-10T14:37:24.000Z" ,
"pattern" : "[file:hashes.MD5 = 'ad92ccf85ec170f340457d33bbb81df5']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:24Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0ea9-ccb4-464e-af89-4bd7950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:29.000Z" ,
"modified" : "2018-10-10T14:37:29.000Z" ,
"pattern" : "[file:hashes.MD5 = 'b8939fa58fad8aa1ec271f6dae0b7255']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:29Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0ead-7954-4f96-a028-4609950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:33.000Z" ,
"modified" : "2018-10-10T14:37:33.000Z" ,
"pattern" : "[file:hashes.MD5 = 'bb476622bcb0c666e12fbe4ccda8bbef']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:33Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0eaf-dae8-47d8-9724-44fb950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:35.000Z" ,
"modified" : "2018-10-10T14:37:35.000Z" ,
"pattern" : "[file:hashes.MD5 = 'be62fc5b1576e0a8491519e10bab931d']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:35Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0eb1-f384-4426-832e-4a13950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:37.000Z" ,
"modified" : "2018-10-10T14:37:37.000Z" ,
"pattern" : "[file:hashes.MD5 = 'bf310319d6ef95f69a45fc4f2d237ed4']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:37Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0eb6-77cc-4215-8b82-44b5950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:42.000Z" ,
"modified" : "2018-10-10T14:37:42.000Z" ,
"pattern" : "[file:hashes.MD5 = 'c375bbf248592cee1a1999227457c300']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:42Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0eb7-dde0-44b3-a715-4f60950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:43.000Z" ,
"modified" : "2018-10-10T14:37:43.000Z" ,
"pattern" : "[file:hashes.MD5 = 'c73fc71ee35e99230941f03fc32934d9']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:43Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0eb7-4230-4f74-b8f5-4487950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:43.000Z" ,
"modified" : "2018-10-10T14:37:43.000Z" ,
"pattern" : "[file:hashes.MD5 = 'c8b0458c384fd34971875b1c753c9c7c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:43Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0eb8-c7c4-4f67-82c8-4443950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:44.000Z" ,
"modified" : "2018-10-10T14:37:44.000Z" ,
"pattern" : "[file:hashes.MD5 = 'cd371d1d3bd7c8e2110587cfa8b7eaea']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:44Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0eb8-fc10-4a90-b12e-49c3950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:44.000Z" ,
"modified" : "2018-10-10T14:37:44.000Z" ,
"pattern" : "[file:hashes.MD5 = 'ce2df2907ce543438c19cfaf6c14f699']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:44Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0eb9-aa60-4db6-908c-4ee2950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:45.000Z" ,
"modified" : "2018-10-10T14:37:45.000Z" ,
"pattern" : "[file:hashes.MD5 = 'd15aee026074fbd18f780fb51ec0632a']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:45Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0ebb-5d08-402d-8c6d-4fce950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:47.000Z" ,
"modified" : "2018-10-10T14:37:47.000Z" ,
"pattern" : "[file:hashes.MD5 = 'd632c8444aab1b43a663401e80c0bac4']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:47Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0ebe-b0a4-477b-9a65-4e41950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:50.000Z" ,
"modified" : "2018-10-10T14:37:50.000Z" ,
"pattern" : "[file:hashes.MD5 = 'd6acee43d61cbd4bcd7a5bdf4ed9b343']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:50Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0ebf-aa70-402d-88aa-4443950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:51.000Z" ,
"modified" : "2018-10-10T14:37:51.000Z" ,
"pattern" : "[file:hashes.MD5 = 'e3e25957b738968befcf2333aa637d97']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:51Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0ebf-a388-432d-a5c3-4130950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:51.000Z" ,
"modified" : "2018-10-10T14:37:51.000Z" ,
"pattern" : "[file:hashes.MD5 = 'eb69fb45feb97af81c2f306564acc2da']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:51Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0ec0-35a8-4d19-ad28-4394950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:52.000Z" ,
"modified" : "2018-10-10T14:37:52.000Z" ,
"pattern" : "[file:hashes.MD5 = 'f00fd318bf58586c29ab970132d1fd2a']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0ec0-fdfc-410a-9626-4610950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:52.000Z" ,
"modified" : "2018-10-10T14:37:52.000Z" ,
"pattern" : "[file:hashes.MD5 = 'f2b5373f32a4b9b3d34701ff973ba69c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0ec1-ec40-4cf8-be41-4d6d950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:53.000Z" ,
"modified" : "2018-10-10T14:37:53.000Z" ,
"pattern" : "[file:hashes.MD5 = 'f84914c30ae4e6b9b1f23d5c01e001ed']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:53Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0ec1-3b70-49d7-b4e4-456d950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:53.000Z" ,
"modified" : "2018-10-10T14:37:53.000Z" ,
"pattern" : "[file:hashes.MD5 = 'faa4469d5cd90623312c86d651f2d930']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:53Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0ec2-c4e4-45c1-8ca7-4c76950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:54.000Z" ,
"modified" : "2018-10-10T14:37:54.000Z" ,
"pattern" : "[file:hashes.MD5 = 'ffb8ea0347a3af3dd2ab1b4e5a1be18a']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:54Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0ec2-04e8-4565-a44a-4a81950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:54.000Z" ,
"modified" : "2018-10-10T14:37:54.000Z" ,
"pattern" : "[file:hashes.MD5 = '345b1ea293764df86506f97ba498cc5e']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:54Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0ec2-2300-465f-8b36-476b950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:54.000Z" ,
"modified" : "2018-10-10T14:37:54.000Z" ,
"pattern" : "[file:hashes.MD5 = '029cb7e622f4eb0d058d577c9d322e92']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:54Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0ec3-44e8-46c7-9191-42d9950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:55.000Z" ,
"modified" : "2018-10-10T14:37:55.000Z" ,
"pattern" : "[file:hashes.MD5 = '06178b5181f30ce00cd55e2690f667ac']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:55Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0ec3-d018-4ca0-91c1-401d950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:55.000Z" ,
"modified" : "2018-10-10T14:37:55.000Z" ,
"pattern" : "[file:hashes.MD5 = '2b8ab9112e34bb910055d85ec800db3f']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:55Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0ec4-2698-487e-af5d-4478950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:56.000Z" ,
"modified" : "2018-10-10T14:37:56.000Z" ,
"pattern" : "[file:hashes.MD5 = '47ec75d3290add179ac5218d193bb9a8']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0ec4-14c0-4eab-9a01-4e6d950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:56.000Z" ,
"modified" : "2018-10-10T14:37:56.000Z" ,
"pattern" : "[file:hashes.MD5 = 'befc203d7fa4c91326791a73e6d6b4da']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0ec7-3544-4e3f-9d4e-44ce950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:59.000Z" ,
"modified" : "2018-10-10T14:37:59.000Z" ,
"pattern" : "[file:hashes.MD5 = 'c561e81e30316208925bfddb3cf3360a']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:59Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0ec7-2310-4abb-93ec-4849950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:37:59.000Z" ,
"modified" : "2018-10-10T14:37:59.000Z" ,
"pattern" : "[file:hashes.MD5 = '132efd7b3bdfb591c1bf2a4e19c710eb']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:37:59Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0ec8-30f4-4746-a683-4ff2950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:38:00.000Z" ,
"modified" : "2018-10-10T14:38:00.000Z" ,
"pattern" : "[file:hashes.MD5 = 'e7a6c57566d9523daa57fe16f52e377e']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:38:00Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0ecc-5798-4b31-811c-486f950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:38:04.000Z" ,
"modified" : "2018-10-10T14:38:04.000Z" ,
"pattern" : "[file:hashes.MD5 = 'c0e35c4523a7931f4c99616d6079fd14']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:38:04Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbe0ecf-550c-4572-882a-4b4c950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-10T14:38:07.000Z" ,
"modified" : "2018-10-10T14:38:07.000Z" ,
"pattern" : "[file:hashes.MD5 = '245fa82c89875b70c2669921d4ba14d3']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-10T14:38:07Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"md5\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbef709-1198-44fb-b614-4783950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:08:57.000Z" ,
"modified" : "2018-10-11T07:08:57.000Z" ,
"pattern" : "[file:name = '\\\\%SystemDrive\\\\%\\\\ProgramData\\\\EventManager.dll']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:08:57Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbef70b-d0d0-4c6a-82f9-4b5e950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:08:59.000Z" ,
"modified" : "2018-10-11T07:08:59.000Z" ,
"pattern" : "[file:name = '\\\\%SystemDrive\\\\%\\\\ProgramData\\\\EventManager.logs']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:08:59Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbef70c-fb50-4fef-89ec-4e8e950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:09:00.000Z" ,
"modified" : "2018-10-11T07:09:00.000Z" ,
"pattern" : "[file:name = '\\\\%SystemDrive\\\\%\\\\ProgramData\\\\WindowsDefenderService.ini']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:09:00Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbef70f-c224-473e-a5b5-4b40950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:09:03.000Z" ,
"modified" : "2018-10-11T07:09:03.000Z" ,
"pattern" : "[file:name = '\\\\%SystemDrive\\\\%\\\\ProgramData\\\\Defender.sct']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:09:03Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbef710-8e94-4a38-b25f-4599950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:09:04.000Z" ,
"modified" : "2018-10-11T07:09:04.000Z" ,
"pattern" : "[file:name = '\\\\%SystemDrive\\\\%\\\\ProgramData\\\\DefenderService.inf']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:09:04Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbef710-9934-43aa-aff6-40e8950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:09:04.000Z" ,
"modified" : "2018-10-11T07:09:04.000Z" ,
"pattern" : "[file:name = '\\\\%SystemDrive\\\\%\\\\ProgramData\\\\WindowsDefender.ini']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:09:04Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbef711-0c90-406b-b169-4894950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:09:05.000Z" ,
"modified" : "2018-10-11T07:09:05.000Z" ,
"pattern" : "[file:name = '\\\\%SystemDrive\\\\%\\\\ProgramData\\\\ZIPSDK\\\\InstallConfNT.vbs']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:09:05Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbef712-8894-4c7d-a835-4122950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:09:06.000Z" ,
"modified" : "2018-10-11T07:09:06.000Z" ,
"pattern" : "[file:name = '\\\\%SystemDrive\\\\%\\\\ProgramData\\\\ZIPSDK\\\\ProjectConfManagerNT.ini']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:09:06Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbef712-718c-42cd-ba5b-4b05950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:09:06.000Z" ,
"modified" : "2018-10-11T07:09:06.000Z" ,
"pattern" : "[file:name = '\\\\%SystemDrive\\\\%\\\\ProgramData\\\\WindowsDefenderTask.ini']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:09:06Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbef713-05c4-47d3-bb74-4efc950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:09:07.000Z" ,
"modified" : "2018-10-11T07:09:07.000Z" ,
"pattern" : "[file:name = '\\\\%SystemDrive\\\\%\\\\ProgramData\\\\WindowsDefenderTask.txt']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:09:07Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbef713-eec4-419d-9dff-4734950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:09:07.000Z" ,
"modified" : "2018-10-11T07:09:07.000Z" ,
"pattern" : "[file:name = '\\\\%SystemDrive\\\\%\\\\ProgramData\\\\WindowsDefenderTask.xml']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:09:07Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbef717-56c0-4ab1-901a-4ab8950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:09:11.000Z" ,
"modified" : "2018-10-11T07:09:11.000Z" ,
"pattern" : "[file:name = '\\\\%SystemDrive\\\\%\\\\ProgramData\\\\DefenderNT\\\\ConfigRegister.vbs']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:09:11Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbef717-d0ec-4611-8724-4025950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:09:11.000Z" ,
"modified" : "2018-10-11T07:09:11.000Z" ,
"pattern" : "[file:name = '\\\\%SystemDrive\\\\%\\\\ProgramData\\\\DefenderNT\\\\SetupConf.ini']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:09:11Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbef718-37ac-4dbf-a117-4a40950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:09:12.000Z" ,
"modified" : "2018-10-11T07:09:12.000Z" ,
"pattern" : "[file:name = '\\\\%SystemDrive\\\\%\\\\ProgramData\\\\ASDKiMalwareSDK\\\\ProjectConfSDK.vbs']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:09:12Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbef718-b9c4-43c0-91b9-4bee950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:09:12.000Z" ,
"modified" : "2018-10-11T07:09:12.000Z" ,
"pattern" : "[file:name = '\\\\%SystemDrive\\\\%\\\\ProgramData\\\\ASDKiMalwareSDK\\\\SetupConfSDK.ini']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:09:12Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbef719-709c-413d-af51-4ee4950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:09:13.000Z" ,
"modified" : "2018-10-11T07:09:13.000Z" ,
"pattern" : "[file:name = '\\\\%SystemDrive\\\\%\\\\ProgramData\\\\FirefoxSDK\\\\ConfigRegisterSDK.ini']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:09:13Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbef719-e438-4400-bfe2-4939950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:09:13.000Z" ,
"modified" : "2018-10-11T07:09:13.000Z" ,
"pattern" : "[file:name = '\\\\%SystemDrive\\\\%\\\\ProgramData\\\\FirefoxSDK\\\\ConfigRegisterSDK.vbs']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:09:13Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbef71a-ad08-458c-86e2-4d27950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:09:14.000Z" ,
"modified" : "2018-10-11T07:09:14.000Z" ,
"pattern" : "[file:name = '\\\\%SystemDrive\\\\%\\\\ProgramData\\\\OneDrive.dll']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:09:14Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbef71d-d7a8-4c02-b480-43d0950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:09:17.000Z" ,
"modified" : "2018-10-11T07:09:17.000Z" ,
"pattern" : "[file:name = '\\\\%SystemDrive\\\\%\\\\ProgramData\\\\OneDrive.html']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:09:17Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbef71d-eda4-4f12-9f0c-43bd950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:09:17.000Z" ,
"modified" : "2018-10-11T07:09:17.000Z" ,
"pattern" : "[file:name = '\\\\%SystemDrive\\\\%\\\\ProgramData\\\\OneDrive.ini']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:09:17Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbef71e-f328-4196-a141-4eb3950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:09:18.000Z" ,
"modified" : "2018-10-11T07:09:18.000Z" ,
"pattern" : "[file:name = '\\\\%SystemDrive\\\\%\\\\ProgramData\\\\WindowsNT\\\\WindowsNT.ini']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:09:18Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbef71e-e224-4ba9-aed2-4332950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:09:18.000Z" ,
"modified" : "2018-10-11T07:09:18.000Z" ,
"pattern" : "[file:name = '\\\\%SystemDrive\\\\%\\\\ProgramData\\\\WindowsNT\\\\WindowsNT.vbs']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:09:18Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbef71f-44d4-4490-8ab7-4407950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:09:19.000Z" ,
"modified" : "2018-10-11T07:09:19.000Z" ,
"pattern" : "[file:name = '\\\\%SystemDrive\\\\%\\\\ProgramData\\\\SYSTEM32SDK\\\\ConfManagerNT.vbs']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:09:19Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbef71f-1b78-4c0a-b435-4a39950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:09:19.000Z" ,
"modified" : "2018-10-11T07:09:19.000Z" ,
"pattern" : "[file:name = '\\\\%SystemDrive\\\\%\\\\ProgramData\\\\SYSTEM32SDK\\\\ProjectConfManagerNT.ini']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:09:19Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5bbef720-43a8-4b70-a29a-49e7950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:09:20.000Z" ,
"modified" : "2018-10-11T07:09:20.000Z" ,
"first_observed" : "2018-10-11T07:09:20Z" ,
"last_observed" : "2018-10-11T07:09:20Z" ,
"number_observed" : 1 ,
"object_refs" : [
"windows-registry-key--5bbef720-43a8-4b70-a29a-49e7950d210f"
] ,
"labels" : [
"misp:type=\"regkey\"" ,
"misp:category=\"Persistence mechanism\""
]
} ,
{
"type" : "windows-registry-key" ,
"spec_version" : "2.1" ,
"id" : "windows-registry-key--5bbef720-43a8-4b70-a29a-49e7950d210f" ,
"key" : "%windir%\\System32\\Tasks\\Microsoft\\WindowsDefenderUpdater"
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5bbef721-0198-44d1-87f9-4a03950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:09:21.000Z" ,
"modified" : "2018-10-11T07:09:21.000Z" ,
"first_observed" : "2018-10-11T07:09:21Z" ,
"last_observed" : "2018-10-11T07:09:21Z" ,
"number_observed" : 1 ,
"object_refs" : [
"windows-registry-key--5bbef721-0198-44d1-87f9-4a03950d210f"
] ,
"labels" : [
"misp:type=\"regkey\"" ,
"misp:category=\"Persistence mechanism\""
]
} ,
{
"type" : "windows-registry-key" ,
"spec_version" : "2.1" ,
"id" : "windows-registry-key--5bbef721-0198-44d1-87f9-4a03950d210f" ,
"key" : "%windir%\\System32\\Tasks\\Microsoft\\MicrosoftOneDrive"
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5bbef721-ef90-4859-937a-431a950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:09:21.000Z" ,
"modified" : "2018-10-11T07:09:21.000Z" ,
"first_observed" : "2018-10-11T07:09:21Z" ,
"last_observed" : "2018-10-11T07:09:21Z" ,
"number_observed" : 1 ,
"object_refs" : [
"windows-registry-key--5bbef721-ef90-4859-937a-431a950d210f"
] ,
"labels" : [
"misp:type=\"regkey\"" ,
"misp:category=\"Persistence mechanism\""
]
} ,
{
"type" : "windows-registry-key" ,
"spec_version" : "2.1" ,
"id" : "windows-registry-key--5bbef721-ef90-4859-937a-431a950d210f" ,
"key" : "%windir%\\System32\\Tasks\\Microsoft\\WindowsDifenderUpdate"
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5bbef722-161c-479c-a92a-41ee950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:09:22.000Z" ,
"modified" : "2018-10-11T07:09:22.000Z" ,
"first_observed" : "2018-10-11T07:09:22Z" ,
"last_observed" : "2018-10-11T07:09:22Z" ,
"number_observed" : 1 ,
"object_refs" : [
"windows-registry-key--5bbef722-161c-479c-a92a-41ee950d210f"
] ,
"labels" : [
"misp:type=\"regkey\"" ,
"misp:category=\"Persistence mechanism\""
]
} ,
{
"type" : "windows-registry-key" ,
"spec_version" : "2.1" ,
"id" : "windows-registry-key--5bbef722-161c-479c-a92a-41ee950d210f" ,
"key" : "%windir%\\System32\\Tasks\\Microsoft\\WindowsSystem32SDK"
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5bbef722-1038-4ec6-8301-493c950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:09:22.000Z" ,
"modified" : "2018-10-11T07:09:22.000Z" ,
"first_observed" : "2018-10-11T07:09:22Z" ,
"last_observed" : "2018-10-11T07:09:22Z" ,
"number_observed" : 1 ,
"object_refs" : [
"windows-registry-key--5bbef722-1038-4ec6-8301-493c950d210f"
] ,
"labels" : [
"misp:type=\"regkey\"" ,
"misp:category=\"Persistence mechanism\""
]
} ,
{
"type" : "windows-registry-key" ,
"spec_version" : "2.1" ,
"id" : "windows-registry-key--5bbef722-1038-4ec6-8301-493c950d210f" ,
"key" : "%windir%\\System32\\Tasks\\Microsoft\\WindowsDefenderSDK"
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5bbef723-6778-4a05-a3fc-45a7950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:09:23.000Z" ,
"modified" : "2018-10-11T07:09:23.000Z" ,
"first_observed" : "2018-10-11T07:09:23Z" ,
"last_observed" : "2018-10-11T07:09:23Z" ,
"number_observed" : 1 ,
"object_refs" : [
"windows-registry-key--5bbef723-6778-4a05-a3fc-45a7950d210f"
] ,
"labels" : [
"misp:type=\"regkey\"" ,
"misp:category=\"Persistence mechanism\""
]
} ,
{
"type" : "windows-registry-key" ,
"spec_version" : "2.1" ,
"id" : "windows-registry-key--5bbef723-6778-4a05-a3fc-45a7950d210f" ,
"key" : "%windir%\\System32\\Tasks\\Microsoft\\WindowsMalwareDefenderSDK"
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5bbef723-1a90-496f-a0a6-4759950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:09:23.000Z" ,
"modified" : "2018-10-11T07:09:23.000Z" ,
"first_observed" : "2018-10-11T07:09:23Z" ,
"last_observed" : "2018-10-11T07:09:23Z" ,
"number_observed" : 1 ,
"object_refs" : [
"windows-registry-key--5bbef723-1a90-496f-a0a6-4759950d210f"
] ,
"labels" : [
"misp:type=\"regkey\"" ,
"misp:category=\"Persistence mechanism\""
]
} ,
{
"type" : "windows-registry-key" ,
"spec_version" : "2.1" ,
"id" : "windows-registry-key--5bbef723-1a90-496f-a0a6-4759950d210f" ,
"key" : "%windir%\\System32\\Tasks\\Microsoft\\WindowsMalwareByteSDK"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbefcc3-9170-475c-a872-485c950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:33:23.000Z" ,
"modified" : "2018-10-11T07:33:23.000Z" ,
"pattern" : "[url:value = 'http://www.cankayasrc.com/style/js/main.php']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:33:23Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"url\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbefcc4-cd58-40bc-a143-4d49950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:33:24.000Z" ,
"modified" : "2018-10-11T07:33:24.000Z" ,
"pattern" : "[url:value = 'http://ektamservis.com/includes/main.php']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:33:24Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"url\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbefcc4-691c-44a9-a0a5-486a950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:33:24.000Z" ,
"modified" : "2018-10-11T07:33:24.000Z" ,
"pattern" : "[url:value = 'http://gtme.ae/font-awesome/css/main.php']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:33:24Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"url\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbefcc5-1f00-409d-925b-412b950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:33:25.000Z" ,
"modified" : "2018-10-11T07:33:25.000Z" ,
"pattern" : "[url:value = 'https://www.adfg.ae/wp-includes/widgets/main.php']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:33:25Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"url\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbefcc5-02fc-47ae-84e3-43f9950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:33:25.000Z" ,
"modified" : "2018-10-11T07:33:25.000Z" ,
"pattern" : "[url:value = 'http://adibf.ae/wp-includes/js/main.php']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:33:25Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"url\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbefcc6-dd74-4a21-abcc-406a950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:33:26.000Z" ,
"modified" : "2018-10-11T07:33:26.000Z" ,
"pattern" : "[url:value = 'http://hubinasia.com/wp-includes/widgets/main.php']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:33:26Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"url\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbefcc9-8280-4d95-a1e2-481f950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:33:29.000Z" ,
"modified" : "2018-10-11T07:33:29.000Z" ,
"pattern" : "[url:value = 'https://benangin.com/wp-includes/widgets/main.php']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:33:29Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"url\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbefccc-5cb0-488b-b32f-45a2950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:33:32.000Z" ,
"modified" : "2018-10-11T07:33:32.000Z" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '104.237.233.60']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:33:32Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbefccd-2f04-4610-930d-49f8950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:33:33.000Z" ,
"modified" : "2018-10-11T07:33:33.000Z" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '104.237.255.212']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:33:33Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbefcce-78d0-4e0a-9e6c-4951950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:33:33.000Z" ,
"modified" : "2018-10-11T07:33:33.000Z" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '104.237.233.40']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:33:33Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbefcce-5468-4b10-b415-4b3b950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:33:34.000Z" ,
"modified" : "2018-10-11T07:33:34.000Z" ,
"pattern" : "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.9.0.155']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T07:33:34Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Network activity"
}
] ,
"labels" : [
"misp:type=\"ip-dst\"" ,
"misp:category=\"Network activity\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5bbefe30-1718-4cae-b3fa-4ae2950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:39:28.000Z" ,
"modified" : "2018-10-11T07:39:28.000Z" ,
"first_observed" : "2018-10-11T07:39:28Z" ,
"last_observed" : "2018-10-11T07:39:28Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--5bbefe30-1718-4cae-b3fa-4ae2950d210f" ,
"artifact--5bbefe30-1718-4cae-b3fa-4ae2950d210f"
] ,
"labels" : [
"misp:type=\"attachment\"" ,
"misp:category=\"Payload delivery\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--5bbefe30-1718-4cae-b3fa-4ae2950d210f" ,
"name" : "181009-muddywater-1.png" ,
"content_ref" : "artifact--5bbefe30-1718-4cae-b3fa-4ae2950d210f"
} ,
{
"type" : "artifact" ,
"spec_version" : "2.1" ,
"id" : "artifact--5bbefe30-1718-4cae-b3fa-4ae2950d210f" ,
"payload_bin" : " i V B O R w 0 K G g o A A A A N S U h E U g A A C B I A A A M A C A Y A A A C T + 9 Y f A A A A A X N S R 0 I A r s 4 c 6 Q A A A A R n Q U 1 B A A C x j w v 8 Y Q U A A A A J c E h Z c w A A D s Q A A A 7 E A Z U r D h s A A P + l S U R B V H h e 7 J 0 J Y B X F / c e / O Q l 3 A i h X A g m I I i h E Q U 6 V o G I 9 W s U D R F s U + d d q r V a 8 W n s o q D 2 s B + J R q 7 U i i l U O r X i j K I d y K a B B A U G E B B L u I w m E 3 M n 7 / 34 z u + / t e 9 l 9 e f v y c v L 7 w O / t X D u 7 O z M 7 O 79 f Z m e j 9 h / K 80 A Q B E E Q B K G O a N e m F T a d M h 3 l 2 f l G i B A q c a m J 6 L f l L h w p L D J C B E E Q B C F 8 T u i Q a L h C 48 B h e X Y L g i A I g i A I g i A I Q n P H y V 4 Q t f + g T C Q Q B E E Q B K H u a N e 2 F T a d + g T K t x c Y I U K o x P V O R L 9 N d + H I U Z l I I A i C 0 J T 55 l / P Y e c n C w 1 f / d P j w o t w x q 9 v x Q k d X U 4 k O C Q T C Q R B E A R B E A R B E A S h r m j s 9 g K Z S C A I g i A I Q p 3 C E w m + 7 / c k y r b l G S F C q M T 3 T s K p m + 6 U i Q S C I A h N G N M o 8 M s L x 5 A G b g T W J 6 T x / + e T R c o 4 c O G f / 2 g E h o Z M J B A E Q R A E Q R A E Q R C E u q E p 2 A v 8 J h J 8 u f U g v t p 6 G O u z 8 r E n r w i l Z R X w e D y o q q Q k V V X w s J B b b a v M b R V W / P N K I w d B E A R B E A R / 1 E S C A T N Q t u W w E S K E S v w p H X D q t 1 N k I o E g C E I T 5 p 0 r L j O M A g 1 h F T A g v Z 6 N A 7 / 8 / H M j I D S s E w n E X i A I g i A I g i A I g i A I k a M p 2 A u i 9 h 0 8 r C Y S f P H 9 f i z Z e A h X j k j D G W k d k d g 6 j s 675 h P v M + 4 / W P H 8 V Y Y P i K Z 9 Y m J i U F l Z i S o 6 u B 2 r 1 k Z r R 4 n e 8 D a f 3 S X 5 e s t Y w w z / H / 7 c g 12 u O X b 0 q B K + m r i 4 e M T G x S G h d W v a x u o E j Z R Q y l I Q B E E Q G j v t 27 T G p r 5 P o M O N A 4 w Q I V Q O v / w t + m 2 + G w W F x 4 w Q Q R A E o a n x 7 h W X 45 c / G U O u B j Q M w I P / f O x + I s H + Q 3 o 1 I b E X N D 7 E X i A I g i A I g i A I g t C 0 a Q r 2 g q h 9 B w 57 v v z x E D 5 e v x 8 P X j c I b V q 2 Q G E Z c J Q U 8 e J y k F I K U k p J e M t 7 G P p p N F 1 T O u n p J 135 b 6 z 89 z g d S M S R s v 3 w Q w / i g Q e m o q y 8 w g j 1 Z 9 W K a C Q m t k d m J n D H H U a g D Q W l w K R J y 5 C o T Q P 4 x z P n q q 0 b 9 u T k 4 O i R I 8 r N C j Y r 2 j G x M Y i L j U P X H j 3 o f O N U X F 2 T m 5 W F q q o q J R U V F U r K y s o w Y N A g I 0 V 1 Q i l L Q R A E Q W j s t G 9 r T C S Y J B M J 3 H J 4 l j G R 4 K h M J B A E Q a g v / v n P m d i w c Y v h 8 + e 0 / q f g V 7 + a 6 E q P f P f K y / F //IZBA/NSGCsS7D+YB7EX1D1iLxAEQRAEQRAEQWj8HI/2gmjW9NdsPYgrR6Qqo0BuAZBf5CFF1ANPJVBeDlRVaHdlGVBhhKulCimDGDVJgl1aoki6detmvJ3gC/cXgxI6mANsFOB4fssgc/MCwzRgl5e/fPPVVzhWeFS5t37/Pfbt3Yuj5N+9Zzf27d+H3F25OHTwEMoryrFz+7Zq+0dC8g8fxo7t21FSXOwNM40C5VSghccK0aJlAgYMOtNvv0AJrSxFREREREQat6gRA79cyM8zEXdCAy094hIRERERqQ8pLy9TRoH/vvqMrXAc/8HZbl9nccfyjZuUEm8K+4OF1y1iL4i0iL1ARERERERERERERESk6cnxai9QawbyNw7PSOuk3iw449nvccaLW/HihoPomliF697+EaOe/xavf70D72RmY8yDS3D+7z7C+be/j7KySnRsm6AystK2bVu6fOcCMJcjzC/R6n4gVqMAL1Q49qJp5LdPa4UrqLKqEntycpG7YwdKS0uUIl5UpL8r3LpNG7Ru3RpHjh5B3uE8REcbSyZGEDYGHC0ooPwP4Zt1a4xQqLcJSkpK6JxKUVxEaY4cxZEjzoYRk5rKMnKswONjb8PcHMMbyIp/4Mqxl+HK299ATk1pGZU+II1fHk5w3pRGicP+NeZhYHcOoZy7HXbHznkDd5hh3nDr+ZtiOZ7tOe3E3NvNtP/AShVWQz7VcJvewLZM7c6HCVI3TOC12ZaPgXlcM8z2PJxwqsNgZWC9psvw+Aq1A+F0rYTdOVnDSHz5GASWgSM1lGU1nNI7XRcR7FyqxbmsW8dycKobwrE9hFI3IVyb7TkFaxMu68B1/k44HTfI+dhdL2M9pxrvm0D4eCFctyAIgiAcZ4Ty5gC/CV6XbNm1C5NffNEr7GcjgF14fSD2gsjRdO0Fgo9g4+gg+qUfoYzFg+hD1bDqEqY45W89dqjnWxNBrieYXcCWEMomUD+y1dWCEewY1rK0pnEKJ2z1NaeyDZa/m3OyhgXGBWLNO0idO+mdjF1csPQ1Eux6TUJJ40Ctzs3AKY+Q8rY591rlZxA0D6rT22/zv9+UmOldtklXNhxrHqYEnGe1c3c4rmO4gV0Z2JaLy7ZulqEh3n7EKZwx4yLRr4WMWT7BrjeUc2oAVJsyzztImTil8wsPB6PsHrN/SOTMuc2mXEMhhPr1tqPaPGtNXFxHrcssAoR4n6x8LPD5bVOunJfDdYdOCPUlCEE4Xu0F0fwpvT2Hi9U3DgtJEb8uvQMQE43cYx7ExUShhN8miI7C1oOlOL9fop7tTvK7a08mxToKxSXl4Dy8Qpl6yBHF8+Ot4Rbh7xcypoHAip9RgG0BvDWMAnZ5WSU6OgaxMbEoJuW8kBTvyopKZQRgpTy1V28MHjoMA87gWf1QBoTKyirbfGojR/ILlHGgsLCQFP8j3nBemvDo0aPKSFFWXob9/LbDzhy/fauJuubgZRlJUdiEezzUwVInPeLed/HW09cimcKc07LQ4GVFDlL80lTPo/p+1JU/+g/kTHgWb739LmZMAOY++gZ2ctxOevA9loNrnqb9KS5YHur4PHii58oIm/NUBIQFlSDHBkbibg7zhlv8LPeOBFJGYniy8zntnPMo5qb8XqWfMSEHjz+6gsKd8vHt5y9u05M4XJf9+fjXzVv3pvjqRoldnbMnsHw4PKAtuKpbLYpq4UHKYAUVPB/PCF/52D+wgvZxulbHskm51i9/Mx99fPsysJPgZVldHO8L2+sK3v7tztMxf4f0wcpBYbgDxbY9ONSN22uzPyfnNuG2Dtzmb5cHi9Nx7esgSF2Gcd8EisImvC6EjxMVFa3GECIuhf7VVz2JiIiIHI9SVlaOZ//5Mn59631eYX5+/e3VhJIr7PIJJmof1j9JJwxF+nTripk33UT7epTc+O9/KyMAb80wjud0dvvbCR8/HPj8xV4QOWnK9gIRnyhswh31SxtxysMrTnqSrbjTS8xjuznfmsTM0z7ORg8MIgqbcC3u9FMnUdiEO+nGbvW1cOwqCsNtFft9IlnnQfROJYFlXlP60ERhE26VUNJUl+ptxJ04XZ+761Z4/U7nFOq5Bju21cb2LGY4tIvw2qTNvWvbN9XUHqtfp7t7zSkf53Jx29ad+hHn/iU0O7cpCpvwcETXy7MYb5Yv24fG3kblZpynOldgJV1n4L71K1RG/AfbnYY/+Vpqn77zVvilN8QpnV94QN4hCtADKVRe1fdbgblzKJDxCw9NatxvBLfF36t2ZxvvUkK+joCyrH8JvE+c6234CLq/qH/xhu3ciRzspLCd3rCdOXT/p6T40oQp3vIREQlBxF6gUZ82KCmrUAp/UTkwpGsb9ZHDPfml6ruGh/i1Azrwqm1HMbxPW5zVu4Py/3RYF4qPxrEiildFpIUX1eO8+GSt4X5ivi0Q8NZAoFGADQJadLxtXgHCbxTwLH5WxFu1aoU27doifdAg9ExLVfEJLRMQGxurlg3UbxjY57N48afVxC5doJQWl6g3Hfhtgq5du3nD2d+p84lo276d+u4il8/hQ4f89g0Up7LscmJHR7Gmcy+MXTgLPaBSrH7G6rfIyjewssdIPbDziwvMI1CWY9XKkRh/De/pQco1EzAiZwVW5Xiwcs4bwIR7MT7o/qakYPzT7+iBqyIwngkMcxbnY5sEhvuEH4ApI0fQGTmd0w6sogfiCErD/hR6aKasXI6V3vjAfPzDnSSU9PbX5XQ+O5Cb0wMjRui6QQrVJbm8+9n
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5bbf0086-44fc-4fea-a218-463b950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:49:26.000Z" ,
"modified" : "2018-10-11T07:49:26.000Z" ,
"first_observed" : "2018-10-11T07:49:26Z" ,
"last_observed" : "2018-10-11T07:49:26Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--5bbf0086-44fc-4fea-a218-463b950d210f" ,
"artifact--5bbf0086-44fc-4fea-a218-463b950d210f"
] ,
"labels" : [
"misp:type=\"attachment\"" ,
"misp:category=\"Payload delivery\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--5bbf0086-44fc-4fea-a218-463b950d210f" ,
"name" : "181009-muddywater-3.png" ,
"content_ref" : "artifact--5bbf0086-44fc-4fea-a218-463b950d210f"
} ,
{
"type" : "artifact" ,
"spec_version" : "2.1" ,
"id" : "artifact--5bbf0086-44fc-4fea-a218-463b950d210f" ,
"payload_bin" : " i V B O R w 0 K G g o A A A A N S U h E U g A A C C A A A A M A C A Y A A A D //YQaAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAP+lSURBVHhe7J0JYBbF+f+/OYBwB/AAIfAGLxSP4MkpCR5Ve4AHqP0VCbS21taKV2tblaD+W60XamttVUCxiqgVz+IBCcjlHVQULxIIIHfCEXIn/+eZ2X3ffd/svu/um/d98yY+n/C8MzszO7M7Mzszz8MeKdt3lTdBEARBEARBEARBEIR2zcG9Mw1ffNixu8LwCYIgCIIgCIIgCILQXolkX0jZvlNuQBAEQRAEQRAEQRCEePHxPx/GxjcXGVuJZ+A552LYr6/CwX3ifAPCLrkBQRAEQRAEQRAEQRDiRVuxL8gNCIIgCIIgCIIgCIIQJ0zjwC/OOZs0cCMwkZDG/9ibbykjwTk3/8kIjA9yA4IgCIIgCIIgCIIgxIe2ZF8IugHh3a934r2vd2NNSQW+Kz+Amtp6NDU1obGBkjQ2oomF/MptNN1GrPjHhUYOgiAIgiAIgiAIgiCYvHTBTwzjQGtYBwxIr2cjwS+WLTMC4oP1BgSxLwiCIAiCIAiCIAhC7GhL9oWUbTt3qxsQ3vliOwrX7sKFI7MxLLsPMrt2oOOPfAJHTnwMKx65yNgCUmmftLQ0NDQ0oJEOwo5VH6RqT7V22K1gf3WFdhlrmLH9x5sHss8zlfv2KeGz6dChI9I7dEBG167kpusESYqbuhQEQRAEQRAEQRCSl5cvGI9f/OBs8rWigQBNeOyN+N+AsH1XuXLFvpB8iH1BEARBEARBEAShbdOW7Asp23bsbnr3m114Y812zPzpyejWuRP21wL7SCGvqgMppyDllIRd3sPQU1Pp3HJIXz/iwn9j5b8n6kCiAyndt982E7feOgO1dfVGaDCrVqQiM7MniouBa64xAm3YUwPk5y9FpjYR4K6HzlCuF74rK8O+vXuVnxVtVrjT0tPQIb0D+g0cSMfbQcXFm00lJWhsbFRSX1+vpLa2FiecfLKRojlu6lIQBEEQBEEQBEGIHf/4x2x8tvZLYyuY44YejV/+crInPfLlC8fj5/yEQivzeALegLB9ZznEvhB/xL4gCIIgCIIgCIKQ/Hyf7QuprPG///VOXDjSp4wDm/YAFQeaSCFtQlMDUFcHNNZrf0MtUG+Eq1ckUgZp6iYL9mlJITnssMOMpxsC4cFiUE2FOcDGAY7npxSK1y00TAR2eQXLx++9h8r9+5T/6y++wLatW7GPtrd8twXbtm/Dps2bsGvnLtTV12Hj+m+b7R8Lqdi9GxvWr0d1VZU/zDQO1FGF7q/cj06dM3DCyScF7Rcq7upSREREREREREREREREJBZSV1erjAP/efIhW+E4/o9nu32dxRvL136ulHlTeDtceHIh9oVYi9gXRERERERERERERERE2p583+0L6l2F/E3GYdkHqScThv39Cwx79Gs8+tlO9MtsxE9f/AZjH/kET3+0AS8Vl+LsmYU48/f/w5lXv4ra2gb06Z6hMrLSvXt3qgbnijBfg1hRrdX+UKzGAX5B4oRzC2jbPq0VbqiGxgZ8V7YJmzZsQE1NtVLIDxw4oOK7duuGrl27Yu++vSjfXY7UVONVjTGEjQL79uyh/Hfh4w/fN0Khnkaorq6mY6pB1QFKs3cf9u51NpCYRKpLIc6suAsXTviJX+5ZYYRjBe7xh/8Wz5YZwWXP4BpL+guvfgYqyimcsZbhD+f8Lfm6YiOevdos4y6sNELD5hXxuEL3s5ZhrQ/C7jwc64+wPW+nc3AKJ2zzccJr/rGsO8I8VpU2TF0yTnm4xqGP2pZrTWuKsY/nPu2l74akdVVv5nZounDlhqlrz3kZtLh9CMeyzWMNibNNH6EfNSPCuakyKK+gujbyd9vGQXk4nE+464cJPVfrcZAEztPp/L22eTS46CeuMespNL/g82hWT8mAakvzuMPUiVO6oPBoMOrubvvOXzb/t1G2t4v29ffLkHkpKjycR4vrLAYEXefOrLw7dFyyqVfOy+G83eOivQTBJW6ePOAnyePJl5s3Y9qjj/qFt9kYYBeejIh9IXaIfaG94HXNbtBs3WqsF5SEm/es86JT2VHk5biGj+a4DCKuza37hCnHvy4j8R9XuHMPV6YHHOvEIPT8rMdJEjgm67F6WFs2q78w+ZhlW4+x2f5OdRwu3LptxSnOmldonk7lOBGufCciHbNd+VFcw6H13ayuCTNNxHytxxzm+MNeo+HO2SnOIOjYrXVkihnn1P+s+4SUZa0n1/XhAmu+TuVHun5jjou6VrhN5wbz3EPzC+7T8T/3KAjSe8PUiVO6oPBoMOpObA2JJejadUZsDUJb4ftuX0jlT/99t7tKfZNxPynkP83pDaSlYlNlEzqkpaCan0ZITcHXO2tw5rGZ+m55kt9fdhQp2Cmoqq4D5+EXyrSJPCl8f7013CL8vUXGNBRYCTIOsE2AXcM4YJeXVVJT05Celo4qUtL3kwLeUN+gjAGsnPsGH45TTh+OE4bxUwFQhoSGhkbbfFoieyv2KCPB/v37sXfvXn84vxJx3759ylhRW1eL7fy0xMayoH2biTrn8HUpEl/ZmHUZXnjxZS03jqLJ7S6soPAVf7sLZZf+3QjPwrN/ewYbjX2AUbje3OfByzAgXPhGmtjvLsMlD9qlJwy/G9k4/294NusPKp9Zl5bhnr+t8MeFy6v5cRmLUJqfR4but4ICbzTSWurD6Tyc6s8xvcM5OJ5bmPqzE8/5kygMf6h4qrsmWrDQomck1x+ndapLJZTPijJkNcvDvVj76KxLEeijtuVazsMIR9YojBig8/LUp1U4YfgjiU7rtt7oeB3TcUDzMCW25xyuTJVTs7CAtLR9nMu2H1vCHGvYfmQvCpvwZn00qvEpOI+NTv2QxKn/2NWv41jidP5RtHk0orAJj0Z0ffwdk4zrTo1vpOSUXWqchzoXUrLo+EP3TawYytdGY3vAZZhlOW5FUHpDnNIFhYfk7VKAgcii+mq+3wo8O58CmaBwdxJxv5E8b/xB9SfbeI/i+jxC6jLxEjJWhGm3ESPp+qPr0R+2cSP4BryVKzb6wzaW0fWelRVIE6X460dExKPU1tbh7/+Yg19fdZNfmP+7/OpmQskVdvmEE7UP65+kE7qRIw/rh9lXXEH7NimZ+u9/K2MAu2YYx3M6u/3thMtPBHy+Yl+InYh9oZ1IFGt2uzWxo45nIwr2O5QdVV7K33wNH84+EioK/3bzc7QTBbmOx+ykt4SpdzPP0LKikVjoNeFsEs5ik79jPqHrN/v9ndoyXBsrDH+o2MdZ6kvlF7A/eOmXptiXEV6c9nEs3/M1bK1vSu+ghzrquTaisPGHSjR2mnBxzfuJc/s59T/n/hPcL5s81Ed4Cc43OrtEfERhEx4qbtO5EbE1cHhI3i5FbA2JluBrV2wNIm1RxL4QjPoEQ3VtvVL8D9QBp/Xrpj7K+F1FjfoO4y5+bIEOYNW3+zDiyO449fDeavtHw/tSfCoqD1C8qiot/DI/zosP2hoeJObTBiFPHYQaB9gwoEXH2+YVIvxEAj8FwAp5ly5d0K1Hd+ScfDIGZftUfEbnDKSnp6vXFeonFOzzWbLk7WZily5Uaqqq1ZMS/DRCv36H+cN5+6BDD0H3nj3UdyK5fnbv2hW0b6g41WXfQ/o4ijWdSMuFJyn/Nk1sSlnABmwqG4iRI424LJrEVTinMzH28YtJcPjK+c8Al96ISVnB4VoYu3A72YBVNMGOHKWWJsiiY81auRwr/fGMNb01nLGGZWHSgy9pJUJhiRt5aeBYVX2UUV04n4d9/TmldzoH53MLX3+h4j1/vR9jzccazljDwtSdEuor/vqzr0u1vfIZrBxIx0FbgX29yHKsWjkKky7R9Z91yaUYWbYCqzj/cOUawgu4LKoPWqLRtklwmgCh4WacXbidMG7rLVI6JjSMxPaco8yLpcXt41S209gS5lhdtGdzYezCWQJ9NPrxycwjTD/0Y93PEJv6dRpLHM8/qjaPRhi78GiEMf0
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5bbf00a0-e538-4d28-b3d4-4ac4950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T07:49:52.000Z" ,
"modified" : "2018-10-11T07:49:52.000Z" ,
"first_observed" : "2018-10-11T07:49:52Z" ,
"last_observed" : "2018-10-11T07:49:52Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--5bbf00a0-e538-4d28-b3d4-4ac4950d210f" ,
"artifact--5bbf00a0-e538-4d28-b3d4-4ac4950d210f"
] ,
"labels" : [
"misp:type=\"attachment\"" ,
"misp:category=\"Payload delivery\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--5bbf00a0-e538-4d28-b3d4-4ac4950d210f" ,
"name" : "181009-muddywater-5.png" ,
"content_ref" : "artifact--5bbf00a0-e538-4d28-b3d4-4ac4950d210f"
} ,
{
"type" : "artifact" ,
"spec_version" : "2.1" ,
"id" : "artifact--5bbf00a0-e538-4d28-b3d4-4ac4950d210f" ,
"payload_bin" : " i V B O R w 0 K G g o A A A A N S U h E U g A A C B 4 A A A M A C A Y A A A C J x z a R A A A A A X N S R 0 I A r s 4 c 6 Q A A A A R n Q U 1 B A A C x j w v 8 Y Q U A A A A J c E h Z c w A A D s Q A A A 7 E A Z U r D h s A A P + l S U R B V H h e 7 J 0 H Y B R V / s e / m 0 0 D A o T e E g h g o S h G R b o C K r b z F A v N O w T 539 l R b H f e e Z 7 e e c V T U S x 36 n m H K C p F T 7 E X l C a 9 S F D p A o G E X p I A I W 2 T / f 9 + 783 s z m 5 m N r u b Q h J + n + S 3 r 86 b m f f e l P f m N 79 x H T i c 44 U g C I I g C E I 10 S S p I T a c + S x K M n O N G C F c 4 t K S 0 W P z / T h 6 / I Q R I w i C I A j R 0 6 p 5 s u E T B E E Q B E E Q B E E Q B E G o W l w H D o n i g S A I g i A I 1 U e T x g 2 x o f t k l G z P M 2 K E c I n r m o w e G + 7 H 0 W O i e C A I g l C X W f v y v 7 D r q y + M U M 3 T 8 b I r c O 4 d d 6 J V C 1E8 E A R B E A R B E A R B E A S h e h D F A 0 E Q B E E Q q h V W P N j Y 4 z k U b 8 s x Y o R w i e / a D N 0 33 C e K B 4 I g C H U Y U + n g V 5 c N o x G 4 E V m T 0 I j / P 1 / N V c o H l / 3 h 90 Z k 9 X L w i F g 5 E g R B E A R B E A R B E I T 6 T r B l x Q D F g x V b D 2 H l 1 i N Y t y M X e 3 N O o K j Y A 6 / X i 7 J S y l J W B i 8 L + Z V b Z r p l W P L P 640 S B E E Q B E E Q A l G K B 72 m o H j z E S N G C J f 4 M 5 u j + / e T R P F A E A S h D v P h d d c Y S g c n Q + v A g M b 1 r H z w q 0 W L j I j q 5 e B h U T w Q B E E Q B E E Q B E E Q h P p O s G V F 1 / 5 D R 5 T i w b c b D 2 D + + s O 4 f k B n n N u 5 B Z I b x c E V x s T I 6 S P + g y W v 3 G C E g B h a x u 12 o 7 S 0 F G V e e 2 M K y 1 b H a E + h d t j N Z X 9 h r n Y Z a 5 w R / t 0 f O r I v Y v K P H V P C e x M X F 4 / Y u D g k N m p E b q z O U E s J p y 4 F Q R A E o b b T N K k R N n S b j O a 39 D J i h H A 58 v r 36 L H p A e Q d z z d i B E E Q h L r G R 9 d d i 19 d P o x 8 J 1 H x A F 7850 t R P B A E Q R A E Q R A E Q R A E o e o o r 3 h w 8 I h 3 x U + H 8 e W 6 A / j T T e c j q U E C j h c D x w q B g h K g t B Q o Y 4 M H 7 P I S x v P v G B e Q 3 h E 47 f p / Y + m / R + h I I i 4 u F k / 8 + U / 44 x 8 f Q 3 G J x 4 g N Z N m S G C Q n N 0 V G B n D v v U a k D X l F w P j x C 5 G s V Q / w j x c v U m 4 k 7 M 3 K w r G j R 5 W f H + D z g 3 x 3 r B t x s X F o 17 E j b W + c S q t u s n f s Q F l Z m R K P x 6 O k u L g Y v c 4 / 38 h R n n D q U h A E Q R B q O 0 0 b G 4 o H 40 X x I F K O T D M U D 46 J 4 o E g C E J N 8 c 9 / T s W P 6 z c b o U D O 6 n k m b r 11 b E T j y I + u v x b / x x Y P T j L / P U k W D 8 S y o i A I g i A I g i A I g i D U T 2 w U D w 57 X / p 8 C 4 a k d 8 T A 7 u 2 R n U e x X q 9 S O P C U u l B U w u 9 l 8 O D f R W H W O / D C H e N C T I w X 6 W k u d L v h 3 / j 21 R t 1 a U R 8 X C z + 85 //4Ne/vhVFxcVGbCDLlri14sHyPNz726ZGbCCsdIDCPAwfn4HczGlI6zYcr754oU4MwdqVq3BGj+5olJSErRs3If/4cZSWleLYsWMqnR/8JzVKQouWLVS465lnKrcqyT2Sg7zcXLRp1w6JDRJV3K5t29W6S0pKkH8iH02Tk9H5tNNUmhPh1KUgCIIg1HaaNG6EjT2eRfNx5xgxQrgcefN7dF9/H46K4oEgCEKNwOO1e+59FG+/+aIRE8gvbp6I5579ExITE4yYivno+uERKR4sXr8Bm3fvNkLAmR06YFDPHo7x4VKTigcHDucoVywr1j7EsqIgCIIgCIIgCIJQVbRu0czwaZTiwa//tRLT7r8YZTHx6Pz0RiDejdv6NMPv+7fAgH9vx579+bi1dzISaFD64ofb4SooQkyRB3v/dxWG3vo25jxztVGcflg+a9YsjBo9GsXFJUZsIJ9/40Za26ZYsGAnHnuskxHrx1Q64AmB4bcvwPBu6cjYtACvvvZzncEBHjivXbUKyU2TkdiwAXJzclBwogCFRYUqjZURyshlJQTOw8oHnU8/3Vi6aigsKMDBfftx+PAhFBQWoP8grSzx08ZNPksHvH7elrTTuqBJE3vFCyacujx5LMEzw2cg9cWXMCrViPLBaf/AUuXviFG+PE7xTuzCrIl3Y1aWDg146CM8OJA8S/6B659eoiMJX3zIbSLUcllhrNcgVP5yaU775rAPjLkfqWPw/IsDsdSXbyAenPNbDFCZ7LCuy8RYJ2bg3okzYKzOKHsM9Cba7Y/d9oUoP9WaP2g7A/bHWGc5nOojjHIZVXZHzHLcPqc+EGqfjKAd4exTllOdh9H2jGPZ5r6MQdbEaLfdpv8G75NTmLHdF0v7WPMSgceiuc3WbQ1RJ07Ybg+h4kPtX0ekZu3yt4uion7s1H8Mym1LqL5oBO2203afQhwDdtj2uzC2x5YK9rsKEMWD6BHFA0EQhJrnjjsfDql48NKLf1UPbsMlUsUDVhCY8NprRgiY+utfKyUDVjoIjo+03BpTPDiUA7GsWP2IZUVBEARBEARBEITaT1VbVqxNtG4ZqHgQwwrue48UqDcPjhcCN6U3B9wxyM73Is7tQiFbOaDR/9ZDRbikR7J+O4HkN2POQAzFFxSWsIEEv1ChbDbRxXYSrPEWMd9A8L11YMGqdJDL8wDsFuoJAbuyrBIT40asOxYFBQU4fvQYSj2lOHrsqBp4p3Xpit59+6HXueepstgKQmlpmW05lZGjuXlK+eD48eM4evSoL95UODhx4gQN7otx4MB+ZO/KCli2nKh9Dl2XJ1MUNvFLnvoHska/hP998BH+91AqZj01A7uC4qeMhi8+eHmfLFkCPERlqHIGYunT/8ASit+VOkbHBcXzMvbbxA/0rsH1VJx6kFcuPVgqyk/pS7L0w08jznHfHPbB612CZ55eoh68/u+FMfDOfAqzUn9rLJ+FZ55aYllfsAzEA+b+G+UidSD6p+h0fmjpS6eyU0Ltj+32OZe/y3E7A/cnxboOqzi1qVO5u2bgXn5o+4KxjCq7ov0P2kcloZexlzD3iaR8nVO8U9vb7lNgef5yiYi3PVT/Dd6noLDDtjm1j9OxGPnx4CC22xPu/r2EKea2GeuruB9zgcFlGhJFX7Q7Vzi1f6htcpLy/S6afq5FYRNfVcJlu1wx6h5CJEKhv+psGxEREZFTXVjB+6V/vq6UDUxhWMEgWCi7wq6cUKKW4fEnjQnDkdPbt1NKBTwWZLnl3/9WSgfsmnGczvnslrcTXn/N4sWqrYdw/YA0pXTAlhVzT3hpLEzbT5tSUgKUebS/tJjGy0a8+tQCLe1WRhHYp4VGxGjfvr26NlrjA8WgkM042mOdb8jYNMdQPbArK1DWrlyJ/ONsRdGLrRs3Yv++fThG4T1792A/j+13Z+PwocMo8ZRg1/Zt5ZavCsk9cgQ7t29X8w1mnKl0wJY6jucfR0KDRPQ6n+c8yi9vSnh1KSIiIiIiIiIiIiIiIlIVUlJSrJQO+AUHO+E0Vmi3W7aq5O13/oc77vytTzgcKj4yCSSGIwuLPWrQeYIG/33aJalXD/bmFqm3DQ7zawleL5ZtO4b+pzfGBV2bq/DV/dpSegzyT/AnAPwr4KErl8WTIdb4ADEUCXyuQbDSASscaNHptmUFCQ+4i4qK1IP+hg0bIqlJY6Sffz46dU5T6fzpg9jYWDU4j4lhU4z25cyb93U5scsXLEUF2rpCYWEh2rVr74vncMs2rdG4aRP1NgTXz5HDhwOWDRanumzbuoWjWPNVvzDBcTuRndURAwbwozYK81vH5AMWY9nSgRipXqf1InXUaAzIWoJlWcHLW2TAaIxMNf0DMQBZVDYtm2qU7YtnjLDC9JuSipEvfKgfwimC04OlgvxLZ2Bpx4HGfnFciH1z2Ae9HNWNStuJZUt2UTLvCS1P+VKXLsZSladiWbpkCVJp2VQVNrHmCbE/IbdPi7/8irbT3J8QYrs+53KXzpwBjH7Iv4yNBO4/CxOYJ1jKL+MkYeyTj6B4h7oNZ5/8wgTGVbztFfX34H3yh+23zbl97I/FaI+H8mK/PZHun5bw+zETuCxLVH2x3Lki8jr25wkWE7s0LeH3cxbGLr5qhH/5CYKLbiysUlbmQUlBUzR/9Ep0tMrwpigtKYJrwAAVbjtA5y2/rAt
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5bbf03d5-77b0-4576-af75-4ee9950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T08:03:33.000Z" ,
"modified" : "2018-10-11T08:03:33.000Z" ,
"first_observed" : "2018-10-11T08:03:33Z" ,
"last_observed" : "2018-10-11T08:03:33Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--5bbf03d5-77b0-4576-af75-4ee9950d210f" ,
"artifact--5bbf03d5-77b0-4576-af75-4ee9950d210f"
] ,
"labels" : [
"misp:type=\"attachment\"" ,
"misp:category=\"Payload delivery\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--5bbf03d5-77b0-4576-af75-4ee9950d210f" ,
"name" : "181009-muddywater-7.png" ,
"content_ref" : "artifact--5bbf03d5-77b0-4576-af75-4ee9950d210f"
} ,
{
"type" : "artifact" ,
"spec_version" : "2.1" ,
"id" : "artifact--5bbf03d5-77b0-4576-af75-4ee9950d210f" ,
"payload_bin" : " i V B O R w 0 K G g o A A A A N S U h E U g A A B Q A A A A Q A C A Y A A A C + k / R D A A A g A E l E Q V R 4 A e z d C b R m V 1 U v + v m 1 p 61 z q q 9 U u k r f Q B I C i H R 6 R R C k D 0 S I N A r S i o g o V 73 y 3 r t X 373 j M m y u g j 2 d 1 w Z R M U B o B E H B j q t I J x B C S N 8 n V Z X q T 3 + + d r / x W 1 + t q h M g F S A v x M h a Y 5 y z 97 f 3 a u b 8 z 7 n m W m v u u d e u 7 d 69 p 5 q a 2 R h z q 1 X 0 V 4 Y x U a t H 1 G r R W V e P a h C x q R a x / 8 B i T B w / H Y v L 3 d j S b s f 8 g e X o N c Z j a l 0 9 u t 0 q x t q 16 P Y P x e R 4 I 5 b n F 6 I 2 a M T U + J Z Y W e r G x M R Y L C 0 d i r G p f j T H a r H a W Y 5 m a z p 6 w 7 G o 18 a i 6 u 6 J e i O i k Z r t R d Q W o 6 q q q I b t q I Y z U R t u i k 5 n G F P r I v b u v z W 2 n b A h F h e 7 U R 9 u i 0 a i d T 5 q t V o 0 m 83 o 9 X q x u r o a Y 2 N j 0 W q 10 n m j 0 U j 31 T k Y D E J y r V 6 v p / N h V a X j t / q v X q u l + p X X h p T r 9 h s d C w s L q c 2 J i Y n o 9 / t H 6 E D v 2 P h 4 K j M c D t M x 15 F + R M T 0 9 H Q c O n Q o t Y F u f M q T + f z q / L n c N 34 c 4 f C N 5 y 85 C w I F g a M I j P r t 0 d / l r C B Q E C g I F A Q K A g W B g k B B 4 L 5 F o K x f 7 l t 8 S + 0 F g Y L A t 4 o A f 83 K y k r y S f E / J Z / P 2 F i q j u + m G j a i 2 + 3 G 9 u 0 b 4 u D B l V h Y m I s N G z b E / P x 8 b N q 0 K R a X F m L d u n X J h 6 T 8 c D i I d r u d y m d / E P 8 S n 5 e k L j 4 j 7e7 b t y + V 7 X Q 6 M T 4 + n t r m K 5 N n y 5 b N s W / f / q j L v H ///qhHLdbNtGJsohGtsXp0V/sxHFax3Kmi2axHZzViaXE5VruDaE+MxeRkPRYXquC32rNvfzQarZibm4utW7YmZ1Wnu5LK1eu1aDRGTjJOruEAkf2ohvX016iti3o1E1FNRVVNRjXwNx7D4XhUg7GIqhlTk2MxOTEe4xNT0e+PnHjDahDLqyOnGyA51hwBwQGnLSA4x7QjZxzwAJfLJNTuxT/tZqde4m84TA6+fJ1wCJ3wAO86etDCISihZe0x/Qh+2Frs2bMn0Tw5OZnKEiZe8KGukgoCBYGCQEGgIFAQKAgUBAoCBYGCQEGgIFAQKAgUBO5fBPh8+Hr4crJPil8q/3Zv/fr1cdNNu5JPh/PPPX65gwcPJt+QY/ZryTs1NZWY4lfKvqeNG2eCb2jjxo1x4MCBuO222+K4446LxcVRQB06suOQ/+jOO/fE7Oxs1Fe7K8mrODleDwFyc4sL0R0Mol41YqJdi8XVpWhPT8TkWMTM1GysdjsxN38walXE1EQtGs1abN26KTnVRKqtrK7EunWceYPkAOz3e0ccXFHVo9EYj6jaMTE+EePtegwH0zHoT8WwNxPVYHPUYls0Gtuj3Tg+Wi3RflV0O1UsLlVRr41Ht9tLDsX2GCfaSLgAAwRHWmYSGK77cx34kt9SdtalH/fiX44mBGr+W1vdzMxMbN68ORzdz45HEXw8w3eXMp34IfxMf3Ze3l25cr0gUBAoCBQECgIFgYJAQaAgUBAoCBQECgIFgYJAQeDbi4DALz6c7G/iv3HNH18QZ93ERC059Xbv3p2ui/4TlMcZmMvyB3EW8hmJ7OPv4gzkBNy2bVtcc80NyQe3tLQUJ510fGzfvj0F5Ike5J/jbxKMxlHIAckfpY1mtzeI40/YHofmh3H55V+K667/Styxe2/ctnMuDh6cjw3ra6nRQ3PdFE44PVHFwqG5aDQmY3WlH/V2O974G78cW7eOx46TT4k779wdk2PjMey1Y7w1HhyA3tSNWiOqqCJqrZifX03nqysRM2OccREDQXAC2poTEdUwqqoe0a9i/SzHpFdeqxQSudwbpki6bm81er1GtFujCD9gAomTDdgAAhjAgeQvg5jzJWEcdgx+q2oBTO3l9tXjXHKPMAmRwNHkHF1ZIXLete2jT3Lk0VVWPcI4CdS5uvIrxWvLfvPnI1q/+XKlREGgIBBsWkkFgYJAQaAgUBAoCBQECgLfRgTK/OvbCHZpqiBQEPgmEOBj4pPif3Lk0+HEc11g18z29XHttbfG8ccfH29605ti9+6dyd/DP5R8R2Ot2L79uJiZmY3XvOY1sW3b5iNBZN645T/i2PO6ML8SB6CIQb/5jXJb/E78RTt37km+J/f4kpr19njsOzAf//SPn4rFlZU458KHxOO2nxwnHb8uscknx39XDSNajYhhFckh14xaun7Rxa+O6emJuOP2XXHySRvjlB07YmlxMWamN8bNN94eG2c3Rr3yKm5Et9+LTjfitlv3xeTUeOzePRdVZyE5swA0GK5Ev1qKQa8fq516DLpjceDAMFY7SzExtRTPf+ETY3Z2FAHYrNdict1k9AfziSHg+sMYkDHsKPRRGGSOtuOUy2AAZHAvHYDaQztBEKo2naPF7/w+dg7FJCR51irEsZyA119/ffLmEkauO5dVP0dgSQWBgkBBoCBQECgIFAQKAgWBgkBBoCBQECgIFAQKAvcfAnw02Ufk1d3so+J7cr68vJp8RK1WI3bt2hW/9Eu/GCeeeEI0m7bKEzBXJUfgT/7kT8by8nLs338w+Xy8vqtedYgc/Od//uf4P//n/6TzE088MU4//fR4xSteEe973/viQx/6UGzdujVFAZ511lnxS7/0/8Rtt41eOW72oxVXXHlF9Pr9eNwTHh+bj18XXpbdf2gYC8tVLMUwJicbsb5Vi9WFKvbNL8a2LdNR6w9j83o7B45FqxmxceOmOHBgf/Q6C/EHb31L/Ozr/q/YsGEmhoN+VLXDe/UNm9Go+yhIP3r9Qdxxx6F49SseEgLmRnl4uSIG/So6nYjeahU/+/N/GivL8zEz24/1s1ticmoxBoNuLC92o1dbifbYaP8/Tr3sNeVkEy3H6bd3797kIQVedtLJC0AhlOOH9+H7VlWkdvhjIpxz2QGYnJmHwzw5IAmKkHIUH1p4anlgzzv//NT03TkBP/axj8UP//APp5BN/HAk4tOegNnx+K3SPipXnqDdO/xK6e9sBEr/+c6Wf+G+IFAQKAgUBAoCBYFvPwJl/vXtx7y0WBAoCHwjCPDr8P/w2eS3Rfmf+KhuvvnmmJ5aHyecsC2uu+6mFOB18sknJH/Y6urIucdXtGXL+uh0VmPLli3RaNSTD0id7vE72evvj/7oj+If//HjaRu/gwcPxY//+I+nQLd//dd/jb/6q/fF3r2jfQRf/epXx4033pocgmhrNlpj8eVrborHPPq74rjj18V1B4ZxaKGKVjdi4+ZatMebccOtndg+1opmFbHQbcd0P2LpwFxs27oxqtpY7N03jE2b2zHZXBez29bHupmpmJqeiNWlXooYrIZVVLVG+qDHWGssajEVrda66HfHYtDoJnCqaEfTp4C9OtuoxbDmCym1uG3n7UIOozcEYqTXjttjzVCPMrXa6AMbnG/2/eNFFXXn/WlONx/R4DjLUXOYBpp3ol076eSTvxE53m0e7fqTHNUpJFP92uF5JXzt5qhA+dDHSyu5d3dJOGdu46vrwa86SyoIFAQKAgWBgkBBoCBQECgIFAQKAgWBgkBBoCBQELj/EPCGpld9+XA47fhs/OYfEtz15SuuTnvxcQq6dsklz0/BawLE5BufGIv/8T/+R/Ihjcq2k79IvZyIAsyk5z//+fHUpz4zPvzhD6bAsj/7sz+Ll7/85fHWt741VldH+wX+6I/+aDzhCU9Ivie+KR8Kac4vV3HbroNxxrmnxp6lKv7fX/mdmFq3PR5z4cPjiU86LX7ljX8dBw/ui6c86pHRGtbi3R/4aOzedVOcvLUef/bHvxGzs+tjbGy0Zx2i9u0/GFu3bonBoBerneWYGJ+K4bAWg2FEbxDRENrYq0e7613oKmox8mLaALAfo88b9/rtWF6qYnkx4rjtJ0ajVo9640AKi1xcXomZxkTykvb7w2iPjb7oyxEGjDvvvDMB6ffOnaP3qQGfnWjO0QlMf/c2cd5lB556CU7UIced3zZjzG3y2BKyd7dF8BFCLpvpcE3Kxx07diSFUFZSLu8B+NVlU4byryBQECgIFAQKAgWBgkBBoCBQECgIFAQKAgWBgkBB4NuKQI78E/3
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5bbf0405-e380-406f-b611-4b32950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T08:04:21.000Z" ,
"modified" : "2018-10-11T08:04:21.000Z" ,
"first_observed" : "2018-10-11T08:04:21Z" ,
"last_observed" : "2018-10-11T08:04:21Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--5bbf0405-e380-406f-b611-4b32950d210f" ,
"artifact--5bbf0405-e380-406f-b611-4b32950d210f"
] ,
"labels" : [
"misp:type=\"attachment\"" ,
"misp:category=\"Payload delivery\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--5bbf0405-e380-406f-b611-4b32950d210f" ,
"name" : "181009-muddywater-8.png" ,
"content_ref" : "artifact--5bbf0405-e380-406f-b611-4b32950d210f"
} ,
{
"type" : "artifact" ,
"spec_version" : "2.1" ,
"id" : "artifact--5bbf0405-e380-406f-b611-4b32950d210f" ,
"payload_bin" : " i V B O R w 0 K G g o A A A A N S U h E U g A A C B w A A A J o C A Y A A A D P 4 m A v A A A A A X N S R 0 I A r s 4 c 6 Q A A A A R n Q U 1 B A A C x j w v 8 Y Q U A A A A J c E h Z c w A A D s Q A A A 7 E A Z U r D h s A A P + l S U R B V H h e 7 J 0 F Y B R H F 8 f / U R I 0 u C U h Q d p C B V q K B S h Q l 6 + 4 V Y E K V b w C d S + F F o L U q E F b S n G o Q J 0 g A U K Q 4 B I g L m g S I C 73 z Z u d v d u 77 G k u R J h f e O z 4 z s z K 7 c 6 + N + N x + l y G A R K J R C K R S C Q S i U Q i k U i q N Y 0 b B A i X e z l z L l O 4 J B K J R C K R S C Q S i U Q i k V R X G j f U H 1 f w O H 1 W K h x I J B K J R C K R S C Q S i U R S 3 b E 2 M F B W t A o H U b F n s S P 2 P P b G Z S I t I w f 5 B U U w G A w o K T Y A J S U w k D A 335 a o 2 x J E f j p Y l C C R S C Q S i U Q i k U g k E o m k M i I V D i Q S i U Q i k U g k E o l E I r m C K S + F g 9 P n M v h 28 + H T 2 H D w H A a H h e L G 0 I Y I q O U D D w 8 P H m e L d s O + R u Q X Q 4 Q P 8 G R 5 v L y 8 U F x c j B K D / p D F t p 2 e i i N P 2 d A 2 k 9 x 5 m c q W 0 I Y J / 7 T X g s n l N N k X L 3 K h 1 v j 4 + M L b x w d + t W q x r b e S o J L i S F 9 K J B K J R C K R S C Q S i U T i C E 0 a 1 h c u c 8 w U D n b G n s a u 2 L M 4 G J e B 0 5 n m l g i q 1 Y H J z c J F 2 N / z R 4 g S J B K J R C K R S C Q S i U Q i k V R G y k 3 h 4 G w G o o 6 f w 597 T + P t B z u j t n 8 N X C o A L u Y B u Y V A c T F Q Q h M c 0 J Y y i F E I T w + g U z D Q d v A C b F 0 w T A l k + P h 449133 s Y b b 7 y J g s I i E W r O t k h P B A T U Q 0 w M M G G C C N Q h K x 8 Y P X o j A h S V A 3 w 0 7 x a + d Y a 0 p C R c v H C B u + n D P X 3 A 9 / L 2 g o + 3 D 5 o H B 7 P 6 + v C 48 i Y 5 L o 6 P w 5 A U F R V x K S g o w A 2 d O 4 s U p X G k L y U S i U Q i k U g k E o l E 4 j 4 + / f R b H D h 4 V P j M u e 7 a q z F 27 C O X 7 T 3 S 3 T R p Z F X h 4 D x / 1 d 96 O B 2 b D 57 B / W F t 0 D G 0 E e r V 8 n X I E q H j 8 M / x z + c j h Y 8 V q N G e J 2 U F P b b t 4 k M M K M l X 4 g 15 Q F a e g W 2 z + J Y o y a c w i s v E R f I z 92 v T 2 v I 4 Z 7 l k x R K B X r w r M 470 p U Q i k U g k E o l E I p F I J I 7 Q 2 I o l Q l k 5 f f Y 85 q 8 / h r 6 d g t G z f Q s k Z 7 F A 9 g 5 L i g Z F x R 7 I L 2 T v t y D j B Q / m J 30 D A 7 w 8 P e D p a U C n E A 9 c M 2 Q B N n 85 V C m M 4 c v e 1 b / + + m s 8 + e R Y 5 B c U i F B z t k V 6 K Q o H 27 M w 4 e V 6 I t Q c U j Z A X h Y G j o 5 B Z v x C h F w z E F / O 661E2 m D P j m h c 1 a E 9 a t W u j d j D R 5 B 96 R K K S 4 p x 8 S K N T o B / 8 K 9 d q z Y a N m r I / W 2 u v p p v 3 U n m + Q x k Z W a i a f P m 8 P P 342 G J J 0 7 y f R c W F i I 7 J x v 1 A g I Q 2 t b 2 O I k j f S m R S C Q S i U Q i k U g k E v d A 72 v j J 7 y O x d / P E y H m P P T o O M y e 9 T b 8 / G q I E P e z + K d V 2 L J l h / A B v X p 1 x U M P D r Y a 7 g x N G j U Q L n M 86 T t 2 d O w Z r m z w y o N d 0 b 19 S 5 R 4 + i I p w 4 B j p 0 p w O L U E B 1 N K s D + x G H t J E h Q h P 1 F S X E L j C E a h D + S k P e / N t t p w r Z C i Q V 3 / u o h L r I O B 9 z f C o G G N M P q R x h j z Z F t M H N e O y + Q X 2 m H K i 22 x L y E T 5 + L j k Z E e r 1 u W P U l N T E J y Q i I y 2 M v 6 m T N n c e r U K Z x K T 0 N K Q g I K C g p 185 S H J J 6 M Q / z x E z h 5 L B b H D h 3 G o X 37 E b N z l 25 a V R z p S y l S p E i R I k W K F C l S p E i R 4 j 6 Z P / 8 b P P 3 M S 7 p C c Z f z P d L d U p 7 s j c v E j a G N + M w G N 84 / j B u / i s V X B 86 i e U A J H l x 9 H H 2 + 2 I e f d i d g b U w 87 n h 7 A 257 a T 1 u G / c b 689 i N K y j f F D X U q d O H a 6 Y Y A 112 Y T M P G X m A k t U Z Q N K R w s q D L z 7 L b 60 g j 1 I 4 Z + U C 9 K S k p G c k I D 8 / D w + Y J S T k 8 P j S Q m h V q 1 a u H D x A h 9 n 8 P Q U S z u 4 k b z c X F z M y m L l n 8 O e X d E i F H w 2 g 7 y 8 P F a n f O T m s D Q X L u L C B d L u s I 29 v p R U Q 3 b M x u C B / T F 40 k q k G v 0 T s T q F x 9 r H L H 8 K V k 9 i b v I z m W s a n z S l 0 + 5 L p d Q + d 2 C u m t b p u t g r R x t m G a e t / 2 y W U o P N s l W x q G t Z 26 X t M y b G / k x Z i S m a c P N j p 5 P e F U r V 3 Q 666e201 + 4 + K L + 9 O t h K Y + 98 t J L P L M 7 a c b Y W z k s Q Z Y h w y / N d D z V 9 q e t I e x 5 a C 7 f T z w 5 h p z 16 a N v I x N S / N q 4 j w l b f m 2 H r 2 D J 0 + 9 i F v j D r e x 2 / N f T a o a 0 T E 4 e u Q Z f b o a a x j D c / 7 + 22 o y L g 9 z C 13 j a O s 7 V 0 Z u G u I P o u X P 8 A p a 6 a a K P f b W G j L S r G 461 z b T i N E + 0 o c 5 + 5 A Q e v r R 3 h l t e O T r 9 S W V b a 7 T g O H C + J 5 D L g y M w F 5 W 0 Q T 0 o F p P C g C v c L Z Q P L c H f B 3 o w N 2 B N L M x u 0 R i 1 / P 6 R l l S A r p w Q F h b S U A m l i s G 0 R L a X A X r w L g C L m N 5 B F Q o n y u k p T I F I Z q p D V Q o s W L c T s C K Z w c 1 G g G Q 2 s c S G f l Z 93 g c 94 s O / w r 3 y W g 9 L l l J b d O 3 Y g + x K l N i D 28 G G k p 6 f j E v O n p a X i 9 O l T S E l J x t m z 51 B U V I j E k y d K 5 X e H Z J 4 / j 4 S T J / k g g R q m T n v I L R G y L 3 E L h Y 6 d b z L L Z y m O 9 a U U K V K k S J E i R Y o U K V K k S H G H F B Y W 8 G k P F 38 / X 1 c o j j 5 I 6 + V 1 l y z + a Q W e e f Y l o 5 D f V r h z U j 6 Q M k P a + V w E 1 P L B p T z g w U 4 N A C 9 P J G c b 4 O P l g T w a Q / D 0 Q O z Z f N z W I U B 5 x 2 X y 0 g N X w Z O F 5 + Z Z K H H w M u m d m L 0 V a 8 M 1 A q P C g b L V Y q Z s Q D o G t B X K B n p l a c X T 0 w v e X t 7 I Z e / z l y 5 c R H F R M V c u o I / 9 I a 3 b 4 O Z u 3 X H D j f Q u D 66 Y U G x h h O E O u Z C Z x c c T L l 26 h A s X L h j D a Q k F m m W B l B 8 K 2 L l K Y x z J i U l m e U s J b 7 P t v p R S 3 W Q H 5 n y w A X 2 m / Y K V s 7 p j O 32 k 2 g r 0 c e D 8 V 0 S b f w i a R 22 H Y Q p z r 2 Y y r R 8 i P p i N H Z Q u e S W m f J C A h + e L O E p r L C M F q 7 Y m I F S z z x 3 h 7 y H h k c 9 F O a 3 w w 8 c r k W J M b 0 0 c L a c r x p F f F V Z P h P Z G 1 x b 0 P W Y m f m j 1 G g + f 90 g C p o f v U M r V 7 R f r 5 T h X H 1 O 8 p a S 0 G G 5 W v r E / m Q D 9 M F W N E / 1 p K 73 j Y q 291 s R 6 e m 175 z 0 C i / a W 7 h 9 d c a Q O 1 t L o n o / 22 m d Z L 2 v H 2 c b x t 3 m + 64 n 5 d W T Q P Q + t n Z + u X i + W Y u 98 L i 3 W z j d r 9 V T E w e O u i r V 0 V v r Y 9 j m n J x b 3 s F J + v T z W z y G n r 8 G y t o P f B 8 I x U D 1 O V N 7 A Z 5 A 4 U p R H M g X Y H q X J U y H C + n X g R K x K F v 4 W Q / C x t t 7 W j r O 1 d G b h F m U 7 K m i N 0 I S f d P L t w P L v T 7 I 9 W Y Y 7 K P b y d Z n E j s t r / N y h x L p p n B F H 22 H Z l 5 d d d K 41 K 8 e t S w 927 W z V 3 D e S k 5 C A k 9 i y P c U Y l p L E 7 i N B L U 1 p X B W 1 f 6 R I u Y x C R g n z P / 2 O v a d P N Q p B M x l Y C k v O 0 S v H n d K r Z 1 f j / k h + F M o F t F X D K J 7 S 6 e W 3 J d b g q v g H 4 j L Q M b Q x s g s M G P b p f j z w 9 W H 8 v P 80 m g U Y 8 M L q o 3 j 0 y z 1 Y v T s O 62 P i M O L d f z B o 2 m / 438 S 13 B K h g Q u W C L R U A t / m 6 i s c a J U N L h m y 0 P / e 12 w q J 6 j Q w E 8 J e + F P t W O J c P H i B Z y v Q E u E H G m J I J F I q h g e h j 2 Y M X Q C / k q m A X b 3 w M s c M h C D B o 0 3 K 9 f D k I Y l U 4 Y q G r J M R k x e i j O 2 f s k q g O K U X z F + s F J v W 31 j L Z 0 23 B X U v h s d H i l C z I l b P a 1 U v z q C I 8 c 5 P / p z f l w G D Z 6 J g 2 U 8 L s 60 o 6 x 95 g 7 U t t s 7 J z f P e Q D f 7 C g U P v 1 + p b K s t d t R H D l e E o l E I n G O y m O J Y F J y U C w R V u q G V x 4 M y C s o 4 o o E O e w n s G v z 2 k C J A W m Z + S A j h X M 0 7 Q H 77 d x 24 i J 6 t K u D L m 0 a c P //ujdj8Z7IzqGp/um3VRFSuaeylKUFrYg6W4HFrAWWygakaKCIEq9bloXQOAK9u9MH/po1a6J23Tro1LkzWoWG8HgyIPD29uZGBcq4gn45//33TynRS2cp+bl5fHyDxhCaN29hDCd/o6ZNUKdeXT4jIvXP+XPnzPJairW+bNakoVXRppNSFYWWMQ1FUEtyt8CgWWuxckIPTbw90eZn0nUwBhndPdAH8UhOMSB6xSLgkRdMcVrZsQyRQb0QbAyjcbpQ9OwmzueWQWw
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5bbf042c-4c84-4d1d-ae23-4a5c950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T08:05:00.000Z" ,
"modified" : "2018-10-11T08:05:00.000Z" ,
"first_observed" : "2018-10-11T08:05:00Z" ,
"last_observed" : "2018-10-11T08:05:00Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--5bbf042c-4c84-4d1d-ae23-4a5c950d210f" ,
"artifact--5bbf042c-4c84-4d1d-ae23-4a5c950d210f"
] ,
"labels" : [
"misp:type=\"attachment\"" ,
"misp:category=\"Payload delivery\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--5bbf042c-4c84-4d1d-ae23-4a5c950d210f" ,
"name" : "181009-muddywater-10.png" ,
"content_ref" : "artifact--5bbf042c-4c84-4d1d-ae23-4a5c950d210f"
} ,
{
"type" : "artifact" ,
"spec_version" : "2.1" ,
"id" : "artifact--5bbf042c-4c84-4d1d-ae23-4a5c950d210f" ,
"payload_bin" : " i V B O R w 0 K G g o A A A A N S U h E U g A A B A A A A A M A C A Y A A A C 6 u h U N A A A g A E l E Q V R 4 A e x 9 C X x U 1 b 3 / 985 M d g I D K G s m J C i u r a I g J A G V t L X V v l Z R W W 1 p k f d / t a 8 t g q B V + + p S 7 W v d Q J T a 9 T 1 c a A U D K m r f 62 I 1 W M k i a o 321 b p B Q i a s s g x b M k l m 5 v 4 / v 9 + 55869 M / d O Z k I S t n N h c s 89 y + / 8 f t 9 z 7 r 3 n 9 z u / c 662 a 88 + H e p Q C C g E F A I K A Y W A Q k A h 0 E s I 9 O + X j / f P X I r O p l A v 1 X D i k s 0 q 8 e O c D x f h w K H W E 1 d I J Z l C Q C G g E F A I 9 B k C P i j 1 v 8 / A V h U p B B Q C C g G F g E L g p E X A o w Y c 3 W p 7 r 1 F K w d c t + F Q h h Y B C Q C G g E L A j 4 L F f q i u F g E J A I a A Q U A g o B B Q C P Y + A p q k h R 3 d Q 1 a B 1 p 5 g q o x B Q C C g E F A I K A U c E f N b Y N z 7 e j Y 0 f 78 W 7 j S F s 39 e K 9 o 4 I d F 1 H L K o D s R h 0 + k V 1 c Y 7 J c w w 1 j 11 j J a P C C g G F g E J A I a A Q U A g o B O w I + J Q i a w c k z S u F W 5 p A q W w K A Y W A Q k A h k A 4 C P t 1 Y A / D 6 P 3 e h + h 97 c E 1 F K W 66 e i z 8 B V n Q t K 5 f 1 m O m / x c k D a r Q o 2 n w e r 2 I R q O I 6 c 7 + a n V v G b M A Y Y P F M B C i c D g k z h R t j T O u b / 9 h s V E g s 9 P h g w d B P 5 I m K y s b v q w s 5 B Y U w J d l s 39 k R r Q P c q e D Z R + w o a p Q C C g E F A I K A Y X A k S G g A 3 p 7 F E N / d P G R 0 T k J S + 99 / D 3 Q U M 0 61 j o J Y V A i K w Q U A g o B h U A P I c B 7 A L z x y R 5 W / n 903 T j 0 y 8 v B o Q 5 g y z 6 g r R O I R o E Y O Q D Q m S o 1 d H q P B o w t B v R o z I y j Z K / P i 3 v v + R H u v P M u d H R G n N k M A 37 / A D R 8 A C x Y Y M 0 y w H q B / e 3 A 3 L l N 8 M P Y N E j P 3 A C w P R j E w Q M H m C 4 Z J c g 4 Q T x m + b I w v L g Y W V l Z t j p 766 K l s R G x W I x / k U g E 9 O v o 6 M B 548 a 5 V p k W l q 6 l V Y J C Q C G g E F A I K A S O M Q S c 5 w W O M S a P U X Y U d s d o w y i 2 F A I K g R M R g c c e W 4 H / + 8 e H j q J 95 t w z 8 a 1 v z e k z P d K R i S O I 9 J H 2 / u b H u 3 F N R Q k r / y 37 S c n X W f H X o x o 6 O w G N 7 M 4 x T c R B h 9 e j Q f e Q L V q D l 50E4 m 8 l y j t i x A j D e y A e 78 h j m C q z K / 0 y H y n / C O 9 n j 4 C m p n U o O W t q 3 P o g M z m c 39 n 4 J s 4452 w U 9 O u H j //5AQ4fOoRoLIqDBw9yblLC+xX0w+BTBqN58yacduaZDlSOLCq0dx/2h0IYOnw4cvNyzXqp7s7OThxuPYwBfj/O+uxnUsqUEZZHxrIqrRBQCCgEFAIKgV5DgGevyfkvDc/CXmPieCXs5VFYyvHC8Sqa4lshoBBQCByLCJC+Rsr/755a7sje174xn73ds3rRm/x3Tz+HDRs2mvVPnjwBX7vuGrjFmxnTCLAPPK35v+nqC3nm/4Kf/RPI9uKGCQPxg/LBqPj1ZmzbeRjfGu9Hjq5j+QubobW1w9MewfZnv4zBhULBtdZVWFiY0lWN3P39ILd/mtlPNgBYlf8QQph6+d1o+GC9tQrHMM3wk7K/PdiC3Pw8tLeHWeEOt4u1BmQUiEWjOHDwADweDxsBHAkdQWS4rQ0H9+/Hvr17sG1bC8onC3dHmu2XM/9trW3weLw4cGA/+vdPlt9afVdYWvP2SLjmflzzYBAzl/8MMwNEsRnPzP8englSeBJuXncrKmRFnLcGCMzGI8tnI5B4LfPZzjV4aOoqBEz6tkTARmMSat3qpmJJvBq03OITqnK/JB7vRy1nKI5jEVyFBfNXgaGgNCk3hR3rtGIHVNzyIm6eZKk1qUwX+S1FRdCFT1ubOdSbRMdar7WN3ein2YZUjxWjpHopwlq3hVfGpsYsEcfOjSe3NnDJ70rfrNIIdCGrzC7psbzWfmuRSea1na38yQRLn6OopH4i4yz3niyaeHYqC2udCXUllqdr137vRMcaJ4kZdaCr+yeVPCnoBqx9yNp/Zf2JZystB/mTMOsiv0me8slnm1MZa5wslAY2MqvtbJW5qz5mK+hwYeXbIVlFKQQUAgoBhYBC4CRDIB0P8d5U/gluUv6tBggyOrjFk2Egk8NHy/S3723jNf/N+4Drxg7C0x8eRMthHVleDeEooHs0fLy7HQsuHoKfvaixBf/7s8+Ax6OhLdxJDgPmQUHaOJB2rbXGmxkoYKz953X/tgSw27+c+Q+RfYD3AhBLAFzpGTRIqfZ5fWhra2NlOxoRyj4lnzbmDIwqLQUp6DV/fY0NBdFozJ3HBL7SvTwQ2s91HDp0iGf6Jc+k/JMXAmHT0dmBw7t2wpedhbPPdTcApIVluoylla8ZVTVBsN5P6w11IPjMA3gmcCuefXQSgs98DwsfqMGzt5AWW4MlD9awUruYLAJ6DR6yXdtWhiTXbtC3J9hpBld/z6VuKpXMq6DlFm+vKdVV7YP3IzjrZ3h2ZrEh8yqUPzobAe7nk7D4eYsRRG/GMzcSn5OEYcQqV20NcMuLeJYArb0f1z54P2oqZFkHPlPmT+bYlc8M6bi1sSt9yYpVVhkXXIWFZEB69EXM4I4kJq0sjwiZU5xdeA0EZuPZ52818sSxg2PbTEKdSxtYZeA2eEC0JRkmnOibxi07l9yZ5b2cmJR0L9SsStHuiaWpP72IxTKa+snqYpQXifvPuZ/b7xOxNlgSkOdmVGWIiWwuScE8O/Z7oMaxLWa7y2MYEe33D0GbjjzuODWvdntGmRLYAm59QsiffF9a84tnoPE8sFG1XOhAzQPxZ4i137m2tSs2FrrWoMt949p/rWXdwk73s1ve7sTrNHTwpLW3UHfIn8hl+CsAvd0+JzKASjaFgEJAIdAFAjTj/+vf/Bb/SHD5l0q3tfhvDa8AGhe6jw2tJboXnjxpAqh+WR+dv25cy3E1XVO+TPnw0PAr3BHhl3JrJzBheD9e9L891A5a57+HNgTQddRtOojyMYW46LRBfP2VsmHwaB4cbu0w3NKIFVL86SVPyr+45pEzbxxgueaZf1LujbX9Bi62mf+Q8BAgL4G4ocBCI5GmcU0N2N7ezgaA/Px89OtfiLHjxmFUaQnzRy75Pp+P1+KTF4Ajf9Dx6qt/Sfq55bXGt7eF2SUkHA5j+PARJn26PmXoEBQO6M/7EBA+e/fsMdOtNGTYDcthQwbD7SfLdutcuwq1xZOEAYDx3IK6mmZUTGINH4GKSQjUbkCtiX0xAqwVy3ZJvJbxiWdq8MQ4eS1pdFF3Eq9Gebd41/pkvfK8AXW1kzCD3R90BGbOQkWwBnVBSpeHzEvnAGY8+oJhFKF0S1rFLMyQ+FSQgSCIFqajA058pspvpcvhFHxmRMcN5xT0uf4EWQ3+alevAmbdEpc7iW8LPpTmwmsgQOqYkZexo/rceHJrgy1oCRajosKgFSg2+7Yz/QTeZP3c7G5pMl72W3eZTHlMurJs/FxbU4PApAoEZB6nfsJplvpkXts5c0zc+WMA4u3B9bi1RVwWomeXx4mOzN+VPDKfOMfpuvVfe/64bO59gvMk4Z2enHH6JGMXdRjtFJeBeJWHG98J8S73TZyPhPy2vuGURvU7xfdcHFGiNYOax/6LxSLobBuAQXdcgWLrb+oARDvboVVUcPywCg2U11pelNXQ71tXoHjqgKR0a95Mw658MY8VKCw8kHF9TPP0z7A8g05Pvzzhxvj1chv1dh9Q9HvuflJYKixVH+jZPkCT2qT8k5Lt9KNX2PJHf8wva/E87v335nXXXY3Jky5ipZ8rBkxjAF0L5f8iUL5M+wN7AOi0yx/ERn9jhxYA7RHsPdCBt7a2ApEotEgUXj2Glr3teJ92B9SBMUX9QPpzZ4fdA4B3DDCQcbNGSIVenqluJ+Xf+iUAMha40WPmjT+0BIDc7ckIQYp+fk4ecnPyksp6PV54vN6keElr4oQyvPFGvbzExIkTXfOamQB0RjrYuEBxI4oCZhkyAJxXOhq7P/2U9weg9MOHD5npVhrxcNyLwir7Rx9timdJCFnzJSR1cdmMqtXAjEcCqF0tLFq6HkRzsBgBORtZFEARahBsrsFDCx5AHVG88SrUzpyNomdWWa6X4+GZtGFjM6oWzEeV4TNffvMLIG8BvmW
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5bbf06ae-f9c4-4fb9-b068-4ed3950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T08:15:42.000Z" ,
"modified" : "2018-10-11T08:15:42.000Z" ,
"first_observed" : "2018-10-11T08:15:42Z" ,
"last_observed" : "2018-10-11T08:15:42Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--5bbf06ae-f9c4-4fb9-b068-4ed3950d210f" ,
"artifact--5bbf06ae-f9c4-4fb9-b068-4ed3950d210f"
] ,
"labels" : [
"misp:type=\"attachment\"" ,
"misp:category=\"Payload delivery\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--5bbf06ae-f9c4-4fb9-b068-4ed3950d210f" ,
"name" : "181009-muddywater-11.png" ,
"content_ref" : "artifact--5bbf06ae-f9c4-4fb9-b068-4ed3950d210f"
} ,
{
"type" : "artifact" ,
"spec_version" : "2.1" ,
"id" : "artifact--5bbf06ae-f9c4-4fb9-b068-4ed3950d210f" ,
"payload_bin" : " i V B O R w 0 K G g o A A A A N S U h E U g A A B 0 Q A A A L I C A Y A A A D v x U O 7 A A A A A X N S R 0 I A r s 4 c 6 Q A A A A R n Q U 1 B A A C x j w v 8 Y Q U A A A A J c E h Z c w A A D s Q A A A 7 E A Z U r D h s A A P + l S U R B V H h e 7 L 0 F Y F z X l T 7 + D Z M 0 Y m a W L T I z J 4 b E D m P D V N j C t t 3 t d r u //0IXy7CFTdOkDaMTM7MtWzJIMkmWxcwsDeP/nPtmbNmRE6dNut3d99lX8+bOffeeSwcuKnw+n1+hUECGDBkyZMiQIUOGDBkyZMiQIUOGDBkyZMiQIUOGDBky/rdBGfiUIUOGDBkyZMiQIUOGDBkyZMiQIUOGDBkyZMiQIUOGjP91kCdEZciQIUOGDBkyZMiQIUOGDBkyZMiQIUOGDBkyZMiQ8b8W8oSoDBkyZMiQIUOGDBkyZMiQIUOGDBkyZMiQIUOGDBky/tfiQ3eIDg6NwqE2we9SwgQVxo0A/YfS5sGEifz8fsChhFurgN/nh887Dr3WBTi9UHvM9IYOPjgArQVehQNenwHwcwx2qJQuKFX0m2IMXq8GCk8iFIigcBPwqUbpdxPFEw2jF/BQGLtuAn6NCiq3ATq7gtJ2QK0ZpphssGhCYVdGQ+NVQ+f3gaj6SBC1FNZJaSrhUoYS/Ur4NBNQK8bhszkQooqBwhUOr1sFhQYUxg6f2k159AViAFQqFfyUf4/HA6VSKZzX6xWfN38PK4eT72yVIUPGR8CvCjwEoPARjyFv4j+SY77kh5I8VUo1xuEhfqVEmJf4pd0Nn16DCYUHBoUaKosTWr0ONuJrWrdX8CwXvce8VQE14PZDq1RASbzOp/SBWCC8Si/xSz9U/iC/IqbspwgYRAt8uqvPfiU8Ki+F8kFNX1USacRflbD53RSXAlqNFh6HExrilT5Km2PksHB5oDcYYHM74VUpKCy9r1CKODTkfJSsgr5D4ZV4PNEluD3F4XZ7uASgVmspT0Srgr5R2Wi0WtidTijVlD8K5yM/XvkjchIQFF6KW/xO8bmdCnpHA5/PQd+pONw+aFRULkoPXE4PtGq9eHcyOB4vlZdSq4aT0lKp1fAQsTqtDk6SJxqdVsgFn9IPp8su6klJ9USZF/lzO10ky1TkxzEHiPoIKKgelFTOfkrYJzLhF+XtpTyA6FVSHSqoHD1OH/RqBRx+C8kuHdW7Dy63lYovBmqdlfLmpBqPJRlH8pnkmAIkn6mdkMQNxMlxU1vj9BRS+3A5qB1x3BSeWsgnkHUyZMiQ8b8JxB9Z5gk+SXxQyEdJ/2e5yrLqqoz2k2xSkVwhiUXPOp0ODgfJBo1GfP8wON7JkOL1eCQbg0U+x68g/u/1eYQ9wmC+zHEGbZHrERVpDjx9dhgYHg08yZAhQ4YMGTJkyJAhQ4YMGR+GIjB3Zh8bg5tsY/oS+OWzh95kgjY0FFGhpoAPm/bXTYj2DQ7CrwmFSqGFfcKKMfYkg1wHP+xqesHlhpbHBDQGqMgINxi98DgHEaYzwW1VwUDvujw2KLQ2eOAmE98EvTYcXhe94/dDoXKTs0ABMuCdnI4CSr0fVnc3lCo1/K5oSs8JKO1Q8pg7keayeWDWm+GjtHng1qfyw6NSUuwqMXCuEpMDHw+d3w0lvWPzG0GxixF5rcYDLbzwWj1EkR5eHyVI8au0PODupFxLAxdicNsnDQbz4IPNZoNWqxV+wd9vDlzWf7pKlyFDxv9ATJ4QDUyASYOsEr/hQVEBHlglL59JD4fPjVCvCmqHBw6lH26DGkqXF+HEyx0uJyzE70x+EkD0z6vVwMmzjX4F1F7iacyHKSIvxeshVuZVeYm3Eh9kfsj8Skx8Mk38ndIMTo4K/sgTmTwh6r86IUpw88Ctlvm0Dx63B3qVVvBqJ08kEr9Ue/zkp4aVeanRABdP+mrVJBhdxJOJTpI7Wi3xZC+loSBaGTwxyvTxohS1hspBBaeTB4S1VEw++LwkHyh+Awk7l9slUcfyjWUPP7MHwcszouxBtKlUeuL1bqjV/CPzeA08HpI1CpIwSi38VAZT8XdOhydbeTIUSs69Hy6i3RwaQuXtEhO2POnJ9caD1y7yY1p8HqJPT/mlOtGQHAvKmI8C15mCMh6cDGWnoPJyEA1aJclhlQ4TFD/VPoXzUFWRnOV8+EjSUbUpfGaSuySXKc9el4FyaRN06bQmeEkukq8UZyBuUV6UbypO6EjWO5wk96nNsNgMtkEZMmTI+L+Fq/w3IEAIkm2gIlnGi2MMBpYnkrzy+70kV0g+EKQJU0mW3OyEKKfB7+l0Glgm7BS3kcwxF8Uhpc3psj3CE61sj0yFP8mE6JA0IcpUqVSkU1AemUaWN9dDeAV+4A83yUO7k8tGeMmQIUOGDBkyZMiQIUOGjP9tCNjC3efOov7l30MxOCA2qXzm4OFNspuV2bko/uIXkTEtL/ADkUQG9TUTogNjY7A7VKg6V42B0SFY7G4yWB0UA326AaNODY/TDovFS4avAc899zBUGIVOTcavU0u/UVxK+k3ngZMM3fFxyrQiHPYJJ3weL3w8WKu0w+tRQeXXQUVGs8bkR3QS/+aE3xsOt9JK8amhdKopjBpuHujWqmH364keQKvkyU3AoHGT4e2gzPHulo+H0uekHKvgVhE9Cg0cLsoWvRrGE8Reikvhg8dvh1/lhdrL86JXBy64jHhQm1d5j1EZ8Sf78QDI5InRjweXtWz5y5Ah4yNwzYSoxFuCE6LMriWezbzJT3xNCZdGBSc8MLmJn7qJXxq0GFd4oCU+FupVEl/zwaFViN3+Pq8XToUSXuZpxA950lPp412UgQlRlV9McLK/NLkZ5FeTeRfRFxjT5Q/eWXrNhCgFI1KIl9OzmtJyEy2UJkVNdFJYFT0TnWLik+jgvZ4upZ/i4T2JlAeKg3es+qkceEepNGFHafHEK9HIbNlLNHu8fmhUeiFYvcTD9TqSQWInI+UhsGNmsnwLTogG/b1ejxi8Vqs15CcNWvMANr/Ck6I84cq8ncNfD64PTktLssDpdgmZwBOrokDoffbn3/kLl7mLfgsxcQ0ALl5YpFGT/HGL4B8PzgPTwKEl5+d2QWXKk9pcjw6HGwa9ieQ1lbDSJdqKiujmCVe/j+qZypzp4RI2GHSULz+9wztpKW5RMFIdsvN5Kc8Up1rJNaSicuHJXyZBNAgZMmTI+D+IIP9lBOUKcUySBSEhIUIu8XcnGRehoQbi+R6ygcSyUiEfGCwjgqfNXItreSvvBmXZxO+xnPKRPOYTCHh3KH9nfh60OybbKdcjOios8PTZgSdE+RQETn7Y4kTPiAOjVl4UFDjZgf8QjfzvynPgh4wEM7ISw0iWf7xs4fgDG2OvQGSZ0xZf+I/kxz786fGQbuHiBUTSbzcLsXqZPiUymV7xJEOGDBkyZMiQIUOGDBkyPiHUZNcONzWh8kc/QK5SgRk8MSnGSz9jsCFIptyx6hoMRcfgnl//KvAD/XT9hGjb0DhOl51DSFQEps3IhU6jg8VNRqgeMHgBpwsIMQETgxa8+Jv38JWvPgG9zoHG2rOICU9AdHg8GewUUO2H1e5Hfd04RoYUSE1Rw2hQwe11wcMTn5Tvy9UW7N5ZgZnzYvH0l1aSkW+h8jDAZ7LC5fAizJcIt00BXYQKXXY3Kpv60NnjhdatRbyeCjDThMQE3v7iCBjXHwU/lCo3/Ao9Rh2haO11oK1rFHabFXHRIUhPiUZMrJoyyoPJduhcPkpHGgTn8uEBjPHxcXR1dSEvL08Yx8EBd/6Nn28OXNaf0DKXIUPG/zHwqB8ztSBjuzogp+TJK+JJPj/xHHo0qo2wEEPl42YNXuItNieUZiNGPA4YVRpoLC7oDAa4dEr47VaxK9+n1sCv0cDtojg8Poj9nn4f8Uc/3CofxeWDiiJUiTSZXzGf9QXICdDmZ3+Kk/x95PgbT4gqmTx65qNynTyRqVRBz5OMbmL6Xj+cxGZ5glbPu1XdPpjNoRi1TkCpD0wsEm1qPgKXHLFheFQ8tBngr7xDlPLNu3F89LuHaDebIzAxPgGtTiN2XTJP1uv1V3Zk8mogQfYk8HHvSpUSWj7i1mkXE6Iul3QUOnF2ccS
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5bbf07f7-701c-45d8-b786-4fd1950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T08:21:11.000Z" ,
"modified" : "2018-10-11T08:21:11.000Z" ,
"first_observed" : "2018-10-11T08:21:11Z" ,
"last_observed" : "2018-10-11T08:21:11Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--5bbf07f7-701c-45d8-b786-4fd1950d210f" ,
"artifact--5bbf07f7-701c-45d8-b786-4fd1950d210f"
] ,
"labels" : [
"misp:type=\"attachment\"" ,
"misp:category=\"Payload delivery\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--5bbf07f7-701c-45d8-b786-4fd1950d210f" ,
"name" : "181009-muddywater-13.png" ,
"content_ref" : "artifact--5bbf07f7-701c-45d8-b786-4fd1950d210f"
} ,
{
"type" : "artifact" ,
"spec_version" : "2.1" ,
"id" : "artifact--5bbf07f7-701c-45d8-b786-4fd1950d210f" ,
"payload_bin" : " i V B O R w 0 K G g o A A A A N S U h E U g A A B s Y A A A I 8 C A Y A A A B C u B 5 I A A A A A X N S R 0 I A r s 4 c 6 Q A A A A R n Q U 1 B A A C x j w v 8 Y Q U A A A A J c E h Z c w A A D s Q A A A 7 E A Z U r D h s A A P + l S U R B V H h e 7 L 0 F g G X V l e / 9 u 1 a 33 N 3 d q 92 d F q C B h g a C E w + R S Q g E i 0 2 S S Y a 8 T G R e X H C 3 p t 3 d X c q r y 93 d 7 V p 9 a 59 b B d 3 Q J C T h z X v f z F 1 w u u 4995 w t a 6291 v r v v c 4 + u g k h X O Q i F 7 n I R S 5 y k Y t c 5 C I X u c h F L n K R i 1 z k I h e 5 y E U u c p G L X O S i / + a k n / z r I h e 5 y E U u c p G L X O Q i F 7 n I R S 5 y k Y t c 5 C I X u c h F L n K R i 1 z k I h f 9 t y b X w p i L X O Q i F 7 n I R S 5 y k Y t c 5 C I X u c h F L n K R i 1 z k I h e 5 y E U u c p G L / k e Q a 2 H M R S 5 y k Y t c 5 C I X u c h F L n K R i 1 z k I h e 5 y E U u c p G L X O Q i F 7 n I R f 8 j y L U w 5 i I X u c h F L n K R i 1 z k I h e 5 y E U u c p G L X O Q i F 7 n I R S 5 y k Y t c 5 K L / E e R a G H O R i 1 z k I h e 5 y E U u c p G L X O Q i F 7 n I R S 5 y k Y t c 5 C I X u c h F L n L R / w h y L Y y 5 y E U u c p G L X O Q i F 7 n I R S 5 y k Y t c 5 C I X u c h F L n K R i 1 z k I h e 56 H 8E6 S a E J j 9 / J H V 2901 + A q N B h 0 G v R 6 / T I f + / T 1 d + n v y i f r f b J x i z 2 L T v L n K R i 1 z k I h e 5 y E U u c p G L X O Q i F / 3 f o p A g / 8 l P H 48 U F l a 41 i D / O A Q 6 O / 4 K e t b r d R p O t t k d k 2 e u T a o 8 d V x J V 393 Y m 2 F 1 B W e / r i k m y z k Y 0 B 8 F 7 n I R S 5 y k Y t c 5 C I X u e j / E k n M b D R S f / I 4 z a + + T J i E s H r 9 J / v 8 l o r b u y 0 2 / O 64 k 0 U P 3 D d 59 m r 62 A t j K s i W O J / + Y Q u d / a M M j l i x 2 u x a s C 6 h t / O v / O P 8 K v 86 / y c s 0 J P E S H + t M R + H j I b J D 1 c A A 1 X 3 l U D B + V m d 0 2 l B //j4Xwce1yJnmXK/+jLZNheAcJGLXOQiF7nIRS5ykYtc5KL/vvT3Lox19fRhECCcW9NDccMAbb2jjKrET4fCwIIfHQ4m7A75M0GX/LZsegSfX5sueNmCm5ubnHdgs9sUep0sUS12yaFW2OR/q0UrQg4ntp6Y0GE0Ci426dFJve7ucsPfgKkK1ypSdalPusmJhU8S32r4WU0IXNETu+rIFaRmA4wGozaxYbFY3muXi1zkIhe5yEUucpGL/vuRijVNbiaJeU3yTeI++a7iP7UOND42LvGu/YrI8X1Ssapdrrnw3W+zyN2NwNgYFRxP/voJkdQxNjjIjouXuGvXrsmTV9PHWhhTYMAoQXBtxyCnStoZGrUxMGxlzGLVgu8JBQqk7RPyj/OzExi0dg5jMkzwwr+uxWKza+fMZrOUqBazrg6U1UcVVw8MaWhA/Y91fELO6bSA22azObPz5JCicJdiVBiunl6LiTarvmr3fBxSgboqz26zOgN8nR69waCd/yTBw4dJKYcT4Ch6TzHkj0P6eK2qVXsUoFLtHB8f1/66yEUucpGLXOQiF7nIRS5y0f95coJbheEMgpeuJIVKNNArGMW5QPL/D5zy9y6Mdff2c7aik6qOUZbnRBLq5y3Y1vmbwm9O/KjDKLj3UkkzJ/Jq+dlXFzE8Zqejo01wqzs+vn7axIAikxEqa3Q0NZnwMOkICYCxcQfjY6NY5RKHVUdl3SDlpe2kp3vxmS/EYrEqsK3d7iT5rOSh1S1stwou7+/pkTLGtPMKP3r5+eFmdpts3z9GWuau3K4WvCyC363aYpfgcZUgK5jfN0DxUsndWYe6fmhwkNHRUcLCwrUFQRddTdr8wyTPlGw+KB3t1yswvzbHMvnZSep3dd45NtWP75fifGLx/bLfv/badGVZevmmPjvr09oph1bOX7lf1eesX66Xf9XnK8tTNHXuves/1CdF75c1Vd8H2/SPkpNPquSp79foq3bm6nPO79eu+cr+yVWaLZwq5+o+XF23Iuc59f9fL/v9fkupzhPv3XF1XVPfnWV+iH9XnPs4dHWbryWXK+tW5+SbdstH1/F+n7S71JkPlPtRZVxLZ96/9uq2fpg++ndVhurFlW36IF15zYd18P2yne15v54P36d9l0OrS44r9UerXTun7vkwr+WLVsaH6f16FDnvm6xLfb9Gm6fIWa7znr+PPiyP9/viHAf/NaT6Ln+cHf5QX7T+Cb338+Rf9eH9q/4avV/+lde/X+7fKuXa9zvpWjr9ceij2qQSYeScnFS//+22/aOk6tcacM06nDo11TZnW53XXfn549I/co+L/m+Rijs7O7spK6vS1lrUmofDPoGvrxeZGal4eHiIbfjwgpdaGFM7LBR879tcHx6K3t1D06FrksIgmv4JqWwyRSpGnSKp95qkypNYeNvRY9y2a/fkyavpYy2Mdff00dg1xJHCViJD/Fg2LYZQfw+tTWqxaqoE7Y/6Ln/M0uaKum7+9Y8HefZfb9Q6azAYaW5u1pgWHi6B8hUNV/2R+JncIgm6LYIWBBTEROi0DLpxCcAV4LI6ZHDI+aFxHRcvNNDTP0KQn5HHH88QsGbQFt4+SKptRqP8Jh9U8K6C9ZHhYfr7+rEI+FBGxGQyYRTw4O3ri7u7WStnit//LGlOQvFJCU4+2FRfxsa135TJcAhfLNJJ/4AArR0fFIfRaKS9rU3jVVR09FU8c5GLXOQiF7nIRS5ykYtc5KL/U6QmOtQiSFVVDU1NrRqemYJJdsE3QYH+pKUl4+Pj7cQ7nxApSGQw6HE3m9HLX0Vq8W1McJTCR87EQed1Vqt1MulSu+xvUkhQwOSnj0dlda3syG3nnuVpgj096BuGoTFnUqfC+eMCzxSWFfxPY0Mz+06V8cMvzhc4a2L//n1EhIWTmZXN2LjcJKSeBquq0FNb7UNgwARrbpQTH6BX363j5z95l9vW5fCd7y2W/lnfw9yK9HoD3Z2deHh6aBi7sa6O/v4+xgRQq+u8vb0JCAokPCpKeGWWc3+fbJTclTwHBwa1RVFPby+629rp7urS+K0mOELDwggJj5CyVcOcjVPXlpeVia40ccONNzIsuNtFV5JOZKfDLphePTGoJedqivu+cKeSjCfkvNJ1nfB3aqpRkXN+QZWjxoVD9NAxKQO9XK/HZhnHNjH5+gs5VPEfOTalLOdDgFKW3YpFdNrNTfRRilPT80rWepMbBp1KWP5gGVKHmmexWrBLfaotDocOk9kN/YQdq8UmZ6RVop/SLNEZ1R81vyO6rNV7Rb/lu3oq0yb16Qwm+Sz1qZulTTYMmKVNEyrR+go+fCySck3CwwmHXbNXik+qPVf1VZ2XtkzYbdjs8ruMLZPYF73UZlO/fYh3znarxGY1/aRT1xtkvMh5ndRjlZMm4ZleeKaX+tXYm6pbu1v1XWzahHb/h/sz1T419+VmUvNYatFddEY9UapkLdfo9EZpnx2L8FJu0JLYlX1U1zr5r/oksnfYsKjVdtEDpQ9X6tlH0VT7tMRtJWPprtUqUjCZ5JuqX3R2qm6d1C28MknRNnW96udkOVfSh3gu/dZ8i8hbCsao9EuNB+nH1WVM6bQFh2rXezrjHEcqKV9NrGoLDNfgpbpO/a6T36/mtfJjE842Sx1uZpO074PykGs0vfgoHVRlq3KEt0r+0m51TOnYhM0i49AgMlTtU1ereT87RqUbwj/FU01/xAaYpByn/thE7jj1T5Uz2bcr9ecqknPa+Be2KD8gxWj6+F7dbqI/Yms+fKdqu/BFar3WHOpHk7PPSneVbqgytLlWsTkWGTtKL0VlP8DHT5KUzVFjVtlPabvaZljaoOaXPyhjpx6JdDQbK7co+Wr6onRW6aPTBn80Oe/VytXKUiR1acbMKZO/Tk4brWzPB2vRbIq0Q7Xr2nr7EST6qLXpyvplXBiVPVHnpI/q6Rtlw5R+f7LkrFsMPqK679n5K7eNdvqmqbFsnPQb0n9t7Cq2/S2eXUGT93yUTXHR/xukdE3ZAA8Pd1588S1NxlFR4Zrclf0sLLjM3PmzWLpkvsTvzhj4StIWxuSegu9/l5XBQbh5en5oTEzFo1VtbXT09Wm2OjkyArPY0tKGRrV0RKCvD6mRkU5/f40xpZPzW0+eYv3
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5bbf0804-142c-4835-a6c2-4038950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T08:21:24.000Z" ,
"modified" : "2018-10-11T08:21:24.000Z" ,
"first_observed" : "2018-10-11T08:21:24Z" ,
"last_observed" : "2018-10-11T08:21:24Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--5bbf0804-142c-4835-a6c2-4038950d210f" ,
"artifact--5bbf0804-142c-4835-a6c2-4038950d210f"
] ,
"labels" : [
"misp:type=\"attachment\"" ,
"misp:category=\"Payload delivery\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--5bbf0804-142c-4835-a6c2-4038950d210f" ,
"name" : "181009-muddywater-15.png" ,
"content_ref" : "artifact--5bbf0804-142c-4835-a6c2-4038950d210f"
} ,
{
"type" : "artifact" ,
"spec_version" : "2.1" ,
"id" : "artifact--5bbf0804-142c-4835-a6c2-4038950d210f" ,
"payload_bin" : " i V B O R w 0 K G g o A A A A N S U h E U g A A B z w A A A K 4 C A Y A A A A B e Y s W A A A A A X N S R 0 I A r s 4 c 6 Q A A A A R n Q U 1 B A A C x j w v 8 Y Q U A A A A J c E h Z c w A A D s Q A A A 7 E A Z U r D h s A A P + l S U R B V H h e 7 L 0 H f F X H 0 T 783 K q r 3 n v v D Q l J 9 N 7 d e 40 d 1 z h x j V v s 2 E n s 2 O l x S 9 w b L r F x w 2 A M p h l j e u + 9 g w A h g Y Q Q 6 u X 2 + 82 z V w c E x j V + 3 + / 1738 G V v f e c 7 b M z s z O 7 s z s n m P w C U A H H X T Q Q Q c d d N B B B x 100 E E H H X T Q Q Q c d d N B B B x 100 E E H H X T Q 4 S c I x u 5 P H X T Q Q Q c d d N B B B x 100 E E H H X T Q Q Q c d d N B B B x 100 E E H H X T Q Q Y e f H O g B T x 100 E E H H X T Q Q Q c d d N B B B x 100 E E H H X T Q Q Q c d d N B B B x 100 O E n C 3 r A U w c d d N B B B x 100 E E H H X T Q Q Q c d d N B B B x 100 E E H H X T Q Q Q c d d P j J g h 7 w 1 E E H H X T Q Q Q c d d N B B B x 100 E E H H X T Q Q Q c d d N B B B x 100 E E H H X 6 y o A c 8 d d B B B x 100 E E H H X T Q Q Q c d d N B B B x 100 E E H H X T Q Q Q c d d N B B h 58 s 6 A F P H X T Q Q Q c d d N B B B x 100 E E H H X T Q Q Q c d d N B B B x 100 E E H H X T Q 4 S c L e s B T B x 100 E E H H X T Q Q Q c d d N B B B x 100 E E H H X T Q Q Q c d d N B B B x 10 + M m C H v D U Q Q c d d N B B B x 100 E E H H X T Q Q Q c d d N B B B x 100 E E H H X T Q Q Q c d f r K g B z x 10 E E H H X T Q Q Q c d d N B B B x 100 E E H H X T Q Q Q c d d N B B B x 100 E G H n y w Y f A L d 378 X H D v e r D 4 N B s B i M s I s y W Q 0 q N 9 f B b n o / w 821 t 7 p g k e a P W N W H X T Q Q Q c d d N B B B x 100 E E H H X 7 S E B s d 0 f 3 t u 0 F j e y c 67 A 54 D I E I s F o R 5 O t E g L c d D p 8 J 7 d 4 g m A x m h H n d 8 E g e p y 0 E r X L d A D s i g l x w + e S a K Q B u t w k m T w B c n X a Y r U 6 Y z E 6 x V Q M Q Z I 5 A W 6 t d 7 F W //Wo2BsLl8sJnbIQ1qA1erw8uhw1GBMNoCJFkELu1E16DQ76znQDB0AiftO8ztMNnOi6GrRcGTwoM3kgEBBgEbyda2zoQFBwidbtVnT6fW0p5BAcDjKpt+eXxyHWf/DaqxO9er1d914DXDD0Ma96nHd3z2g8FZf5318+kuQN6/mZ7TE6n0NBkkv6x/348+FvDmyXVZ3fqCVpdLpcLZrMZVuGp2+1WdVosFnWNv5lHa1sHHXTQQQcddNBBBx1+WvDTPE+orcG5rtfW5Fyj87dLfovRA6slQNb/QGdnB4KDgyX/SXuEa3qv1yMX/PWYzaYzrvs1G8fhcCAqKkzqckh+k7TnRWtrq8obFhaGtrY2lY/liYffjhDbz+NW1wIDAxES7LdJvg3+q4AnA5wsfbixEweOtqOxTQxNt1BBTB9VK/8oQ8//2ycUigwNwPDeSQgMMAtRvrlp0k9oJV/8vwmKpvJHXZI//p8nDSS73aMY8X1AI7zCRuH6zXjpoIMOOuiggw466KCDDjro8PXwvQOeLQ40t7XDKsZ0cLBNDLtOmL2dYhAGws4gqFlstg4nLAYLTCEGtIt97XTJbR8Dky5YQ0LFDjTCyOt2LwzGLrS11wMeI5Li0mHvcsPl6ITJZIZJ6nM6xLA3NcES1K4MQZddjHhfMAKsQTCZDWKge+H2+JQLQ2rttkHF0DS5YTA3y08futqljy4bgoLF7JWG2+1dYpAb1T2D2MpeMdDhdasNwgQGDP0OAbOyOekI4G8GETUblJ+0T5n4nQFSOg9UPin3o0B3W5oNTeB3tqfhqDkatOvElbhotjPBKHjzPsswT0/QytG5ERQUpJwZXV1dqi+sm0nrG/vP/DrooIMOOuiggw466PDTgpNr458KcA3OtTc3NfK7FpjU1v/+YKUbVosVERGhqK9vlvsm+R4i96HW9LRngoICxB5zda/3A9Un7QLWyTq4/med2obHjg5uNIWyDWw2q7ID2A7vsVxAgAXt7R3qWmRkqOBoRGenXeHKOuNiI7t78M3wgwOexxvFyBN+rtlzHOsONCNIOuByC4EkseeqVn6yF91BT6fLizkr9uONh0YiNyUCdhJOypGgdrsfeQ34tcsBNDSKTSkWqNspzJDfYpfKdzuc0gwNU7cYuSajtGEhMwwo6RUoBrJREe+bQDCCUTrgN8LsYod6xNASw1IMYLMQWcvTHVr90UDVKZ07aSgyWOv/ZMSa+JypTUaxHU6HXyDPcF8HHXTQQQcddNBBBx10+GmD3zDzKePTamFwi+t+zVwziFnlhcPugPsnYBN834Bn7dFOWAKMsAbZ0NjcjoP79qDh2GE0t9pxrMUuBrEHFq8RJoMFdjGO3WLL2axm+NztYje2IUAMbrGrERwQipHDh6OoJA1d9kZ0tHZJmRBYzRZ4XJ1iVwWJYWlTAU+jtQWWQAY8LSrg6XTaEMz73WRXFFZ2rf877TaDsMVgFruNv91m0BT1iWnnYQaj2MMel9hsYqQaxNgXhIySkW1zFzMNf+3EJA182sDab9qBtPWYaCtqQUDtugK/4fhfAU+vsm46FQhaG4Se15iYj/eIN+8RL17nd15nALbn756g1cG+sZ7Ozk7lBLHZbMpBojlEeI9wenkddNBBBx100EEHHXT4vw8/vYCntgbnOp32CG2Nnhsyec9oFPtF8slyXu4bsHz5ClRXH1RreIfDqeoxmblJ04CQkGAkJiagvLxcPuPR1eVQa3/G/Vgv66QNwGsMdvIaT4cy0Ol2e9TpTt4PDwsS+03sPLdXBUR5spR1abbT/3jAs6GxCesqG7HhYCvGlKWid2Y0bNwJK/fElhMCqTintKCyq49AsWWue2wG7ry8BMUZUWIYmlC5by/sXXaUlJTCLgTTQPqNo8eAXbssaG+1IiUJSIoHHC4x+FxCWI+PNqQQwIAlK49i47pqBFl8ePAPhUhJpbHqN9ZOAUHCJG2SqTS+aIAeb2hAZ3u72n1LZjLYGRgcjIioaD/SP4LdpYw9dRqW4U4REqcLbS0t6rdXEgOdThGU+KQkWAOsQr9TG6UQrFmzCgUFhQgNDTtp8Orw44AyxuVT8af7O4G/v4n/WjkBNYyYt8e1E+V7XiPwunzIVf7xw5nyflN5Xv86UNWyQI/y/l/8cypodbNOltLa+dY2tHI96pXfqqWe13lZq5TXelbKOuTjZPmvaV+7rvKoKyfAX99Xy6k2e+aVayqvVhcv8bcq/kPb5WUZ16py9dMPkpfX+V9BzzpPh69pm/h/pV4C8/POmerT2tXua7/9l+Raj0KqHpXzZBvd106UPxMwjz+Tv87uwifaIUjhE+XVZd44FadT2v0mOFN737WcfDD/1+N2su6vypG/LP+fEVjlycIn6jwhdz3Lsx1197S25eMUnhB4vbtagiajZ6z3TKCynSGv1p72+3ToLncyv/+3KtGd/zvj8HWg4XB6n78PsA5/JSfwIpzAjXDavf8/wC8bikqKjl+hl0L3DHm0bz3zfhf4Groo4D35+D50P4H/mYp018c/mnz+EPjaNjR8VcXfH/f/Gti+H4Gvb1fh2AP3b/v9fUDa7i6tcNDh/1EQOaBNsmXzdqzfsFUZh4bujZK0AeJiojB06ADExsWILfPj2AQUN278tFotIsKCgFzwiL1Eo9IqtpHaqMnLYqNwB6/HI7aUv+g3QlzMdzNINairdyE4xIJaMQK37dyFhuZGsRct8MArtppD2UtWa4B8Bzra/buQw4JpiLvFjrTDavaJXWfHogVrcd0NN+DscwdLyTYEmC1wdkLtUPZ57WI022HyhUgfzDBaWyXRFjRL2UAcP+ZGYEC4GP5eSR2S36kMbjc38JLc8umBS+ptlWteBBjDYPQGoksaCIsyI7cgAQaT5JFyHM0kp0mdD2Xg0B/MJH9p/JO3WsCTv2mjcrc0d0CTD8o2FTuQ6cRu6x/BDmTAk7Rj+6yTbTFp33mPSXN88FPblU1HBEErSznR9KX2qYGSGwH2g4mODNYVGRmp2mlu5k5xo9rYy+vsvw466KCDDjrooIMOOvy04KcX8CRwnc81uXZak+t12iZc03N9brMFwd7lQEeHXQUfX3jhRbEJ7MjMzBS7wAC
} ,
{
"type" : "observed-data" ,
"spec_version" : "2.1" ,
"id" : "observed-data--5bbf0907-48b0-4ee0-be05-4df4950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T08:25:43.000Z" ,
"modified" : "2018-10-11T08:25:43.000Z" ,
"first_observed" : "2018-10-11T08:25:43Z" ,
"last_observed" : "2018-10-11T08:25:43Z" ,
"number_observed" : 1 ,
"object_refs" : [
"file--5bbf0907-48b0-4ee0-be05-4df4950d210f" ,
"artifact--5bbf0907-48b0-4ee0-be05-4df4950d210f"
] ,
"labels" : [
"misp:type=\"attachment\"" ,
"misp:category=\"Payload delivery\""
]
} ,
{
"type" : "file" ,
"spec_version" : "2.1" ,
"id" : "file--5bbf0907-48b0-4ee0-be05-4df4950d210f" ,
"name" : "181009-muddywater-17.png" ,
"content_ref" : "artifact--5bbf0907-48b0-4ee0-be05-4df4950d210f"
} ,
{
"type" : "artifact" ,
"spec_version" : "2.1" ,
"id" : "artifact--5bbf0907-48b0-4ee0-be05-4df4950d210f" ,
"payload_bin" : " i V B O R w 0 K G g o A A A A N S U h E U g A A B A A A A A M A C A Y A A A C 6 u h U N A A A g A E l E Q V R 4 A e x 9 C Z w U 1 b X + 18 v A s A w 0 o K z T M A O i q I m O Y n C m B x V M S N T 3 o q g w o C 88 C b 9 / Y j Y E Q b K 8 F 40 v v s U N R E n y Y p I 3 I S G R Y U B F k / e y E B 18 Y W a Q m O e Y x b g y w / S w y t K s 0 z P T 3 f X / n X P r V l d 1 V 3 V X z w 7 e g p 6 q u s s 553731 q 17 z j 33 l u f Q k W M a 1 K E Q U A g o B B Q C C g G F g E J A I a A Q U A g o B B Q C C g G F w D m N g B 9 K / T + n K 1 g V T i G g E F A I K A Q U A g o B h Y B C Q C G g E F A I K A T 6 F o H X //N7aP7tr/tMiImfvAFXfPFL8PeZBIqxQkAhoBBQCCgEFAIKAYWAQkAhoBBQCCgEznEEpPL//z45B/D0QWE14Ee68cFz6HByCcCr7x7GrneP4o3GCPYfO4O29hg0TUMirgGJBDT6xTVxTshzArXfva0PSqFYKgQUAgoBhYBCQCGgEFAIKAQUAgoBhYBCoH8j8MKtN0Mo/32h/evYaBp+9Ntt8Gv6GoDf/+0Qav56BLeFinHvrSUIDMmDx5NdwKnzfwRJg0h7PR74fD7E43EkNPv1BfWveYUUUV2YKBCh62hEnCnYHKbff+ObE/UMuZ1OnzwJ+lFp8vIGwJ+Xh/whQ+DP698OEG6wzA0JlVohoBBQCCgEFAIKAYWAQkAhoBBQCCgEeh2B7Kp1z4qk8+c9AF597wgr//9y53QMHTQQp9qBPceA1g4gHgcS5ABAZxJJ1+m9HqBkIqDFE0YYRfv8Pjz07X/BAw98C+0dMftCRIFAYDga3gKWLTMnGW6+wfE2YPHiJgQQEeFa7gaA/eEwTp44wfnJKEHGCZIxz5+HcRMnIi8vz8Kzp25aGhuRSCT4F4vFQL/29nZcNn26I0tXWDrmVhEKAYWAQkAhoBBQCCgEFAIKAYWAQkAhkCsC3/1uJf7y17dts33k0ovw+c8vylmPFHPj9hPktox6KNBP2vsf3j2M20JFrPy3HCclX2PFX4t70NFByxTI3d8jwqDB5/VA89K8vwc+tiQkC0Jpx48fr3sPJMNt5Y8SM6vSL9OR8o/ocfYIaGraiqJpc5PWB5nI5vz6rj/gwksuxpChQ/Hu397C6VOnEE/EcfLkSU5NSvjQIUMx6rxRaN79PqZcdJENla4FRY4ew/FIBGPGjUP+oHyDL/Hu6OjA6TOnMTwQwLSPfiRjmXLCsmsiq9wKAYWAQkAhoBBQCCgEFAIKAYWAQuBDjwDpa6T8//yn62yx+Id/XMre7nk96E2+469v4u29ew3+F02YgJmXXgKncCOhiwv2gac1//feeiXP/F/xnb8BA3y4e8YI/FPZKIR+sBv7Dp7G568KYKCmYd0Lu+FpbYO3LYb9z96EUQVCwTXzKigosCwLMMfRNbn7B/hMM/vpBgCz8h9BBHNveBANb21PJZN2TzP8pOzvD7cgf/AgtLVFWeGOtom1BmQUSMTjOHHyBLxeLxsB0oh0MSDa2oqTx4/j2NEj2LevBWUzr2GKNNsvZ/5bz7TC6/XhxInjGDYsvfxmEbJhaU6rrnsRgdpHcNtjtUDwDjy5rhx1S7+CTWHBP7TqRdxXrstiTvdV4PGlG6En0/NOxKa5j6DOIvpELFj3HSxo1nnocRa6lvSmGzM/i1zluG/r1xCSSY10ExEMNydl4nidfxCATEfhXNY7QMFGuDlM0jbOzdhk4OLE3w1+YYEHM2bmeHzuRgQJIyNMMq3NECfT2JztymkOA5DEP0O5bEgbQUzPXJZMsmaIC2/EsrR2RPXiJFcGWiRcmlyGxPYXtumJh2zHDu3HgqHkWyt4ZGxHLGSGejWX21xPuvi28kr+5vpwouNQNrjBVfYR9JxnarM22NmjT4J3A9ad6Xfs8DHLIgV2qH9zHXOdSGzs+s8sdCUr81nS1MPE8+qCjlP7MNM2romeUz0aiVxeSNlMeHFOK86Wftcl5R5Pxn1QLULcB2fAxCkdqA+T+TsjrY5d+dfw3Cr5sk3SCVd9BcuqkPLeSMY7X2Uoi8xktLOUd5qMz+mcQzm6jFlOgtknlmU3P8s2Keseuxl1IdM4yK6vJFp1M23rz4akQ5CL+nLIqYIVAtkQcOMh3pPKP8lHyv+SH/7QELXyc5/ja7twMgzkcvjJFWH/0VZe8998DLizZCSeefskWk5ryPN5EI0DmteDdw+3Ydk1o/GdFz2Ax4Ov3nEhvF4PWqMd5DBgHHRJGwd6yG/AFG4koAt97T+v+7dEgN3+5cx/hOwDvBeAWALgSE+nQUq13+dHa2srK9vxmFD2KXrK1AsxqbgYpKDX/u8rbCiIxxPOMqbI5fb2ROQ48zh16hTP9EuZSfknLwTCpr2jHacPHYR/QB4uvtTZAOAKS7eCqXTdiEAtVj9WywrhStKoazcCq17Es6SM1j2C2x97BLUhUrZT0oU3AijHyudNirgGrHz+RayU0lH+qokoKwSatTvw7PNfEzEWujJx6tnKjwZBm4Jfw7NPlSO86StY/mgtnuXBkjWdhYqJv9a8EcsfC2PBUy+iQiraGvkMpeTnMAsVvglvetQdf1v87kDLPSR/uTBaEI/U/sQuTIqRKU6mkeewfTmbg/b4Bx3LJQnanZtRXRsWxpNU2VLvzdnt4hiH9HbUnE2uNFrNqM6GsVkWOKeve+wRhBd+B88umCiegUc3ouypO9hoZNuGHTBPrWILe7pJKwM9c7UOzx9lcMLdJtyBDkxlE8+RKJt8JGxlSntGdEOHjfxO2Bn0U0AwpzfLQ4piLljn3O844ONEx3X/Yfv8f82xX0zrB3R8wg7ld5SPG5tNO0jB2/bWph5t02UNTD7HXC56Lu7ZiCC9T6S1NrwR1bVAhbzPSrMnEtRi9a0bEXzqO+JdUHgH1j5/BzMy6sMOE6d0QXP+FNquxZ+IYPNGbGouT76fOG8tNlU1A6A1qjbvDTf0M+ULfQ3PPk8y7+B3UtY+Kys/l+WwYJaVaA8kSH3v1+Jxc5swcSwLlePx2lpoId04w5MMzQjXNqOC3hEAwuEwgsFg+nvdRMf1Zab6ck1EJfywI0Az/j/44c/w1xSXf5rpTz1+pnsFUP9n9IGpiRzutUQcCVpb7+KYOn4cSOn/7A9+wKnp/OPPf57vSZ+kg+4pXTzmsOw+hQ/p7nR4qYeMtsfYZf9MBzBj3FBe9L8/0gZKc4Q2BNA01L9/EmVTC/CxKSP5/u9Lx8Lr8eL0mXbdjZ0EIcWf7AOk/It77oF54wDTfVRf0y/PunCWmf8IeQrQpoCmjQFT6djcUwW2tbWxAWDw4MEYOqwAJdOnY1JxEctHLvl+v5/X4pMXgK180PDyy79L+zmlNYe3tUbZJSQajWLcuPEGfbo/b8xoFAwfxvsQED5Hjxwx4s005LUTlmNHj4LTT+ZVZ1N7s2knXcdnIoJBnUdoISqMa1JYw2gJS/6mdMZDKOPSz3W1tQiWhxCExi9HQ86QrghnLYvktwf1tc0IldOoUUMwVI5g3Q7UGfllOqsMZv51VRuBhauSZTPyUh77/Ia8yIG/LX5BVDz1gm6wIOCscgooU8PkvV16GZd+dionDU4Mvgb+2cqVTp9p1G1E3cRyYQCwlCWTrE5xovSGbEwvm1x2tLJhnFoWp/R70BKeiFBIxys40SinPYYanDC3limVv10ZNMC2/eh5nXC3C7elswP1deWoYFcTDcEFCxEK16LeeL4dZOI6SX1G7NI6Y2ePhbM8XcHa/Nw70cmIs96mzXQy17EJG1vcrXVvpmuPi7v+Mo2OXTuwPJ9WOQRvu3q0S+cmzExrD6ofI+X/BawMmfIGF6LCfJ9VPlPebk1rljWVR6Y4c1qndE7h5ryp1wB10XV1e5L9NJWX3nNGf52ax829W1ncpsvGs6fKkY1vZ+JNzy23LQcM6B3ASr/gEa6rRXDhHUAzGWYojN5XSL4zutROHWToEs3OYKPyOPXNZ0s4Kcak/JNyb/ejlrbuqX+lk9H6cy8bZ3f9p3zaNFbuScmXhzQG0L1U/ildrgd7AGi6JYI2+isZMwRoi+HoiXa8tvcMEIvDE4vDpyX
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5bbf13d1-88bc-4b03-a881-4167950d210f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-11T09:11:45.000Z" ,
"modified" : "2018-10-11T09:11:45.000Z" ,
"pattern" : "[file:name = '\\\\%TEMP\\\\%\\\\Word8.0\\\\MSForms.exd']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-11T09:11:45Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "Payload delivery"
}
] ,
"labels" : [
"misp:type=\"filename\"" ,
"misp:category=\"Payload delivery\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--0dce5235-c55f-4bd3-8ac0-31177f487562" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T11:59:16.000Z" ,
"modified" : "2018-10-26T11:59:16.000Z" ,
"pattern" : "[file:hashes.MD5 = 'ab4f947f4649b9ec28d182b02778aa69' AND file:hashes.SHA1 = '7d0b494354f1db904f21f52da58f14811c536e15' AND file:hashes.SHA256 = 'e04bb1c0a84debcae77cd82b0a27a02cdd68d47214d6bafefec8f5cad71f4a1c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T11:59:16Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--56f07a86-19e1-477b-bec7-68f3b5f92d94" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T11:59:32.000Z" ,
"modified" : "2018-10-26T11:59:32.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-13T21:47:43" ,
"category" : "Other" ,
"uuid" : "fbb78d5f-50ce-462f-8538-2e09bda58175"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/e04bb1c0a84debcae77cd82b0a27a02cdd68d47214d6bafefec8f5cad71f4a1c/analysis/1539467263/" ,
"category" : "External analysis" ,
"uuid" : "46f13db6-aba1-4eb2-9056-98724eaaca82"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "34/59" ,
"category" : "Other" ,
"uuid" : "9b6be0c6-73e7-4921-99dd-d140374da874"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--31a57645-1669-4e5b-a07c-55300bdff8bf" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T11:59:49.000Z" ,
"modified" : "2018-10-26T11:59:49.000Z" ,
"pattern" : "[file:hashes.MD5 = '864d6321be50f29e7a7a4bfab746245a' AND file:hashes.SHA1 = '243ba07c35cf6b13ca5cde030437aa933840ee57' AND file:hashes.SHA256 = 'b0da2a7d0eeb5ab43eb99108b87d0141edcba4aa11d44c1f708527499410133f']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T11:59:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--2cb20ec0-1762-421e-9640-4acca2c0d48a" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T11:59:51.000Z" ,
"modified" : "2018-10-26T11:59:51.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-13T21:12:55" ,
"category" : "Other" ,
"uuid" : "ccefa26a-e8f1-4059-8b0c-e883650a1f82"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/b0da2a7d0eeb5ab43eb99108b87d0141edcba4aa11d44c1f708527499410133f/analysis/1539465175/" ,
"category" : "External analysis" ,
"uuid" : "4edb42c8-5318-482b-9706-ba634f7d645f"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "36/58" ,
"category" : "Other" ,
"uuid" : "d6f96a07-6f04-4fb5-a4d5-9b77805e1673"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--0ccd4d0b-e97f-4dac-9d63-38118a4ff31b" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T11:59:53.000Z" ,
"modified" : "2018-10-26T11:59:53.000Z" ,
"pattern" : "[file:hashes.MD5 = 'a9ec30226c83ba6d7abb8d2011cdae14' AND file:hashes.SHA1 = 'faf580608b76a47bcf181ec44bb36d637112d3fa' AND file:hashes.SHA256 = 'f2f573af0f76fe0f21bbe630a4bb50b1c1836eb24429bfb8c93673276f27e374']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T11:59:53Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--297156af-d00a-49e5-b136-0d8b658dc016" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T11:59:57.000Z" ,
"modified" : "2018-10-26T11:59:57.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-25T04:12:07" ,
"category" : "Other" ,
"uuid" : "6e87a413-11e2-4db4-b30f-9c37295afa68"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/f2f573af0f76fe0f21bbe630a4bb50b1c1836eb24429bfb8c93673276f27e374/analysis/1540440727/" ,
"category" : "External analysis" ,
"uuid" : "adc80cf9-1a81-483c-9cd9-ee63e1aab260"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "37/59" ,
"category" : "Other" ,
"uuid" : "476a4225-fb4a-411e-b1c7-81694562e5d0"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--6c5c645a-1154-4e6f-9a8c-e09bec28b813" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:00:13.000Z" ,
"modified" : "2018-10-26T12:00:13.000Z" ,
"pattern" : "[file:hashes.MD5 = '9f4044674100a8c28f9ed1b336c337ce' AND file:hashes.SHA1 = 'cd2267e2d736e925247c2a22e4ca75d7e2ebb21e' AND file:hashes.SHA256 = '5f2a6601d349af00a4cc101a638003af2f330879c333168cbf6a7a123dfb3928']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:00:13Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--c19442e0-d547-48a0-9fb2-8309d78c74e6" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:00:17.000Z" ,
"modified" : "2018-10-26T12:00:17.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-13T21:15:51" ,
"category" : "Other" ,
"uuid" : "59ea5e4b-a5b2-4fe1-8f2a-d40de70b6c16"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/5f2a6601d349af00a4cc101a638003af2f330879c333168cbf6a7a123dfb3928/analysis/1539465351/" ,
"category" : "External analysis" ,
"uuid" : "95289a6a-6ccb-4120-9647-92ba50be4f07"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "36/57" ,
"category" : "Other" ,
"uuid" : "7ec61e79-d07e-4e6e-88ca-6fcf6d0d97fb"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--fec87bee-a27f-453d-81b2-b573b2980dfc" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:00:18.000Z" ,
"modified" : "2018-10-26T12:00:18.000Z" ,
"pattern" : "[file:hashes.MD5 = '801f34abbf90ac2b4fb4b6289830cd16' AND file:hashes.SHA1 = '0282bf2a9dca0a87e7fe2a12480c1cc2ea234b49' AND file:hashes.SHA256 = 'b7b8faac19a58548b28506415f9ece479055e9af0557911ca8bbaa82b483ffb8']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:00:18Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--fa3879d1-a417-4bb5-82c1-0771fd8f690d" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:00:21.000Z" ,
"modified" : "2018-10-26T12:00:21.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-17T23:41:58" ,
"category" : "Other" ,
"uuid" : "57481417-11bb-441e-9a35-60e6ec1f3ff0"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/b7b8faac19a58548b28506415f9ece479055e9af0557911ca8bbaa82b483ffb8/analysis/1539819718/" ,
"category" : "External analysis" ,
"uuid" : "3dac3f72-d638-4382-838b-978aee470ccb"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "36/56" ,
"category" : "Other" ,
"uuid" : "080dbfe0-8f57-4486-9965-fb65ba7ad586"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--b870e457-a906-4413-ac38-e27ae839ae13" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:00:27.000Z" ,
"modified" : "2018-10-26T12:00:27.000Z" ,
"pattern" : "[file:hashes.MD5 = 'befc203d7fa4c91326791a73e6d6b4da' AND file:hashes.SHA1 = '8743083219b6943c0c580093dd4139fe353c9943' AND file:hashes.SHA256 = 'e60c802b692a503f4f91e8809bb961b5423c602f6fb374de1af4d983415de3f1']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:00:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--460c2688-f882-4aa9-9a35-4707ce903ee9" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:00:47.000Z" ,
"modified" : "2018-10-26T12:00:47.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-14T18:34:36" ,
"category" : "Other" ,
"uuid" : "27acc580-2607-4d61-85ec-bd5cfa0c7ceb"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/e60c802b692a503f4f91e8809bb961b5423c602f6fb374de1af4d983415de3f1/analysis/1539542076/" ,
"category" : "External analysis" ,
"uuid" : "4822738f-83d9-4a9a-85ff-a5133ec69db5"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "26/67" ,
"category" : "Other" ,
"uuid" : "3a96fb3e-ed42-48de-8660-328e10a672db"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--3d147083-9b4f-4565-9cd2-0be561143f21" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:00:51.000Z" ,
"modified" : "2018-10-26T12:00:51.000Z" ,
"pattern" : "[file:hashes.MD5 = '4c5a5c236c9f4480b3d725f297673fad' AND file:hashes.SHA1 = '7b24d7332f22c4d9ac72070203745b4bea208cb4' AND file:hashes.SHA256 = '616b5f143156dffbdc6cd5765d157874540739f7d74a0b86cb0c4ed342605443']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:00:51Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--5005a835-a840-49dc-bc1b-04269dd4ab59" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:00:53.000Z" ,
"modified" : "2018-10-26T12:00:53.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-13T23:06:37" ,
"category" : "Other" ,
"uuid" : "ff571687-a6a1-42a5-818d-36d1d1d0a9de"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/616b5f143156dffbdc6cd5765d157874540739f7d74a0b86cb0c4ed342605443/analysis/1539471997/" ,
"category" : "External analysis" ,
"uuid" : "c2767a80-e660-4c2d-ba1a-6743626dca55"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "38/58" ,
"category" : "Other" ,
"uuid" : "9dde102c-dacb-4416-b391-5185126c685f"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--33c319ea-ce85-4548-996d-fada6f872995" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:00:55.000Z" ,
"modified" : "2018-10-26T12:00:55.000Z" ,
"pattern" : "[file:hashes.MD5 = 'eb69fb45feb97af81c2f306564acc2da' AND file:hashes.SHA1 = '6059e4d34dee97e6f63be8cb9467327ceb7c7f90' AND file:hashes.SHA256 = '6a68e8b12960257621cb89f979c1fbbd0f13c2338fad0f64e133deb95c99b2f9']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:00:55Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--e8307187-524b-454e-a7e5-35de3ae028b0" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:00:57.000Z" ,
"modified" : "2018-10-26T12:00:57.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-13T22:23:51" ,
"category" : "Other" ,
"uuid" : "004f025e-8b14-4088-9321-2adcc6770960"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/6a68e8b12960257621cb89f979c1fbbd0f13c2338fad0f64e133deb95c99b2f9/analysis/1539469431/" ,
"category" : "External analysis" ,
"uuid" : "a76e300f-4dbe-4ee1-b841-9a0fcb6d7afc"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "37/57" ,
"category" : "Other" ,
"uuid" : "878d37aa-b3b1-4ea0-9cc3-858f68baecde"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--acd0e574-aa79-4dac-80d4-e804d961b256" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:00:59.000Z" ,
"modified" : "2018-10-26T12:00:59.000Z" ,
"pattern" : "[file:hashes.MD5 = 'aa564e207926d06b8a59ba50ca2c543d' AND file:hashes.SHA1 = '7b5000cbc07308f030f8bedba6620d767a0504b5' AND file:hashes.SHA256 = '3eb27ecfbe5381b9cf4dcba2486e9773d9893b92c95032be784e0d2198740539']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:00:59Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--df591dc3-d453-43fc-977d-4bb8b0bc9cb1" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:01:01.000Z" ,
"modified" : "2018-10-26T12:01:01.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-22T02:07:43" ,
"category" : "Other" ,
"uuid" : "0cf968c1-8b54-4f96-9b54-7d5931ae1358"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/3eb27ecfbe5381b9cf4dcba2486e9773d9893b92c95032be784e0d2198740539/analysis/1540174063/" ,
"category" : "External analysis" ,
"uuid" : "fa29434e-262e-4d94-992d-e7a6cc2c6760"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "39/59" ,
"category" : "Other" ,
"uuid" : "0f583fd2-ecd3-4bbb-a414-4512ab544fbe"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--e7d69dcc-6ff2-4f14-a8c3-97a099dc7001" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:01:02.000Z" ,
"modified" : "2018-10-26T12:01:02.000Z" ,
"pattern" : "[file:hashes.MD5 = '7beb94f602e97785370fec2d059d54a5' AND file:hashes.SHA1 = '53785a0d58b774125d702cdd70015be273348314' AND file:hashes.SHA256 = '153117aa54492ca955b540ac0a8c21c1be98e9f7dd8636a36d73581ec1ddcf58']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:01:02Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--fafae45c-0a60-4442-a37f-22d9fb5b84a0" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:01:06.000Z" ,
"modified" : "2018-10-26T12:01:06.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-17T23:41:31" ,
"category" : "Other" ,
"uuid" : "83d26909-2907-4ba1-aff9-f09839171472"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/153117aa54492ca955b540ac0a8c21c1be98e9f7dd8636a36d73581ec1ddcf58/analysis/1539819691/" ,
"category" : "External analysis" ,
"uuid" : "0de6b052-d025-4fc0-8f3e-edfea36ecac1"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "37/56" ,
"category" : "Other" ,
"uuid" : "44a5b20b-ffb0-4158-befa-f2685079b0e4"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--51cbcdd0-059c-4be4-bb1d-689701e0af1e" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:01:08.000Z" ,
"modified" : "2018-10-26T12:01:08.000Z" ,
"pattern" : "[file:hashes.MD5 = 'faa4469d5cd90623312c86d651f2d930' AND file:hashes.SHA1 = '07704be3cb7c7dd6cfb987ded284960f721074fd' AND file:hashes.SHA256 = '41a32a19c78a542ab4d0701c31d9ef6c7f019c9bc604ab9415f4790b7ac6c591']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:01:08Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--e35d7710-6c17-4600-a491-78d9b2d974af" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:01:38.000Z" ,
"modified" : "2018-10-26T12:01:38.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-13T22:27:41" ,
"category" : "Other" ,
"uuid" : "23e4abbc-275f-42b2-8e89-28a917123c9d"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/41a32a19c78a542ab4d0701c31d9ef6c7f019c9bc604ab9415f4790b7ac6c591/analysis/1539469661/" ,
"category" : "External analysis" ,
"uuid" : "369759b7-dc04-4573-aaa3-74f4a02f3a26"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "33/58" ,
"category" : "Other" ,
"uuid" : "14888e4c-d1e6-47ec-8e6e-4bef89fb41c4"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5f1c620f-9bb5-44a0-a49d-d4a20fcc5b56" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:01:40.000Z" ,
"modified" : "2018-10-26T12:01:40.000Z" ,
"pattern" : "[file:hashes.MD5 = 'ffb8ea0347a3af3dd2ab1b4e5a1be18a' AND file:hashes.SHA1 = '99d3597fea978d3d8ea6ad1e5727d581ec409c1a' AND file:hashes.SHA256 = 'fbbda9d8d9bcaaf9a7af84d08af3f5140f5f75778461e48253dc761cc9dc027c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:01:40Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--fd6b82ad-05eb-4cc7-b654-8259cb33f397" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:01:42.000Z" ,
"modified" : "2018-10-26T12:01:42.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-17T10:36:10" ,
"category" : "Other" ,
"uuid" : "cef03c0d-37a8-4edd-b4e7-d5c6e9e03e21"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/fbbda9d8d9bcaaf9a7af84d08af3f5140f5f75778461e48253dc761cc9dc027c/analysis/1539772570/" ,
"category" : "External analysis" ,
"uuid" : "90c624d8-f537-4c4d-96d0-43582d1685d7"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "39/58" ,
"category" : "Other" ,
"uuid" : "901270e4-cbf1-43db-912f-3cac0d96048c"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--e37a5a13-697f-433b-b91f-b796b81c6843" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:01:43.000Z" ,
"modified" : "2018-10-26T12:01:43.000Z" ,
"pattern" : "[file:hashes.MD5 = 'bf310319d6ef95f69a45fc4f2d237ed4' AND file:hashes.SHA1 = 'f53f52b9aa4573f7250d7693617f8617ec139aad' AND file:hashes.SHA256 = '009cc0f34f60467552ef79c3892c501043c972be55fe936efb30584975d45ec0']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:01:43Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--4931955c-02f5-437a-8673-39acb95429fe" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:01:46.000Z" ,
"modified" : "2018-10-26T12:01:46.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-24T06:15:40" ,
"category" : "Other" ,
"uuid" : "344c2c9f-3b0f-4b3f-82ce-735421a7086f"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/009cc0f34f60467552ef79c3892c501043c972be55fe936efb30584975d45ec0/analysis/1540361740/" ,
"category" : "External analysis" ,
"uuid" : "9864b8f4-5820-4f81-9f30-dcdd027ed6cb"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "40/58" ,
"category" : "Other" ,
"uuid" : "bc85be94-5bba-48e1-b653-708cc7e18e67"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--0fb7a91b-5a1d-456b-a372-9bd1792e4d59" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:01:48.000Z" ,
"modified" : "2018-10-26T12:01:48.000Z" ,
"pattern" : "[file:hashes.MD5 = '7a2ff07283ddc69d9f34cfa0d3c936d4' AND file:hashes.SHA1 = 'db6376bfd590285e271387c81b676281a7a80abb' AND file:hashes.SHA256 = '18cf5795c2208d330bd297c18445a9e25238dd7f28a1a6ef55e2a9239f5748cd']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:01:48Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--53a0ab1d-952b-4206-a553-8b111df85bd3" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:01:50.000Z" ,
"modified" : "2018-10-26T12:01:50.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-17T23:41:09" ,
"category" : "Other" ,
"uuid" : "aec3ad8e-2951-4414-8294-3f120ad31c03"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/18cf5795c2208d330bd297c18445a9e25238dd7f28a1a6ef55e2a9239f5748cd/analysis/1539819669/" ,
"category" : "External analysis" ,
"uuid" : "7039be4c-75a2-41b3-b438-143e2061cc6b"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "38/57" ,
"category" : "Other" ,
"uuid" : "2876775b-b8b5-4a9a-9bfa-3d41beb4a280"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--53e618c4-8a5d-4156-a5c6-8ea1f5328d3a" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:01:52.000Z" ,
"modified" : "2018-10-26T12:01:52.000Z" ,
"pattern" : "[file:hashes.MD5 = 'c561e81e30316208925bfddb3cf3360a' AND file:hashes.SHA1 = '0c252c9778029cba362152c4623371b70f8e5422' AND file:hashes.SHA256 = '507039a0c8a9a9c378118cd7015dd824e31b77c2b8835215d1a021bea82c66b4']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:01:52Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--b68a949d-1041-4ec5-a1ee-50774483da01" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:01:54.000Z" ,
"modified" : "2018-10-26T12:01:54.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-16T18:43:28" ,
"category" : "Other" ,
"uuid" : "5894efa3-341f-4187-acfb-ba9671aa7857"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/507039a0c8a9a9c378118cd7015dd824e31b77c2b8835215d1a021bea82c66b4/analysis/1539715408/" ,
"category" : "External analysis" ,
"uuid" : "c2a8d451-533b-422a-ab8b-59e2b59b8fc3"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "24/57" ,
"category" : "Other" ,
"uuid" : "3ea35811-9d92-437a-8e0f-200ef2ea70f1"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--9ab3586b-39d0-4150-8279-e143df7ad88b" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:02:01.000Z" ,
"modified" : "2018-10-26T12:02:01.000Z" ,
"pattern" : "[file:hashes.MD5 = '3c2a0d6d0ecf06f1be9ad411d06f7ba8' AND file:hashes.SHA1 = '6123f7da1f716bbb9e0a8e76255ee6a68c6c9cf7' AND file:hashes.SHA256 = '38556ba0b512636006c00b51f24ac92755bd1f1b21b4ae1812abf6bf9543221e']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:02:01Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--7102d5f3-62d3-4f2f-b6fe-63baeea4ffb6" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:02:16.000Z" ,
"modified" : "2018-10-26T12:02:16.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-24T01:03:54" ,
"category" : "Other" ,
"uuid" : "d4ad2444-48d7-4b4e-82ca-e9c893c4b421"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/38556ba0b512636006c00b51f24ac92755bd1f1b21b4ae1812abf6bf9543221e/analysis/1540343034/" ,
"category" : "External analysis" ,
"uuid" : "c483436e-4621-4809-8549-47989da7897a"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "38/58" ,
"category" : "Other" ,
"uuid" : "68fb4c54-1a70-4526-b690-e5648ed7a409"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--2df61ab0-86b0-444f-841d-0c3cb4543ad4" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:02:17.000Z" ,
"modified" : "2018-10-26T12:02:17.000Z" ,
"pattern" : "[file:hashes.MD5 = '94edf251b5fe7cc19488b5f0c3c3e359' AND file:hashes.SHA1 = 'a02dfebd01369337e01b4f6bfd644d47457bee25' AND file:hashes.SHA256 = '2cea0b740f338c513a6390e7951ff3371f44c7c928abf14675b49358a03a5d13']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:02:17Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--90c525e7-74e9-4a8c-ab7e-a609a3633442" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:02:25.000Z" ,
"modified" : "2018-10-26T12:02:25.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-11T15:13:29" ,
"category" : "Other" ,
"uuid" : "bf025950-5a64-418b-9353-f178b20594d9"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/2cea0b740f338c513a6390e7951ff3371f44c7c928abf14675b49358a03a5d13/analysis/1539270809/" ,
"category" : "External analysis" ,
"uuid" : "639c14de-057f-4137-83a9-42d18645c69a"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "38/58" ,
"category" : "Other" ,
"uuid" : "559330bd-627c-4da1-bbcf-65360a1b8f42"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--b0c96e50-6743-4347-b27f-2d9828182184" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:02:27.000Z" ,
"modified" : "2018-10-26T12:02:27.000Z" ,
"pattern" : "[file:hashes.MD5 = 'e5683fb480353c0dec333a7573710748' AND file:hashes.SHA1 = 'c972a47804b6c4259b91c24e0c6db0537d03924a' AND file:hashes.SHA256 = 'abc269676eab9cf71f4f00195d1be02c10ea5bfb383fa1396dc108e0f6f9b9be']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:02:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--f3cd75ac-beeb-4a9f-a2d4-b78604188d99" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:02:30.000Z" ,
"modified" : "2018-10-26T12:02:30.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-13T22:21:06" ,
"category" : "Other" ,
"uuid" : "b2170fc8-0314-492a-a056-ae127af70224"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/abc269676eab9cf71f4f00195d1be02c10ea5bfb383fa1396dc108e0f6f9b9be/analysis/1539469266/" ,
"category" : "External analysis" ,
"uuid" : "ada170fb-d732-411f-a153-71bef4482d9b"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "37/58" ,
"category" : "Other" ,
"uuid" : "efc1bbf7-0741-415e-a1f8-e9a7cfe61c06"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--4a57082d-1113-4c31-ac54-fcabcd334522" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:02:31.000Z" ,
"modified" : "2018-10-26T12:02:31.000Z" ,
"pattern" : "[file:hashes.MD5 = '16ac1a2c1e1c3b49e1a3a48fb71cc74f' AND file:hashes.SHA1 = '8d5e3bed94115e93e51e67db815edbab10e35505' AND file:hashes.SHA256 = 'bfb4fc96c1ba657107c7c60845f6ab720634c8a9214943b5221378a37a8916cd']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:02:31Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--21387002-20ff-4b1d-ad38-09d5a5dc2556" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:02:34.000Z" ,
"modified" : "2018-10-26T12:02:34.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-23T00:27:20" ,
"category" : "Other" ,
"uuid" : "5641fdee-9ff7-4245-989d-1e19129ab9ef"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/bfb4fc96c1ba657107c7c60845f6ab720634c8a9214943b5221378a37a8916cd/analysis/1540254440/" ,
"category" : "External analysis" ,
"uuid" : "0edebb25-8990-44d3-b9b7-4dee26732170"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "39/58" ,
"category" : "Other" ,
"uuid" : "a2e6295c-f018-47fd-b91a-91ba91ad9789"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--08d435b6-9c5c-47ef-827e-0c2e535a1264" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:02:35.000Z" ,
"modified" : "2018-10-26T12:02:35.000Z" ,
"pattern" : "[file:hashes.MD5 = '9486593e4fb5a4d440093d54a3519187' AND file:hashes.SHA1 = 'f9bc806bc1fb99e8e88e3d8f142729bdd5a44ec9' AND file:hashes.SHA256 = '707d2128a0c326626adef0d3a4cab78562abd82c2bd8ede8cc82f86c01f1e024']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:02:35Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--8d937a08-3ec8-4710-bc00-62adce8d1fd2" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:02:37.000Z" ,
"modified" : "2018-10-26T12:02:37.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-17T23:43:45" ,
"category" : "Other" ,
"uuid" : "e5ee124b-3851-40e6-993f-b420649d377d"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/707d2128a0c326626adef0d3a4cab78562abd82c2bd8ede8cc82f86c01f1e024/analysis/1539819825/" ,
"category" : "External analysis" ,
"uuid" : "35b244af-573f-4c7a-9cab-196b5a03ba03"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "34/54" ,
"category" : "Other" ,
"uuid" : "23567f6b-9d28-4f16-8934-f93c366ee411"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--e31585a9-e153-4b53-b420-d6e0519e00c4" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:02:43.000Z" ,
"modified" : "2018-10-26T12:02:43.000Z" ,
"pattern" : "[file:hashes.MD5 = '5bd61a94e7698574eaf82ef277316463' AND file:hashes.SHA1 = 'a80655582da300ba1e1c3f4ac78d61a5a8f6d3ab' AND file:hashes.SHA256 = 'c87799cce6d65158da97aa31a5160a0a6b6dd5a89dea312604cc66ed5e976cc9']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:02:43Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--96804372-de78-45de-bd01-063861671447" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:02:59.000Z" ,
"modified" : "2018-10-26T12:02:59.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-19T00:09:43" ,
"category" : "Other" ,
"uuid" : "1d0fb92b-26b0-44d4-a470-d5627eafe433"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/c87799cce6d65158da97aa31a5160a0a6b6dd5a89dea312604cc66ed5e976cc9/analysis/1539907783/" ,
"category" : "External analysis" ,
"uuid" : "68b8a252-3984-49af-9e06-427ffd8647a3"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "37/57" ,
"category" : "Other" ,
"uuid" : "77d8e639-57b8-48ea-bff8-12d899391121"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--d2f7d021-4acb-4319-81f9-53370a45e832" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:03:07.000Z" ,
"modified" : "2018-10-26T12:03:07.000Z" ,
"pattern" : "[file:hashes.MD5 = 'c8b0458c384fd34971875b1c753c9c7c' AND file:hashes.SHA1 = 'e9731cc102d3c07744a06b63631addf8fc2b3f46' AND file:hashes.SHA256 = '5c7d16bd89ef37fe02cac1851e7214a01636ee4061a80bfdbde3a2d199721a79']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:03:07Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--4d21d162-1fb4-4198-8949-2c296cd028cd" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:03:09.000Z" ,
"modified" : "2018-10-26T12:03:09.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-25T03:39:26" ,
"category" : "Other" ,
"uuid" : "0afbb267-8a1c-4447-b229-83f60aac17fe"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/5c7d16bd89ef37fe02cac1851e7214a01636ee4061a80bfdbde3a2d199721a79/analysis/1540438766/" ,
"category" : "External analysis" ,
"uuid" : "3f6aa0b4-7a59-45e7-963c-0a4aee1cc714"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "38/59" ,
"category" : "Other" ,
"uuid" : "6b2c0d26-b8ec-4818-8bf8-7fc21ab36e72"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--74246f0f-70de-4ad4-a1f4-361cac2bd78f" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:03:16.000Z" ,
"modified" : "2018-10-26T12:03:16.000Z" ,
"pattern" : "[file:hashes.MD5 = 'e7a6c57566d9523daa57fe16f52e377e' AND file:hashes.SHA1 = 'a008761e02c15773286457854bc92baa6b2f0781' AND file:hashes.SHA256 = '91fe25107612a35f1e1c2b9ffa1027262062ee9a389d1fd4e118ea6f4798bcef']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:03:16Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--4dffe3df-3904-40e0-bc19-f002f1b33eeb" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:03:30.000Z" ,
"modified" : "2018-10-26T12:03:30.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-22T12:08:17" ,
"category" : "Other" ,
"uuid" : "e155075d-a0cd-4e7f-ac83-5dcd26f7ec1c"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/91fe25107612a35f1e1c2b9ffa1027262062ee9a389d1fd4e118ea6f4798bcef/analysis/1540210097/" ,
"category" : "External analysis" ,
"uuid" : "f35782b4-2bd3-4ced-8d3e-b9fdee1a2595"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "25/55" ,
"category" : "Other" ,
"uuid" : "70aa74b9-17f7-46f0-9f2d-0850c61b47d7"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--88c615e1-7bbb-4b0a-bddc-7b85e2bb579e" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:03:31.000Z" ,
"modified" : "2018-10-26T12:03:31.000Z" ,
"pattern" : "[file:hashes.MD5 = '345b1ea293764df86506f97ba498cc5e' AND file:hashes.SHA1 = '72701410c05dda3c088a15f791946cf0861a9bcb' AND file:hashes.SHA256 = '818253f297fea7d8a2324ee1a233aabbaf3b0b4b9cdaa1ebd676fe00f2247388']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:03:31Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--7c5e4ccd-80e2-47cd-8cb1-a56ef4e0b865" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:03:35.000Z" ,
"modified" : "2018-10-26T12:03:35.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-23T00:44:51" ,
"category" : "Other" ,
"uuid" : "28db44f2-a7a7-4ff0-a28b-73595a216e73"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/818253f297fea7d8a2324ee1a233aabbaf3b0b4b9cdaa1ebd676fe00f2247388/analysis/1540255491/" ,
"category" : "External analysis" ,
"uuid" : "7929d031-2e77-4bf9-86e1-6c23dd9e9ca0"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "32/68" ,
"category" : "Other" ,
"uuid" : "1a6d5d54-abd9-4c3e-a67a-cf448db31909"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--6c663bc9-cfc1-4ca0-a03c-0b4f60d6e7d4" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:03:55.000Z" ,
"modified" : "2018-10-26T12:03:55.000Z" ,
"pattern" : "[file:hashes.MD5 = '5a42a712e3b3cfa1db32d9e3d832f8f1' AND file:hashes.SHA1 = 'a6f51730ee561e3395220b2dd26b927d1de4680d' AND file:hashes.SHA256 = 'b9c70adbc731b1b2779ab35bb0fab29ae703e2a4a7214c5e2749b02daf326a9b']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:03:55Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--5bd663c3-7b0b-41f6-8a5e-cbc776ad81ea" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:03:58.000Z" ,
"modified" : "2018-10-26T12:03:58.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-22T02:08:38" ,
"category" : "Other" ,
"uuid" : "17c8b38c-273b-4196-b6f6-6304a28dca4b"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/b9c70adbc731b1b2779ab35bb0fab29ae703e2a4a7214c5e2749b02daf326a9b/analysis/1540174118/" ,
"category" : "External analysis" ,
"uuid" : "ecd92234-0391-4ff4-9b50-cf3c8780606b"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "38/59" ,
"category" : "Other" ,
"uuid" : "aaeb9a5d-83ce-4c4b-9464-c5c752cc74b7"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--109617d0-6a8e-4cc9-aae1-92e11425e4cd" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:04:00.000Z" ,
"modified" : "2018-10-26T12:04:00.000Z" ,
"pattern" : "[file:hashes.MD5 = 'f2b5373f32a4b9b3d34701ff973ba69c' AND file:hashes.SHA1 = '36b2a003df195e2d640412a5791b631037e04e4b' AND file:hashes.SHA256 = '2a49d29d58d4d962bee5430e40f488bb79ebab92cf13db5bb4708f3eaf95caed']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:04:00Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--afaeb002-c625-489a-9cec-ce0191ed8d49" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:04:06.000Z" ,
"modified" : "2018-10-26T12:04:06.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-23T14:07:42" ,
"category" : "Other" ,
"uuid" : "967e1cb9-fa4e-4dbc-bc94-9c49e99cfeed"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/2a49d29d58d4d962bee5430e40f488bb79ebab92cf13db5bb4708f3eaf95caed/analysis/1540303662/" ,
"category" : "External analysis" ,
"uuid" : "0b13224b-f5d6-4835-98ca-96aa65aa18b4"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "39/59" ,
"category" : "Other" ,
"uuid" : "035c4a03-b759-4935-b66b-134ebe2042de"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--bd146a67-39d0-4e55-bd92-27ad3ed4b6b4" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:04:29.000Z" ,
"modified" : "2018-10-26T12:04:29.000Z" ,
"pattern" : "[file:hashes.MD5 = 'c375bbf248592cee1a1999227457c300' AND file:hashes.SHA1 = 'afe50ddb5bf5702a4cc9a6cc21a441b09dbfb2c2' AND file:hashes.SHA256 = 'aa60c1fae6a0ef3b9863f710e46f0a7407cf0feffa240b9a4661a4e8884ac627']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:04:29Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--db4f4e2d-3ac3-4dbc-9519-3a4204112ecc" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:04:39.000Z" ,
"modified" : "2018-10-26T12:04:39.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-11T15:13:06" ,
"category" : "Other" ,
"uuid" : "76997782-64df-422e-9af6-b8563208fce5"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/aa60c1fae6a0ef3b9863f710e46f0a7407cf0feffa240b9a4661a4e8884ac627/analysis/1539270786/" ,
"category" : "External analysis" ,
"uuid" : "6484cb82-39eb-4d42-9878-d6dcbea93a9f"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "39/58" ,
"category" : "Other" ,
"uuid" : "cd8127b2-5546-4275-b3d7-4d1425ed4208"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--4f7b9f67-83dc-46f9-af98-a4b1fc542771" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:04:49.000Z" ,
"modified" : "2018-10-26T12:04:49.000Z" ,
"pattern" : "[file:hashes.MD5 = '59502e209aedf80e170e653306ca1553' AND file:hashes.SHA1 = '680fdada9f598f57f774f285dbfea5c383dc5b03' AND file:hashes.SHA256 = '40ffcbf044ec951242a92a09b6a239183def2e74fc18e5975fa70e849d875a2e']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:04:49Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--9094218a-0a32-4747-8f21-bf0f7bfed79d" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:05:02.000Z" ,
"modified" : "2018-10-26T12:05:02.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-22T12:09:22" ,
"category" : "Other" ,
"uuid" : "d06e1229-9cd6-47ff-a11d-621b3cce363f"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/40ffcbf044ec951242a92a09b6a239183def2e74fc18e5975fa70e849d875a2e/analysis/1540210162/" ,
"category" : "External analysis" ,
"uuid" : "2cacb2d3-befa-4eb8-8320-1c50a9bb38d3"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "37/57" ,
"category" : "Other" ,
"uuid" : "3635dbaf-ee96-4cd6-9b58-90184ff70f68"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--3302d71e-7875-4c88-b2ba-41dad3c95145" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:05:20.000Z" ,
"modified" : "2018-10-26T12:05:20.000Z" ,
"pattern" : "[file:hashes.MD5 = '24e1bd221ba3813ed7b6056136237587' AND file:hashes.SHA1 = '8d86e25ee414d49cf925d5fd333443e39eebfc8f' AND file:hashes.SHA256 = '3d96811de7419a8c090a671d001a85f2b1875243e5b38e6f927d9877d0ff9b0c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:05:20Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--16f41dd9-5ec8-42fc-9def-e3b9f5868d5b" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:05:32.000Z" ,
"modified" : "2018-10-26T12:05:32.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-26T00:34:39" ,
"category" : "Other" ,
"uuid" : "434f756d-ef27-4be1-83c9-2b61eba6396c"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/3d96811de7419a8c090a671d001a85f2b1875243e5b38e6f927d9877d0ff9b0c/analysis/1540514079/" ,
"category" : "External analysis" ,
"uuid" : "9b4acfe3-9c4b-4a6d-ad0b-56bf33d8686c"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "38/59" ,
"category" : "Other" ,
"uuid" : "fffa1e19-c195-450a-a0c6-04331a49bf32"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--cc368270-d79e-4a9d-ba7d-064db8e3425a" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:05:55.000Z" ,
"modified" : "2018-10-26T12:05:55.000Z" ,
"pattern" : "[file:hashes.MD5 = 'ce2df2907ce543438c19cfaf6c14f699' AND file:hashes.SHA1 = '17ac7424c06f42844b70ac508d12608329d331ae' AND file:hashes.SHA256 = '209fb398318a0d346b933b0c408467fce8dea36c10cd0f69ce4b342e28cee9dc']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:05:55Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--7ab71cfb-ea18-49f4-bfc5-cd3ee49738cd" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:06:10.000Z" ,
"modified" : "2018-10-26T12:06:10.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-13T22:18:08" ,
"category" : "Other" ,
"uuid" : "465381ee-3728-499f-8ccc-fb9001348416"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/209fb398318a0d346b933b0c408467fce8dea36c10cd0f69ce4b342e28cee9dc/analysis/1539469088/" ,
"category" : "External analysis" ,
"uuid" : "e0c02618-f216-4a5a-9ef9-515f4f2f8d32"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "37/58" ,
"category" : "Other" ,
"uuid" : "f4b7b799-d5ae-4303-9564-d1d8896cd47e"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--344a7eaa-7132-4b02-82c1-e5584b3169c1" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:06:18.000Z" ,
"modified" : "2018-10-26T12:06:18.000Z" ,
"pattern" : "[file:hashes.MD5 = '47ec75d3290add179ac5218d193bb9a8' AND file:hashes.SHA1 = '4e23eca913de2aeb7093cb7ecfbf1dc272ff78b9' AND file:hashes.SHA256 = 'f6707b5f41192353be3311fc7f48ee30465038366386b909e6cefaade70c91bc']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:06:18Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--46d0a508-b361-4427-a099-64e9f943116d" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:06:48.000Z" ,
"modified" : "2018-10-26T12:06:48.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-26T00:47:39" ,
"category" : "Other" ,
"uuid" : "1d654ffa-2b0d-4038-ba6d-36d739672f45"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/f6707b5f41192353be3311fc7f48ee30465038366386b909e6cefaade70c91bc/analysis/1540514859/" ,
"category" : "External analysis" ,
"uuid" : "2aecd147-b707-46f9-bf79-6d82917db72b"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "35/67" ,
"category" : "Other" ,
"uuid" : "c58a1b2d-1600-48e2-92d0-711442e0309a"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--245a788b-a28c-4d13-9cfb-6a3f67f892f4" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:06:50.000Z" ,
"modified" : "2018-10-26T12:06:50.000Z" ,
"pattern" : "[file:hashes.MD5 = 'cd371d1d3bd7c8e2110587cfa8b7eaea' AND file:hashes.SHA1 = 'a74ebea575319e9e26a5fcd6939e103dbd230eb4' AND file:hashes.SHA256 = '315a95d2565b05d936d1357311848d7cc021dfddfd8bfe4a3f7dea18c2c19522']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:06:50Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--c53779ab-34b1-4e06-80a2-f060d1dd2212" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:06:53.000Z" ,
"modified" : "2018-10-26T12:06:53.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-13T22:14:36" ,
"category" : "Other" ,
"uuid" : "a4622b73-9b01-4cad-84cf-c42f58c9f5cf"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/315a95d2565b05d936d1357311848d7cc021dfddfd8bfe4a3f7dea18c2c19522/analysis/1539468876/" ,
"category" : "External analysis" ,
"uuid" : "4c4dffec-736d-4643-8a9d-fbe1b7d39a75"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "36/58" ,
"category" : "Other" ,
"uuid" : "4eecd42c-bcd8-4c3c-8b21-44a9d8841aab"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--3ca55f8e-4d26-48b5-92fd-5ea47ba8b291" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:06:56.000Z" ,
"modified" : "2018-10-26T12:06:56.000Z" ,
"pattern" : "[file:hashes.MD5 = 'f84914c30ae4e6b9b1f23d5c01e001ed' AND file:hashes.SHA1 = '78ba7c54d0ee1009ea8fdf7a198ff3a2b0a7a4f7' AND file:hashes.SHA256 = '18479a93fc2d5acd7d71d596f27a5834b2b236b44219bb08f6ca06cf760b74f6']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:06:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--fa93027d-b99b-4cc3-a32d-f0afdec46d12" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:07:30.000Z" ,
"modified" : "2018-10-26T12:07:30.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-13T22:26:48" ,
"category" : "Other" ,
"uuid" : "2c5e82fd-e20a-49a3-8b2a-4b53a1afba45"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/18479a93fc2d5acd7d71d596f27a5834b2b236b44219bb08f6ca06cf760b74f6/analysis/1539469608/" ,
"category" : "External analysis" ,
"uuid" : "271f0f46-a4c8-46ea-bbe0-98b84304a82d"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "41/58" ,
"category" : "Other" ,
"uuid" : "a15edd7e-0add-47a9-b03c-b7140b2937e4"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--969cd2bf-3874-4c07-a054-5eec49bf0079" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:07:33.000Z" ,
"modified" : "2018-10-26T12:07:33.000Z" ,
"pattern" : "[file:hashes.MD5 = '665947cf7037a6772687b69279753cdf' AND file:hashes.SHA1 = '89f726a22b1cad37d95befeed64a6c379f7db2ad' AND file:hashes.SHA256 = '94625dd8151814dd6186735a6a6a87b2a4c71c04b8402caf314fb6f98434eaad']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:07:33Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--341e106f-4861-4bb6-9581-fbee0cb3632c" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:07:36.000Z" ,
"modified" : "2018-10-26T12:07:36.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-20T13:08:11" ,
"category" : "Other" ,
"uuid" : "3420ce84-479f-475c-ba66-604c7c5683f4"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/94625dd8151814dd6186735a6a6a87b2a4c71c04b8402caf314fb6f98434eaad/analysis/1540040891/" ,
"category" : "External analysis" ,
"uuid" : "55cc886a-e25d-476b-8a7e-20a5fe4e6614"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "39/59" ,
"category" : "Other" ,
"uuid" : "54676eed-d4a9-4ab3-a05f-478ec6349aae"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--46b26e92-d82a-4fea-8c89-580becaa903a" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:08:00.000Z" ,
"modified" : "2018-10-26T12:08:00.000Z" ,
"pattern" : "[file:hashes.MD5 = '4f873578956d2790101443f24e4bd4d3' AND file:hashes.SHA1 = 'c8b93462145d8233af5f52c4acea38de255e4701' AND file:hashes.SHA256 = 'ad7210a49bd908aae54da0f496ca62cb10a20c3c934dede84f9afff229186873']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:08:00Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--f4196559-f992-4516-bce9-7658600a7894" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:08:37.000Z" ,
"modified" : "2018-10-26T12:08:37.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-26T00:58:48" ,
"category" : "Other" ,
"uuid" : "92129c9b-7c1c-45de-a493-af00635c6770"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/ad7210a49bd908aae54da0f496ca62cb10a20c3c934dede84f9afff229186873/analysis/1540515528/" ,
"category" : "External analysis" ,
"uuid" : "b14351f0-b0d5-49f6-a388-42bc6abd1d28"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "17/58" ,
"category" : "Other" ,
"uuid" : "13e6c4c4-91e6-42c4-9662-8258abed6aad"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--ba352a5d-16d7-4309-9282-c2e88311365b" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:08:45.000Z" ,
"modified" : "2018-10-26T12:08:45.000Z" ,
"pattern" : "[file:hashes.MD5 = 'b8939fa58fad8aa1ec271f6dae0b7255' AND file:hashes.SHA1 = '0336503957730b0669a4575fa64b9c4d9d25f240' AND file:hashes.SHA256 = '76e9988dad0278998861717c774227bf94112db548946ef617bfaa262cb5e338']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:08:45Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--afbfb77f-dbbf-476b-bd72-4cc29f2d52eb" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:08:51.000Z" ,
"modified" : "2018-10-26T12:08:51.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-22T22:07:39" ,
"category" : "Other" ,
"uuid" : "d6768968-bbbb-4f37-8c09-49822cf5ef5d"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/76e9988dad0278998861717c774227bf94112db548946ef617bfaa262cb5e338/analysis/1540246059/" ,
"category" : "External analysis" ,
"uuid" : "b782bdf4-6702-4b0c-b531-aac359e9c545"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "41/59" ,
"category" : "Other" ,
"uuid" : "4aa66c8a-42e4-48a6-91c9-edafbfe98f53"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--277fd140-36c3-4b42-a9f6-56ec81f87384" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:08:58.000Z" ,
"modified" : "2018-10-26T12:08:58.000Z" ,
"pattern" : "[file:hashes.MD5 = '08acd1149b09bf6455c553f512b51085' AND file:hashes.SHA1 = '56837e2222dd6dd2700afdaf35d7d219b4566dff' AND file:hashes.SHA256 = 'f9a825385e4bf2a86943f78708f7b5a3bb4244c334be5cd363c221b59a21d42e']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:08:58Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--cdf6b744-d24a-49f9-8ac4-2c2c72de5e56" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:09:24.000Z" ,
"modified" : "2018-10-26T12:09:24.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-16T12:57:16" ,
"category" : "Other" ,
"uuid" : "f4514c63-d34d-479c-aabc-f399ce433dd4"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/f9a825385e4bf2a86943f78708f7b5a3bb4244c334be5cd363c221b59a21d42e/analysis/1539694636/" ,
"category" : "External analysis" ,
"uuid" : "39c081fa-2210-4dd9-936e-69f8f0b8687b"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "38/59" ,
"category" : "Other" ,
"uuid" : "bad218fe-9d9a-4251-a7ab-9a4690a5bd93"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--2d1711bf-a2cb-4113-96c0-26c70f04bc38" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:09:44.000Z" ,
"modified" : "2018-10-26T12:09:44.000Z" ,
"pattern" : "[file:hashes.MD5 = 'd15aee026074fbd18f780fb51ec0632a' AND file:hashes.SHA1 = '352687a98fb232e5614f7ce7cd57512553535915' AND file:hashes.SHA256 = 'af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:09:44Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--348d53ec-29f8-48bd-b32e-d4d632e8bf5d" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:09:58.000Z" ,
"modified" : "2018-10-26T12:09:58.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-13T22:19:12" ,
"category" : "Other" ,
"uuid" : "8705cda0-5405-46d6-b4e7-d295efdf377b"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102/analysis/1539469152/" ,
"category" : "External analysis" ,
"uuid" : "9a3461b2-a6d2-4233-9a07-e8a682f5f474"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "39/59" ,
"category" : "Other" ,
"uuid" : "3bd447c7-a736-4410-88c0-efc980eb4477"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--efb4664d-3744-4557-a6b0-eadb0e46f982" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:10:01.000Z" ,
"modified" : "2018-10-26T12:10:01.000Z" ,
"pattern" : "[file:hashes.MD5 = 'aa1e8d0e1c4d4eb9984124df003ea7f2' AND file:hashes.SHA1 = 'dfcd4a66adc4ebd573a48f1715a8f2b0c0291160' AND file:hashes.SHA256 = 'cd123cc3c192e822d24534ad52b7c76becbe0b10f987c881d90a4629ef84f736']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:10:01Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--864c648b-dfb9-457c-84a7-a69a18909bfc" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:10:05.000Z" ,
"modified" : "2018-10-26T12:10:05.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-13T21:17:03" ,
"category" : "Other" ,
"uuid" : "8d0ceced-616b-42c9-89cf-4f92cc6d2c3e"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/cd123cc3c192e822d24534ad52b7c76becbe0b10f987c881d90a4629ef84f736/analysis/1539465423/" ,
"category" : "External analysis" ,
"uuid" : "46db7b18-cf5d-44c7-8710-219172ec1a25"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "40/58" ,
"category" : "Other" ,
"uuid" : "ba031384-7102-4ea7-bc64-4d257267e9ed"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--0a31c783-7db1-4ee2-9113-dd1393956968" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:10:27.000Z" ,
"modified" : "2018-10-26T12:10:27.000Z" ,
"pattern" : "[file:hashes.MD5 = 'bb476622bcb0c666e12fbe4ccda8bbef' AND file:hashes.SHA1 = '4986d8bca37e0863f5baf25a0da27e6b253d12bb' AND file:hashes.SHA256 = '3f14a1210d1f2cdb916275bf32cb49159b6f49a54f246bdcb0e967cd0edb8e82']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:10:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--d49c4443-b917-485f-9988-346a4c174c36" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:10:29.000Z" ,
"modified" : "2018-10-26T12:10:29.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-13T21:51:07" ,
"category" : "Other" ,
"uuid" : "37a5c439-b1b4-4c95-bd21-f1e1f076f047"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/3f14a1210d1f2cdb916275bf32cb49159b6f49a54f246bdcb0e967cd0edb8e82/analysis/1539467467/" ,
"category" : "External analysis" ,
"uuid" : "08388520-2788-48f8-86cf-e34359a3a533"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "34/58" ,
"category" : "Other" ,
"uuid" : "447fa4aa-0cab-45ba-8ca7-d8996eef6876"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5a1bf1ba-5c6b-4882-af35-f992c5545079" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:10:31.000Z" ,
"modified" : "2018-10-26T12:10:31.000Z" ,
"pattern" : "[file:hashes.MD5 = '5466c8a099d1d30096775b1f4357d3cf' AND file:hashes.SHA1 = '4f632db14f1cda11f7d3f907e746155cde399eaf' AND file:hashes.SHA256 = '9038ba1b7991ff38b802f28c0e006d12d466a8e374d2f2a83a039aabcbe76f5c']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:10:31Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--7fbb889d-657e-40e0-9458-b7a422b9ccd2" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:10:33.000Z" ,
"modified" : "2018-10-26T12:10:33.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-13T20:15:57" ,
"category" : "Other" ,
"uuid" : "253f6040-7ba2-40f1-9026-2ff49db3ab24"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/9038ba1b7991ff38b802f28c0e006d12d466a8e374d2f2a83a039aabcbe76f5c/analysis/1539461757/" ,
"category" : "External analysis" ,
"uuid" : "3f3c9059-f685-4d08-afc1-4c73cee08a38"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "41/59" ,
"category" : "Other" ,
"uuid" : "b583f736-79f9-4a5e-bc47-e02fc26f14f1"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--58012976-30e2-4822-b6a7-fdbf701fc7b8" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:10:35.000Z" ,
"modified" : "2018-10-26T12:10:35.000Z" ,
"pattern" : "[file:hashes.MD5 = 'f00fd318bf58586c29ab970132d1fd2a' AND file:hashes.SHA1 = '6f5f226c071f97ac46c0b4f4d390fcce3f40b860' AND file:hashes.SHA256 = 'bbcafdb4fd7bf107d8b85934286d531536b7a0a30e5eeed07e27f0f7afcf8a77']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:10:35Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--cb449345-1d6a-466a-ba9b-b35a37462d75" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:10:41.000Z" ,
"modified" : "2018-10-26T12:10:41.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-22T12:06:39" ,
"category" : "Other" ,
"uuid" : "8876e6b2-2e78-4e96-9472-5a5c7f16b1a7"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/bbcafdb4fd7bf107d8b85934286d531536b7a0a30e5eeed07e27f0f7afcf8a77/analysis/1540209999/" ,
"category" : "External analysis" ,
"uuid" : "fe921098-fd26-4c29-a9f8-be97758741a0"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "40/59" ,
"category" : "Other" ,
"uuid" : "a44f783a-6846-4063-9ad1-51786f917a1b"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--dc0c9d2f-28dd-44fe-913a-db5481dfc8ba" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:10:43.000Z" ,
"modified" : "2018-10-26T12:10:43.000Z" ,
"pattern" : "[file:hashes.MD5 = 'd632c8444aab1b43a663401e80c0bac4' AND file:hashes.SHA1 = '2b3981a8889d51bb14a3a974d1578b0161b8784b' AND file:hashes.SHA256 = '3da24cd3af9a383b731ce178b03c68a813ab30f4c7c8dfbc823a32816b9406fb']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:10:43Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--ee33f122-421f-4d64-82c7-8e6f75329c57" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:10:46.000Z" ,
"modified" : "2018-10-26T12:10:46.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-11T15:14:26" ,
"category" : "Other" ,
"uuid" : "4263a1ce-39bd-45de-82f4-e2a9061c5333"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/3da24cd3af9a383b731ce178b03c68a813ab30f4c7c8dfbc823a32816b9406fb/analysis/1539270866/" ,
"category" : "External analysis" ,
"uuid" : "8cbe935b-39b3-41ae-b212-6531a480d97f"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "41/59" ,
"category" : "Other" ,
"uuid" : "b5212545-5018-404c-b8b4-c9fff615e8dd"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--a4fe4a04-2083-4108-a050-f5920409d023" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:10:56.000Z" ,
"modified" : "2018-10-26T12:10:56.000Z" ,
"pattern" : "[file:hashes.MD5 = '2b8ab9112e34bb910055d85ec800db3f' AND file:hashes.SHA1 = '36216f2ef471a3189f175630cebb06f04e30bf4b' AND file:hashes.SHA256 = '276a765a10f98cda1a38d3a31e7483585ca3722ecad19d784441293acf1b7beb']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:10:56Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--43dd37f2-90c2-463f-9166-eb111de8e695" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:11:09.000Z" ,
"modified" : "2018-10-26T12:11:09.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-21T00:16:09" ,
"category" : "Other" ,
"uuid" : "7c8477a8-c454-4aaf-a0dc-091459cbea54"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/276a765a10f98cda1a38d3a31e7483585ca3722ecad19d784441293acf1b7beb/analysis/1540080969/" ,
"category" : "External analysis" ,
"uuid" : "81f1d13e-321a-422c-9c22-bd12f7659d04"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "36/67" ,
"category" : "Other" ,
"uuid" : "8d8c772f-2b41-47d9-bff0-31c360bc614f"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--5ecac345-ba1e-4426-9400-0f42240de6f9" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:11:10.000Z" ,
"modified" : "2018-10-26T12:11:10.000Z" ,
"pattern" : "[file:hashes.MD5 = '37f7e6e5f073508e1ee552ebea5d200e' AND file:hashes.SHA1 = '34f4c4ac3500a91c5d9394b247ba1eeb7152535d' AND file:hashes.SHA256 = 'd07d4e71927cab4f251bcc216f560674c5fb783add9c9f956d3fc457153be025']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:11:10Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--3d957cef-2600-427d-8c91-ca9a3cc06dbb" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:11:12.000Z" ,
"modified" : "2018-10-26T12:11:12.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-26T00:37:14" ,
"category" : "Other" ,
"uuid" : "6afed300-f5d6-4060-a0f3-e9dd72358090"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/d07d4e71927cab4f251bcc216f560674c5fb783add9c9f956d3fc457153be025/analysis/1540514234/" ,
"category" : "External analysis" ,
"uuid" : "b6bd2374-449e-48bc-86c6-8f9f85fb3e7e"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "36/57" ,
"category" : "Other" ,
"uuid" : "992192ee-c474-4e35-96c3-bcb874336924"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--b5662b78-6d3b-44cf-86db-a7ffd1324345" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:11:13.000Z" ,
"modified" : "2018-10-26T12:11:13.000Z" ,
"pattern" : "[file:hashes.MD5 = '5de97ae178888f2dd222bb8a66060ac2' AND file:hashes.SHA1 = '32f723050afe20a3b5b6c3a1d60db385045a3dbf' AND file:hashes.SHA256 = 'eff78c23790ee834f773569b52cddb01dc3c4dd9660f5a476af044ef6fe73894']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:11:13Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--e2436b65-f8eb-47f8-96fd-a957987bf24e" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:11:15.000Z" ,
"modified" : "2018-10-26T12:11:15.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-13T20:48:54" ,
"category" : "Other" ,
"uuid" : "3ad214b5-7e6f-4772-a671-90c2db86a80a"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/eff78c23790ee834f773569b52cddb01dc3c4dd9660f5a476af044ef6fe73894/analysis/1539463734/" ,
"category" : "External analysis" ,
"uuid" : "fbb0e0ec-50b8-45c9-8dd2-3457ea1c7006"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "41/59" ,
"category" : "Other" ,
"uuid" : "fbec1590-9808-4e00-a56b-bf587d8f1f43"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "indicator" ,
"spec_version" : "2.1" ,
"id" : "indicator--c18dbdfc-e3d4-419a-9d61-399cbd689f00" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:11:27.000Z" ,
"modified" : "2018-10-26T12:11:27.000Z" ,
"pattern" : "[file:hashes.MD5 = 'be62fc5b1576e0a8491519e10bab931d' AND file:hashes.SHA1 = 'b3545913847b7cb53fe01d599c5dd35b7c82ad97' AND file:hashes.SHA256 = '86b5aab2be0b3f29e3184fd2337792a80706cc593cc17de85eea2401af29738f']" ,
"pattern_type" : "stix" ,
"pattern_version" : "2.1" ,
"valid_from" : "2018-10-26T12:11:27Z" ,
"kill_chain_phases" : [
{
"kill_chain_name" : "misp-category" ,
"phase_name" : "file"
}
] ,
"labels" : [
"misp:name=\"file\"" ,
"misp:meta-category=\"file\"" ,
"misp:to_ids=\"True\""
]
} ,
{
"type" : "x-misp-object" ,
"spec_version" : "2.1" ,
"id" : "x-misp-object--f73e119f-231f-497c-8b71-1b3c9c2a475a" ,
"created_by_ref" : "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f" ,
"created" : "2018-10-26T12:11:40.000Z" ,
"modified" : "2018-10-26T12:11:40.000Z" ,
"labels" : [
"misp:name=\"virustotal-report\"" ,
"misp:meta-category=\"misc\""
] ,
"x_misp_attributes" : [
{
"type" : "datetime" ,
"object_relation" : "last-submission" ,
"value" : "2018-10-18T03:49:04" ,
"category" : "Other" ,
"uuid" : "1f03c32a-e9cf-4551-bfca-87673f0711d2"
} ,
{
"type" : "link" ,
"object_relation" : "permalink" ,
"value" : "https://www.virustotal.com/file/86b5aab2be0b3f29e3184fd2337792a80706cc593cc17de85eea2401af29738f/analysis/1539834544/" ,
"category" : "External analysis" ,
"uuid" : "5f555d33-f1b6-42b7-b206-03b0da8796ea"
} ,
{
"type" : "text" ,
"object_relation" : "detection-ratio" ,
"value" : "20/57" ,
"category" : "Other" ,
"uuid" : "11eb8dfc-9816-4000-978c-a777dcb0ef96"
}
] ,
"x_misp_meta_category" : "misc" ,
"x_misp_name" : "virustotal-report"
} ,
{
"type" : "marking-definition" ,
"spec_version" : "2.1" ,
"id" : "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ,
"created" : "2017-01-20T00:00:00.000Z" ,
"definition_type" : "tlp" ,
"name" : "TLP:WHITE" ,
"definition" : {
"tlp" : "white"
}
}
2023-04-21 13:25:09 +00:00
]
}
