2023-04-21 13:25:09 +00:00
|
|
|
{
|
2023-06-14 17:31:25 +00:00
|
|
|
"type": "bundle",
|
|
|
|
|
"id": "bundle--5d13bc95-ecbc-4af9-b684-423602de0b81",
|
|
|
|
|
"objects": [
|
|
|
|
|
{
|
|
|
|
|
"type": "identity",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-06-26T18:50:47.000Z",
|
|
|
|
|
"modified": "2019-06-26T18:50:47.000Z",
|
|
|
|
|
"name": "CIRCL",
|
|
|
|
|
"identity_class": "organization"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "report",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "report--5d13bc95-ecbc-4af9-b684-423602de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-06-26T18:50:47.000Z",
|
|
|
|
|
"modified": "2019-06-26T18:50:47.000Z",
|
|
|
|
|
"name": "Soft Cell case - guessed indicators (via Twitter discussion)",
|
|
|
|
|
"published": "2019-06-26T18:52:05Z",
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"observed-data--5d13bca8-77cc-4742-90d0-4e1502de0b81",
|
|
|
|
|
"url--5d13bca8-77cc-4742-90d0-4e1502de0b81",
|
|
|
|
|
"indicator--5d13bce5-dd84-486e-a09b-415002de0b81",
|
|
|
|
|
"indicator--5d13bce6-acc4-4222-8d5d-4f7602de0b81",
|
|
|
|
|
"indicator--5d13bce6-80a8-4a42-a24d-462b02de0b81",
|
|
|
|
|
"indicator--5d13bce6-ee08-479c-a459-4e7b02de0b81",
|
|
|
|
|
"indicator--5d13bce6-c1c4-47f5-9dab-486e02de0b81",
|
|
|
|
|
"indicator--5d13bce6-ac00-4d05-9a1c-43a002de0b81",
|
|
|
|
|
"indicator--5d13bcfe-4314-4e44-b0c2-43c702de0b81",
|
|
|
|
|
"indicator--5d13bcfe-9fd8-4d8c-9b64-4c0c02de0b81",
|
|
|
|
|
"indicator--5d13bcfe-60e4-4863-82dc-412f02de0b81",
|
|
|
|
|
"indicator--5d13bd31-d2ac-4a2e-99e7-4e7902de0b81",
|
|
|
|
|
"indicator--5d13bd32-2c90-4102-b8b4-4ba602de0b81",
|
|
|
|
|
"observed-data--5d13bdd1-5c0c-49b8-8671-4b3302de0b81",
|
|
|
|
|
"url--5d13bdd1-5c0c-49b8-8671-4b3302de0b81",
|
|
|
|
|
"observed-data--5d13bde4-1b68-4c06-ae4c-5385e387cbd9",
|
|
|
|
|
"network-traffic--5d13bde4-1b68-4c06-ae4c-5385e387cbd9",
|
|
|
|
|
"ipv4-addr--5d13bde4-1b68-4c06-ae4c-5385e387cbd9",
|
|
|
|
|
"observed-data--5d13bde4-31ac-4368-922a-5385e387cbd9",
|
|
|
|
|
"network-traffic--5d13bde4-31ac-4368-922a-5385e387cbd9",
|
|
|
|
|
"ipv4-addr--5d13bde4-31ac-4368-922a-5385e387cbd9",
|
|
|
|
|
"observed-data--5d13bde4-9e8c-42cb-bfc9-5385e387cbd9",
|
|
|
|
|
"network-traffic--5d13bde4-9e8c-42cb-bfc9-5385e387cbd9",
|
|
|
|
|
"ipv4-addr--5d13bde4-9e8c-42cb-bfc9-5385e387cbd9",
|
|
|
|
|
"indicator--a84950f4-4292-4648-a458-571a4adf25a9",
|
|
|
|
|
"x-misp-object--b5a0e459-5c77-470f-9237-ebbbc696c22d",
|
|
|
|
|
"indicator--f04d4630-aae5-4603-b43a-f905aacf83c5",
|
|
|
|
|
"x-misp-object--21e4d20a-add1-41f7-84c2-c38beaafd633",
|
|
|
|
|
"indicator--18448777-1668-45b1-a0d5-821d348e970c",
|
|
|
|
|
"x-misp-object--cf10a26e-de17-4073-9445-50f0519dce18",
|
|
|
|
|
"indicator--eceee0ff-b9ce-47fd-b34e-ee27ec26f394",
|
|
|
|
|
"x-misp-object--6cae530d-e8f6-4513-95e4-0ccddf9c7a84",
|
|
|
|
|
"indicator--9ab69867-6fa8-49ec-96f2-8276c622a426",
|
|
|
|
|
"x-misp-object--baca908c-f701-4c24-8c83-4b5840ba7558",
|
2023-06-24 09:36:52 +00:00
|
|
|
"relationship--589cebbf-c931-460d-95e7-d073c1346133",
|
|
|
|
|
"relationship--cb83a59b-fa7f-496a-82b7-7931823db96a",
|
|
|
|
|
"relationship--42d5408c-cdb3-474e-8e0b-22bf24f54fa0",
|
|
|
|
|
"relationship--113a47c9-ea59-4ecf-a3e0-e485ca666bf1",
|
|
|
|
|
"relationship--5d619c97-cfa4-4f81-8af4-2ea03c4ddb4b"
|
2023-06-14 17:31:25 +00:00
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"Threat-Report",
|
|
|
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
|
|
|
"type:OSINT",
|
|
|
|
|
"osint:lifetime=\"perpetual\"",
|
|
|
|
|
"osint:certainty=\"50\""
|
|
|
|
|
],
|
|
|
|
|
"object_marking_refs": [
|
|
|
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5d13bca8-77cc-4742-90d0-4e1502de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-06-26T18:42:48.000Z",
|
|
|
|
|
"modified": "2019-06-26T18:42:48.000Z",
|
|
|
|
|
"first_observed": "2019-06-26T18:42:48Z",
|
|
|
|
|
"last_observed": "2019-06-26T18:42:48Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5d13bca8-77cc-4742-90d0-4e1502de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5d13bca8-77cc-4742-90d0-4e1502de0b81",
|
|
|
|
|
"value": "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5d13bce5-dd84-486e-a09b-415002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-06-26T18:43:49.000Z",
|
|
|
|
|
"modified": "2019-06-26T18:43:49.000Z",
|
|
|
|
|
"description": "A few C2s associated with the hashes Tom posted:",
|
|
|
|
|
"pattern": "[domain-name:value = 'asyspy256.ddns.net']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2019-06-26T18:43:49Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5d13bce6-acc4-4222-8d5d-4f7602de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-06-26T18:43:50.000Z",
|
|
|
|
|
"modified": "2019-06-26T18:43:50.000Z",
|
|
|
|
|
"description": "A few C2s associated with the hashes Tom posted:",
|
|
|
|
|
"pattern": "[domain-name:value = 'cvdfhjh1231.myftp.biz']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2019-06-26T18:43:50Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5d13bce6-80a8-4a42-a24d-462b02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-06-26T18:43:50.000Z",
|
|
|
|
|
"modified": "2019-06-26T18:43:50.000Z",
|
|
|
|
|
"description": "A few C2s associated with the hashes Tom posted:",
|
|
|
|
|
"pattern": "[domain-name:value = 'dffwescwer4325.myftp.biz']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2019-06-26T18:43:50Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5d13bce6-ee08-479c-a459-4e7b02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-06-26T18:43:50.000Z",
|
|
|
|
|
"modified": "2019-06-26T18:43:50.000Z",
|
|
|
|
|
"description": "A few C2s associated with the hashes Tom posted:",
|
|
|
|
|
"pattern": "[domain-name:value = 'hotkillmail9sddcc.ddns.net']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2019-06-26T18:43:50Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5d13bce6-c1c4-47f5-9dab-486e02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-06-26T18:43:50.000Z",
|
|
|
|
|
"modified": "2019-06-26T18:43:50.000Z",
|
|
|
|
|
"description": "A few C2s associated with the hashes Tom posted:",
|
|
|
|
|
"pattern": "[domain-name:value = 'rosaf112.ddns.net']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2019-06-26T18:43:50Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5d13bce6-ac00-4d05-9a1c-43a002de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-06-26T18:43:50.000Z",
|
|
|
|
|
"modified": "2019-06-26T18:43:50.000Z",
|
|
|
|
|
"description": "A few C2s associated with the hashes Tom posted:",
|
|
|
|
|
"pattern": "[domain-name:value = 'sz2016rose.ddns.net']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2019-06-26T18:43:50Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Network activity"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"hostname\"",
|
|
|
|
|
"misp:category=\"Network activity\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5d13bcfe-4314-4e44-b0c2-43c702de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-06-26T18:44:14.000Z",
|
|
|
|
|
"modified": "2019-06-26T18:44:14.000Z",
|
|
|
|
|
"description": "Based on the writeup, likely associated file",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'fa599fddd6b6df4b654e022fe7a91c82152f983e1ce0b97406eb27bb2fb4c3ab']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2019-06-26T18:44:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5d13bcfe-9fd8-4d8c-9b64-4c0c02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-06-26T18:44:14.000Z",
|
|
|
|
|
"modified": "2019-06-26T18:44:14.000Z",
|
|
|
|
|
"description": "Based on the writeup, likely associated file",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '12979d85d37a7e246757d5ebf238c6ac91e6641950cf45d95b104eb7dbb7db71']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2019-06-26T18:44:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5d13bcfe-60e4-4863-82dc-412f02de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-06-26T18:44:14.000Z",
|
|
|
|
|
"modified": "2019-06-26T18:44:14.000Z",
|
|
|
|
|
"description": "Based on the writeup, likely associated file",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = 'c81dd8dd3623181cbc117ca7255e6ea530f770c05624c6896362f03fbfc06280']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2019-06-26T18:44:14Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5d13bd31-d2ac-4a2e-99e7-4e7902de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-06-26T18:45:05.000Z",
|
|
|
|
|
"modified": "2019-06-26T18:45:05.000Z",
|
|
|
|
|
"description": "Adding two more hashes of mal-ssMUIDLL.dlls:",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '5bf80b871278a29f356bd42af1e35428aead20cd90b0c7642247afcaaa95b022']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2019-06-26T18:45:05Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--5d13bd32-2c90-4102-b8b4-4ba602de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-06-26T18:45:06.000Z",
|
|
|
|
|
"modified": "2019-06-26T18:45:06.000Z",
|
|
|
|
|
"description": "Adding two more hashes of mal-ssMUIDLL.dlls:",
|
|
|
|
|
"pattern": "[file:hashes.SHA256 = '95817d8c742dd667225273847ea15f46445ab1439e634c05785084af7cb39a58']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2019-06-26T18:45:06Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "Payload delivery"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"sha256\"",
|
|
|
|
|
"misp:category=\"Payload delivery\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5d13bdd1-5c0c-49b8-8671-4b3302de0b81",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-06-26T18:47:45.000Z",
|
|
|
|
|
"modified": "2019-06-26T18:47:45.000Z",
|
|
|
|
|
"first_observed": "2019-06-26T18:47:45Z",
|
|
|
|
|
"last_observed": "2019-06-26T18:47:45Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"url--5d13bdd1-5c0c-49b8-8671-4b3302de0b81"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"link\"",
|
|
|
|
|
"misp:category=\"External analysis\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "url",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "url--5d13bdd1-5c0c-49b8-8671-4b3302de0b81",
|
|
|
|
|
"value": "https://twitter.com/tlansec/status/1143451202736336896"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5d13bde4-1b68-4c06-ae4c-5385e387cbd9",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-06-26T18:48:04.000Z",
|
|
|
|
|
"modified": "2019-06-26T18:48:04.000Z",
|
|
|
|
|
"first_observed": "2019-06-26T18:48:04Z",
|
|
|
|
|
"last_observed": "2019-06-26T18:48:04Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5d13bde4-1b68-4c06-ae4c-5385e387cbd9",
|
|
|
|
|
"ipv4-addr--5d13bde4-1b68-4c06-ae4c-5385e387cbd9"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-src\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5d13bde4-1b68-4c06-ae4c-5385e387cbd9",
|
|
|
|
|
"src_ref": "ipv4-addr--5d13bde4-1b68-4c06-ae4c-5385e387cbd9",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5d13bde4-1b68-4c06-ae4c-5385e387cbd9",
|
|
|
|
|
"value": "210.56.60.240"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5d13bde4-31ac-4368-922a-5385e387cbd9",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-06-26T18:48:04.000Z",
|
|
|
|
|
"modified": "2019-06-26T18:48:04.000Z",
|
|
|
|
|
"first_observed": "2019-06-26T18:48:04Z",
|
|
|
|
|
"last_observed": "2019-06-26T18:48:04Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5d13bde4-31ac-4368-922a-5385e387cbd9",
|
|
|
|
|
"ipv4-addr--5d13bde4-31ac-4368-922a-5385e387cbd9"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-src\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5d13bde4-31ac-4368-922a-5385e387cbd9",
|
|
|
|
|
"src_ref": "ipv4-addr--5d13bde4-31ac-4368-922a-5385e387cbd9",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5d13bde4-31ac-4368-922a-5385e387cbd9",
|
|
|
|
|
"value": "45.121.48.106"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "observed-data",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "observed-data--5d13bde4-9e8c-42cb-bfc9-5385e387cbd9",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-06-26T18:48:04.000Z",
|
|
|
|
|
"modified": "2019-06-26T18:48:04.000Z",
|
|
|
|
|
"first_observed": "2019-06-26T18:48:04Z",
|
|
|
|
|
"last_observed": "2019-06-26T18:48:04Z",
|
|
|
|
|
"number_observed": 1,
|
|
|
|
|
"object_refs": [
|
|
|
|
|
"network-traffic--5d13bde4-9e8c-42cb-bfc9-5385e387cbd9",
|
|
|
|
|
"ipv4-addr--5d13bde4-9e8c-42cb-bfc9-5385e387cbd9"
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:type=\"ip-src\"",
|
|
|
|
|
"misp:category=\"Network activity\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "network-traffic",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "network-traffic--5d13bde4-9e8c-42cb-bfc9-5385e387cbd9",
|
|
|
|
|
"src_ref": "ipv4-addr--5d13bde4-9e8c-42cb-bfc9-5385e387cbd9",
|
|
|
|
|
"protocols": [
|
|
|
|
|
"tcp"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "ipv4-addr",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "ipv4-addr--5d13bde4-9e8c-42cb-bfc9-5385e387cbd9",
|
|
|
|
|
"value": "45.77.226.209"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--a84950f4-4292-4648-a458-571a4adf25a9",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-06-26T18:45:52.000Z",
|
|
|
|
|
"modified": "2019-06-26T18:45:52.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'e435b961048c2fecc2e8e697dc9bd666' AND file:hashes.SHA1 = '5d17fd6904db389040767f8474ca88be4b43de07' AND file:hashes.SHA256 = 'fa599fddd6b6df4b654e022fe7a91c82152f983e1ce0b97406eb27bb2fb4c3ab']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2019-06-26T18:45:52Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "file"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:name=\"file\"",
|
|
|
|
|
"misp:meta-category=\"file\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "x-misp-object",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "x-misp-object--b5a0e459-5c77-470f-9237-ebbbc696c22d",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-06-26T18:45:53.000Z",
|
|
|
|
|
"modified": "2019-06-26T18:45:53.000Z",
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:name=\"virustotal-report\"",
|
|
|
|
|
"misp:meta-category=\"misc\""
|
|
|
|
|
],
|
|
|
|
|
"x_misp_attributes": [
|
|
|
|
|
{
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"value": "2019-06-25T22:39:22",
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Based on the writeup, likely associated file",
|
|
|
|
|
"uuid": "6759f955-ea4a-4d4f-a238-5936eeed21a3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "link",
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"value": "https://www.virustotal.com/file/fa599fddd6b6df4b654e022fe7a91c82152f983e1ce0b97406eb27bb2fb4c3ab/analysis/1561502362/",
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Based on the writeup, likely associated file",
|
|
|
|
|
"uuid": "fdd7a321-97b2-4ce4-a4e7-ff904f5c71de"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "text",
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"value": "49/71",
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Based on the writeup, likely associated file",
|
|
|
|
|
"uuid": "c9f21984-4969-42ba-9260-08f63be6d4d2"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"x_misp_meta_category": "misc",
|
|
|
|
|
"x_misp_name": "virustotal-report"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--f04d4630-aae5-4603-b43a-f905aacf83c5",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-06-26T18:45:53.000Z",
|
|
|
|
|
"modified": "2019-06-26T18:45:53.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '185ad2bfaa924571c492ee1d3f281bac' AND file:hashes.SHA1 = '722dc399e6048127e52843075fd652006b8c85a4' AND file:hashes.SHA256 = '95817d8c742dd667225273847ea15f46445ab1439e634c05785084af7cb39a58']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2019-06-26T18:45:53Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "file"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:name=\"file\"",
|
|
|
|
|
"misp:meta-category=\"file\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "x-misp-object",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "x-misp-object--21e4d20a-add1-41f7-84c2-c38beaafd633",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-06-26T18:45:53.000Z",
|
|
|
|
|
"modified": "2019-06-26T18:45:53.000Z",
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:name=\"virustotal-report\"",
|
|
|
|
|
"misp:meta-category=\"misc\""
|
|
|
|
|
],
|
|
|
|
|
"x_misp_attributes": [
|
|
|
|
|
{
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"value": "2019-06-25T04:55:52",
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Adding two more hashes of mal-ssMUIDLL.dlls:",
|
|
|
|
|
"uuid": "42fed8da-db9b-4cce-9cae-f00f52b51482"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "link",
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"value": "https://www.virustotal.com/file/95817d8c742dd667225273847ea15f46445ab1439e634c05785084af7cb39a58/analysis/1561438552/",
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Adding two more hashes of mal-ssMUIDLL.dlls:",
|
|
|
|
|
"uuid": "c0e15224-5bc2-4290-8766-dc9654b59d5c"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "text",
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"value": "34/67",
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Adding two more hashes of mal-ssMUIDLL.dlls:",
|
|
|
|
|
"uuid": "2a6f9f10-9e74-4f1c-a56b-dd93c48c5faa"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"x_misp_meta_category": "misc",
|
|
|
|
|
"x_misp_name": "virustotal-report"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--18448777-1668-45b1-a0d5-821d348e970c",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-06-26T18:45:53.000Z",
|
|
|
|
|
"modified": "2019-06-26T18:45:53.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = 'fb8c172c964e6740963eb223407a917c' AND file:hashes.SHA1 = '4448a3cd278d6c7b85987f0c9ba5dfeef7be8dad' AND file:hashes.SHA256 = '12979d85d37a7e246757d5ebf238c6ac91e6641950cf45d95b104eb7dbb7db71']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2019-06-26T18:45:53Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "file"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:name=\"file\"",
|
|
|
|
|
"misp:meta-category=\"file\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "x-misp-object",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "x-misp-object--cf10a26e-de17-4073-9445-50f0519dce18",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-06-26T18:45:53.000Z",
|
|
|
|
|
"modified": "2019-06-26T18:45:53.000Z",
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:name=\"virustotal-report\"",
|
|
|
|
|
"misp:meta-category=\"misc\""
|
|
|
|
|
],
|
|
|
|
|
"x_misp_attributes": [
|
|
|
|
|
{
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"value": "2019-06-25T22:39:18",
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Based on the writeup, likely associated file",
|
|
|
|
|
"uuid": "1213473d-68a4-4940-a71b-9f786124f235"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "link",
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"value": "https://www.virustotal.com/file/12979d85d37a7e246757d5ebf238c6ac91e6641950cf45d95b104eb7dbb7db71/analysis/1561502358/",
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Based on the writeup, likely associated file",
|
|
|
|
|
"uuid": "6a5f1012-9ec0-4c37-825d-28343f4b1bc3"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "text",
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"value": "52/72",
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Based on the writeup, likely associated file",
|
|
|
|
|
"uuid": "94582d67-0fce-45f4-ba0b-96e6f7e46aaf"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"x_misp_meta_category": "misc",
|
|
|
|
|
"x_misp_name": "virustotal-report"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--eceee0ff-b9ce-47fd-b34e-ee27ec26f394",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-06-26T18:45:53.000Z",
|
|
|
|
|
"modified": "2019-06-26T18:45:53.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '89d0cdd3617c118c6ba1a720e9f9bd62' AND file:hashes.SHA1 = 'b69594d1fc9d44bb89fa09cacfbf61723b7fe1bd' AND file:hashes.SHA256 = 'c81dd8dd3623181cbc117ca7255e6ea530f770c05624c6896362f03fbfc06280']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2019-06-26T18:45:53Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "file"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:name=\"file\"",
|
|
|
|
|
"misp:meta-category=\"file\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "x-misp-object",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "x-misp-object--6cae530d-e8f6-4513-95e4-0ccddf9c7a84",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-06-26T18:45:53.000Z",
|
|
|
|
|
"modified": "2019-06-26T18:45:53.000Z",
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:name=\"virustotal-report\"",
|
|
|
|
|
"misp:meta-category=\"misc\""
|
|
|
|
|
],
|
|
|
|
|
"x_misp_attributes": [
|
|
|
|
|
{
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"value": "2019-06-25T22:39:23",
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Based on the writeup, likely associated file",
|
|
|
|
|
"uuid": "4116418a-2b61-46a0-a3a2-f0a8519e5d9b"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "link",
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"value": "https://www.virustotal.com/file/c81dd8dd3623181cbc117ca7255e6ea530f770c05624c6896362f03fbfc06280/analysis/1561502363/",
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Based on the writeup, likely associated file",
|
|
|
|
|
"uuid": "9f8cf8f5-392a-4d3e-aeed-d86554b90293"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "text",
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"value": "54/72",
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Based on the writeup, likely associated file",
|
|
|
|
|
"uuid": "3ba84440-48e6-4138-b1e2-b28e6bd10df8"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"x_misp_meta_category": "misc",
|
|
|
|
|
"x_misp_name": "virustotal-report"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "indicator",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "indicator--9ab69867-6fa8-49ec-96f2-8276c622a426",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-06-26T18:45:53.000Z",
|
|
|
|
|
"modified": "2019-06-26T18:45:53.000Z",
|
|
|
|
|
"pattern": "[file:hashes.MD5 = '9a97ddbb141d01ce0b1b994399cfb7dc' AND file:hashes.SHA1 = 'e841a63e47361a572db9a7334af459ddca11347a' AND file:hashes.SHA256 = '5bf80b871278a29f356bd42af1e35428aead20cd90b0c7642247afcaaa95b022']",
|
|
|
|
|
"pattern_type": "stix",
|
|
|
|
|
"pattern_version": "2.1",
|
|
|
|
|
"valid_from": "2019-06-26T18:45:53Z",
|
|
|
|
|
"kill_chain_phases": [
|
|
|
|
|
{
|
|
|
|
|
"kill_chain_name": "misp-category",
|
|
|
|
|
"phase_name": "file"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:name=\"file\"",
|
|
|
|
|
"misp:meta-category=\"file\"",
|
|
|
|
|
"misp:to_ids=\"True\""
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "x-misp-object",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "x-misp-object--baca908c-f701-4c24-8c83-4b5840ba7558",
|
|
|
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
|
|
|
"created": "2019-06-26T18:45:54.000Z",
|
|
|
|
|
"modified": "2019-06-26T18:45:54.000Z",
|
|
|
|
|
"labels": [
|
|
|
|
|
"misp:name=\"virustotal-report\"",
|
|
|
|
|
"misp:meta-category=\"misc\""
|
|
|
|
|
],
|
|
|
|
|
"x_misp_attributes": [
|
|
|
|
|
{
|
|
|
|
|
"type": "datetime",
|
|
|
|
|
"object_relation": "last-submission",
|
|
|
|
|
"value": "2019-02-14T01:23:14",
|
|
|
|
|
"category": "Other",
|
|
|
|
|
"comment": "Adding two more hashes of mal-ssMUIDLL.dlls:",
|
|
|
|
|
"uuid": "6e0656fd-9975-4200-b7f4-601aed707e4f"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "link",
|
|
|
|
|
"object_relation": "permalink",
|
|
|
|
|
"value": "https://www.virustotal.com/file/5bf80b871278a29f356bd42af1e35428aead20cd90b0c7642247afcaaa95b022/analysis/1550107394/",
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Adding two more hashes of mal-ssMUIDLL.dlls:",
|
|
|
|
|
"uuid": "03c6dda3-fceb-466b-a741-59590d4dd000"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "text",
|
|
|
|
|
"object_relation": "detection-ratio",
|
|
|
|
|
"value": "42/69",
|
|
|
|
|
"category": "Payload delivery",
|
|
|
|
|
"comment": "Adding two more hashes of mal-ssMUIDLL.dlls:",
|
|
|
|
|
"uuid": "779f1fd3-da3e-4e43-b7e7-580f9fbf9296"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"x_misp_meta_category": "misc",
|
|
|
|
|
"x_misp_name": "virustotal-report"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "relationship",
|
|
|
|
|
"spec_version": "2.1",
|
2023-06-24 09:36:52 +00:00
|
|
|
"id": "relationship--589cebbf-c931-460d-95e7-d073c1346133",
|
2023-06-14 17:31:25 +00:00
|
|
|
"created": "2019-06-26T18:45:54.000Z",
|
|
|
|
|
"modified": "2019-06-26T18:45:54.000Z",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "analysed-with",
|
2023-06-14 17:31:25 +00:00
|
|
|
"source_ref": "indicator--a84950f4-4292-4648-a458-571a4adf25a9",
|
|
|
|
|
"target_ref": "x-misp-object--b5a0e459-5c77-470f-9237-ebbbc696c22d"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "relationship",
|
|
|
|
|
"spec_version": "2.1",
|
2023-06-24 09:36:52 +00:00
|
|
|
"id": "relationship--cb83a59b-fa7f-496a-82b7-7931823db96a",
|
2023-06-14 17:31:25 +00:00
|
|
|
"created": "2019-06-26T18:45:54.000Z",
|
|
|
|
|
"modified": "2019-06-26T18:45:54.000Z",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "analysed-with",
|
2023-06-14 17:31:25 +00:00
|
|
|
"source_ref": "indicator--f04d4630-aae5-4603-b43a-f905aacf83c5",
|
|
|
|
|
"target_ref": "x-misp-object--21e4d20a-add1-41f7-84c2-c38beaafd633"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "relationship",
|
|
|
|
|
"spec_version": "2.1",
|
2023-06-24 09:36:52 +00:00
|
|
|
"id": "relationship--42d5408c-cdb3-474e-8e0b-22bf24f54fa0",
|
2023-06-14 17:31:25 +00:00
|
|
|
"created": "2019-06-26T18:45:54.000Z",
|
|
|
|
|
"modified": "2019-06-26T18:45:54.000Z",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "analysed-with",
|
2023-06-14 17:31:25 +00:00
|
|
|
"source_ref": "indicator--18448777-1668-45b1-a0d5-821d348e970c",
|
|
|
|
|
"target_ref": "x-misp-object--cf10a26e-de17-4073-9445-50f0519dce18"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "relationship",
|
|
|
|
|
"spec_version": "2.1",
|
2023-06-24 09:36:52 +00:00
|
|
|
"id": "relationship--113a47c9-ea59-4ecf-a3e0-e485ca666bf1",
|
2023-06-14 17:31:25 +00:00
|
|
|
"created": "2019-06-26T18:45:54.000Z",
|
|
|
|
|
"modified": "2019-06-26T18:45:54.000Z",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "analysed-with",
|
2023-06-14 17:31:25 +00:00
|
|
|
"source_ref": "indicator--eceee0ff-b9ce-47fd-b34e-ee27ec26f394",
|
|
|
|
|
"target_ref": "x-misp-object--6cae530d-e8f6-4513-95e4-0ccddf9c7a84"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "relationship",
|
|
|
|
|
"spec_version": "2.1",
|
2023-06-24 09:36:52 +00:00
|
|
|
"id": "relationship--5d619c97-cfa4-4f81-8af4-2ea03c4ddb4b",
|
2023-06-14 17:31:25 +00:00
|
|
|
"created": "2019-06-26T18:45:54.000Z",
|
|
|
|
|
"modified": "2019-06-26T18:45:54.000Z",
|
2023-04-21 13:25:09 +00:00
|
|
|
"relationship_type": "analysed-with",
|
2023-06-14 17:31:25 +00:00
|
|
|
"source_ref": "indicator--9ab69867-6fa8-49ec-96f2-8276c622a426",
|
|
|
|
|
"target_ref": "x-misp-object--baca908c-f701-4c24-8c83-4b5840ba7558"
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"type": "marking-definition",
|
|
|
|
|
"spec_version": "2.1",
|
|
|
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
|
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
|
|
|
"definition_type": "tlp",
|
|
|
|
|
"name": "TLP:WHITE",
|
|
|
|
|
"definition": {
|
|
|
|
|
"tlp": "white"
|
|
|
|
|
}
|
|
|
|
|
}
|
2023-04-21 13:25:09 +00:00
|
|
|
]
|
|
|
|
|
}
|
