adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/5d5fb3ac-ae54-42d3-9fe7-4d65950d210f.json

728 lines
31 KiB
JSON
Raw Normal View History

chg: [feed] added
2023-04-21 13:25:09 +00:00
{
chg: [feed] feed updated
2023-06-14 17:31:25 +00:00
"type": "bundle",
"id": "bundle--5d5fb3ac-ae54-42d3-9fe7-4d65950d210f",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-08-23T09:59:16.000Z",
"modified": "2019-08-23T09:59:16.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--5d5fb3ac-ae54-42d3-9fe7-4d65950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-08-23T09:59:16.000Z",
"modified": "2019-08-23T09:59:16.000Z",
"name": "OSINT - Emotet is back",
"published": "2019-08-23T10:00:21Z",
"object_refs": [
"indicator--5d5fb3c2-d6e0-4095-9993-4c97950d210f",
"indicator--5d5fb3c2-5990-4b73-8048-4ea4950d210f",
"indicator--5d5fb3c2-31c0-4be9-ba1e-4e88950d210f",
"indicator--5d5fb3c2-7310-4300-a2c4-4b28950d210f",
"indicator--5d5fb3c2-c9e0-44a3-9555-4697950d210f",
"indicator--5d5fb3c2-d334-4057-95b6-492a950d210f",
"indicator--5d5fb3c2-561c-42d1-bd6a-45a9950d210f",
"indicator--5d5fb3c3-5cd0-4800-94ee-4ba9950d210f",
"indicator--5d5fb3c3-5f68-465e-8cd0-4a51950d210f",
"indicator--5d5fb3c3-a218-4ed7-8fdc-4335950d210f",
"indicator--5d5fb3c3-e0c4-4972-84b4-4d0b950d210f",
"indicator--5d5fb3c3-fc90-407f-a872-432d950d210f",
"indicator--5d5fb3c3-b0f8-4c12-8a49-4f67950d210f",
"indicator--5d5fb3c3-af24-45fc-a5cb-4f46950d210f",
"indicator--5d5fb3c3-b57c-4cbb-9fd2-4656950d210f",
"indicator--5d5fb3c4-40e0-43cf-81d5-4c7f950d210f",
"indicator--5d5fb3c4-7894-4619-adff-4671950d210f",
"indicator--5d5fb3c4-3e94-4a12-b058-4323950d210f",
"indicator--5d5fb3c4-bb1c-4558-8b00-4c11950d210f",
"indicator--5d5fb3c4-6584-4403-a760-4cd1950d210f",
"indicator--5d5fb3c4-79e8-4334-9903-423f950d210f",
"indicator--5d5fb3c4-138c-4d34-a862-4c82950d210f",
"indicator--5d5fb3c4-d820-4140-a769-4718950d210f",
"indicator--5d5fb3c4-7778-4691-9d87-4f86950d210f",
"indicator--5d5fb3c4-0420-4c80-a6c3-42eb950d210f",
"observed-data--5d5fb3db-706c-4b79-a949-492d950d210f",
"url--5d5fb3db-706c-4b79-a949-492d950d210f",
"observed-data--5d5fb403-4d9c-4908-b127-4bec950d210f",
"url--5d5fb403-4d9c-4908-b127-4bec950d210f"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"type:OSINT",
"osint:lifetime=\"perpetual\"",
"osint:certainty=\"50\"",
"misp-galaxy:banker=\"Geodo\"",
"circl:topic=\"finance\"",
"adversary:infrastructure-action=\"take-down\""
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5d5fb3c2-d6e0-4095-9993-4c97950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-08-23T09:37:06.000Z",
"modified": "2019-08-23T09:37:06.000Z",
"description": "On port 8080",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '104.131.11.150' AND network-traffic:dst_port = '8080']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-08-23T09:37:06Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5d5fb3c2-5990-4b73-8048-4ea4950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-08-23T09:37:06.000Z",
"modified": "2019-08-23T09:37:06.000Z",
"description": "On port 8080",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '104.131.208.175' AND network-traffic:dst_port = '8080']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-08-23T09:37:06Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5d5fb3c2-31c0-4be9-ba1e-4e88950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-08-23T09:37:06.000Z",
"modified": "2019-08-23T09:37:06.000Z",
"description": "On port 7080",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '104.236.151.95' AND network-traffic:dst_port = '7080']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-08-23T09:37:06Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5d5fb3c2-7310-4300-a2c4-4b28950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-08-23T09:37:06.000Z",
"modified": "2019-08-23T09:37:06.000Z",
"description": "On port 443",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '142.93.88.16' AND network-traffic:dst_port = '443']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-08-23T09:37:06Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5d5fb3c2-c9e0-44a3-9555-4697950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-08-23T09:37:06.000Z",
"modified": "2019-08-23T09:37:06.000Z",
"description": "On port 80",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '144.139.247.220' AND network-traffic:dst_port = '80']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-08-23T09:37:06Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5d5fb3c2-d334-4057-95b6-492a950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-08-23T09:37:06.000Z",
"modified": "2019-08-23T09:37:06.000Z",
"description": "On port 7080",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '159.89.179.87' AND network-traffic:dst_port = '7080']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-08-23T09:37:06Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5d5fb3c2-561c-42d1-bd6a-45a9950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-08-23T09:37:06.000Z",
"modified": "2019-08-23T09:37:06.000Z",
"description": "On port 8080",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '162.144.119.216' AND network-traffic:dst_port = '8080']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-08-23T09:37:06Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5d5fb3c3-5cd0-4800-94ee-4ba9950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-08-23T09:37:07.000Z",
"modified": "2019-08-23T09:37:07.000Z",
"description": "On port 8080",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '162.243.125.212' AND network-traffic:dst_port = '8080']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-08-23T09:37:07Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5d5fb3c3-5f68-465e-8cd0-4a51950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-08-23T09:37:07.000Z",
"modified": "2019-08-23T09:37:07.000Z",
"description": "On port 8080",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '170.150.11.245' AND network-traffic:dst_port = '8080']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-08-23T09:37:07Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5d5fb3c3-a218-4ed7-8fdc-4335950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-08-23T09:37:07.000Z",
"modified": "2019-08-23T09:37:07.000Z",
"description": "On port 8080",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '176.31.200.130' AND network-traffic:dst_port = '8080']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-08-23T09:37:07Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5d5fb3c3-e0c4-4972-84b4-4d0b950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-08-23T09:37:07.000Z",
"modified": "2019-08-23T09:37:07.000Z",
"description": "On port 80",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '177.242.214.30' AND network-traffic:dst_port = '80']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-08-23T09:37:07Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5d5fb3c3-fc90-407f-a872-432d950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-08-23T09:37:07.000Z",
"modified": "2019-08-23T09:37:07.000Z",
"description": "On port 22",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '187.163.180.243' AND network-traffic:dst_port = '22']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-08-23T09:37:07Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5d5fb3c3-b0f8-4c12-8a49-4f67950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-08-23T09:37:07.000Z",
"modified": "2019-08-23T09:37:07.000Z",
"description": "On port 8080",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '195.242.117.231' AND network-traffic:dst_port = '8080']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-08-23T09:37:07Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5d5fb3c3-af24-45fc-a5cb-4f46950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-08-23T09:37:07.000Z",
"modified": "2019-08-23T09:37:07.000Z",
"description": "On port 8080",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '216.98.148.156' AND network-traffic:dst_port = '8080']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-08-23T09:37:07Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5d5fb3c3-b57c-4cbb-9fd2-4656950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-08-23T09:37:07.000Z",
"modified": "2019-08-23T09:37:07.000Z",
"description": "On port 7080",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '217.13.106.160' AND network-traffic:dst_port = '7080']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-08-23T09:37:07Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5d5fb3c4-40e0-43cf-81d5-4c7f950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-08-23T09:37:08.000Z",
"modified": "2019-08-23T09:37:08.000Z",
"description": "On port 7080",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '31.12.67.62' AND network-traffic:dst_port = '7080']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-08-23T09:37:08Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5d5fb3c4-7894-4619-adff-4671950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-08-23T09:37:08.000Z",
"modified": "2019-08-23T09:37:08.000Z",
"description": "On port 443",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '45.123.3.54' AND network-traffic:dst_port = '443']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-08-23T09:37:08Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5d5fb3c4-3e94-4a12-b058-4323950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-08-23T09:37:08.000Z",
"modified": "2019-08-23T09:37:08.000Z",
"description": "On port 7080",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '45.32.158.232' AND network-traffic:dst_port = '7080']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-08-23T09:37:08Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5d5fb3c4-bb1c-4558-8b00-4c11950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-08-23T09:37:08.000Z",
"modified": "2019-08-23T09:37:08.000Z",
"description": "On port 8080",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '46.101.142.115' AND network-traffic:dst_port = '8080']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-08-23T09:37:08Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5d5fb3c4-6584-4403-a760-4cd1950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-08-23T09:37:08.000Z",
"modified": "2019-08-23T09:37:08.000Z",
"description": "On port 443",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '46.105.131.69' AND network-traffic:dst_port = '443']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-08-23T09:37:08Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5d5fb3c4-79e8-4334-9903-423f950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-08-23T09:37:08.000Z",
"modified": "2019-08-23T09:37:08.000Z",
"description": "On port 8080",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '64.13.225.150' AND network-traffic:dst_port = '8080']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-08-23T09:37:08Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5d5fb3c4-138c-4d34-a862-4c82950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-08-23T09:37:08.000Z",
"modified": "2019-08-23T09:37:08.000Z",
"description": "On port 8080",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '69.45.19.145' AND network-traffic:dst_port = '8080']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-08-23T09:37:08Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5d5fb3c4-d820-4140-a769-4718950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-08-23T09:37:08.000Z",
"modified": "2019-08-23T09:37:08.000Z",
"description": "On port 8080",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '70.32.84.74' AND network-traffic:dst_port = '8080']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-08-23T09:37:08Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5d5fb3c4-7778-4691-9d87-4f86950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-08-23T09:37:08.000Z",
"modified": "2019-08-23T09:37:08.000Z",
"description": "On port 8080",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '75.127.14.170' AND network-traffic:dst_port = '8080']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-08-23T09:37:08Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5d5fb3c4-0420-4c80-a6c3-42eb950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-08-23T09:37:08.000Z",
"modified": "2019-08-23T09:37:08.000Z",
"description": "On port 7080",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '91.83.93.103' AND network-traffic:dst_port = '7080']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-08-23T09:37:08Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5d5fb3db-706c-4b79-a949-492d950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-08-23T09:37:31.000Z",
"modified": "2019-08-23T09:37:31.000Z",
"first_observed": "2019-08-23T09:37:31Z",
"last_observed": "2019-08-23T09:37:31Z",
"number_observed": 1,
"object_refs": [
"url--5d5fb3db-706c-4b79-a949-492d950d210f"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--5d5fb3db-706c-4b79-a949-492d950d210f",
"value": "https://pastebin.com/raw/7Kq2e1ik"
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5d5fb403-4d9c-4908-b127-4bec950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-08-23T09:38:11.000Z",
"modified": "2019-08-23T09:38:11.000Z",
"first_observed": "2019-08-23T09:38:11Z",
"last_observed": "2019-08-23T09:38:11Z",
"number_observed": 1,
"object_refs": [
"url--5d5fb403-4d9c-4908-b127-4bec950d210f"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--5d5fb403-4d9c-4908-b127-4bec950d210f",
"value": "https://github.com/blacklotuslabs/Research/blob/master/Emotet_Active_C2_08_22_19.txt"
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
chg: [feed] added
2023-04-21 13:25:09 +00:00
]
}
Reference in a new issue Copy permalink