misp-circl-feed/feeds/circl/misp/5e2a9dc9-adb4-49bc-9be1-4304950d210f.json

{
    "type": "bundle",
    "id": "bundle--5e2a9dc9-adb4-49bc-9be1-4304950d210f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2020-01-24T08:34:28.000Z",
            "modified": "2020-01-24T08:34:28.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--5e2a9dc9-adb4-49bc-9be1-4304950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2020-01-24T08:34:28.000Z",
            "modified": "2020-01-24T08:34:28.000Z",
            "name": "OSINT - First Node.js-based Ransomware : Nodera",
            "published": "2020-01-24T08:34:40Z",
            "object_refs": [
                "indicator--5e2aaa52-d230-4bc6-ab9f-2090950d210f",
                "indicator--5e2aaa54-d280-4e74-bd88-2090950d210f",
                "observed-data--5e2aaadd-e758-49f9-825e-2091950d210f",
                "url--5e2aaadd-e758-49f9-825e-2091950d210f",
                "indicator--5f8af945-8a3d-4504-b607-7ddfdf6deb75",
                "x-misp-object--51ba9d61-5380-4585-b0c0-b7fe0bc36bc9",
                "indicator--cc3072d2-9476-47dd-8aa5-820487dea369",
                "x-misp-object--b9cfdf21-9bd5-4e25-8006-51f1643b713f",
                "relationship--ed27bcba-0c95-4269-8472-5ad51a1b9c2d",
                "relationship--5b245ed5-d051-44ce-814c-514f80cb7e41"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "type:OSINT",
                "osint:lifetime=\"perpetual\"",
                "osint:certainty=\"50\"",
                "misp-galaxy:ransomware=\"Nodera Ransomware\"",
                "dnc:malware-type=\"Ransomware\"",
                "enisa:nefarious-activity-abuse=\"ransomware\"",
                "ecsirt:malicious-code=\"ransomware\"",
                "malware_classification:malware-category=\"Ransomware\"",
                "veris:action:malware:variety=\"Ransomware\"",
                "Ransomware",
                "ms-caro-malware:malware-type=\"Ransom\"",
                "ms-caro-malware-full:malware-type=\"Ransom\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5e2aaa52-d230-4bc6-ab9f-2090950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2020-01-24T08:26:58.000Z",
            "modified": "2020-01-24T08:26:58.000Z",
            "pattern": "[file:hashes.SHA256 = '7265c1fb74eb9ea3cd98358475620ce54b9033421ba042957135bdefd078b366']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2020-01-24T08:26:58Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5e2aaa54-d280-4e74-bd88-2090950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2020-01-24T08:27:00.000Z",
            "modified": "2020-01-24T08:27:00.000Z",
            "pattern": "[file:hashes.SHA256 = '53a95c9126be8262afb0821da4d7137e6c8a4d9b363f91298249ca134d394bf4']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2020-01-24T08:27:00Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "Payload delivery"
                }
            ],
            "labels": [
                "misp:type=\"sha256\"",
                "misp:category=\"Payload delivery\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--5e2aaadd-e758-49f9-825e-2091950d210f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2020-01-24T08:29:17.000Z",
            "modified": "2020-01-24T08:29:17.000Z",
            "first_observed": "2020-01-24T08:29:17Z",
            "last_observed": "2020-01-24T08:29:17Z",
            "number_observed": 1,
            "object_refs": [
                "url--5e2aaadd-e758-49f9-825e-2091950d210f"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5e2aaadd-e758-49f9-825e-2091950d210f",
            "value": "https://blogs.quickheal.com/first-node-js-based-ransomware-nodera/"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5f8af945-8a3d-4504-b607-7ddfdf6deb75",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2020-01-24T08:27:51.000Z",
            "modified": "2020-01-24T08:27:51.000Z",
            "pattern": "[file:hashes.MD5 = '976b17845289d9f8a5ee1c8a9e9c4173' AND file:hashes.SHA1 = 'c458e4c32e3ebb1fca331ef235fe3f96e505e066' AND file:hashes.SHA256 = '53a95c9126be8262afb0821da4d7137e6c8a4d9b363f91298249ca134d394bf4']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2020-01-24T08:27:51Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--51ba9d61-5380-4585-b0c0-b7fe0bc36bc9",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2020-01-24T08:27:51.000Z",
            "modified": "2020-01-24T08:27:51.000Z",
            "labels": [
                "misp:name=\"virustotal-report\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "datetime",
                    "object_relation": "last-submission",
                    "value": "2020-01-24T07:09:56",
                    "category": "Other",
                    "uuid": "97ad26f4-976d-44ea-9c7e-9ce0894ba133"
                },
                {
                    "type": "link",
                    "object_relation": "permalink",
                    "value": "https://www.virustotal.com/file/53a95c9126be8262afb0821da4d7137e6c8a4d9b363f91298249ca134d394bf4/analysis/1579849796/",
                    "category": "Payload delivery",
                    "uuid": "bac4b8ec-8e41-42ca-bf06-cf214c10ffa8"
                },
                {
                    "type": "text",
                    "object_relation": "detection-ratio",
                    "value": "11/56",
                    "category": "Payload delivery",
                    "uuid": "30db4ce2-0d52-4e48-8df2-8afb47f8f6b9"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "virustotal-report"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--cc3072d2-9476-47dd-8aa5-820487dea369",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2020-01-24T08:27:52.000Z",
            "modified": "2020-01-24T08:27:52.000Z",
            "pattern": "[file:hashes.MD5 = 'e8cfee97467d4006257afdaabf945565' AND file:hashes.SHA1 = '7879bbaf9bd6de58a7b318d013cd479d4a24ffae' AND file:hashes.SHA256 = '7265c1fb74eb9ea3cd98358475620ce54b9033421ba042957135bdefd078b366']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "valid_from": "2020-01-24T08:27:52Z",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "misp-category",
                    "phase_name": "file"
                }
            ],
            "labels": [
                "misp:name=\"file\"",
                "misp:meta-category=\"file\"",
                "misp:to_ids=\"True\""
            ]
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--b9cfdf21-9bd5-4e25-8006-51f1643b713f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2020-01-24T08:27:52.000Z",
            "modified": "2020-01-24T08:27:52.000Z",
            "labels": [
                "misp:name=\"virustotal-report\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "datetime",
                    "object_relation": "last-submission",
                    "value": "2020-01-24T05:46:08",
                    "category": "Other",
                    "uuid": "e384fb38-468a-4e7a-b1d3-e112b4037604"
                },
                {
                    "type": "link",
                    "object_relation": "permalink",
                    "value": "https://www.virustotal.com/file/7265c1fb74eb9ea3cd98358475620ce54b9033421ba042957135bdefd078b366/analysis/1579844768/",
                    "category": "Payload delivery",
                    "uuid": "3a80a603-65cb-4fb0-91c1-15dbf8fc3e71"
                },
                {
                    "type": "text",
                    "object_relation": "detection-ratio",
                    "value": "23/57",
                    "category": "Payload delivery",
                    "uuid": "c09bba97-5263-4b7d-8139-0b86b92333e0"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "virustotal-report"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ed27bcba-0c95-4269-8472-5ad51a1b9c2d",
            "created": "2020-01-24T08:27:52.000Z",
            "modified": "2020-01-24T08:27:52.000Z",
            "relationship_type": "analysed-with",
            "source_ref": "indicator--5f8af945-8a3d-4504-b607-7ddfdf6deb75",
            "target_ref": "x-misp-object--51ba9d61-5380-4585-b0c0-b7fe0bc36bc9"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5b245ed5-d051-44ce-814c-514f80cb7e41",
            "created": "2020-01-24T08:27:52.000Z",
            "modified": "2020-01-24T08:27:52.000Z",
            "relationship_type": "analysed-with",
            "source_ref": "indicator--cc3072d2-9476-47dd-8aa5-820487dea369",
            "target_ref": "x-misp-object--b9cfdf21-9bd5-4e25-8006-51f1643b713f"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}